Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 23:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9dcc3d297ccd4eb0c90cfc4902d189cd91c13e29e080e49ecd21b459a5fe927cN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9dcc3d297ccd4eb0c90cfc4902d189cd91c13e29e080e49ecd21b459a5fe927cN.exe
-
Size
454KB
-
MD5
1c71a78ac7790ed0e6520d3d31c1d000
-
SHA1
a48ec9a554f249112d2c45cdd125a555c6a2ddaa
-
SHA256
9dcc3d297ccd4eb0c90cfc4902d189cd91c13e29e080e49ecd21b459a5fe927c
-
SHA512
d2c8d71ea29e98704f675d8c24b581700744a83e7b007f5a0c4c6c037616aa5e7650d6778b79581ae5c78c120ae7bf2388270f1800d2e1be2cea839b731cddfa
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbef:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3808-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2092-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2092-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/936-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/756-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-711-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-884-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-1163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4736 jjpvv.exe 3808 fffffxr.exe 4916 xrllffx.exe 1048 7hhtbb.exe 4124 rrllrxf.exe 3676 pvvvp.exe 3708 nnhnnt.exe 5084 jjjjd.exe 2096 5vdvp.exe 2092 xfffxrl.exe 116 bbtntt.exe 2816 rrrfxrl.exe 4680 lrfxlrr.exe 3664 7jpjp.exe 1864 3flflxr.exe 3172 jpvpj.exe 4184 btbbtn.exe 2200 ddjdd.exe 4856 vvvpj.exe 1308 xfllfll.exe 2556 nthnnb.exe 3548 dvdvp.exe 1896 7ntnnn.exe 3712 xlxrffl.exe 4424 hnbnhh.exe 3100 xfrlfxr.exe 2928 bhhbtn.exe 3532 jvjpj.exe 1656 lflfllf.exe 2912 hnnhbh.exe 3376 httnhb.exe 4164 1xfrlrx.exe 3608 rllffxx.exe 2616 7hnbtn.exe 3236 jvdvd.exe 4744 fflffxx.exe 3656 bnnbhb.exe 2652 7djdv.exe 936 1ffxxfx.exe 1892 dvdvv.exe 756 7nbbtn.exe 4176 pjjvp.exe 2332 5lllxxl.exe 2884 hnthhh.exe 1028 vppjv.exe 3952 rxxlfxl.exe 3504 thhtnh.exe 4384 5bbthh.exe 3408 7vvdj.exe 1968 lrrlllx.exe 5012 thtnbt.exe 4992 dpppd.exe 4728 fxrrfxr.exe 4092 fxfxxrr.exe 1048 9jvjd.exe 264 1lxrllx.exe 4048 lxlffrl.exe 1888 bbbttt.exe 3188 djjdv.exe 2684 lrfflrx.exe 376 ttbttb.exe 3564 5vdvv.exe 512 fxrxrrx.exe 1756 nhtnhh.exe -
resource yara_rule behavioral2/memory/4736-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2092-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/936-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-711-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3btnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlfrrx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 868 wrote to memory of 4736 868 9dcc3d297ccd4eb0c90cfc4902d189cd91c13e29e080e49ecd21b459a5fe927cN.exe 83 PID 868 wrote to memory of 4736 868 9dcc3d297ccd4eb0c90cfc4902d189cd91c13e29e080e49ecd21b459a5fe927cN.exe 83 PID 868 wrote to memory of 4736 868 9dcc3d297ccd4eb0c90cfc4902d189cd91c13e29e080e49ecd21b459a5fe927cN.exe 83 PID 4736 wrote to memory of 3808 4736 jjpvv.exe 84 PID 4736 wrote to memory of 3808 4736 jjpvv.exe 84 PID 4736 wrote to memory of 3808 4736 jjpvv.exe 84 PID 3808 wrote to memory of 4916 3808 fffffxr.exe 85 PID 3808 wrote to memory of 4916 3808 fffffxr.exe 85 PID 3808 wrote to memory of 4916 3808 fffffxr.exe 85 PID 4916 wrote to memory of 1048 4916 xrllffx.exe 86 PID 4916 wrote to memory of 1048 4916 xrllffx.exe 86 PID 4916 wrote to memory of 1048 4916 xrllffx.exe 86 PID 1048 wrote to memory of 4124 1048 7hhtbb.exe 87 PID 1048 wrote to memory of 4124 1048 7hhtbb.exe 87 PID 1048 wrote to memory of 4124 1048 7hhtbb.exe 87 PID 4124 wrote to memory of 3676 4124 rrllrxf.exe 88 PID 4124 wrote to memory of 3676 4124 rrllrxf.exe 88 PID 4124 wrote to memory of 3676 4124 rrllrxf.exe 88 PID 3676 wrote to memory of 3708 3676 pvvvp.exe 89 PID 3676 wrote to memory of 3708 3676 pvvvp.exe 89 PID 3676 wrote to memory of 3708 3676 pvvvp.exe 89 PID 3708 wrote to memory of 5084 3708 nnhnnt.exe 90 PID 3708 wrote to memory of 5084 3708 nnhnnt.exe 90 PID 3708 wrote to memory of 5084 3708 nnhnnt.exe 90 PID 5084 wrote to memory of 2096 5084 jjjjd.exe 91 PID 5084 wrote to memory of 2096 5084 jjjjd.exe 91 PID 5084 wrote to memory of 2096 5084 jjjjd.exe 91 PID 2096 wrote to memory of 2092 2096 5vdvp.exe 92 PID 2096 wrote to memory of 2092 2096 5vdvp.exe 92 PID 2096 wrote to memory of 2092 2096 5vdvp.exe 92 PID 2092 wrote to memory of 116 2092 xfffxrl.exe 93 PID 2092 wrote to memory of 116 2092 xfffxrl.exe 93 PID 2092 wrote to memory of 116 2092 xfffxrl.exe 93 PID 116 wrote to memory of 2816 116 bbtntt.exe 94 PID 116 wrote to memory of 2816 116 bbtntt.exe 94 PID 116 wrote to memory of 2816 116 bbtntt.exe 94 PID 2816 wrote to memory of 4680 2816 rrrfxrl.exe 95 PID 2816 wrote to memory of 4680 2816 rrrfxrl.exe 95 PID 2816 wrote to memory of 4680 2816 rrrfxrl.exe 95 PID 4680 wrote to memory of 3664 4680 lrfxlrr.exe 96 PID 4680 wrote to memory of 3664 4680 lrfxlrr.exe 96 PID 4680 wrote to memory of 3664 4680 lrfxlrr.exe 96 PID 3664 wrote to memory of 1864 3664 7jpjp.exe 97 PID 3664 wrote to memory of 1864 3664 7jpjp.exe 97 PID 3664 wrote to memory of 1864 3664 7jpjp.exe 97 PID 1864 wrote to memory of 3172 1864 3flflxr.exe 98 PID 1864 wrote to memory of 3172 1864 3flflxr.exe 98 PID 1864 wrote to memory of 3172 1864 3flflxr.exe 98 PID 3172 wrote to memory of 4184 3172 jpvpj.exe 99 PID 3172 wrote to memory of 4184 3172 jpvpj.exe 99 PID 3172 wrote to memory of 4184 3172 jpvpj.exe 99 PID 4184 wrote to memory of 2200 4184 btbbtn.exe 100 PID 4184 wrote to memory of 2200 4184 btbbtn.exe 100 PID 4184 wrote to memory of 2200 4184 btbbtn.exe 100 PID 2200 wrote to memory of 4856 2200 ddjdd.exe 101 PID 2200 wrote to memory of 4856 2200 ddjdd.exe 101 PID 2200 wrote to memory of 4856 2200 ddjdd.exe 101 PID 4856 wrote to memory of 1308 4856 vvvpj.exe 102 PID 4856 wrote to memory of 1308 4856 vvvpj.exe 102 PID 4856 wrote to memory of 1308 4856 vvvpj.exe 102 PID 1308 wrote to memory of 2556 1308 xfllfll.exe 103 PID 1308 wrote to memory of 2556 1308 xfllfll.exe 103 PID 1308 wrote to memory of 2556 1308 xfllfll.exe 103 PID 2556 wrote to memory of 3548 2556 nthnnb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dcc3d297ccd4eb0c90cfc4902d189cd91c13e29e080e49ecd21b459a5fe927cN.exe"C:\Users\Admin\AppData\Local\Temp\9dcc3d297ccd4eb0c90cfc4902d189cd91c13e29e080e49ecd21b459a5fe927cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\jjpvv.exec:\jjpvv.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\fffffxr.exec:\fffffxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\xrllffx.exec:\xrllffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\7hhtbb.exec:\7hhtbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\rrllrxf.exec:\rrllrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\pvvvp.exec:\pvvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\nnhnnt.exec:\nnhnnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\jjjjd.exec:\jjjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\5vdvp.exec:\5vdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\xfffxrl.exec:\xfffxrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\bbtntt.exec:\bbtntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\rrrfxrl.exec:\rrrfxrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\lrfxlrr.exec:\lrfxlrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\7jpjp.exec:\7jpjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\3flflxr.exec:\3flflxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\jpvpj.exec:\jpvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\btbbtn.exec:\btbbtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\ddjdd.exec:\ddjdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\vvvpj.exec:\vvvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\xfllfll.exec:\xfllfll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\nthnnb.exec:\nthnnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\dvdvp.exec:\dvdvp.exe23⤵
- Executes dropped EXE
PID:3548 -
\??\c:\7ntnnn.exec:\7ntnnn.exe24⤵
- Executes dropped EXE
PID:1896 -
\??\c:\xlxrffl.exec:\xlxrffl.exe25⤵
- Executes dropped EXE
PID:3712 -
\??\c:\hnbnhh.exec:\hnbnhh.exe26⤵
- Executes dropped EXE
PID:4424 -
\??\c:\xfrlfxr.exec:\xfrlfxr.exe27⤵
- Executes dropped EXE
PID:3100 -
\??\c:\bhhbtn.exec:\bhhbtn.exe28⤵
- Executes dropped EXE
PID:2928 -
\??\c:\jvjpj.exec:\jvjpj.exe29⤵
- Executes dropped EXE
PID:3532 -
\??\c:\lflfllf.exec:\lflfllf.exe30⤵
- Executes dropped EXE
PID:1656 -
\??\c:\hnnhbh.exec:\hnnhbh.exe31⤵
- Executes dropped EXE
PID:2912 -
\??\c:\httnhb.exec:\httnhb.exe32⤵
- Executes dropped EXE
PID:3376 -
\??\c:\1xfrlrx.exec:\1xfrlrx.exe33⤵
- Executes dropped EXE
PID:4164 -
\??\c:\rllffxx.exec:\rllffxx.exe34⤵
- Executes dropped EXE
PID:3608 -
\??\c:\7hnbtn.exec:\7hnbtn.exe35⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jvdvd.exec:\jvdvd.exe36⤵
- Executes dropped EXE
PID:3236 -
\??\c:\fflffxx.exec:\fflffxx.exe37⤵
- Executes dropped EXE
PID:4744 -
\??\c:\bnnbhb.exec:\bnnbhb.exe38⤵
- Executes dropped EXE
PID:3656 -
\??\c:\7djdv.exec:\7djdv.exe39⤵
- Executes dropped EXE
PID:2652 -
\??\c:\1ffxxfx.exec:\1ffxxfx.exe40⤵
- Executes dropped EXE
PID:936 -
\??\c:\dvdvv.exec:\dvdvv.exe41⤵
- Executes dropped EXE
PID:1892 -
\??\c:\7nbbtn.exec:\7nbbtn.exe42⤵
- Executes dropped EXE
PID:756 -
\??\c:\pjjvp.exec:\pjjvp.exe43⤵
- Executes dropped EXE
PID:4176 -
\??\c:\5lllxxl.exec:\5lllxxl.exe44⤵
- Executes dropped EXE
PID:2332 -
\??\c:\hnthhh.exec:\hnthhh.exe45⤵
- Executes dropped EXE
PID:2884 -
\??\c:\vppjv.exec:\vppjv.exe46⤵
- Executes dropped EXE
PID:1028 -
\??\c:\rxxlfxl.exec:\rxxlfxl.exe47⤵
- Executes dropped EXE
PID:3952 -
\??\c:\thhtnh.exec:\thhtnh.exe48⤵
- Executes dropped EXE
PID:3504 -
\??\c:\5bbthh.exec:\5bbthh.exe49⤵
- Executes dropped EXE
PID:4384 -
\??\c:\7vvdj.exec:\7vvdj.exe50⤵
- Executes dropped EXE
PID:3408 -
\??\c:\xlxxlrr.exec:\xlxxlrr.exe51⤵PID:3900
-
\??\c:\lrrlllx.exec:\lrrlllx.exe52⤵
- Executes dropped EXE
PID:1968 -
\??\c:\thtnbt.exec:\thtnbt.exe53⤵
- Executes dropped EXE
PID:5012 -
\??\c:\dpppd.exec:\dpppd.exe54⤵
- Executes dropped EXE
PID:4992 -
\??\c:\fxrrfxr.exec:\fxrrfxr.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4728 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe56⤵
- Executes dropped EXE
PID:4092 -
\??\c:\9jvjd.exec:\9jvjd.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1048 -
\??\c:\1lxrllx.exec:\1lxrllx.exe58⤵
- Executes dropped EXE
PID:264 -
\??\c:\lxlffrl.exec:\lxlffrl.exe59⤵
- Executes dropped EXE
PID:4048 -
\??\c:\bbbttt.exec:\bbbttt.exe60⤵
- Executes dropped EXE
PID:1888 -
\??\c:\djjdv.exec:\djjdv.exe61⤵
- Executes dropped EXE
PID:3188 -
\??\c:\lrfflrx.exec:\lrfflrx.exe62⤵
- Executes dropped EXE
PID:2684 -
\??\c:\ttbttb.exec:\ttbttb.exe63⤵
- Executes dropped EXE
PID:376 -
\??\c:\5vdvv.exec:\5vdvv.exe64⤵
- Executes dropped EXE
PID:3564 -
\??\c:\fxrxrrx.exec:\fxrxrrx.exe65⤵
- Executes dropped EXE
PID:512 -
\??\c:\nhtnhh.exec:\nhtnhh.exe66⤵
- Executes dropped EXE
PID:1756 -
\??\c:\5pdvv.exec:\5pdvv.exe67⤵PID:2848
-
\??\c:\xflxrlx.exec:\xflxrlx.exe68⤵PID:3772
-
\??\c:\btbttt.exec:\btbttt.exe69⤵PID:3328
-
\??\c:\dddjd.exec:\dddjd.exe70⤵
- System Location Discovery: System Language Discovery
PID:4760 -
\??\c:\frfxffl.exec:\frfxffl.exe71⤵PID:1388
-
\??\c:\7nnhht.exec:\7nnhht.exe72⤵PID:4652
-
\??\c:\thtnnn.exec:\thtnnn.exe73⤵PID:4072
-
\??\c:\jpppj.exec:\jpppj.exe74⤵PID:5000
-
\??\c:\5rrlffx.exec:\5rrlffx.exe75⤵PID:3616
-
\??\c:\hbbbbh.exec:\hbbbbh.exe76⤵PID:4612
-
\??\c:\7pddv.exec:\7pddv.exe77⤵PID:4184
-
\??\c:\llrlxxr.exec:\llrlxxr.exe78⤵PID:3252
-
\??\c:\5fffxff.exec:\5fffxff.exe79⤵PID:4912
-
\??\c:\httnnn.exec:\httnnn.exe80⤵PID:2116
-
\??\c:\ddjjj.exec:\ddjjj.exe81⤵PID:1308
-
\??\c:\jvdpd.exec:\jvdpd.exe82⤵PID:2404
-
\??\c:\frxrlll.exec:\frxrlll.exe83⤵PID:2932
-
\??\c:\3nnnnt.exec:\3nnnnt.exe84⤵PID:1780
-
\??\c:\5ppjd.exec:\5ppjd.exe85⤵PID:3392
-
\??\c:\lxfxlll.exec:\lxfxlll.exe86⤵PID:2856
-
\??\c:\nntnnh.exec:\nntnnh.exe87⤵PID:2952
-
\??\c:\dpdvv.exec:\dpdvv.exe88⤵PID:2152
-
\??\c:\1xrlffr.exec:\1xrlffr.exe89⤵PID:5024
-
\??\c:\nhhhbb.exec:\nhhhbb.exe90⤵PID:4368
-
\??\c:\7ddjd.exec:\7ddjd.exe91⤵PID:1120
-
\??\c:\llrlffx.exec:\llrlffx.exe92⤵PID:3632
-
\??\c:\1tbbbb.exec:\1tbbbb.exe93⤵PID:4800
-
\??\c:\vjpjj.exec:\vjpjj.exe94⤵PID:3224
-
\??\c:\vvdpd.exec:\vvdpd.exe95⤵PID:3200
-
\??\c:\rrrrlff.exec:\rrrrlff.exe96⤵PID:1552
-
\??\c:\tnhnhn.exec:\tnhnhn.exe97⤵PID:2548
-
\??\c:\pdjjd.exec:\pdjjd.exe98⤵PID:1644
-
\??\c:\rrxxfxf.exec:\rrxxfxf.exe99⤵
- System Location Discovery: System Language Discovery
PID:3584 -
\??\c:\5hnnhh.exec:\5hnnhh.exe100⤵PID:736
-
\??\c:\7bthnt.exec:\7bthnt.exe101⤵PID:1916
-
\??\c:\djvpj.exec:\djvpj.exe102⤵PID:4220
-
\??\c:\lxlfffx.exec:\lxlfffx.exe103⤵PID:2288
-
\??\c:\hhtnhn.exec:\hhtnhn.exe104⤵PID:3136
-
\??\c:\pvdvd.exec:\pvdvd.exe105⤵PID:2228
-
\??\c:\flfffll.exec:\flfffll.exe106⤵PID:2724
-
\??\c:\nnnthn.exec:\nnnthn.exe107⤵PID:1076
-
\??\c:\pdjdv.exec:\pdjdv.exe108⤵PID:3128
-
\??\c:\jdvpj.exec:\jdvpj.exe109⤵PID:5044
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe110⤵PID:3012
-
\??\c:\bbhbbt.exec:\bbhbbt.exe111⤵PID:3972
-
\??\c:\3jppp.exec:\3jppp.exe112⤵PID:4404
-
\??\c:\lrxxxrr.exec:\lrxxxrr.exe113⤵PID:4416
-
\??\c:\9nhbtb.exec:\9nhbtb.exe114⤵PID:4280
-
\??\c:\hhhbbb.exec:\hhhbbb.exe115⤵PID:4980
-
\??\c:\7pdvj.exec:\7pdvj.exe116⤵PID:1968
-
\??\c:\rlrrflf.exec:\rlrrflf.exe117⤵PID:4712
-
\??\c:\bhhbtt.exec:\bhhbtt.exe118⤵PID:4992
-
\??\c:\jjppj.exec:\jjppj.exe119⤵PID:652
-
\??\c:\llrxrff.exec:\llrxrff.exe120⤵PID:2184
-
\??\c:\hbbhtt.exec:\hbbhtt.exe121⤵PID:4124
-
\??\c:\pjpjd.exec:\pjpjd.exe122⤵PID:2592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-