Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2024 02:34
Static task
static1
Behavioral task
behavioral1
Sample
ab3a4e3efad4632b128f80f80efe97cd77875ebe04c4816b8e9b59b1d96a17ef.exe
Resource
win7-20241010-en
General
-
Target
ab3a4e3efad4632b128f80f80efe97cd77875ebe04c4816b8e9b59b1d96a17ef.exe
-
Size
334KB
-
MD5
578a5e1c8203beaac541a7112a0cb49a
-
SHA1
3bf592530553339b7297580cd2a6e385e4507099
-
SHA256
ab3a4e3efad4632b128f80f80efe97cd77875ebe04c4816b8e9b59b1d96a17ef
-
SHA512
dba1ba6dd90df19770e56261b3f69205ad9ee181b37eff9957c06523b1f6051164bb537181d0f202d8708849fbe92806cbb00fc4dca0ad99df8d414ce58655bd
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPh3:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/4744-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/428-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/800-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3380-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/800-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3908-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2988-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/384-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-853-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-1071-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3096 jdjdv.exe 4692 lrfxrrl.exe 552 nhhnhn.exe 428 jdjvp.exe 408 fffxrrl.exe 3132 vjpjd.exe 4172 7nnnhh.exe 4224 tbttbh.exe 4508 jppjp.exe 1372 lxlfffx.exe 3912 9ntnbt.exe 1404 fffxxrf.exe 2440 vpppj.exe 8 djvpv.exe 4144 bttnnn.exe 1200 nnnhhb.exe 2528 jjppj.exe 2584 jddvd.exe 2656 9rrlfff.exe 1096 xrfxrrl.exe 3412 vvjvd.exe 800 djvvv.exe 2532 lllfxxx.exe 1876 nnbbtt.exe 4956 djppp.exe 3756 1lxxrlf.exe 2776 nbthtt.exe 4856 jdddv.exe 2924 rrxxxrr.exe 2104 nnbbhh.exe 3128 fxfxllx.exe 3632 ddjdj.exe 2476 vpppp.exe 1616 tbntnb.exe 4628 bbhtth.exe 1608 7pppp.exe 3476 3xfrlxx.exe 2300 bbnnnb.exe 1928 nhttnt.exe 4884 jvddd.exe 2732 9xlfrlx.exe 4540 nhtnnn.exe 2664 pjvpj.exe 3572 xflfxff.exe 4672 lxrrrxr.exe 2544 tnnnnt.exe 784 5ppjj.exe 3684 7llllff.exe 4376 7xfxxxx.exe 2916 nhnhhh.exe 2316 jpvvj.exe 2260 9jddj.exe 4740 xfrrrrl.exe 1472 nbbttb.exe 3984 nnnhtt.exe 4840 7pvpj.exe 4296 lfrlflf.exe 5032 hntbhn.exe 604 7jjdd.exe 3464 ffllxxx.exe 3320 hntnhn.exe 464 hthbnn.exe 4352 jvvvp.exe 1372 lxlxffx.exe -
resource yara_rule behavioral2/memory/4744-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/428-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/800-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2664-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3380-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/800-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3908-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2988-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/384-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-853-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-1071-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4744 wrote to memory of 3096 4744 ab3a4e3efad4632b128f80f80efe97cd77875ebe04c4816b8e9b59b1d96a17ef.exe 82 PID 4744 wrote to memory of 3096 4744 ab3a4e3efad4632b128f80f80efe97cd77875ebe04c4816b8e9b59b1d96a17ef.exe 82 PID 4744 wrote to memory of 3096 4744 ab3a4e3efad4632b128f80f80efe97cd77875ebe04c4816b8e9b59b1d96a17ef.exe 82 PID 3096 wrote to memory of 4692 3096 jdjdv.exe 83 PID 3096 wrote to memory of 4692 3096 jdjdv.exe 83 PID 3096 wrote to memory of 4692 3096 jdjdv.exe 83 PID 4692 wrote to memory of 552 4692 lrfxrrl.exe 84 PID 4692 wrote to memory of 552 4692 lrfxrrl.exe 84 PID 4692 wrote to memory of 552 4692 lrfxrrl.exe 84 PID 552 wrote to memory of 428 552 nhhnhn.exe 85 PID 552 wrote to memory of 428 552 nhhnhn.exe 85 PID 552 wrote to memory of 428 552 nhhnhn.exe 85 PID 428 wrote to memory of 408 428 jdjvp.exe 86 PID 428 wrote to memory of 408 428 jdjvp.exe 86 PID 428 wrote to memory of 408 428 jdjvp.exe 86 PID 408 wrote to memory of 3132 408 fffxrrl.exe 87 PID 408 wrote to memory of 3132 408 fffxrrl.exe 87 PID 408 wrote to memory of 3132 408 fffxrrl.exe 87 PID 3132 wrote to memory of 4172 3132 vjpjd.exe 88 PID 3132 wrote to memory of 4172 3132 vjpjd.exe 88 PID 3132 wrote to memory of 4172 3132 vjpjd.exe 88 PID 4172 wrote to memory of 4224 4172 7nnnhh.exe 89 PID 4172 wrote to memory of 4224 4172 7nnnhh.exe 89 PID 4172 wrote to memory of 4224 4172 7nnnhh.exe 89 PID 4224 wrote to memory of 4508 4224 tbttbh.exe 90 PID 4224 wrote to memory of 4508 4224 tbttbh.exe 90 PID 4224 wrote to memory of 4508 4224 tbttbh.exe 90 PID 4508 wrote to memory of 1372 4508 jppjp.exe 91 PID 4508 wrote to memory of 1372 4508 jppjp.exe 91 PID 4508 wrote to memory of 1372 4508 jppjp.exe 91 PID 1372 wrote to memory of 3912 1372 lxlfffx.exe 92 PID 1372 wrote to memory of 3912 1372 lxlfffx.exe 92 PID 1372 wrote to memory of 3912 1372 lxlfffx.exe 92 PID 3912 wrote to memory of 1404 3912 9ntnbt.exe 93 PID 3912 wrote to memory of 1404 3912 9ntnbt.exe 93 PID 3912 wrote to memory of 1404 3912 9ntnbt.exe 93 PID 1404 wrote to memory of 2440 1404 fffxxrf.exe 94 PID 1404 wrote to memory of 2440 1404 fffxxrf.exe 94 PID 1404 wrote to memory of 2440 1404 fffxxrf.exe 94 PID 2440 wrote to memory of 8 2440 vpppj.exe 95 PID 2440 wrote to memory of 8 2440 vpppj.exe 95 PID 2440 wrote to memory of 8 2440 vpppj.exe 95 PID 8 wrote to memory of 4144 8 djvpv.exe 96 PID 8 wrote to memory of 4144 8 djvpv.exe 96 PID 8 wrote to memory of 4144 8 djvpv.exe 96 PID 4144 wrote to memory of 1200 4144 bttnnn.exe 97 PID 4144 wrote to memory of 1200 4144 bttnnn.exe 97 PID 4144 wrote to memory of 1200 4144 bttnnn.exe 97 PID 1200 wrote to memory of 2528 1200 nnnhhb.exe 98 PID 1200 wrote to memory of 2528 1200 nnnhhb.exe 98 PID 1200 wrote to memory of 2528 1200 nnnhhb.exe 98 PID 2528 wrote to memory of 2584 2528 jjppj.exe 99 PID 2528 wrote to memory of 2584 2528 jjppj.exe 99 PID 2528 wrote to memory of 2584 2528 jjppj.exe 99 PID 2584 wrote to memory of 2656 2584 jddvd.exe 100 PID 2584 wrote to memory of 2656 2584 jddvd.exe 100 PID 2584 wrote to memory of 2656 2584 jddvd.exe 100 PID 2656 wrote to memory of 1096 2656 9rrlfff.exe 101 PID 2656 wrote to memory of 1096 2656 9rrlfff.exe 101 PID 2656 wrote to memory of 1096 2656 9rrlfff.exe 101 PID 1096 wrote to memory of 3412 1096 xrfxrrl.exe 102 PID 1096 wrote to memory of 3412 1096 xrfxrrl.exe 102 PID 1096 wrote to memory of 3412 1096 xrfxrrl.exe 102 PID 3412 wrote to memory of 800 3412 vvjvd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab3a4e3efad4632b128f80f80efe97cd77875ebe04c4816b8e9b59b1d96a17ef.exe"C:\Users\Admin\AppData\Local\Temp\ab3a4e3efad4632b128f80f80efe97cd77875ebe04c4816b8e9b59b1d96a17ef.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\jdjdv.exec:\jdjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\lrfxrrl.exec:\lrfxrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\nhhnhn.exec:\nhhnhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\jdjvp.exec:\jdjvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\fffxrrl.exec:\fffxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\vjpjd.exec:\vjpjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\7nnnhh.exec:\7nnnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\tbttbh.exec:\tbttbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\jppjp.exec:\jppjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\lxlfffx.exec:\lxlfffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\9ntnbt.exec:\9ntnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\fffxxrf.exec:\fffxxrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\vpppj.exec:\vpppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\djvpv.exec:\djvpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\bttnnn.exec:\bttnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\nnnhhb.exec:\nnnhhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\jjppj.exec:\jjppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\jddvd.exec:\jddvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\9rrlfff.exec:\9rrlfff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\vvjvd.exec:\vvjvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\djvvv.exec:\djvvv.exe23⤵
- Executes dropped EXE
PID:800 -
\??\c:\lllfxxx.exec:\lllfxxx.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2532 -
\??\c:\nnbbtt.exec:\nnbbtt.exe25⤵
- Executes dropped EXE
PID:1876 -
\??\c:\djppp.exec:\djppp.exe26⤵
- Executes dropped EXE
PID:4956 -
\??\c:\1lxxrlf.exec:\1lxxrlf.exe27⤵
- Executes dropped EXE
PID:3756 -
\??\c:\nbthtt.exec:\nbthtt.exe28⤵
- Executes dropped EXE
PID:2776 -
\??\c:\jdddv.exec:\jdddv.exe29⤵
- Executes dropped EXE
PID:4856 -
\??\c:\rrxxxrr.exec:\rrxxxrr.exe30⤵
- Executes dropped EXE
PID:2924 -
\??\c:\nnbbhh.exec:\nnbbhh.exe31⤵
- Executes dropped EXE
PID:2104 -
\??\c:\fxfxllx.exec:\fxfxllx.exe32⤵
- Executes dropped EXE
PID:3128 -
\??\c:\ddjdj.exec:\ddjdj.exe33⤵
- Executes dropped EXE
PID:3632 -
\??\c:\vpppp.exec:\vpppp.exe34⤵
- Executes dropped EXE
PID:2476 -
\??\c:\tbntnb.exec:\tbntnb.exe35⤵
- Executes dropped EXE
PID:1616 -
\??\c:\bbhtth.exec:\bbhtth.exe36⤵
- Executes dropped EXE
PID:4628 -
\??\c:\7pppp.exec:\7pppp.exe37⤵
- Executes dropped EXE
PID:1608 -
\??\c:\3xfrlxx.exec:\3xfrlxx.exe38⤵
- Executes dropped EXE
PID:3476 -
\??\c:\bbnnnb.exec:\bbnnnb.exe39⤵
- Executes dropped EXE
PID:2300 -
\??\c:\nhttnt.exec:\nhttnt.exe40⤵
- Executes dropped EXE
PID:1928 -
\??\c:\jvddd.exec:\jvddd.exe41⤵
- Executes dropped EXE
PID:4884 -
\??\c:\9xlfrlx.exec:\9xlfrlx.exe42⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nhtnnn.exec:\nhtnnn.exe43⤵
- Executes dropped EXE
PID:4540 -
\??\c:\pjvpj.exec:\pjvpj.exe44⤵
- Executes dropped EXE
PID:2664 -
\??\c:\xflfxff.exec:\xflfxff.exe45⤵
- Executes dropped EXE
PID:3572 -
\??\c:\lxrrrxr.exec:\lxrrrxr.exe46⤵
- Executes dropped EXE
PID:4672 -
\??\c:\tnnnnt.exec:\tnnnnt.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\5ppjj.exec:\5ppjj.exe48⤵
- Executes dropped EXE
PID:784 -
\??\c:\7llllff.exec:\7llllff.exe49⤵
- Executes dropped EXE
PID:3684 -
\??\c:\7xfxxxx.exec:\7xfxxxx.exe50⤵
- Executes dropped EXE
PID:4376 -
\??\c:\nhnhhh.exec:\nhnhhh.exe51⤵
- Executes dropped EXE
PID:2916 -
\??\c:\jpvvj.exec:\jpvvj.exe52⤵
- Executes dropped EXE
PID:2316 -
\??\c:\9jddj.exec:\9jddj.exe53⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xfrrrrl.exec:\xfrrrrl.exe54⤵
- Executes dropped EXE
PID:4740 -
\??\c:\nbbttb.exec:\nbbttb.exe55⤵
- Executes dropped EXE
PID:1472 -
\??\c:\nnnhtt.exec:\nnnhtt.exe56⤵
- Executes dropped EXE
PID:3984 -
\??\c:\7pvpj.exec:\7pvpj.exe57⤵
- Executes dropped EXE
PID:4840 -
\??\c:\lfrlflf.exec:\lfrlflf.exe58⤵
- Executes dropped EXE
PID:4296 -
\??\c:\hntbhn.exec:\hntbhn.exe59⤵
- Executes dropped EXE
PID:5032 -
\??\c:\7jjdd.exec:\7jjdd.exe60⤵
- Executes dropped EXE
PID:604 -
\??\c:\ffllxxx.exec:\ffllxxx.exe61⤵
- Executes dropped EXE
PID:3464 -
\??\c:\hntnhn.exec:\hntnhn.exe62⤵
- Executes dropped EXE
PID:3320 -
\??\c:\hthbnn.exec:\hthbnn.exe63⤵
- Executes dropped EXE
PID:464 -
\??\c:\jvvvp.exec:\jvvvp.exe64⤵
- Executes dropped EXE
PID:4352 -
\??\c:\lxlxffx.exec:\lxlxffx.exe65⤵
- Executes dropped EXE
PID:1372 -
\??\c:\bhbbtt.exec:\bhbbtt.exe66⤵PID:3912
-
\??\c:\vpvdv.exec:\vpvdv.exe67⤵PID:3380
-
\??\c:\1vppv.exec:\1vppv.exe68⤵PID:2196
-
\??\c:\rlxrlff.exec:\rlxrlff.exe69⤵PID:4988
-
\??\c:\nhbbbb.exec:\nhbbbb.exe70⤵PID:3708
-
\??\c:\pdddd.exec:\pdddd.exe71⤵PID:3396
-
\??\c:\5rlflfx.exec:\5rlflfx.exe72⤵PID:2312
-
\??\c:\9htnnn.exec:\9htnnn.exe73⤵PID:2708
-
\??\c:\vpvvd.exec:\vpvvd.exe74⤵PID:3496
-
\??\c:\rrrlffx.exec:\rrrlffx.exe75⤵PID:1200
-
\??\c:\hhttbt.exec:\hhttbt.exe76⤵PID:4048
-
\??\c:\1ddvp.exec:\1ddvp.exe77⤵PID:4696
-
\??\c:\dpvjj.exec:\dpvjj.exe78⤵PID:4780
-
\??\c:\rlrlxxr.exec:\rlrlxxr.exe79⤵PID:5092
-
\??\c:\1nntnh.exec:\1nntnh.exe80⤵PID:1772
-
\??\c:\jpjpp.exec:\jpjpp.exe81⤵PID:2292
-
\??\c:\xlxrrrl.exec:\xlxrrrl.exe82⤵PID:3412
-
\??\c:\xrfxxfx.exec:\xrfxxfx.exe83⤵PID:800
-
\??\c:\3tbnbn.exec:\3tbnbn.exe84⤵PID:2532
-
\??\c:\vjpjd.exec:\vjpjd.exe85⤵PID:3452
-
\??\c:\vpvpj.exec:\vpvpj.exe86⤵PID:3640
-
\??\c:\tnnhbt.exec:\tnnhbt.exe87⤵PID:4796
-
\??\c:\tntnnn.exec:\tntnnn.exe88⤵PID:2948
-
\??\c:\pddvp.exec:\pddvp.exe89⤵PID:4492
-
\??\c:\xllfxrr.exec:\xllfxrr.exe90⤵PID:5100
-
\??\c:\hbntnt.exec:\hbntnt.exe91⤵PID:4120
-
\??\c:\tnbnhh.exec:\tnbnhh.exe92⤵
- System Location Discovery: System Language Discovery
PID:2104 -
\??\c:\jddvp.exec:\jddvp.exe93⤵PID:3668
-
\??\c:\flxlffx.exec:\flxlffx.exe94⤵PID:1496
-
\??\c:\nhbntt.exec:\nhbntt.exe95⤵PID:3156
-
\??\c:\1dpjv.exec:\1dpjv.exe96⤵PID:3332
-
\??\c:\3vdvd.exec:\3vdvd.exe97⤵PID:2880
-
\??\c:\rllfffx.exec:\rllfffx.exe98⤵PID:1632
-
\??\c:\bnhbtb.exec:\bnhbtb.exe99⤵PID:1052
-
\??\c:\jpjdv.exec:\jpjdv.exe100⤵PID:2732
-
\??\c:\xffrlfx.exec:\xffrlfx.exe101⤵PID:4540
-
\??\c:\lllfrrl.exec:\lllfrrl.exe102⤵PID:3976
-
\??\c:\bttnbb.exec:\bttnbb.exe103⤵PID:3700
-
\??\c:\xrflfff.exec:\xrflfff.exe104⤵PID:3100
-
\??\c:\9tbbhn.exec:\9tbbhn.exe105⤵PID:1692
-
\??\c:\pjddv.exec:\pjddv.exe106⤵PID:3480
-
\??\c:\jdddp.exec:\jdddp.exe107⤵PID:1604
-
\??\c:\rrlfffl.exec:\rrlfffl.exe108⤵PID:4384
-
\??\c:\nhnhtt.exec:\nhnhtt.exe109⤵PID:4744
-
\??\c:\pjpjd.exec:\pjpjd.exe110⤵PID:3096
-
\??\c:\1lrlfrl.exec:\1lrlfrl.exe111⤵PID:3908
-
\??\c:\5hnnhh.exec:\5hnnhh.exe112⤵PID:4504
-
\??\c:\jvdvp.exec:\jvdvp.exe113⤵PID:544
-
\??\c:\xlrlxxl.exec:\xlrlxxl.exe114⤵PID:3916
-
\??\c:\fxfxfxr.exec:\fxfxfxr.exe115⤵PID:3592
-
\??\c:\nbhbtt.exec:\nbhbtt.exe116⤵PID:4296
-
\??\c:\jdpjd.exec:\jdpjd.exe117⤵PID:3440
-
\??\c:\5xxrlff.exec:\5xxrlff.exe118⤵PID:4160
-
\??\c:\bthbtt.exec:\bthbtt.exe119⤵PID:380
-
\??\c:\djvvv.exec:\djvvv.exe120⤵PID:3320
-
\??\c:\9dvpd.exec:\9dvpd.exe121⤵PID:464
-
\??\c:\3frlffx.exec:\3frlffx.exe122⤵PID:2988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-