Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 22:25
Behavioral task
behavioral1
Sample
6771caafa04088a93e2611937ddb31dbc0a145d3fab0929f7c679a05bce99666N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
6771caafa04088a93e2611937ddb31dbc0a145d3fab0929f7c679a05bce99666N.exe
-
Size
376KB
-
MD5
7c3a978c1722da9c5a16e0dc5646ba40
-
SHA1
3da4cc484c7743f50414e60bdea0b2d7b3e79c2c
-
SHA256
6771caafa04088a93e2611937ddb31dbc0a145d3fab0929f7c679a05bce99666
-
SHA512
4962f2e083949f86e41ef8099a6a01ec1f63cae6921b433ac984e7d35f72d87d3cd5fc8fe4b10e7a3c523c855cdca1cdf2dc051663de30e4b3a6ee82e06f99fd
-
SSDEEP
6144:0cm4FmowdHoSHWVs+QEoD/dL/4oSlCIqbKRs4EkfRDaPRrnVkWHQmA:C4wFHoS2Vs+IdMoSzqkR5RWVVWmA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/224-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3620-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2128-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/372-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3016-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1544-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3364-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1632-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3364-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/984-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/432-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1048-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/924-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3224-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4796-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4340-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/760-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4248-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2984-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3512-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2184-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4636-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3084-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1472-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/832-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2068-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1676-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2152-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1044-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1412-500-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2772-534-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1096-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2212-608-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-660-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4232-976-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4016-1319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/392-1485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3652 jpppp.exe 8 bnhhnt.exe 4936 jddvp.exe 3620 ntnnhb.exe 2204 dpddv.exe 5076 htnhht.exe 3428 jdvvj.exe 4568 thnhbb.exe 2128 llffrrr.exe 1528 vvddj.exe 4972 xflfrrf.exe 372 hnhhhn.exe 396 pjjjj.exe 3016 lrllflf.exe 1544 xxllllr.exe 3744 xxfxffl.exe 2436 fxxxxxr.exe 624 jjpdd.exe 1512 hhbbbn.exe 1632 vvddv.exe 3364 llrrlxx.exe 1980 vvdjp.exe 984 flxxxll.exe 1092 ntbbhn.exe 432 rxllflf.exe 2772 tntnnh.exe 1048 7pvvd.exe 924 pvjjj.exe 3224 xxrlffr.exe 4956 tntbbb.exe 2156 xffxrfx.exe 4796 pdddd.exe 4940 nhnttb.exe 220 9dpjj.exe 4404 vjppp.exe 4392 rxxxrxr.exe 5044 bbbbbb.exe 1836 7jddd.exe 2792 xrrrlll.exe 4340 ttnnhb.exe 3500 pvjpd.exe 784 5httnn.exe 2036 jjjdd.exe 760 xrrrrrr.exe 4248 rxxxxff.exe 3412 tbbttb.exe 4860 vdvvv.exe 4804 vdjpp.exe 2984 fxfxxxl.exe 3512 9nnbth.exe 4260 vjvpp.exe 3544 xxrlxxl.exe 2184 nhthhh.exe 1964 tbbttt.exe 2616 vvdjj.exe 1424 xrxxrxl.exe 716 1bhhhb.exe 3312 vjddd.exe 4080 ffrllll.exe 636 5lllfll.exe 1044 hhtbbh.exe 3276 jjvdd.exe 3880 llrrrxx.exe 3744 1rllfll.exe -
resource yara_rule behavioral2/memory/224-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b38-3.dat upx behavioral2/memory/224-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b93-10.dat upx behavioral2/memory/8-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3652-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9a-13.dat upx behavioral2/files/0x000a000000023b9c-21.dat upx behavioral2/memory/4936-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3620-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9d-29.dat upx behavioral2/files/0x000a000000023b9e-32.dat upx behavioral2/memory/2204-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9f-38.dat upx behavioral2/memory/5076-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3428-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba0-45.dat upx behavioral2/memory/3428-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba1-51.dat upx behavioral2/memory/4568-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba2-56.dat upx behavioral2/memory/2128-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba3-61.dat upx behavioral2/memory/1528-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4972-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023ba4-67.dat upx behavioral2/memory/372-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba5-75.dat upx behavioral2/files/0x0058000000023ba6-80.dat upx behavioral2/memory/3016-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba7-86.dat upx behavioral2/memory/396-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b97-91.dat upx behavioral2/memory/1544-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba8-97.dat upx behavioral2/files/0x000a000000023ba9-102.dat upx behavioral2/memory/2436-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023baa-108.dat upx behavioral2/memory/624-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bab-115.dat upx behavioral2/files/0x000a000000023bad-120.dat upx behavioral2/memory/3364-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1632-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bae-128.dat upx behavioral2/memory/3364-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023baf-132.dat upx behavioral2/memory/1980-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb0-139.dat upx behavioral2/memory/984-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb1-144.dat upx behavioral2/memory/432-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb2-151.dat upx behavioral2/files/0x000a000000023bb3-156.dat upx behavioral2/files/0x000a000000023bb4-160.dat upx behavioral2/memory/1048-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/924-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb5-168.dat upx behavioral2/files/0x000a000000023bb6-174.dat upx behavioral2/memory/3224-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb7-178.dat upx behavioral2/files/0x000a000000023bb8-182.dat upx behavioral2/memory/4796-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4940-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4392-203-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 224 wrote to memory of 3652 224 6771caafa04088a93e2611937ddb31dbc0a145d3fab0929f7c679a05bce99666N.exe 83 PID 224 wrote to memory of 3652 224 6771caafa04088a93e2611937ddb31dbc0a145d3fab0929f7c679a05bce99666N.exe 83 PID 224 wrote to memory of 3652 224 6771caafa04088a93e2611937ddb31dbc0a145d3fab0929f7c679a05bce99666N.exe 83 PID 3652 wrote to memory of 8 3652 jpppp.exe 84 PID 3652 wrote to memory of 8 3652 jpppp.exe 84 PID 3652 wrote to memory of 8 3652 jpppp.exe 84 PID 8 wrote to memory of 4936 8 bnhhnt.exe 85 PID 8 wrote to memory of 4936 8 bnhhnt.exe 85 PID 8 wrote to memory of 4936 8 bnhhnt.exe 85 PID 4936 wrote to memory of 3620 4936 jddvp.exe 86 PID 4936 wrote to memory of 3620 4936 jddvp.exe 86 PID 4936 wrote to memory of 3620 4936 jddvp.exe 86 PID 3620 wrote to memory of 2204 3620 ntnnhb.exe 87 PID 3620 wrote to memory of 2204 3620 ntnnhb.exe 87 PID 3620 wrote to memory of 2204 3620 ntnnhb.exe 87 PID 2204 wrote to memory of 5076 2204 dpddv.exe 88 PID 2204 wrote to memory of 5076 2204 dpddv.exe 88 PID 2204 wrote to memory of 5076 2204 dpddv.exe 88 PID 5076 wrote to memory of 3428 5076 htnhht.exe 89 PID 5076 wrote to memory of 3428 5076 htnhht.exe 89 PID 5076 wrote to memory of 3428 5076 htnhht.exe 89 PID 3428 wrote to memory of 4568 3428 jdvvj.exe 90 PID 3428 wrote to memory of 4568 3428 jdvvj.exe 90 PID 3428 wrote to memory of 4568 3428 jdvvj.exe 90 PID 4568 wrote to memory of 2128 4568 thnhbb.exe 91 PID 4568 wrote to memory of 2128 4568 thnhbb.exe 91 PID 4568 wrote to memory of 2128 4568 thnhbb.exe 91 PID 2128 wrote to memory of 1528 2128 llffrrr.exe 92 PID 2128 wrote to memory of 1528 2128 llffrrr.exe 92 PID 2128 wrote to memory of 1528 2128 llffrrr.exe 92 PID 1528 wrote to memory of 4972 1528 vvddj.exe 93 PID 1528 wrote to memory of 4972 1528 vvddj.exe 93 PID 1528 wrote to memory of 4972 1528 vvddj.exe 93 PID 4972 wrote to memory of 372 4972 xflfrrf.exe 94 PID 4972 wrote to memory of 372 4972 xflfrrf.exe 94 PID 4972 wrote to memory of 372 4972 xflfrrf.exe 94 PID 372 wrote to memory of 396 372 hnhhhn.exe 95 PID 372 wrote to memory of 396 372 hnhhhn.exe 95 PID 372 wrote to memory of 396 372 hnhhhn.exe 95 PID 396 wrote to memory of 3016 396 pjjjj.exe 96 PID 396 wrote to memory of 3016 396 pjjjj.exe 96 PID 396 wrote to memory of 3016 396 pjjjj.exe 96 PID 3016 wrote to memory of 1544 3016 lrllflf.exe 97 PID 3016 wrote to memory of 1544 3016 lrllflf.exe 97 PID 3016 wrote to memory of 1544 3016 lrllflf.exe 97 PID 1544 wrote to memory of 3744 1544 xxllllr.exe 98 PID 1544 wrote to memory of 3744 1544 xxllllr.exe 98 PID 1544 wrote to memory of 3744 1544 xxllllr.exe 98 PID 3744 wrote to memory of 2436 3744 xxfxffl.exe 99 PID 3744 wrote to memory of 2436 3744 xxfxffl.exe 99 PID 3744 wrote to memory of 2436 3744 xxfxffl.exe 99 PID 2436 wrote to memory of 624 2436 fxxxxxr.exe 100 PID 2436 wrote to memory of 624 2436 fxxxxxr.exe 100 PID 2436 wrote to memory of 624 2436 fxxxxxr.exe 100 PID 624 wrote to memory of 1512 624 jjpdd.exe 101 PID 624 wrote to memory of 1512 624 jjpdd.exe 101 PID 624 wrote to memory of 1512 624 jjpdd.exe 101 PID 1512 wrote to memory of 1632 1512 hhbbbn.exe 102 PID 1512 wrote to memory of 1632 1512 hhbbbn.exe 102 PID 1512 wrote to memory of 1632 1512 hhbbbn.exe 102 PID 1632 wrote to memory of 3364 1632 vvddv.exe 103 PID 1632 wrote to memory of 3364 1632 vvddv.exe 103 PID 1632 wrote to memory of 3364 1632 vvddv.exe 103 PID 3364 wrote to memory of 1980 3364 llrrlxx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\6771caafa04088a93e2611937ddb31dbc0a145d3fab0929f7c679a05bce99666N.exe"C:\Users\Admin\AppData\Local\Temp\6771caafa04088a93e2611937ddb31dbc0a145d3fab0929f7c679a05bce99666N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\jpppp.exec:\jpppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\bnhhnt.exec:\bnhhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\jddvp.exec:\jddvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\ntnnhb.exec:\ntnnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\dpddv.exec:\dpddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\htnhht.exec:\htnhht.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\jdvvj.exec:\jdvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\thnhbb.exec:\thnhbb.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\llffrrr.exec:\llffrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\vvddj.exec:\vvddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\xflfrrf.exec:\xflfrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\hnhhhn.exec:\hnhhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\pjjjj.exec:\pjjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\lrllflf.exec:\lrllflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\xxllllr.exec:\xxllllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\xxfxffl.exec:\xxfxffl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\fxxxxxr.exec:\fxxxxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\jjpdd.exec:\jjpdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\hhbbbn.exec:\hhbbbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\vvddv.exec:\vvddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\llrrlxx.exec:\llrrlxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\vvdjp.exec:\vvdjp.exe23⤵
- Executes dropped EXE
PID:1980 -
\??\c:\flxxxll.exec:\flxxxll.exe24⤵
- Executes dropped EXE
PID:984 -
\??\c:\ntbbhn.exec:\ntbbhn.exe25⤵
- Executes dropped EXE
PID:1092 -
\??\c:\rxllflf.exec:\rxllflf.exe26⤵
- Executes dropped EXE
PID:432 -
\??\c:\tntnnh.exec:\tntnnh.exe27⤵
- Executes dropped EXE
PID:2772 -
\??\c:\7pvvd.exec:\7pvvd.exe28⤵
- Executes dropped EXE
PID:1048 -
\??\c:\pvjjj.exec:\pvjjj.exe29⤵
- Executes dropped EXE
PID:924 -
\??\c:\xxrlffr.exec:\xxrlffr.exe30⤵
- Executes dropped EXE
PID:3224 -
\??\c:\tntbbb.exec:\tntbbb.exe31⤵
- Executes dropped EXE
PID:4956 -
\??\c:\xffxrfx.exec:\xffxrfx.exe32⤵
- Executes dropped EXE
PID:2156 -
\??\c:\pdddd.exec:\pdddd.exe33⤵
- Executes dropped EXE
PID:4796 -
\??\c:\nhnttb.exec:\nhnttb.exe34⤵
- Executes dropped EXE
PID:4940 -
\??\c:\9dpjj.exec:\9dpjj.exe35⤵
- Executes dropped EXE
PID:220 -
\??\c:\vjppp.exec:\vjppp.exe36⤵
- Executes dropped EXE
PID:4404 -
\??\c:\rxxxrxr.exec:\rxxxrxr.exe37⤵
- Executes dropped EXE
PID:4392 -
\??\c:\bbbbbb.exec:\bbbbbb.exe38⤵
- Executes dropped EXE
PID:5044 -
\??\c:\7jddd.exec:\7jddd.exe39⤵
- Executes dropped EXE
PID:1836 -
\??\c:\xrrrlll.exec:\xrrrlll.exe40⤵
- Executes dropped EXE
PID:2792 -
\??\c:\ttnnhb.exec:\ttnnhb.exe41⤵
- Executes dropped EXE
PID:4340 -
\??\c:\pvjpd.exec:\pvjpd.exe42⤵
- Executes dropped EXE
PID:3500 -
\??\c:\5httnn.exec:\5httnn.exe43⤵
- Executes dropped EXE
PID:784 -
\??\c:\jjjdd.exec:\jjjdd.exe44⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe45⤵
- Executes dropped EXE
PID:760 -
\??\c:\rxxxxff.exec:\rxxxxff.exe46⤵
- Executes dropped EXE
PID:4248 -
\??\c:\tbbttb.exec:\tbbttb.exe47⤵
- Executes dropped EXE
PID:3412 -
\??\c:\vdvvv.exec:\vdvvv.exe48⤵
- Executes dropped EXE
PID:4860 -
\??\c:\vdjpp.exec:\vdjpp.exe49⤵
- Executes dropped EXE
PID:4804 -
\??\c:\fxfxxxl.exec:\fxfxxxl.exe50⤵
- Executes dropped EXE
PID:2984 -
\??\c:\9nnbth.exec:\9nnbth.exe51⤵
- Executes dropped EXE
PID:3512 -
\??\c:\vjvpp.exec:\vjvpp.exe52⤵
- Executes dropped EXE
PID:4260 -
\??\c:\xxrlxxl.exec:\xxrlxxl.exe53⤵
- Executes dropped EXE
PID:3544 -
\??\c:\nhthhh.exec:\nhthhh.exe54⤵
- Executes dropped EXE
PID:2184 -
\??\c:\tbbttt.exec:\tbbttt.exe55⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vvdjj.exec:\vvdjj.exe56⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xrxxrxl.exec:\xrxxrxl.exe57⤵
- Executes dropped EXE
PID:1424 -
\??\c:\1bhhhb.exec:\1bhhhb.exe58⤵
- Executes dropped EXE
PID:716 -
\??\c:\vjddd.exec:\vjddd.exe59⤵
- Executes dropped EXE
PID:3312 -
\??\c:\ffrllll.exec:\ffrllll.exe60⤵
- Executes dropped EXE
PID:4080 -
\??\c:\5lllfll.exec:\5lllfll.exe61⤵
- Executes dropped EXE
PID:636 -
\??\c:\hhtbbh.exec:\hhtbbh.exe62⤵
- Executes dropped EXE
PID:1044 -
\??\c:\jjvdd.exec:\jjvdd.exe63⤵
- Executes dropped EXE
PID:3276 -
\??\c:\llrrrxx.exec:\llrrrxx.exe64⤵
- Executes dropped EXE
PID:3880 -
\??\c:\1rllfll.exec:\1rllfll.exe65⤵
- Executes dropped EXE
PID:3744 -
\??\c:\tbhhnn.exec:\tbhhnn.exe66⤵PID:4636
-
\??\c:\1nnhhh.exec:\1nnhhh.exe67⤵PID:1504
-
\??\c:\ppvvv.exec:\ppvvv.exe68⤵PID:548
-
\??\c:\1xllrrf.exec:\1xllrrf.exe69⤵PID:1916
-
\??\c:\hbhnnb.exec:\hbhnnb.exe70⤵PID:4644
-
\??\c:\bhthtb.exec:\bhthtb.exe71⤵PID:3084
-
\??\c:\9jjpp.exec:\9jjpp.exe72⤵PID:1192
-
\??\c:\xflfffl.exec:\xflfffl.exe73⤵PID:512
-
\??\c:\hbhbbb.exec:\hbhbbb.exe74⤵PID:2504
-
\??\c:\jjjjd.exec:\jjjjd.exe75⤵PID:3636
-
\??\c:\fffxllx.exec:\fffxllx.exe76⤵PID:1472
-
\??\c:\tnhbbh.exec:\tnhbbh.exe77⤵
- System Location Discovery: System Language Discovery
PID:2700 -
\??\c:\djvpj.exec:\djvpj.exe78⤵PID:4508
-
\??\c:\dppjd.exec:\dppjd.exe79⤵PID:4892
-
\??\c:\5xfffll.exec:\5xfffll.exe80⤵PID:4884
-
\??\c:\bbhhnt.exec:\bbhhnt.exe81⤵PID:4960
-
\??\c:\dddpv.exec:\dddpv.exe82⤵PID:832
-
\??\c:\xffllll.exec:\xffllll.exe83⤵PID:4996
-
\??\c:\5rrrffx.exec:\5rrrffx.exe84⤵PID:3668
-
\??\c:\hhhhbn.exec:\hhhhbn.exe85⤵PID:2156
-
\??\c:\vpppj.exec:\vpppj.exe86⤵PID:3232
-
\??\c:\rffxrrl.exec:\rffxrrl.exe87⤵PID:216
-
\??\c:\fffffll.exec:\fffffll.exe88⤵PID:3060
-
\??\c:\btbbtt.exec:\btbbtt.exe89⤵PID:2068
-
\??\c:\9pdvj.exec:\9pdvj.exe90⤵PID:2508
-
\??\c:\lllfffx.exec:\lllfffx.exe91⤵PID:4144
-
\??\c:\btbhhb.exec:\btbhhb.exe92⤵PID:1836
-
\??\c:\pvddp.exec:\pvddp.exe93⤵PID:2792
-
\??\c:\ddjjj.exec:\ddjjj.exe94⤵PID:2704
-
\??\c:\xrlrlxl.exec:\xrlrlxl.exe95⤵
- System Location Discovery: System Language Discovery
PID:1676 -
\??\c:\1bhnnt.exec:\1bhnnt.exe96⤵PID:2912
-
\??\c:\ppppp.exec:\ppppp.exe97⤵PID:4364
-
\??\c:\ppdvp.exec:\ppdvp.exe98⤵PID:4256
-
\??\c:\xxrllll.exec:\xxrllll.exe99⤵PID:3616
-
\??\c:\3tbttt.exec:\3tbttt.exe100⤵PID:3480
-
\??\c:\jjpjp.exec:\jjpjp.exe101⤵PID:2932
-
\??\c:\jvvdj.exec:\jvvdj.exe102⤵PID:2204
-
\??\c:\lllllll.exec:\lllllll.exe103⤵PID:2612
-
\??\c:\tbbbbn.exec:\tbbbbn.exe104⤵PID:4280
-
\??\c:\vdddj.exec:\vdddj.exe105⤵PID:3512
-
\??\c:\5jjpj.exec:\5jjpj.exe106⤵PID:4260
-
\??\c:\5xfrllf.exec:\5xfrllf.exe107⤵PID:3544
-
\??\c:\rlxrxrr.exec:\rlxrxrr.exe108⤵PID:2152
-
\??\c:\vpjdv.exec:\vpjdv.exe109⤵PID:1628
-
\??\c:\rfffllf.exec:\rfffllf.exe110⤵PID:4424
-
\??\c:\1tnnnt.exec:\1tnnnt.exe111⤵PID:556
-
\??\c:\5ntnnn.exec:\5ntnnn.exe112⤵PID:1932
-
\??\c:\djddd.exec:\djddd.exe113⤵PID:396
-
\??\c:\lrlxrrl.exec:\lrlxrrl.exe114⤵PID:4876
-
\??\c:\9rlxlxr.exec:\9rlxlxr.exe115⤵PID:2008
-
\??\c:\1nhhnn.exec:\1nhhnn.exe116⤵PID:636
-
\??\c:\dvjjp.exec:\dvjjp.exe117⤵PID:1044
-
\??\c:\vdppp.exec:\vdppp.exe118⤵PID:3276
-
\??\c:\flxrlrf.exec:\flxrlrf.exe119⤵PID:3880
-
\??\c:\hbbtnn.exec:\hbbtnn.exe120⤵PID:4420
-
\??\c:\9dppv.exec:\9dppv.exe121⤵PID:4824
-
\??\c:\vdvjd.exec:\vdvjd.exe122⤵PID:1200
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-