Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 12:13
Behavioral task
behavioral1
Sample
8e2eb20149da338ff4e8e6effa4d312b5f92f1691b73733b2422b845c1c2fa2e.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
8e2eb20149da338ff4e8e6effa4d312b5f92f1691b73733b2422b845c1c2fa2e.exe
-
Size
335KB
-
MD5
91eabb4abe843a2b22a227c507e1ed48
-
SHA1
7dc8dc60a5fc92b89b600dfbaa2f4ce357ad33f7
-
SHA256
8e2eb20149da338ff4e8e6effa4d312b5f92f1691b73733b2422b845c1c2fa2e
-
SHA512
98472cf0c56b52836cf7f16f6b42c9c9227dd7977019b492db9af2788a7fedc445b686011783ce11ab2e69f69357ef14823678d034c63258feebcc1ed7d2adfb
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeRr:R4wFHoSHYHUrAwfMp3CDRr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4624-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/896-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1988-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2752-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1744-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1896-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2640-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4800-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1004-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/644-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1316-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3812-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2884-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1504-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/860-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/728-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4616-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1192-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4132-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3564-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/672-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1228-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2880-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2748-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3384-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2060-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4808-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2412-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2772-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3156-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3704-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2808-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4264-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3880-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3168-488-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4500-567-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2932-666-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/676-848-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2680-1024-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4488 jvvpv.exe 4372 llfrxrl.exe 896 nbnbnh.exe 1988 nbthnh.exe 2752 vjjdv.exe 1744 rxlfrfr.exe 1896 pdpjv.exe 2640 fxrfrlx.exe 4800 hbthtn.exe 4856 xxxlxlf.exe 2764 nntnbn.exe 3892 ddpjj.exe 1004 fxfrffr.exe 1076 7btnnh.exe 1316 5jpjd.exe 644 5llxllx.exe 2884 thhbbn.exe 3812 xfxlfxl.exe 4004 lxfxxll.exe 1120 nhbtht.exe 1564 7jvjd.exe 1504 lfxlfrl.exe 60 ntthbt.exe 1656 dppdp.exe 860 xlfrffr.exe 1460 ppdjj.exe 2664 3vdpv.exe 1852 lrrlxrl.exe 728 bthbhb.exe 2208 xllxlxr.exe 4616 btnbnh.exe 1468 5nhtnh.exe 2504 5rrflfr.exe 1600 xrxlrlf.exe 4448 vjjdv.exe 1296 djvpp.exe 1536 xxrrfrf.exe 5108 llfrfxr.exe 1192 tbbhtn.exe 1672 jpjvj.exe 3020 1pjvd.exe 1228 xxxlxrf.exe 3260 bbbtnh.exe 4132 thbntn.exe 4600 jvpdp.exe 1860 lxlrfrl.exe 3564 htnnbn.exe 1420 tnttnb.exe 2272 jdpdj.exe 672 fxrfrlx.exe 3460 3rxrllf.exe 3636 nbnbnt.exe 1372 httnhb.exe 4816 1vjvj.exe 2472 3fxllfl.exe 2176 btbnbb.exe 2880 7dvpv.exe 2748 xflflfr.exe 3384 xxlfrlx.exe 4552 tbbnht.exe 648 bnhtbt.exe 2604 dvvpd.exe 4940 7frflfr.exe 2060 hbbtbn.exe -
resource yara_rule behavioral2/memory/4624-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000d000000023b53-3.dat upx behavioral2/memory/4624-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b76-9.dat upx behavioral2/files/0x000a000000023b7a-14.dat upx behavioral2/memory/896-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7b-18.dat upx behavioral2/memory/1988-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4372-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1988-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7c-23.dat upx behavioral2/memory/2752-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7d-28.dat upx behavioral2/files/0x000a000000023b7e-33.dat upx behavioral2/memory/1744-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b80-38.dat upx behavioral2/memory/1896-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2640-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b81-43.dat upx behavioral2/files/0x000a000000023b82-48.dat upx behavioral2/memory/4800-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b83-53.dat upx behavioral2/memory/4856-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b84-58.dat upx behavioral2/memory/2764-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b85-63.dat upx behavioral2/memory/3892-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b86-68.dat upx behavioral2/memory/1076-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1004-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b87-74.dat upx behavioral2/files/0x000a000000023b88-77.dat upx behavioral2/memory/644-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1316-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b89-84.dat upx behavioral2/files/0x000b000000023b77-88.dat upx behavioral2/memory/3812-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2884-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8a-95.dat upx behavioral2/files/0x000a000000023b8b-99.dat upx behavioral2/memory/4004-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8c-103.dat upx behavioral2/memory/1120-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8d-108.dat upx behavioral2/memory/1504-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8e-112.dat upx behavioral2/files/0x000a000000023b8f-117.dat upx behavioral2/files/0x000a000000023b90-121.dat upx behavioral2/memory/860-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b92-127.dat upx behavioral2/files/0x000a000000023b93-130.dat upx behavioral2/memory/2664-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b94-135.dat upx behavioral2/memory/1852-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2664-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b95-141.dat upx behavioral2/files/0x000a000000023b96-147.dat upx behavioral2/memory/728-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4616-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b97-151.dat upx behavioral2/files/0x000a000000023b98-155.dat upx behavioral2/memory/4616-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1192-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1192-175-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4624 wrote to memory of 4488 4624 8e2eb20149da338ff4e8e6effa4d312b5f92f1691b73733b2422b845c1c2fa2e.exe 82 PID 4624 wrote to memory of 4488 4624 8e2eb20149da338ff4e8e6effa4d312b5f92f1691b73733b2422b845c1c2fa2e.exe 82 PID 4624 wrote to memory of 4488 4624 8e2eb20149da338ff4e8e6effa4d312b5f92f1691b73733b2422b845c1c2fa2e.exe 82 PID 4488 wrote to memory of 4372 4488 jvvpv.exe 83 PID 4488 wrote to memory of 4372 4488 jvvpv.exe 83 PID 4488 wrote to memory of 4372 4488 jvvpv.exe 83 PID 4372 wrote to memory of 896 4372 llfrxrl.exe 84 PID 4372 wrote to memory of 896 4372 llfrxrl.exe 84 PID 4372 wrote to memory of 896 4372 llfrxrl.exe 84 PID 896 wrote to memory of 1988 896 nbnbnh.exe 85 PID 896 wrote to memory of 1988 896 nbnbnh.exe 85 PID 896 wrote to memory of 1988 896 nbnbnh.exe 85 PID 1988 wrote to memory of 2752 1988 nbthnh.exe 86 PID 1988 wrote to memory of 2752 1988 nbthnh.exe 86 PID 1988 wrote to memory of 2752 1988 nbthnh.exe 86 PID 2752 wrote to memory of 1744 2752 vjjdv.exe 87 PID 2752 wrote to memory of 1744 2752 vjjdv.exe 87 PID 2752 wrote to memory of 1744 2752 vjjdv.exe 87 PID 1744 wrote to memory of 1896 1744 rxlfrfr.exe 88 PID 1744 wrote to memory of 1896 1744 rxlfrfr.exe 88 PID 1744 wrote to memory of 1896 1744 rxlfrfr.exe 88 PID 1896 wrote to memory of 2640 1896 pdpjv.exe 89 PID 1896 wrote to memory of 2640 1896 pdpjv.exe 89 PID 1896 wrote to memory of 2640 1896 pdpjv.exe 89 PID 2640 wrote to memory of 4800 2640 fxrfrlx.exe 90 PID 2640 wrote to memory of 4800 2640 fxrfrlx.exe 90 PID 2640 wrote to memory of 4800 2640 fxrfrlx.exe 90 PID 4800 wrote to memory of 4856 4800 hbthtn.exe 91 PID 4800 wrote to memory of 4856 4800 hbthtn.exe 91 PID 4800 wrote to memory of 4856 4800 hbthtn.exe 91 PID 4856 wrote to memory of 2764 4856 xxxlxlf.exe 92 PID 4856 wrote to memory of 2764 4856 xxxlxlf.exe 92 PID 4856 wrote to memory of 2764 4856 xxxlxlf.exe 92 PID 2764 wrote to memory of 3892 2764 nntnbn.exe 93 PID 2764 wrote to memory of 3892 2764 nntnbn.exe 93 PID 2764 wrote to memory of 3892 2764 nntnbn.exe 93 PID 3892 wrote to memory of 1004 3892 ddpjj.exe 94 PID 3892 wrote to memory of 1004 3892 ddpjj.exe 94 PID 3892 wrote to memory of 1004 3892 ddpjj.exe 94 PID 1004 wrote to memory of 1076 1004 fxfrffr.exe 95 PID 1004 wrote to memory of 1076 1004 fxfrffr.exe 95 PID 1004 wrote to memory of 1076 1004 fxfrffr.exe 95 PID 1076 wrote to memory of 1316 1076 7btnnh.exe 96 PID 1076 wrote to memory of 1316 1076 7btnnh.exe 96 PID 1076 wrote to memory of 1316 1076 7btnnh.exe 96 PID 1316 wrote to memory of 644 1316 5jpjd.exe 97 PID 1316 wrote to memory of 644 1316 5jpjd.exe 97 PID 1316 wrote to memory of 644 1316 5jpjd.exe 97 PID 644 wrote to memory of 2884 644 5llxllx.exe 98 PID 644 wrote to memory of 2884 644 5llxllx.exe 98 PID 644 wrote to memory of 2884 644 5llxllx.exe 98 PID 2884 wrote to memory of 3812 2884 thhbbn.exe 99 PID 2884 wrote to memory of 3812 2884 thhbbn.exe 99 PID 2884 wrote to memory of 3812 2884 thhbbn.exe 99 PID 3812 wrote to memory of 4004 3812 xfxlfxl.exe 100 PID 3812 wrote to memory of 4004 3812 xfxlfxl.exe 100 PID 3812 wrote to memory of 4004 3812 xfxlfxl.exe 100 PID 4004 wrote to memory of 1120 4004 lxfxxll.exe 101 PID 4004 wrote to memory of 1120 4004 lxfxxll.exe 101 PID 4004 wrote to memory of 1120 4004 lxfxxll.exe 101 PID 1120 wrote to memory of 1564 1120 nhbtht.exe 102 PID 1120 wrote to memory of 1564 1120 nhbtht.exe 102 PID 1120 wrote to memory of 1564 1120 nhbtht.exe 102 PID 1564 wrote to memory of 1504 1564 7jvjd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e2eb20149da338ff4e8e6effa4d312b5f92f1691b73733b2422b845c1c2fa2e.exe"C:\Users\Admin\AppData\Local\Temp\8e2eb20149da338ff4e8e6effa4d312b5f92f1691b73733b2422b845c1c2fa2e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\jvvpv.exec:\jvvpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\llfrxrl.exec:\llfrxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\nbnbnh.exec:\nbnbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\nbthnh.exec:\nbthnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\vjjdv.exec:\vjjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\rxlfrfr.exec:\rxlfrfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\pdpjv.exec:\pdpjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\fxrfrlx.exec:\fxrfrlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\hbthtn.exec:\hbthtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\xxxlxlf.exec:\xxxlxlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\nntnbn.exec:\nntnbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\ddpjj.exec:\ddpjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\fxfrffr.exec:\fxfrffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\7btnnh.exec:\7btnnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\5jpjd.exec:\5jpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\5llxllx.exec:\5llxllx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\thhbbn.exec:\thhbbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\xfxlfxl.exec:\xfxlfxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\lxfxxll.exec:\lxfxxll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\nhbtht.exec:\nhbtht.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\7jvjd.exec:\7jvjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\lfxlfrl.exec:\lfxlfrl.exe23⤵
- Executes dropped EXE
PID:1504 -
\??\c:\ntthbt.exec:\ntthbt.exe24⤵
- Executes dropped EXE
PID:60 -
\??\c:\dppdp.exec:\dppdp.exe25⤵
- Executes dropped EXE
PID:1656 -
\??\c:\xlfrffr.exec:\xlfrffr.exe26⤵
- Executes dropped EXE
PID:860 -
\??\c:\ppdjj.exec:\ppdjj.exe27⤵
- Executes dropped EXE
PID:1460 -
\??\c:\3vdpv.exec:\3vdpv.exe28⤵
- Executes dropped EXE
PID:2664 -
\??\c:\lrrlxrl.exec:\lrrlxrl.exe29⤵
- Executes dropped EXE
PID:1852 -
\??\c:\bthbhb.exec:\bthbhb.exe30⤵
- Executes dropped EXE
PID:728 -
\??\c:\xllxlxr.exec:\xllxlxr.exe31⤵
- Executes dropped EXE
PID:2208 -
\??\c:\btnbnh.exec:\btnbnh.exe32⤵
- Executes dropped EXE
PID:4616 -
\??\c:\5nhtnh.exec:\5nhtnh.exe33⤵
- Executes dropped EXE
PID:1468 -
\??\c:\5rrflfr.exec:\5rrflfr.exe34⤵
- Executes dropped EXE
PID:2504 -
\??\c:\xrxlrlf.exec:\xrxlrlf.exe35⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vjjdv.exec:\vjjdv.exe36⤵
- Executes dropped EXE
PID:4448 -
\??\c:\djvpp.exec:\djvpp.exe37⤵
- Executes dropped EXE
PID:1296 -
\??\c:\xxrrfrf.exec:\xxrrfrf.exe38⤵
- Executes dropped EXE
PID:1536 -
\??\c:\llfrfxr.exec:\llfrfxr.exe39⤵
- Executes dropped EXE
PID:5108 -
\??\c:\tbbhtn.exec:\tbbhtn.exe40⤵
- Executes dropped EXE
PID:1192 -
\??\c:\jpjvj.exec:\jpjvj.exe41⤵
- Executes dropped EXE
PID:1672 -
\??\c:\1pjvd.exec:\1pjvd.exe42⤵
- Executes dropped EXE
PID:3020 -
\??\c:\xxxlxrf.exec:\xxxlxrf.exe43⤵
- Executes dropped EXE
PID:1228 -
\??\c:\bbbtnh.exec:\bbbtnh.exe44⤵
- Executes dropped EXE
PID:3260 -
\??\c:\thbntn.exec:\thbntn.exe45⤵
- Executes dropped EXE
PID:4132 -
\??\c:\jvpdp.exec:\jvpdp.exe46⤵
- Executes dropped EXE
PID:4600 -
\??\c:\lxlrfrl.exec:\lxlrfrl.exe47⤵
- Executes dropped EXE
PID:1860 -
\??\c:\htnnbn.exec:\htnnbn.exe48⤵
- Executes dropped EXE
PID:3564 -
\??\c:\tnttnb.exec:\tnttnb.exe49⤵
- Executes dropped EXE
PID:1420 -
\??\c:\jdpdj.exec:\jdpdj.exe50⤵
- Executes dropped EXE
PID:2272 -
\??\c:\fxrfrlx.exec:\fxrfrlx.exe51⤵
- Executes dropped EXE
PID:672 -
\??\c:\3rxrllf.exec:\3rxrllf.exe52⤵
- Executes dropped EXE
PID:3460 -
\??\c:\nbnbnt.exec:\nbnbnt.exe53⤵
- Executes dropped EXE
PID:3636 -
\??\c:\httnhb.exec:\httnhb.exe54⤵
- Executes dropped EXE
PID:1372 -
\??\c:\1vjvj.exec:\1vjvj.exe55⤵
- Executes dropped EXE
PID:4816 -
\??\c:\3fxllfl.exec:\3fxllfl.exe56⤵
- Executes dropped EXE
PID:2472 -
\??\c:\btbnbb.exec:\btbnbb.exe57⤵
- Executes dropped EXE
PID:2176 -
\??\c:\7dvpv.exec:\7dvpv.exe58⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xflflfr.exec:\xflflfr.exe59⤵
- Executes dropped EXE
PID:2748 -
\??\c:\xxlfrlx.exec:\xxlfrlx.exe60⤵
- Executes dropped EXE
PID:3384 -
\??\c:\tbbnht.exec:\tbbnht.exe61⤵
- Executes dropped EXE
PID:4552 -
\??\c:\bnhtbt.exec:\bnhtbt.exe62⤵
- Executes dropped EXE
PID:648 -
\??\c:\dvvpd.exec:\dvvpd.exe63⤵
- Executes dropped EXE
PID:2604 -
\??\c:\7frflfr.exec:\7frflfr.exe64⤵
- Executes dropped EXE
PID:4940 -
\??\c:\hbbtbn.exec:\hbbtbn.exe65⤵
- Executes dropped EXE
PID:2060 -
\??\c:\bnhtht.exec:\bnhtht.exe66⤵PID:1096
-
\??\c:\pdvjd.exec:\pdvjd.exe67⤵PID:3724
-
\??\c:\3lfflrf.exec:\3lfflrf.exe68⤵PID:3696
-
\??\c:\xrfxxrf.exec:\xrfxxrf.exe69⤵PID:1084
-
\??\c:\htntht.exec:\htntht.exe70⤵PID:4492
-
\??\c:\5tthbt.exec:\5tthbt.exe71⤵PID:4808
-
\??\c:\jvpdp.exec:\jvpdp.exe72⤵PID:2468
-
\??\c:\rflxlfr.exec:\rflxlfr.exe73⤵PID:2836
-
\??\c:\hhbthn.exec:\hhbthn.exe74⤵PID:2412
-
\??\c:\nnhbnh.exec:\nnhbnh.exe75⤵PID:1152
-
\??\c:\vvvpd.exec:\vvvpd.exe76⤵PID:3896
-
\??\c:\jvdjd.exec:\jvdjd.exe77⤵PID:3628
-
\??\c:\xfxlxrr.exec:\xfxlxrr.exe78⤵PID:4024
-
\??\c:\tbnbbt.exec:\tbnbbt.exe79⤵PID:2772
-
\??\c:\ttnhnb.exec:\ttnhnb.exe80⤵PID:3892
-
\??\c:\pvppp.exec:\pvppp.exe81⤵PID:2064
-
\??\c:\xlxlxrl.exec:\xlxlxrl.exe82⤵PID:2896
-
\??\c:\9lrflfr.exec:\9lrflfr.exe83⤵PID:1332
-
\??\c:\ttnhht.exec:\ttnhht.exe84⤵PID:2316
-
\??\c:\ddvpd.exec:\ddvpd.exe85⤵PID:4016
-
\??\c:\jddpd.exec:\jddpd.exe86⤵PID:2684
-
\??\c:\3xxlrrx.exec:\3xxlrrx.exe87⤵PID:5112
-
\??\c:\lllxlxl.exec:\lllxlxl.exe88⤵PID:3156
-
\??\c:\nbhbnb.exec:\nbhbnb.exe89⤵PID:224
-
\??\c:\7vjvj.exec:\7vjvj.exe90⤵PID:3812
-
\??\c:\xffrlxr.exec:\xffrlxr.exe91⤵PID:3704
-
\??\c:\lrrfrlx.exec:\lrrfrlx.exe92⤵PID:3356
-
\??\c:\thtbnn.exec:\thtbnn.exe93⤵PID:4420
-
\??\c:\jjdvj.exec:\jjdvj.exe94⤵PID:4012
-
\??\c:\lrlxfxl.exec:\lrlxfxl.exe95⤵PID:1608
-
\??\c:\lllfrfr.exec:\lllfrfr.exe96⤵PID:3012
-
\??\c:\tbbnhb.exec:\tbbnhb.exe97⤵PID:2808
-
\??\c:\tbbnbn.exec:\tbbnbn.exe98⤵PID:3772
-
\??\c:\pddpd.exec:\pddpd.exe99⤵PID:4872
-
\??\c:\frlrxrf.exec:\frlrxrf.exe100⤵PID:1224
-
\??\c:\5frlxxl.exec:\5frlxxl.exe101⤵PID:1252
-
\??\c:\tnhbnh.exec:\tnhbnh.exe102⤵PID:1588
-
\??\c:\vvpjd.exec:\vvpjd.exe103⤵PID:2788
-
\??\c:\7vpdj.exec:\7vpdj.exe104⤵PID:2284
-
\??\c:\frlrfrl.exec:\frlrfrl.exe105⤵PID:4264
-
\??\c:\hbbtnn.exec:\hbbtnn.exe106⤵PID:2400
-
\??\c:\5vvpj.exec:\5vvpj.exe107⤵PID:3464
-
\??\c:\fflxffr.exec:\fflxffr.exe108⤵PID:4916
-
\??\c:\rfllfxr.exec:\rfllfxr.exe109⤵PID:3968
-
\??\c:\hnnnht.exec:\hnnnht.exe110⤵PID:3300
-
\??\c:\pjdpj.exec:\pjdpj.exe111⤵PID:4460
-
\??\c:\pjvpv.exec:\pjvpv.exe112⤵PID:400
-
\??\c:\flxlxrf.exec:\flxlxrf.exe113⤵PID:3588
-
\??\c:\nbnbnt.exec:\nbnbnt.exe114⤵PID:1172
-
\??\c:\btbnbh.exec:\btbnbh.exe115⤵PID:4544
-
\??\c:\vjdpv.exec:\vjdpv.exe116⤵PID:4524
-
\??\c:\dpjvd.exec:\dpjvd.exe117⤵PID:5092
-
\??\c:\lxlxlxl.exec:\lxlxlxl.exe118⤵PID:2232
-
\??\c:\3tthnt.exec:\3tthnt.exe119⤵PID:540
-
\??\c:\ththtt.exec:\ththtt.exe120⤵PID:3020
-
\??\c:\pdpdp.exec:\pdpdp.exe121⤵PID:976
-
\??\c:\jddpv.exec:\jddpv.exe122⤵PID:5096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-