Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 09:20
Behavioral task
behavioral1
Sample
78fe7f44e720704e83d60aa3de20e97899f26939f833d7ac2365b9ad31322806.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
78fe7f44e720704e83d60aa3de20e97899f26939f833d7ac2365b9ad31322806.exe
-
Size
65KB
-
MD5
1d153d2c1756575f601e7bc0ef323e57
-
SHA1
7537b663257b3376e984bd6cf1d2bfa4186b03ab
-
SHA256
78fe7f44e720704e83d60aa3de20e97899f26939f833d7ac2365b9ad31322806
-
SHA512
7350142b190bc763ad1c71d888099abd0a40cf53605285cadaa43d8588ad00557e8a521f809f4406b8fb2b78ab655c6d3a95170159df42c675af319e6f792abe
-
SSDEEP
1536:tvQBeOGtrYS3srx93UBWfwC6Ggnouy8gA2l5CcSgui36:thOmTsF93UYfwC6GIoutgVocSr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4592-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4620-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1372-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1996-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/788-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3424-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2464-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4160-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3856-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4652-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2880-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3752-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1572-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4172-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4808-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/720-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3392-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1620-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1564-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3688-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3324-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/984-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4184-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1052-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2000-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2168-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3648-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3320-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1140-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/536-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1116-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3116-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1964-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1848-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2680-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/688-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/732-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2424-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1932-617-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-627-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1876-712-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-716-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4184-849-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-874-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2468-876-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3664-957-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4620 jjppv.exe 5104 dvdvp.exe 3448 flxxxff.exe 1372 rrlfxrf.exe 1996 ttnnbb.exe 788 jdvpp.exe 3424 rxflflf.exe 2464 1llxrlf.exe 4160 3tbhhh.exe 3856 jjjvj.exe 1604 dpvvj.exe 3552 rrffxxx.exe 4100 hhbbtt.exe 3432 hhhbbb.exe 4388 1pjdv.exe 4652 9xlfllr.exe 2880 bhhhnt.exe 464 hntnhh.exe 3752 vpjdv.exe 2272 frrlfxx.exe 1572 9rlllfx.exe 4172 nbbtht.exe 4808 3hnbhb.exe 720 3vvpv.exe 2928 rxxflxr.exe 4940 jpjdd.exe 3392 dvjdj.exe 1620 rlxlxrl.exe 1168 ddvjp.exe 1424 jpjvv.exe 1104 rlffrrf.exe 1564 hbnhbt.exe 3688 jvvpj.exe 3324 pdvjd.exe 984 lrxlrlx.exe 3428 btbttn.exe 3064 pjvpj.exe 4184 7vjdv.exe 4832 llxxlfr.exe 2280 lllxllf.exe 2140 bnnhbb.exe 2588 btnbbt.exe 1052 1jdvv.exe 396 jdjvj.exe 3088 7rrflff.exe 2468 xxrlfxl.exe 4496 7nnbtn.exe 2644 bnnbbn.exe 2304 jvjvp.exe 4256 1ddpv.exe 2020 rxfxrrf.exe 2000 1bhtnb.exe 2168 nhhbhb.exe 4524 dpdpj.exe 868 pdvjd.exe 1420 llxrfxl.exe 2712 bhhtnh.exe 3648 hbhthn.exe 5092 hbtnnh.exe 4312 jdpdv.exe 3604 lffrlff.exe 3320 frlfrxr.exe 1140 nhbthb.exe 772 pppdd.exe -
resource yara_rule behavioral2/memory/4592-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023c0f-3.dat upx behavioral2/memory/4592-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb6-8.dat upx behavioral2/memory/5104-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4620-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb7-12.dat upx behavioral2/files/0x0007000000023cb8-22.dat upx behavioral2/memory/3448-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb9-26.dat upx behavioral2/memory/1372-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cba-32.dat upx behavioral2/memory/1996-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/788-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbb-37.dat upx behavioral2/files/0x0007000000023cbc-42.dat upx behavioral2/memory/3424-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2464-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbd-48.dat upx behavioral2/files/0x0007000000023cbe-54.dat upx behavioral2/memory/4160-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbf-58.dat upx behavioral2/memory/3856-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc0-64.dat upx behavioral2/files/0x0007000000023cc1-70.dat upx behavioral2/files/0x0007000000023cc2-75.dat upx behavioral2/files/0x0007000000023cc3-79.dat upx behavioral2/memory/3432-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc4-86.dat upx behavioral2/memory/4652-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc5-92.dat upx behavioral2/files/0x0007000000023cc6-96.dat upx behavioral2/memory/2880-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc7-102.dat upx behavioral2/memory/464-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc8-110.dat upx behavioral2/memory/3752-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cca-114.dat upx behavioral2/memory/2272-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccb-121.dat upx behavioral2/memory/1572-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4172-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccc-128.dat upx behavioral2/files/0x0007000000023ccd-134.dat upx behavioral2/memory/4808-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/720-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cce-139.dat upx behavioral2/files/0x0007000000023ccf-145.dat upx behavioral2/memory/4940-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd0-152.dat upx behavioral2/memory/3392-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd1-157.dat upx behavioral2/memory/1620-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd2-163.dat upx behavioral2/memory/1168-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023cb3-168.dat upx behavioral2/memory/1424-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd3-175.dat upx behavioral2/files/0x0007000000023cd4-179.dat upx behavioral2/memory/1564-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3688-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3324-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/984-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3428-199-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4592 wrote to memory of 4620 4592 78fe7f44e720704e83d60aa3de20e97899f26939f833d7ac2365b9ad31322806.exe 82 PID 4592 wrote to memory of 4620 4592 78fe7f44e720704e83d60aa3de20e97899f26939f833d7ac2365b9ad31322806.exe 82 PID 4592 wrote to memory of 4620 4592 78fe7f44e720704e83d60aa3de20e97899f26939f833d7ac2365b9ad31322806.exe 82 PID 4620 wrote to memory of 5104 4620 jjppv.exe 83 PID 4620 wrote to memory of 5104 4620 jjppv.exe 83 PID 4620 wrote to memory of 5104 4620 jjppv.exe 83 PID 5104 wrote to memory of 3448 5104 dvdvp.exe 84 PID 5104 wrote to memory of 3448 5104 dvdvp.exe 84 PID 5104 wrote to memory of 3448 5104 dvdvp.exe 84 PID 3448 wrote to memory of 1372 3448 flxxxff.exe 85 PID 3448 wrote to memory of 1372 3448 flxxxff.exe 85 PID 3448 wrote to memory of 1372 3448 flxxxff.exe 85 PID 1372 wrote to memory of 1996 1372 rrlfxrf.exe 86 PID 1372 wrote to memory of 1996 1372 rrlfxrf.exe 86 PID 1372 wrote to memory of 1996 1372 rrlfxrf.exe 86 PID 1996 wrote to memory of 788 1996 ttnnbb.exe 87 PID 1996 wrote to memory of 788 1996 ttnnbb.exe 87 PID 1996 wrote to memory of 788 1996 ttnnbb.exe 87 PID 788 wrote to memory of 3424 788 jdvpp.exe 88 PID 788 wrote to memory of 3424 788 jdvpp.exe 88 PID 788 wrote to memory of 3424 788 jdvpp.exe 88 PID 3424 wrote to memory of 2464 3424 rxflflf.exe 89 PID 3424 wrote to memory of 2464 3424 rxflflf.exe 89 PID 3424 wrote to memory of 2464 3424 rxflflf.exe 89 PID 2464 wrote to memory of 4160 2464 1llxrlf.exe 90 PID 2464 wrote to memory of 4160 2464 1llxrlf.exe 90 PID 2464 wrote to memory of 4160 2464 1llxrlf.exe 90 PID 4160 wrote to memory of 3856 4160 3tbhhh.exe 91 PID 4160 wrote to memory of 3856 4160 3tbhhh.exe 91 PID 4160 wrote to memory of 3856 4160 3tbhhh.exe 91 PID 3856 wrote to memory of 1604 3856 jjjvj.exe 92 PID 3856 wrote to memory of 1604 3856 jjjvj.exe 92 PID 3856 wrote to memory of 1604 3856 jjjvj.exe 92 PID 1604 wrote to memory of 3552 1604 dpvvj.exe 93 PID 1604 wrote to memory of 3552 1604 dpvvj.exe 93 PID 1604 wrote to memory of 3552 1604 dpvvj.exe 93 PID 3552 wrote to memory of 4100 3552 rrffxxx.exe 94 PID 3552 wrote to memory of 4100 3552 rrffxxx.exe 94 PID 3552 wrote to memory of 4100 3552 rrffxxx.exe 94 PID 4100 wrote to memory of 3432 4100 hhbbtt.exe 95 PID 4100 wrote to memory of 3432 4100 hhbbtt.exe 95 PID 4100 wrote to memory of 3432 4100 hhbbtt.exe 95 PID 3432 wrote to memory of 4388 3432 hhhbbb.exe 96 PID 3432 wrote to memory of 4388 3432 hhhbbb.exe 96 PID 3432 wrote to memory of 4388 3432 hhhbbb.exe 96 PID 4388 wrote to memory of 4652 4388 1pjdv.exe 97 PID 4388 wrote to memory of 4652 4388 1pjdv.exe 97 PID 4388 wrote to memory of 4652 4388 1pjdv.exe 97 PID 4652 wrote to memory of 2880 4652 9xlfllr.exe 98 PID 4652 wrote to memory of 2880 4652 9xlfllr.exe 98 PID 4652 wrote to memory of 2880 4652 9xlfllr.exe 98 PID 2880 wrote to memory of 464 2880 bhhhnt.exe 99 PID 2880 wrote to memory of 464 2880 bhhhnt.exe 99 PID 2880 wrote to memory of 464 2880 bhhhnt.exe 99 PID 464 wrote to memory of 3752 464 hntnhh.exe 100 PID 464 wrote to memory of 3752 464 hntnhh.exe 100 PID 464 wrote to memory of 3752 464 hntnhh.exe 100 PID 3752 wrote to memory of 2272 3752 vpjdv.exe 101 PID 3752 wrote to memory of 2272 3752 vpjdv.exe 101 PID 3752 wrote to memory of 2272 3752 vpjdv.exe 101 PID 2272 wrote to memory of 1572 2272 frrlfxx.exe 102 PID 2272 wrote to memory of 1572 2272 frrlfxx.exe 102 PID 2272 wrote to memory of 1572 2272 frrlfxx.exe 102 PID 1572 wrote to memory of 4172 1572 9rlllfx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\78fe7f44e720704e83d60aa3de20e97899f26939f833d7ac2365b9ad31322806.exe"C:\Users\Admin\AppData\Local\Temp\78fe7f44e720704e83d60aa3de20e97899f26939f833d7ac2365b9ad31322806.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\jjppv.exec:\jjppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\dvdvp.exec:\dvdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\flxxxff.exec:\flxxxff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\rrlfxrf.exec:\rrlfxrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\ttnnbb.exec:\ttnnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\jdvpp.exec:\jdvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\rxflflf.exec:\rxflflf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\1llxrlf.exec:\1llxrlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\3tbhhh.exec:\3tbhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\jjjvj.exec:\jjjvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\dpvvj.exec:\dpvvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\rrffxxx.exec:\rrffxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\hhbbtt.exec:\hhbbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\hhhbbb.exec:\hhhbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\1pjdv.exec:\1pjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\9xlfllr.exec:\9xlfllr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\bhhhnt.exec:\bhhhnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\hntnhh.exec:\hntnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\vpjdv.exec:\vpjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\frrlfxx.exec:\frrlfxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\9rlllfx.exec:\9rlllfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\nbbtht.exec:\nbbtht.exe23⤵
- Executes dropped EXE
PID:4172 -
\??\c:\3hnbhb.exec:\3hnbhb.exe24⤵
- Executes dropped EXE
PID:4808 -
\??\c:\3vvpv.exec:\3vvpv.exe25⤵
- Executes dropped EXE
PID:720 -
\??\c:\rxxflxr.exec:\rxxflxr.exe26⤵
- Executes dropped EXE
PID:2928 -
\??\c:\jpjdd.exec:\jpjdd.exe27⤵
- Executes dropped EXE
PID:4940 -
\??\c:\dvjdj.exec:\dvjdj.exe28⤵
- Executes dropped EXE
PID:3392 -
\??\c:\rlxlxrl.exec:\rlxlxrl.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1620 -
\??\c:\ddvjp.exec:\ddvjp.exe30⤵
- Executes dropped EXE
PID:1168 -
\??\c:\jpjvv.exec:\jpjvv.exe31⤵
- Executes dropped EXE
PID:1424 -
\??\c:\rlffrrf.exec:\rlffrrf.exe32⤵
- Executes dropped EXE
PID:1104 -
\??\c:\hbnhbt.exec:\hbnhbt.exe33⤵
- Executes dropped EXE
PID:1564 -
\??\c:\jvvpj.exec:\jvvpj.exe34⤵
- Executes dropped EXE
PID:3688 -
\??\c:\pdvjd.exec:\pdvjd.exe35⤵
- Executes dropped EXE
PID:3324 -
\??\c:\lrxlrlx.exec:\lrxlrlx.exe36⤵
- Executes dropped EXE
PID:984 -
\??\c:\btbttn.exec:\btbttn.exe37⤵
- Executes dropped EXE
PID:3428 -
\??\c:\pjvpj.exec:\pjvpj.exe38⤵
- Executes dropped EXE
PID:3064 -
\??\c:\7vjdv.exec:\7vjdv.exe39⤵
- Executes dropped EXE
PID:4184 -
\??\c:\llxxlfr.exec:\llxxlfr.exe40⤵
- Executes dropped EXE
PID:4832 -
\??\c:\lllxllf.exec:\lllxllf.exe41⤵
- Executes dropped EXE
PID:2280 -
\??\c:\bnnhbb.exec:\bnnhbb.exe42⤵
- Executes dropped EXE
PID:2140 -
\??\c:\btnbbt.exec:\btnbbt.exe43⤵
- Executes dropped EXE
PID:2588 -
\??\c:\1jdvv.exec:\1jdvv.exe44⤵
- Executes dropped EXE
PID:1052 -
\??\c:\jdjvj.exec:\jdjvj.exe45⤵
- Executes dropped EXE
PID:396 -
\??\c:\7rrflff.exec:\7rrflff.exe46⤵
- Executes dropped EXE
PID:3088 -
\??\c:\xxrlfxl.exec:\xxrlfxl.exe47⤵
- Executes dropped EXE
PID:2468 -
\??\c:\7nnbtn.exec:\7nnbtn.exe48⤵
- Executes dropped EXE
PID:4496 -
\??\c:\bnnbbn.exec:\bnnbbn.exe49⤵
- Executes dropped EXE
PID:2644 -
\??\c:\jvjvp.exec:\jvjvp.exe50⤵
- Executes dropped EXE
PID:2304 -
\??\c:\1ddpv.exec:\1ddpv.exe51⤵
- Executes dropped EXE
PID:4256 -
\??\c:\rxfxrrf.exec:\rxfxrrf.exe52⤵
- Executes dropped EXE
PID:2020 -
\??\c:\1bhtnb.exec:\1bhtnb.exe53⤵
- Executes dropped EXE
PID:2000 -
\??\c:\nhhbhb.exec:\nhhbhb.exe54⤵
- Executes dropped EXE
PID:2168 -
\??\c:\dpdpj.exec:\dpdpj.exe55⤵
- Executes dropped EXE
PID:4524 -
\??\c:\pdvjd.exec:\pdvjd.exe56⤵
- Executes dropped EXE
PID:868 -
\??\c:\llxrfxl.exec:\llxrfxl.exe57⤵
- Executes dropped EXE
PID:1420 -
\??\c:\bhhtnh.exec:\bhhtnh.exe58⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hbhthn.exec:\hbhthn.exe59⤵
- Executes dropped EXE
PID:3648 -
\??\c:\hbtnnh.exec:\hbtnnh.exe60⤵
- Executes dropped EXE
PID:5092 -
\??\c:\jdpdv.exec:\jdpdv.exe61⤵
- Executes dropped EXE
PID:4312 -
\??\c:\lffrlff.exec:\lffrlff.exe62⤵
- Executes dropped EXE
PID:3604 -
\??\c:\frlfrxr.exec:\frlfrxr.exe63⤵
- Executes dropped EXE
PID:3320 -
\??\c:\nhbthb.exec:\nhbthb.exe64⤵
- Executes dropped EXE
PID:1140 -
\??\c:\pppdd.exec:\pppdd.exe65⤵
- Executes dropped EXE
PID:772 -
\??\c:\dvdvp.exec:\dvdvp.exe66⤵PID:876
-
\??\c:\3ppdp.exec:\3ppdp.exe67⤵PID:4428
-
\??\c:\rllffxx.exec:\rllffxx.exe68⤵PID:2460
-
\??\c:\nnhttn.exec:\nnhttn.exe69⤵PID:1880
-
\??\c:\3bbthb.exec:\3bbthb.exe70⤵PID:3368
-
\??\c:\jdjdp.exec:\jdjdp.exe71⤵PID:1196
-
\??\c:\vpjvd.exec:\vpjvd.exe72⤵PID:4696
-
\??\c:\lfrflfr.exec:\lfrflfr.exe73⤵PID:728
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe74⤵PID:4084
-
\??\c:\xrfxrfx.exec:\xrfxrfx.exe75⤵PID:1088
-
\??\c:\nttnbt.exec:\nttnbt.exe76⤵PID:760
-
\??\c:\nbbtnh.exec:\nbbtnh.exe77⤵PID:700
-
\??\c:\jpppd.exec:\jpppd.exe78⤵PID:636
-
\??\c:\vpjdp.exec:\vpjdp.exe79⤵PID:2880
-
\??\c:\xrxlrlr.exec:\xrxlrlr.exe80⤵PID:536
-
\??\c:\fffrllf.exec:\fffrllf.exe81⤵PID:1116
-
\??\c:\tbbthb.exec:\tbbthb.exe82⤵PID:3180
-
\??\c:\tnbtnh.exec:\tnbtnh.exe83⤵PID:3008
-
\??\c:\ntbthb.exec:\ntbthb.exe84⤵PID:1308
-
\??\c:\vppvj.exec:\vppvj.exe85⤵PID:4920
-
\??\c:\xrlxlfr.exec:\xrlxlfr.exe86⤵PID:3116
-
\??\c:\fxxrrlr.exec:\fxxrrlr.exe87⤵PID:4568
-
\??\c:\nhnhhb.exec:\nhnhhb.exe88⤵PID:2820
-
\??\c:\bhbtbb.exec:\bhbtbb.exe89⤵PID:1964
-
\??\c:\tnhthb.exec:\tnhthb.exe90⤵PID:3164
-
\??\c:\1dpjp.exec:\1dpjp.exe91⤵PID:3668
-
\??\c:\3dvpd.exec:\3dvpd.exe92⤵PID:4940
-
\??\c:\xxrrxfl.exec:\xxrrxfl.exe93⤵PID:3392
-
\??\c:\fffxlfx.exec:\fffxlfx.exe94⤵PID:1848
-
\??\c:\5tbtth.exec:\5tbtth.exe95⤵PID:448
-
\??\c:\jjvpv.exec:\jjvpv.exe96⤵PID:1316
-
\??\c:\dvppp.exec:\dvppp.exe97⤵PID:3316
-
\??\c:\rfxlxrf.exec:\rfxlxrf.exe98⤵PID:2680
-
\??\c:\rxfxlfx.exec:\rxfxlfx.exe99⤵PID:2624
-
\??\c:\xfxrffr.exec:\xfxrffr.exe100⤵PID:688
-
\??\c:\nbbtnh.exec:\nbbtnh.exe101⤵PID:732
-
\??\c:\dvdvp.exec:\dvdvp.exe102⤵PID:1152
-
\??\c:\dppdp.exec:\dppdp.exe103⤵PID:4444
-
\??\c:\rrrlxrl.exec:\rrrlxrl.exe104⤵PID:5056
-
\??\c:\ffrfxrr.exec:\ffrfxrr.exe105⤵PID:1708
-
\??\c:\9hhbtn.exec:\9hhbtn.exe106⤵
- System Location Discovery: System Language Discovery
PID:3064 -
\??\c:\vddvj.exec:\vddvj.exe107⤵PID:2120
-
\??\c:\pvpdd.exec:\pvpdd.exe108⤵PID:4192
-
\??\c:\xxrlxrf.exec:\xxrlxrf.exe109⤵PID:2280
-
\??\c:\7xffxrf.exec:\7xffxrf.exe110⤵PID:2196
-
\??\c:\ntnhnb.exec:\ntnhnb.exe111⤵PID:3228
-
\??\c:\thhbhh.exec:\thhbhh.exe112⤵PID:2344
-
\??\c:\dvjdj.exec:\dvjdj.exe113⤵PID:4076
-
\??\c:\7jpdp.exec:\7jpdp.exe114⤵PID:4500
-
\??\c:\fxrfrlr.exec:\fxrfrlr.exe115⤵PID:2308
-
\??\c:\tbbbbb.exec:\tbbbbb.exe116⤵PID:4612
-
\??\c:\nhbtnh.exec:\nhbtnh.exe117⤵PID:2424
-
\??\c:\pvpjv.exec:\pvpjv.exe118⤵PID:5068
-
\??\c:\pdjvp.exec:\pdjvp.exe119⤵PID:4720
-
\??\c:\xlflxrl.exec:\xlflxrl.exe120⤵PID:1740
-
\??\c:\1lfxllf.exec:\1lfxllf.exe121⤵PID:3636
-
\??\c:\nhhbnt.exec:\nhhbnt.exe122⤵PID:3436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-