Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 23:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe
-
Size
455KB
-
MD5
283c9364bbff0bd00d26d2f288e1542e
-
SHA1
68e823a497f4682b40a4ab50ff23d7653c7d5783
-
SHA256
878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6
-
SHA512
1cdae995124ae1bbfbdc2b4610ed0032c2f98e96d3410d3917484190337d0b6945facf5b6c10304dc272758b9caa6675e351f181d2385d444532279dedaac56c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4260-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1184-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/416-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3288-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-661-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2568-683-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-859-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3788-909-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-988-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-1145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-1598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5064 jjpjd.exe 3764 dvpvj.exe 4740 fxffxxf.exe 3652 tnhbhh.exe 1716 thtbbh.exe 2300 nthhht.exe 2584 xrfxrrr.exe 2964 vdjdj.exe 3372 llrrxlf.exe 1184 ddppd.exe 2324 bhhhhh.exe 1060 ntttbb.exe 416 jdppp.exe 4320 3llrlxf.exe 876 xxlfrll.exe 4564 hbhbtt.exe 2428 llffflr.exe 3152 pjdjp.exe 4156 tnbhnb.exe 1416 xfrrrxf.exe 1868 djpdp.exe 4516 bbbhtn.exe 3448 bhnhnh.exe 4716 dvjdp.exe 3968 xrrlxxr.exe 2552 ddjjd.exe 4660 nhbnth.exe 1976 frrxxrr.exe 4108 dvvjd.exe 3288 xrrfxxf.exe 2712 ffrlrrr.exe 2564 hbbhtb.exe 1988 3rrrrrr.exe 1896 tbnnhh.exe 1580 jdppd.exe 940 pjpvv.exe 1676 5rrlfll.exe 4720 hhbhbh.exe 2872 1vjdv.exe 1036 rrxxxfl.exe 3920 5ttttb.exe 2172 pvdjp.exe 3064 ddddv.exe 2072 rlrxffx.exe 2028 3pjvj.exe 32 ppppp.exe 4804 frxxrxx.exe 4060 7tbbbh.exe 1384 vdvjv.exe 4460 htnhbh.exe 4768 htbtnt.exe 896 jpppv.exe 4064 lffflrl.exe 5112 tttttt.exe 956 ttbbbh.exe 2192 vdvvp.exe 4428 lrlfrrr.exe 1872 bthhhh.exe 2656 vjppv.exe 4448 1rflrxl.exe 4468 3bnttn.exe 3112 ddjjj.exe 2860 rlxxfxx.exe 2964 nbhthb.exe -
resource yara_rule behavioral2/memory/5064-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1184-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/416-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3288-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2568-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-859-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flllxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4260 wrote to memory of 5064 4260 878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe 82 PID 4260 wrote to memory of 5064 4260 878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe 82 PID 4260 wrote to memory of 5064 4260 878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe 82 PID 5064 wrote to memory of 3764 5064 jjpjd.exe 83 PID 5064 wrote to memory of 3764 5064 jjpjd.exe 83 PID 5064 wrote to memory of 3764 5064 jjpjd.exe 83 PID 3764 wrote to memory of 4740 3764 dvpvj.exe 84 PID 3764 wrote to memory of 4740 3764 dvpvj.exe 84 PID 3764 wrote to memory of 4740 3764 dvpvj.exe 84 PID 4740 wrote to memory of 3652 4740 fxffxxf.exe 85 PID 4740 wrote to memory of 3652 4740 fxffxxf.exe 85 PID 4740 wrote to memory of 3652 4740 fxffxxf.exe 85 PID 3652 wrote to memory of 1716 3652 tnhbhh.exe 86 PID 3652 wrote to memory of 1716 3652 tnhbhh.exe 86 PID 3652 wrote to memory of 1716 3652 tnhbhh.exe 86 PID 1716 wrote to memory of 2300 1716 thtbbh.exe 87 PID 1716 wrote to memory of 2300 1716 thtbbh.exe 87 PID 1716 wrote to memory of 2300 1716 thtbbh.exe 87 PID 2300 wrote to memory of 2584 2300 nthhht.exe 88 PID 2300 wrote to memory of 2584 2300 nthhht.exe 88 PID 2300 wrote to memory of 2584 2300 nthhht.exe 88 PID 2584 wrote to memory of 2964 2584 xrfxrrr.exe 89 PID 2584 wrote to memory of 2964 2584 xrfxrrr.exe 89 PID 2584 wrote to memory of 2964 2584 xrfxrrr.exe 89 PID 2964 wrote to memory of 3372 2964 vdjdj.exe 90 PID 2964 wrote to memory of 3372 2964 vdjdj.exe 90 PID 2964 wrote to memory of 3372 2964 vdjdj.exe 90 PID 3372 wrote to memory of 1184 3372 llrrxlf.exe 91 PID 3372 wrote to memory of 1184 3372 llrrxlf.exe 91 PID 3372 wrote to memory of 1184 3372 llrrxlf.exe 91 PID 1184 wrote to memory of 2324 1184 ddppd.exe 92 PID 1184 wrote to memory of 2324 1184 ddppd.exe 92 PID 1184 wrote to memory of 2324 1184 ddppd.exe 92 PID 2324 wrote to memory of 1060 2324 bhhhhh.exe 93 PID 2324 wrote to memory of 1060 2324 bhhhhh.exe 93 PID 2324 wrote to memory of 1060 2324 bhhhhh.exe 93 PID 1060 wrote to memory of 416 1060 ntttbb.exe 94 PID 1060 wrote to memory of 416 1060 ntttbb.exe 94 PID 1060 wrote to memory of 416 1060 ntttbb.exe 94 PID 416 wrote to memory of 4320 416 jdppp.exe 95 PID 416 wrote to memory of 4320 416 jdppp.exe 95 PID 416 wrote to memory of 4320 416 jdppp.exe 95 PID 4320 wrote to memory of 876 4320 3llrlxf.exe 96 PID 4320 wrote to memory of 876 4320 3llrlxf.exe 96 PID 4320 wrote to memory of 876 4320 3llrlxf.exe 96 PID 876 wrote to memory of 4564 876 xxlfrll.exe 97 PID 876 wrote to memory of 4564 876 xxlfrll.exe 97 PID 876 wrote to memory of 4564 876 xxlfrll.exe 97 PID 4564 wrote to memory of 2428 4564 hbhbtt.exe 98 PID 4564 wrote to memory of 2428 4564 hbhbtt.exe 98 PID 4564 wrote to memory of 2428 4564 hbhbtt.exe 98 PID 2428 wrote to memory of 3152 2428 llffflr.exe 99 PID 2428 wrote to memory of 3152 2428 llffflr.exe 99 PID 2428 wrote to memory of 3152 2428 llffflr.exe 99 PID 3152 wrote to memory of 4156 3152 pjdjp.exe 100 PID 3152 wrote to memory of 4156 3152 pjdjp.exe 100 PID 3152 wrote to memory of 4156 3152 pjdjp.exe 100 PID 4156 wrote to memory of 1416 4156 tnbhnb.exe 101 PID 4156 wrote to memory of 1416 4156 tnbhnb.exe 101 PID 4156 wrote to memory of 1416 4156 tnbhnb.exe 101 PID 1416 wrote to memory of 1868 1416 xfrrrxf.exe 102 PID 1416 wrote to memory of 1868 1416 xfrrrxf.exe 102 PID 1416 wrote to memory of 1868 1416 xfrrrxf.exe 102 PID 1868 wrote to memory of 4516 1868 djpdp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe"C:\Users\Admin\AppData\Local\Temp\878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\jjpjd.exec:\jjpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\dvpvj.exec:\dvpvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\fxffxxf.exec:\fxffxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\tnhbhh.exec:\tnhbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\thtbbh.exec:\thtbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\nthhht.exec:\nthhht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\xrfxrrr.exec:\xrfxrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\vdjdj.exec:\vdjdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\llrrxlf.exec:\llrrxlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\ddppd.exec:\ddppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\bhhhhh.exec:\bhhhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\ntttbb.exec:\ntttbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\jdppp.exec:\jdppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
\??\c:\3llrlxf.exec:\3llrlxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\xxlfrll.exec:\xxlfrll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\hbhbtt.exec:\hbhbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\llffflr.exec:\llffflr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\pjdjp.exec:\pjdjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\tnbhnb.exec:\tnbhnb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\xfrrrxf.exec:\xfrrrxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\djpdp.exec:\djpdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\bbbhtn.exec:\bbbhtn.exe23⤵
- Executes dropped EXE
PID:4516 -
\??\c:\bhnhnh.exec:\bhnhnh.exe24⤵
- Executes dropped EXE
PID:3448 -
\??\c:\dvjdp.exec:\dvjdp.exe25⤵
- Executes dropped EXE
PID:4716 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe26⤵
- Executes dropped EXE
PID:3968 -
\??\c:\ddjjd.exec:\ddjjd.exe27⤵
- Executes dropped EXE
PID:2552 -
\??\c:\nhbnth.exec:\nhbnth.exe28⤵
- Executes dropped EXE
PID:4660 -
\??\c:\frrxxrr.exec:\frrxxrr.exe29⤵
- Executes dropped EXE
PID:1976 -
\??\c:\dvvjd.exec:\dvvjd.exe30⤵
- Executes dropped EXE
PID:4108 -
\??\c:\xrrfxxf.exec:\xrrfxxf.exe31⤵
- Executes dropped EXE
PID:3288 -
\??\c:\ffrlrrr.exec:\ffrlrrr.exe32⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hbbhtb.exec:\hbbhtb.exe33⤵
- Executes dropped EXE
PID:2564 -
\??\c:\3rrrrrr.exec:\3rrrrrr.exe34⤵
- Executes dropped EXE
PID:1988 -
\??\c:\tbnnhh.exec:\tbnnhh.exe35⤵
- Executes dropped EXE
PID:1896 -
\??\c:\jdppd.exec:\jdppd.exe36⤵
- Executes dropped EXE
PID:1580 -
\??\c:\pjpvv.exec:\pjpvv.exe37⤵
- Executes dropped EXE
PID:940 -
\??\c:\5rrlfll.exec:\5rrlfll.exe38⤵
- Executes dropped EXE
PID:1676 -
\??\c:\hhbhbh.exec:\hhbhbh.exe39⤵
- Executes dropped EXE
PID:4720 -
\??\c:\1vjdv.exec:\1vjdv.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rrxxxfl.exec:\rrxxxfl.exe41⤵
- Executes dropped EXE
PID:1036 -
\??\c:\5ttttb.exec:\5ttttb.exe42⤵
- Executes dropped EXE
PID:3920 -
\??\c:\pvdjp.exec:\pvdjp.exe43⤵
- Executes dropped EXE
PID:2172 -
\??\c:\ddddv.exec:\ddddv.exe44⤵
- Executes dropped EXE
PID:3064 -
\??\c:\rlrxffx.exec:\rlrxffx.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2072 -
\??\c:\3pjvj.exec:\3pjvj.exe46⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ppppp.exec:\ppppp.exe47⤵
- Executes dropped EXE
PID:32 -
\??\c:\frxxrxx.exec:\frxxrxx.exe48⤵
- Executes dropped EXE
PID:4804 -
\??\c:\7tbbbh.exec:\7tbbbh.exe49⤵
- Executes dropped EXE
PID:4060 -
\??\c:\vdvjv.exec:\vdvjv.exe50⤵
- Executes dropped EXE
PID:1384 -
\??\c:\htnhbh.exec:\htnhbh.exe51⤵
- Executes dropped EXE
PID:4460 -
\??\c:\htbtnt.exec:\htbtnt.exe52⤵
- Executes dropped EXE
PID:4768 -
\??\c:\jpppv.exec:\jpppv.exe53⤵
- Executes dropped EXE
PID:896 -
\??\c:\lffflrl.exec:\lffflrl.exe54⤵
- Executes dropped EXE
PID:4064 -
\??\c:\tttttt.exec:\tttttt.exe55⤵
- Executes dropped EXE
PID:5112 -
\??\c:\ttbbbh.exec:\ttbbbh.exe56⤵
- Executes dropped EXE
PID:956 -
\??\c:\vdvvp.exec:\vdvvp.exe57⤵
- Executes dropped EXE
PID:2192 -
\??\c:\lrlfrrr.exec:\lrlfrrr.exe58⤵
- Executes dropped EXE
PID:4428 -
\??\c:\bthhhh.exec:\bthhhh.exe59⤵
- Executes dropped EXE
PID:1872 -
\??\c:\vjppv.exec:\vjppv.exe60⤵
- Executes dropped EXE
PID:2656 -
\??\c:\1rflrxl.exec:\1rflrxl.exe61⤵
- Executes dropped EXE
PID:4448 -
\??\c:\3bnttn.exec:\3bnttn.exe62⤵
- Executes dropped EXE
PID:4468 -
\??\c:\ddjjj.exec:\ddjjj.exe63⤵
- Executes dropped EXE
PID:3112 -
\??\c:\rlxxfxx.exec:\rlxxfxx.exe64⤵
- Executes dropped EXE
PID:2860 -
\??\c:\nbhthb.exec:\nbhthb.exe65⤵
- Executes dropped EXE
PID:2964 -
\??\c:\jdddj.exec:\jdddj.exe66⤵PID:2520
-
\??\c:\xfrrxlr.exec:\xfrrxlr.exe67⤵PID:2408
-
\??\c:\hnhhtt.exec:\hnhhtt.exe68⤵PID:4664
-
\??\c:\dpvvp.exec:\dpvvp.exe69⤵PID:2404
-
\??\c:\ddjdd.exec:\ddjdd.exe70⤵PID:3844
-
\??\c:\ffffxff.exec:\ffffxff.exe71⤵PID:2228
-
\??\c:\tbnnnt.exec:\tbnnnt.exe72⤵PID:2088
-
\??\c:\7vvpj.exec:\7vvpj.exe73⤵PID:1080
-
\??\c:\llfxlll.exec:\llfxlll.exe74⤵PID:4928
-
\??\c:\nbhbbn.exec:\nbhbbn.exe75⤵PID:3012
-
\??\c:\dpjvv.exec:\dpjvv.exe76⤵PID:3848
-
\??\c:\1ffxllf.exec:\1ffxllf.exe77⤵PID:4876
-
\??\c:\tttnnn.exec:\tttnnn.exe78⤵PID:4340
-
\??\c:\dddvp.exec:\dddvp.exe79⤵PID:1828
-
\??\c:\lffllrl.exec:\lffllrl.exe80⤵PID:3444
-
\??\c:\btbtnn.exec:\btbtnn.exe81⤵PID:2336
-
\??\c:\vppjv.exec:\vppjv.exe82⤵PID:796
-
\??\c:\7ffrrrr.exec:\7ffrrrr.exe83⤵PID:1084
-
\??\c:\xlrlrrr.exec:\xlrlrrr.exe84⤵PID:2900
-
\??\c:\nnhhnn.exec:\nnhhnn.exe85⤵PID:4852
-
\??\c:\jjpdv.exec:\jjpdv.exe86⤵PID:3304
-
\??\c:\fflxrxx.exec:\fflxrxx.exe87⤵PID:2080
-
\??\c:\rfllfff.exec:\rfllfff.exe88⤵PID:3684
-
\??\c:\bthnnn.exec:\bthnnn.exe89⤵PID:3984
-
\??\c:\pdvvp.exec:\pdvvp.exe90⤵PID:4532
-
\??\c:\llllllr.exec:\llllllr.exe91⤵PID:2128
-
\??\c:\3nthhn.exec:\3nthhn.exe92⤵PID:4444
-
\??\c:\9pddv.exec:\9pddv.exe93⤵PID:2716
-
\??\c:\fxfffff.exec:\fxfffff.exe94⤵PID:2412
-
\??\c:\tbntnt.exec:\tbntnt.exe95⤵PID:3256
-
\??\c:\vvppp.exec:\vvppp.exe96⤵PID:4220
-
\??\c:\ffxlffx.exec:\ffxlffx.exe97⤵PID:64
-
\??\c:\hbhbtt.exec:\hbhbtt.exe98⤵PID:4272
-
\??\c:\3bhbbh.exec:\3bhbbh.exe99⤵PID:1956
-
\??\c:\5pvpj.exec:\5pvpj.exe100⤵PID:2004
-
\??\c:\ffrrlxx.exec:\ffrrlxx.exe101⤵PID:5080
-
\??\c:\7ntntt.exec:\7ntntt.exe102⤵PID:3836
-
\??\c:\dvjdp.exec:\dvjdp.exe103⤵PID:4056
-
\??\c:\xxxllxx.exec:\xxxllxx.exe104⤵PID:4912
-
\??\c:\hbnnnt.exec:\hbnnnt.exe105⤵PID:1368
-
\??\c:\9vjjp.exec:\9vjjp.exe106⤵PID:2688
-
\??\c:\dpdjd.exec:\dpdjd.exe107⤵PID:2172
-
\??\c:\llllrrr.exec:\llllrrr.exe108⤵PID:3064
-
\??\c:\nnnnnt.exec:\nnnnnt.exe109⤵PID:1032
-
\??\c:\vvppj.exec:\vvppj.exe110⤵PID:4748
-
\??\c:\llrrrxf.exec:\llrrrxf.exe111⤵PID:704
-
\??\c:\hhhtnt.exec:\hhhtnt.exe112⤵PID:2176
-
\??\c:\ttttnn.exec:\ttttnn.exe113⤵PID:1916
-
\??\c:\ddppp.exec:\ddppp.exe114⤵PID:4404
-
\??\c:\lxxffll.exec:\lxxffll.exe115⤵PID:5096
-
\??\c:\bbbhnn.exec:\bbbhnn.exe116⤵PID:4768
-
\??\c:\9ppjj.exec:\9ppjj.exe117⤵PID:3680
-
\??\c:\ddppd.exec:\ddppd.exe118⤵PID:4620
-
\??\c:\rxlrxxx.exec:\rxlrxxx.exe119⤵PID:5112
-
\??\c:\hntnbb.exec:\hntnbb.exe120⤵PID:1936
-
\??\c:\djjjj.exec:\djjjj.exe121⤵PID:2968
-
\??\c:\llffxxx.exec:\llffxxx.exe122⤵PID:4556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-