Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 01:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe
-
Size
453KB
-
MD5
bd0a5f7caeeb32ce42cdd5414b2b1a8a
-
SHA1
1725c336f24d7408ad7d7b2907fb998fcbd76ee2
-
SHA256
a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1
-
SHA512
4f57fce8b268e082ab63a7f38b45f39b341e273a715edf442b7383b3cc01bd660469bf75ff118e7bc884aa108c33f29836c13446623bc42d25710fad312447cf
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeC:q7Tc2NYHUrAwfMp3CDC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4432-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1784-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1272-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/244-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/316-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/892-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4120-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-762-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-778-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-872-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-912-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-934-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-1061-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2568-1209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-1255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-1271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/776-1434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4432 jjvvd.exe 3580 9xrlxrf.exe 1176 ttbbbn.exe 3280 jjdvp.exe 2956 5bhhhh.exe 3028 xffxrlx.exe 2772 thnhtt.exe 968 nbnntb.exe 4084 9bbbnt.exe 2912 vddpp.exe 1928 pvpdp.exe 1556 xxlrxxl.exe 3316 nthhhn.exe 1048 tbthbt.exe 1360 vvdvp.exe 2052 jjpjv.exe 3080 bbhhbb.exe 2108 5pvvv.exe 1784 ntnhbb.exe 2896 xrffrrf.exe 924 btttnn.exe 1272 nbhbtt.exe 3328 tnnnhn.exe 4988 1dvvv.exe 3424 tntttb.exe 4932 xxrlffx.exe 1688 vpvjd.exe 3616 9rlfffx.exe 4604 pjpjj.exe 644 fflxrfr.exe 4496 vdpjj.exe 2424 rrrrllf.exe 4848 dddvj.exe 4796 xrxxrfr.exe 3052 btbbbh.exe 4004 vpjjp.exe 244 rrllxxr.exe 2156 thnttt.exe 744 pjjjj.exe 2944 rrxllll.exe 5028 ttbbbb.exe 1592 jddjd.exe 4404 5lllflx.exe 220 7vdvd.exe 4340 fxflllr.exe 2136 ffrrrrr.exe 336 tbtnht.exe 3580 vjjdp.exe 468 fffxrrr.exe 4860 3ttbbh.exe 3280 vvdvp.exe 4812 llflrrr.exe 976 5nnhhh.exe 1412 pvjpp.exe 2772 fxxrlxr.exe 3332 bhtttt.exe 5108 pjppp.exe 3440 xrxrrrl.exe 4364 rlxrlxx.exe 1488 nnbnnb.exe 872 jdvvv.exe 2844 1fxxxff.exe 4436 bbbbth.exe 2232 bhnbbb.exe -
resource yara_rule behavioral2/memory/4432-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1272-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/244-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/316-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/892-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-912-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-934-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-1061-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2568-1209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-1255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-1271-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xfllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4000 wrote to memory of 4432 4000 a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe 82 PID 4000 wrote to memory of 4432 4000 a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe 82 PID 4000 wrote to memory of 4432 4000 a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe 82 PID 4432 wrote to memory of 3580 4432 jjvvd.exe 83 PID 4432 wrote to memory of 3580 4432 jjvvd.exe 83 PID 4432 wrote to memory of 3580 4432 jjvvd.exe 83 PID 3580 wrote to memory of 1176 3580 9xrlxrf.exe 84 PID 3580 wrote to memory of 1176 3580 9xrlxrf.exe 84 PID 3580 wrote to memory of 1176 3580 9xrlxrf.exe 84 PID 1176 wrote to memory of 3280 1176 ttbbbn.exe 85 PID 1176 wrote to memory of 3280 1176 ttbbbn.exe 85 PID 1176 wrote to memory of 3280 1176 ttbbbn.exe 85 PID 3280 wrote to memory of 2956 3280 jjdvp.exe 86 PID 3280 wrote to memory of 2956 3280 jjdvp.exe 86 PID 3280 wrote to memory of 2956 3280 jjdvp.exe 86 PID 2956 wrote to memory of 3028 2956 5bhhhh.exe 87 PID 2956 wrote to memory of 3028 2956 5bhhhh.exe 87 PID 2956 wrote to memory of 3028 2956 5bhhhh.exe 87 PID 3028 wrote to memory of 2772 3028 xffxrlx.exe 88 PID 3028 wrote to memory of 2772 3028 xffxrlx.exe 88 PID 3028 wrote to memory of 2772 3028 xffxrlx.exe 88 PID 2772 wrote to memory of 968 2772 thnhtt.exe 89 PID 2772 wrote to memory of 968 2772 thnhtt.exe 89 PID 2772 wrote to memory of 968 2772 thnhtt.exe 89 PID 968 wrote to memory of 4084 968 nbnntb.exe 90 PID 968 wrote to memory of 4084 968 nbnntb.exe 90 PID 968 wrote to memory of 4084 968 nbnntb.exe 90 PID 4084 wrote to memory of 2912 4084 9bbbnt.exe 91 PID 4084 wrote to memory of 2912 4084 9bbbnt.exe 91 PID 4084 wrote to memory of 2912 4084 9bbbnt.exe 91 PID 2912 wrote to memory of 1928 2912 vddpp.exe 92 PID 2912 wrote to memory of 1928 2912 vddpp.exe 92 PID 2912 wrote to memory of 1928 2912 vddpp.exe 92 PID 1928 wrote to memory of 1556 1928 pvpdp.exe 93 PID 1928 wrote to memory of 1556 1928 pvpdp.exe 93 PID 1928 wrote to memory of 1556 1928 pvpdp.exe 93 PID 1556 wrote to memory of 3316 1556 xxlrxxl.exe 94 PID 1556 wrote to memory of 3316 1556 xxlrxxl.exe 94 PID 1556 wrote to memory of 3316 1556 xxlrxxl.exe 94 PID 3316 wrote to memory of 1048 3316 nthhhn.exe 95 PID 3316 wrote to memory of 1048 3316 nthhhn.exe 95 PID 3316 wrote to memory of 1048 3316 nthhhn.exe 95 PID 1048 wrote to memory of 1360 1048 tbthbt.exe 96 PID 1048 wrote to memory of 1360 1048 tbthbt.exe 96 PID 1048 wrote to memory of 1360 1048 tbthbt.exe 96 PID 1360 wrote to memory of 2052 1360 vvdvp.exe 97 PID 1360 wrote to memory of 2052 1360 vvdvp.exe 97 PID 1360 wrote to memory of 2052 1360 vvdvp.exe 97 PID 2052 wrote to memory of 3080 2052 jjpjv.exe 98 PID 2052 wrote to memory of 3080 2052 jjpjv.exe 98 PID 2052 wrote to memory of 3080 2052 jjpjv.exe 98 PID 3080 wrote to memory of 2108 3080 bbhhbb.exe 99 PID 3080 wrote to memory of 2108 3080 bbhhbb.exe 99 PID 3080 wrote to memory of 2108 3080 bbhhbb.exe 99 PID 2108 wrote to memory of 1784 2108 5pvvv.exe 100 PID 2108 wrote to memory of 1784 2108 5pvvv.exe 100 PID 2108 wrote to memory of 1784 2108 5pvvv.exe 100 PID 1784 wrote to memory of 2896 1784 ntnhbb.exe 101 PID 1784 wrote to memory of 2896 1784 ntnhbb.exe 101 PID 1784 wrote to memory of 2896 1784 ntnhbb.exe 101 PID 2896 wrote to memory of 924 2896 xrffrrf.exe 102 PID 2896 wrote to memory of 924 2896 xrffrrf.exe 102 PID 2896 wrote to memory of 924 2896 xrffrrf.exe 102 PID 924 wrote to memory of 1272 924 btttnn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe"C:\Users\Admin\AppData\Local\Temp\a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\jjvvd.exec:\jjvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\9xrlxrf.exec:\9xrlxrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\ttbbbn.exec:\ttbbbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\jjdvp.exec:\jjdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\5bhhhh.exec:\5bhhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\xffxrlx.exec:\xffxrlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\thnhtt.exec:\thnhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\nbnntb.exec:\nbnntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\9bbbnt.exec:\9bbbnt.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\vddpp.exec:\vddpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\pvpdp.exec:\pvpdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\xxlrxxl.exec:\xxlrxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\nthhhn.exec:\nthhhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\tbthbt.exec:\tbthbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\vvdvp.exec:\vvdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\jjpjv.exec:\jjpjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\bbhhbb.exec:\bbhhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\5pvvv.exec:\5pvvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\ntnhbb.exec:\ntnhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\xrffrrf.exec:\xrffrrf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\btttnn.exec:\btttnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\nbhbtt.exec:\nbhbtt.exe23⤵
- Executes dropped EXE
PID:1272 -
\??\c:\tnnnhn.exec:\tnnnhn.exe24⤵
- Executes dropped EXE
PID:3328 -
\??\c:\1dvvv.exec:\1dvvv.exe25⤵
- Executes dropped EXE
PID:4988 -
\??\c:\tntttb.exec:\tntttb.exe26⤵
- Executes dropped EXE
PID:3424 -
\??\c:\xxrlffx.exec:\xxrlffx.exe27⤵
- Executes dropped EXE
PID:4932 -
\??\c:\vpvjd.exec:\vpvjd.exe28⤵
- Executes dropped EXE
PID:1688 -
\??\c:\9rlfffx.exec:\9rlfffx.exe29⤵
- Executes dropped EXE
PID:3616 -
\??\c:\pjpjj.exec:\pjpjj.exe30⤵
- Executes dropped EXE
PID:4604 -
\??\c:\fflxrfr.exec:\fflxrfr.exe31⤵
- Executes dropped EXE
PID:644 -
\??\c:\vdpjj.exec:\vdpjj.exe32⤵
- Executes dropped EXE
PID:4496 -
\??\c:\rrrrllf.exec:\rrrrllf.exe33⤵
- Executes dropped EXE
PID:2424 -
\??\c:\dddvj.exec:\dddvj.exe34⤵
- Executes dropped EXE
PID:4848 -
\??\c:\xrxxrfr.exec:\xrxxrfr.exe35⤵
- Executes dropped EXE
PID:4796 -
\??\c:\btbbbh.exec:\btbbbh.exe36⤵
- Executes dropped EXE
PID:3052 -
\??\c:\vpjjp.exec:\vpjjp.exe37⤵
- Executes dropped EXE
PID:4004 -
\??\c:\rrllxxr.exec:\rrllxxr.exe38⤵
- Executes dropped EXE
PID:244 -
\??\c:\thnttt.exec:\thnttt.exe39⤵
- Executes dropped EXE
PID:2156 -
\??\c:\pjjjj.exec:\pjjjj.exe40⤵
- Executes dropped EXE
PID:744 -
\??\c:\rrxllll.exec:\rrxllll.exe41⤵
- Executes dropped EXE
PID:2944 -
\??\c:\ttbbbb.exec:\ttbbbb.exe42⤵
- Executes dropped EXE
PID:5028 -
\??\c:\jddjd.exec:\jddjd.exe43⤵
- Executes dropped EXE
PID:1592 -
\??\c:\5lllflx.exec:\5lllflx.exe44⤵
- Executes dropped EXE
PID:4404 -
\??\c:\7vdvd.exec:\7vdvd.exe45⤵
- Executes dropped EXE
PID:220 -
\??\c:\fxflllr.exec:\fxflllr.exe46⤵
- Executes dropped EXE
PID:4340 -
\??\c:\ffrrrrr.exec:\ffrrrrr.exe47⤵
- Executes dropped EXE
PID:2136 -
\??\c:\tbtnht.exec:\tbtnht.exe48⤵
- Executes dropped EXE
PID:336 -
\??\c:\vjjdp.exec:\vjjdp.exe49⤵
- Executes dropped EXE
PID:3580 -
\??\c:\fffxrrr.exec:\fffxrrr.exe50⤵
- Executes dropped EXE
PID:468 -
\??\c:\3ttbbh.exec:\3ttbbh.exe51⤵
- Executes dropped EXE
PID:4860 -
\??\c:\vvdvp.exec:\vvdvp.exe52⤵
- Executes dropped EXE
PID:3280 -
\??\c:\llflrrr.exec:\llflrrr.exe53⤵
- Executes dropped EXE
PID:4812 -
\??\c:\5nnhhh.exec:\5nnhhh.exe54⤵
- Executes dropped EXE
PID:976 -
\??\c:\pvjpp.exec:\pvjpp.exe55⤵
- Executes dropped EXE
PID:1412 -
\??\c:\fxxrlxr.exec:\fxxrlxr.exe56⤵
- Executes dropped EXE
PID:2772 -
\??\c:\bhtttt.exec:\bhtttt.exe57⤵
- Executes dropped EXE
PID:3332 -
\??\c:\pjppp.exec:\pjppp.exe58⤵
- Executes dropped EXE
PID:5108 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe59⤵
- Executes dropped EXE
PID:3440 -
\??\c:\rlxrlxx.exec:\rlxrlxx.exe60⤵
- Executes dropped EXE
PID:4364 -
\??\c:\nnbnnb.exec:\nnbnnb.exe61⤵
- Executes dropped EXE
PID:1488 -
\??\c:\jdvvv.exec:\jdvvv.exe62⤵
- Executes dropped EXE
PID:872 -
\??\c:\1fxxxff.exec:\1fxxxff.exe63⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bbbbth.exec:\bbbbth.exe64⤵
- Executes dropped EXE
PID:4436 -
\??\c:\bhnbbb.exec:\bhnbbb.exe65⤵
- Executes dropped EXE
PID:2232 -
\??\c:\pvjjv.exec:\pvjjv.exe66⤵PID:2004
-
\??\c:\rrxrffx.exec:\rrxrffx.exe67⤵PID:316
-
\??\c:\ntnttt.exec:\ntnttt.exe68⤵PID:1260
-
\??\c:\thnnnn.exec:\thnnnn.exe69⤵PID:2248
-
\??\c:\vdddv.exec:\vdddv.exe70⤵PID:1932
-
\??\c:\rlllxxx.exec:\rlllxxx.exe71⤵PID:2900
-
\??\c:\3nhhhn.exec:\3nhhhn.exe72⤵PID:2108
-
\??\c:\pjvvv.exec:\pjvvv.exe73⤵
- System Location Discovery: System Language Discovery
PID:1368 -
\??\c:\xxlrrxl.exec:\xxlrrxl.exe74⤵PID:1916
-
\??\c:\3tnnnn.exec:\3tnnnn.exe75⤵PID:2344
-
\??\c:\bbnnhn.exec:\bbnnhn.exe76⤵PID:1524
-
\??\c:\ddppv.exec:\ddppv.exe77⤵PID:1400
-
\??\c:\1jjjd.exec:\1jjjd.exe78⤵PID:2316
-
\??\c:\xrlfllr.exec:\xrlfllr.exe79⤵PID:2832
-
\??\c:\hthbtt.exec:\hthbtt.exe80⤵PID:4900
-
\??\c:\djpjj.exec:\djpjj.exe81⤵PID:4444
-
\??\c:\rxllrrx.exec:\rxllrrx.exe82⤵PID:1624
-
\??\c:\htnnnn.exec:\htnnnn.exe83⤵PID:1976
-
\??\c:\jjdvp.exec:\jjdvp.exe84⤵PID:3596
-
\??\c:\lfxxffr.exec:\lfxxffr.exe85⤵PID:892
-
\??\c:\bntnbt.exec:\bntnbt.exe86⤵PID:3972
-
\??\c:\bbbtth.exec:\bbbtth.exe87⤵PID:3188
-
\??\c:\3djjj.exec:\3djjj.exe88⤵PID:3616
-
\??\c:\lfllfff.exec:\lfllfff.exe89⤵PID:3228
-
\??\c:\ttntnb.exec:\ttntnb.exe90⤵PID:4604
-
\??\c:\ddppp.exec:\ddppp.exe91⤵PID:3708
-
\??\c:\rxxxrxx.exec:\rxxxrxx.exe92⤵PID:4556
-
\??\c:\hnbhbh.exec:\hnbhbh.exe93⤵PID:3736
-
\??\c:\btbbtb.exec:\btbbtb.exe94⤵PID:4700
-
\??\c:\7ddvv.exec:\7ddvv.exe95⤵PID:2008
-
\??\c:\ffrxxrl.exec:\ffrxxrl.exe96⤵PID:3560
-
\??\c:\1httbt.exec:\1httbt.exe97⤵PID:4584
-
\??\c:\ddjjj.exec:\ddjjj.exe98⤵PID:388
-
\??\c:\jvjdd.exec:\jvjdd.exe99⤵PID:4068
-
\??\c:\lrrrxxx.exec:\lrrrxxx.exe100⤵PID:4564
-
\??\c:\7hnbbn.exec:\7hnbbn.exe101⤵PID:3684
-
\??\c:\vvdvp.exec:\vvdvp.exe102⤵PID:1112
-
\??\c:\jpppj.exec:\jpppj.exe103⤵PID:4120
-
\??\c:\3rxrrxf.exec:\3rxrrxf.exe104⤵PID:2204
-
\??\c:\tnnnhh.exec:\tnnnhh.exe105⤵PID:3004
-
\??\c:\pvdjd.exec:\pvdjd.exe106⤵PID:5012
-
\??\c:\rrllrxf.exec:\rrllrxf.exe107⤵PID:4692
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe108⤵PID:4836
-
\??\c:\jppjv.exec:\jppjv.exe109⤵PID:2244
-
\??\c:\7ppjj.exec:\7ppjj.exe110⤵PID:3324
-
\??\c:\lrffxfx.exec:\lrffxfx.exe111⤵PID:1552
-
\??\c:\bntttb.exec:\bntttb.exe112⤵PID:3688
-
\??\c:\1djdv.exec:\1djdv.exe113⤵PID:4268
-
\??\c:\rrrllff.exec:\rrrllff.exe114⤵PID:3988
-
\??\c:\nntnnn.exec:\nntnnn.exe115⤵PID:4284
-
\??\c:\vpdvv.exec:\vpdvv.exe116⤵PID:3472
-
\??\c:\vpddd.exec:\vpddd.exe117⤵PID:1696
-
\??\c:\ffffffr.exec:\ffffffr.exe118⤵PID:2160
-
\??\c:\ttbtnt.exec:\ttbtnt.exe119⤵PID:5096
-
\??\c:\3jpjv.exec:\3jpjv.exe120⤵PID:116
-
\??\c:\lrrffll.exec:\lrrffll.exe121⤵PID:2396
-
\??\c:\5nttnb.exec:\5nttnb.exe122⤵PID:4084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-