Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 04:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d33d937558fc2f4e60327e698c9734828b273337b02f390890d62cbac33f1c56.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d33d937558fc2f4e60327e698c9734828b273337b02f390890d62cbac33f1c56.exe
-
Size
454KB
-
MD5
c0da95c510515ff04476b51b74480366
-
SHA1
78011a0cb5499787267a14206864ae1767ffd491
-
SHA256
d33d937558fc2f4e60327e698c9734828b273337b02f390890d62cbac33f1c56
-
SHA512
ec2e5cc085524544a0790a881d76ad1aa66a411ff9367bca917bf48230e18f4c1842a608ce682c1585019acb42c2f757698bf0f26d71d60413f182bebda1abe2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeW:q7Tc2NYHUrAwfMp3CDW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4408-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3884-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1740-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/692-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2524-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/384-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1296-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1340-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-743-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-801-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-842-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-1090-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-1112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-1780-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1208 dpjjj.exe 4776 rfxxllr.exe 1340 9hhhbb.exe 1656 vpppj.exe 1356 rxfxxxr.exe 3720 htbtnn.exe 3436 jddvd.exe 4980 pvjdv.exe 400 xrxlxrx.exe 3960 bnbbtt.exe 2128 1jppv.exe 4992 lffflll.exe 1296 3xrrllf.exe 1592 9thbbn.exe 5116 jvjdd.exe 4192 vdpjd.exe 1920 xrxrrxx.exe 4676 thnhbb.exe 384 dvdvv.exe 5032 jpddd.exe 3504 lxlrllf.exe 1548 5nnnhh.exe 3596 btthhb.exe 2524 vpvvv.exe 3840 9xlxffr.exe 692 hhnbtt.exe 3440 dvdvv.exe 3604 7dvjd.exe 1032 fxffrrr.exe 4100 tntbbh.exe 748 vpvdv.exe 4772 xlrlffx.exe 2360 tnnnhh.exe 4616 hnhhtt.exe 1596 djjjj.exe 3176 lxxxfxl.exe 2896 ttbhhh.exe 2636 hbbhhn.exe 2000 dddjp.exe 4800 fxxrfxr.exe 2968 bnnnhb.exe 3888 7nttbn.exe 1424 9vddv.exe 1860 7xfflrl.exe 2396 lfllflr.exe 1580 bttttt.exe 1744 jjvjv.exe 1740 xlfxrfx.exe 5084 flxxrrr.exe 3628 hbhbbh.exe 4316 jddjj.exe 212 7dvvv.exe 3884 ffxxfff.exe 3660 hhhbtn.exe 4996 tbhhtt.exe 2012 jddvv.exe 1156 rxxxlfr.exe 2620 7nttnn.exe 2936 5pvvp.exe 5072 pjddp.exe 2356 flrllrx.exe 1500 hbbbbb.exe 2260 vjvpp.exe 5060 ddjjj.exe -
resource yara_rule behavioral2/memory/4408-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3884-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/692-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2524-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/384-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1296-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1340-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-801-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-842-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/708-963-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-1090-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3htnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4408 wrote to memory of 1208 4408 d33d937558fc2f4e60327e698c9734828b273337b02f390890d62cbac33f1c56.exe 83 PID 4408 wrote to memory of 1208 4408 d33d937558fc2f4e60327e698c9734828b273337b02f390890d62cbac33f1c56.exe 83 PID 4408 wrote to memory of 1208 4408 d33d937558fc2f4e60327e698c9734828b273337b02f390890d62cbac33f1c56.exe 83 PID 1208 wrote to memory of 4776 1208 dpjjj.exe 84 PID 1208 wrote to memory of 4776 1208 dpjjj.exe 84 PID 1208 wrote to memory of 4776 1208 dpjjj.exe 84 PID 4776 wrote to memory of 1340 4776 rfxxllr.exe 85 PID 4776 wrote to memory of 1340 4776 rfxxllr.exe 85 PID 4776 wrote to memory of 1340 4776 rfxxllr.exe 85 PID 1340 wrote to memory of 1656 1340 9hhhbb.exe 86 PID 1340 wrote to memory of 1656 1340 9hhhbb.exe 86 PID 1340 wrote to memory of 1656 1340 9hhhbb.exe 86 PID 1656 wrote to memory of 1356 1656 vpppj.exe 87 PID 1656 wrote to memory of 1356 1656 vpppj.exe 87 PID 1656 wrote to memory of 1356 1656 vpppj.exe 87 PID 1356 wrote to memory of 3720 1356 rxfxxxr.exe 88 PID 1356 wrote to memory of 3720 1356 rxfxxxr.exe 88 PID 1356 wrote to memory of 3720 1356 rxfxxxr.exe 88 PID 3720 wrote to memory of 3436 3720 htbtnn.exe 89 PID 3720 wrote to memory of 3436 3720 htbtnn.exe 89 PID 3720 wrote to memory of 3436 3720 htbtnn.exe 89 PID 3436 wrote to memory of 4980 3436 jddvd.exe 90 PID 3436 wrote to memory of 4980 3436 jddvd.exe 90 PID 3436 wrote to memory of 4980 3436 jddvd.exe 90 PID 4980 wrote to memory of 400 4980 pvjdv.exe 91 PID 4980 wrote to memory of 400 4980 pvjdv.exe 91 PID 4980 wrote to memory of 400 4980 pvjdv.exe 91 PID 400 wrote to memory of 3960 400 xrxlxrx.exe 92 PID 400 wrote to memory of 3960 400 xrxlxrx.exe 92 PID 400 wrote to memory of 3960 400 xrxlxrx.exe 92 PID 3960 wrote to memory of 2128 3960 bnbbtt.exe 93 PID 3960 wrote to memory of 2128 3960 bnbbtt.exe 93 PID 3960 wrote to memory of 2128 3960 bnbbtt.exe 93 PID 2128 wrote to memory of 4992 2128 1jppv.exe 94 PID 2128 wrote to memory of 4992 2128 1jppv.exe 94 PID 2128 wrote to memory of 4992 2128 1jppv.exe 94 PID 4992 wrote to memory of 1296 4992 lffflll.exe 95 PID 4992 wrote to memory of 1296 4992 lffflll.exe 95 PID 4992 wrote to memory of 1296 4992 lffflll.exe 95 PID 1296 wrote to memory of 1592 1296 3xrrllf.exe 96 PID 1296 wrote to memory of 1592 1296 3xrrllf.exe 96 PID 1296 wrote to memory of 1592 1296 3xrrllf.exe 96 PID 1592 wrote to memory of 5116 1592 9thbbn.exe 97 PID 1592 wrote to memory of 5116 1592 9thbbn.exe 97 PID 1592 wrote to memory of 5116 1592 9thbbn.exe 97 PID 5116 wrote to memory of 4192 5116 jvjdd.exe 98 PID 5116 wrote to memory of 4192 5116 jvjdd.exe 98 PID 5116 wrote to memory of 4192 5116 jvjdd.exe 98 PID 4192 wrote to memory of 1920 4192 vdpjd.exe 99 PID 4192 wrote to memory of 1920 4192 vdpjd.exe 99 PID 4192 wrote to memory of 1920 4192 vdpjd.exe 99 PID 1920 wrote to memory of 4676 1920 xrxrrxx.exe 100 PID 1920 wrote to memory of 4676 1920 xrxrrxx.exe 100 PID 1920 wrote to memory of 4676 1920 xrxrrxx.exe 100 PID 4676 wrote to memory of 384 4676 thnhbb.exe 101 PID 4676 wrote to memory of 384 4676 thnhbb.exe 101 PID 4676 wrote to memory of 384 4676 thnhbb.exe 101 PID 384 wrote to memory of 5032 384 dvdvv.exe 102 PID 384 wrote to memory of 5032 384 dvdvv.exe 102 PID 384 wrote to memory of 5032 384 dvdvv.exe 102 PID 5032 wrote to memory of 3504 5032 jpddd.exe 103 PID 5032 wrote to memory of 3504 5032 jpddd.exe 103 PID 5032 wrote to memory of 3504 5032 jpddd.exe 103 PID 3504 wrote to memory of 1548 3504 lxlrllf.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d33d937558fc2f4e60327e698c9734828b273337b02f390890d62cbac33f1c56.exe"C:\Users\Admin\AppData\Local\Temp\d33d937558fc2f4e60327e698c9734828b273337b02f390890d62cbac33f1c56.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\dpjjj.exec:\dpjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\rfxxllr.exec:\rfxxllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\9hhhbb.exec:\9hhhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\vpppj.exec:\vpppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\rxfxxxr.exec:\rxfxxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\htbtnn.exec:\htbtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\jddvd.exec:\jddvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\pvjdv.exec:\pvjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\xrxlxrx.exec:\xrxlxrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\bnbbtt.exec:\bnbbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\1jppv.exec:\1jppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\lffflll.exec:\lffflll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\3xrrllf.exec:\3xrrllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\9thbbn.exec:\9thbbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\jvjdd.exec:\jvjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\vdpjd.exec:\vdpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\xrxrrxx.exec:\xrxrrxx.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\thnhbb.exec:\thnhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\dvdvv.exec:\dvdvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\jpddd.exec:\jpddd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\lxlrllf.exec:\lxlrllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\5nnnhh.exec:\5nnnhh.exe23⤵
- Executes dropped EXE
PID:1548 -
\??\c:\btthhb.exec:\btthhb.exe24⤵
- Executes dropped EXE
PID:3596 -
\??\c:\vpvvv.exec:\vpvvv.exe25⤵
- Executes dropped EXE
PID:2524 -
\??\c:\9xlxffr.exec:\9xlxffr.exe26⤵
- Executes dropped EXE
PID:3840 -
\??\c:\hhnbtt.exec:\hhnbtt.exe27⤵
- Executes dropped EXE
PID:692 -
\??\c:\dvdvv.exec:\dvdvv.exe28⤵
- Executes dropped EXE
PID:3440 -
\??\c:\7dvjd.exec:\7dvjd.exe29⤵
- Executes dropped EXE
PID:3604 -
\??\c:\fxffrrr.exec:\fxffrrr.exe30⤵
- Executes dropped EXE
PID:1032 -
\??\c:\tntbbh.exec:\tntbbh.exe31⤵
- Executes dropped EXE
PID:4100 -
\??\c:\vpvdv.exec:\vpvdv.exe32⤵
- Executes dropped EXE
PID:748 -
\??\c:\xlrlffx.exec:\xlrlffx.exe33⤵
- Executes dropped EXE
PID:4772 -
\??\c:\tnnnhh.exec:\tnnnhh.exe34⤵
- Executes dropped EXE
PID:2360 -
\??\c:\hnhhtt.exec:\hnhhtt.exe35⤵
- Executes dropped EXE
PID:4616 -
\??\c:\djjjj.exec:\djjjj.exe36⤵
- Executes dropped EXE
PID:1596 -
\??\c:\lxxxfxl.exec:\lxxxfxl.exe37⤵
- Executes dropped EXE
PID:3176 -
\??\c:\ttbhhh.exec:\ttbhhh.exe38⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hbbhhn.exec:\hbbhhn.exe39⤵
- Executes dropped EXE
PID:2636 -
\??\c:\dddjp.exec:\dddjp.exe40⤵
- Executes dropped EXE
PID:2000 -
\??\c:\fxxrfxr.exec:\fxxrfxr.exe41⤵
- Executes dropped EXE
PID:4800 -
\??\c:\bnnnhb.exec:\bnnnhb.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2968 -
\??\c:\7nttbn.exec:\7nttbn.exe43⤵
- Executes dropped EXE
PID:3888 -
\??\c:\9vddv.exec:\9vddv.exe44⤵
- Executes dropped EXE
PID:1424 -
\??\c:\7xfflrl.exec:\7xfflrl.exe45⤵
- Executes dropped EXE
PID:1860 -
\??\c:\lfllflr.exec:\lfllflr.exe46⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bttttt.exec:\bttttt.exe47⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jjvjv.exec:\jjvjv.exe48⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xlfxrfx.exec:\xlfxrfx.exe49⤵
- Executes dropped EXE
PID:1740 -
\??\c:\flxxrrr.exec:\flxxrrr.exe50⤵
- Executes dropped EXE
PID:5084 -
\??\c:\hbhbbh.exec:\hbhbbh.exe51⤵
- Executes dropped EXE
PID:3628 -
\??\c:\jddjj.exec:\jddjj.exe52⤵
- Executes dropped EXE
PID:4316 -
\??\c:\7dvvv.exec:\7dvvv.exe53⤵
- Executes dropped EXE
PID:212 -
\??\c:\ffxxfff.exec:\ffxxfff.exe54⤵
- Executes dropped EXE
PID:3884 -
\??\c:\hhhbtn.exec:\hhhbtn.exe55⤵
- Executes dropped EXE
PID:3660 -
\??\c:\tbhhtt.exec:\tbhhtt.exe56⤵
- Executes dropped EXE
PID:4996 -
\??\c:\jddvv.exec:\jddvv.exe57⤵
- Executes dropped EXE
PID:2012 -
\??\c:\rxxxlfr.exec:\rxxxlfr.exe58⤵
- Executes dropped EXE
PID:1156 -
\??\c:\7nttnn.exec:\7nttnn.exe59⤵
- Executes dropped EXE
PID:2620 -
\??\c:\5pvvp.exec:\5pvvp.exe60⤵
- Executes dropped EXE
PID:2936 -
\??\c:\pjddp.exec:\pjddp.exe61⤵
- Executes dropped EXE
PID:5072 -
\??\c:\flrllrx.exec:\flrllrx.exe62⤵
- Executes dropped EXE
PID:2356 -
\??\c:\hbbbbb.exec:\hbbbbb.exe63⤵
- Executes dropped EXE
PID:1500 -
\??\c:\vjvpp.exec:\vjvpp.exe64⤵
- Executes dropped EXE
PID:2260 -
\??\c:\ddjjj.exec:\ddjjj.exe65⤵
- Executes dropped EXE
PID:5060 -
\??\c:\lxrrrff.exec:\lxrrrff.exe66⤵PID:4984
-
\??\c:\hbhbbb.exec:\hbhbbb.exe67⤵PID:2216
-
\??\c:\tnhbbb.exec:\tnhbbb.exe68⤵PID:3768
-
\??\c:\vppjj.exec:\vppjj.exe69⤵PID:3076
-
\??\c:\rfrrrxx.exec:\rfrrrxx.exe70⤵PID:4192
-
\??\c:\bnhbbb.exec:\bnhbbb.exe71⤵PID:1748
-
\??\c:\thtnnh.exec:\thtnnh.exe72⤵PID:1780
-
\??\c:\dpddd.exec:\dpddd.exe73⤵PID:4028
-
\??\c:\pjjjj.exec:\pjjjj.exe74⤵PID:4788
-
\??\c:\rrxxxff.exec:\rrxxxff.exe75⤵PID:1312
-
\??\c:\nhhhhh.exec:\nhhhhh.exe76⤵PID:3124
-
\??\c:\vpvdv.exec:\vpvdv.exe77⤵PID:2184
-
\??\c:\lxxffrl.exec:\lxxffrl.exe78⤵PID:4708
-
\??\c:\tbnnhh.exec:\tbnnhh.exe79⤵PID:3840
-
\??\c:\ppddp.exec:\ppddp.exe80⤵PID:4844
-
\??\c:\7lxrllx.exec:\7lxrllx.exe81⤵PID:1124
-
\??\c:\xrfxlll.exec:\xrfxlll.exe82⤵PID:5000
-
\??\c:\hnbtbt.exec:\hnbtbt.exe83⤵PID:512
-
\??\c:\jddvj.exec:\jddvj.exe84⤵PID:4056
-
\??\c:\rlffxxl.exec:\rlffxxl.exe85⤵PID:3476
-
\??\c:\btbtnn.exec:\btbtnn.exe86⤵PID:4772
-
\??\c:\dvjpd.exec:\dvjpd.exe87⤵PID:1540
-
\??\c:\djvvp.exec:\djvvp.exe88⤵PID:4680
-
\??\c:\rrffxrx.exec:\rrffxrx.exe89⤵PID:4808
-
\??\c:\bthhhn.exec:\bthhhn.exe90⤵PID:2916
-
\??\c:\vpvpj.exec:\vpvpj.exe91⤵PID:1640
-
\??\c:\pppjj.exec:\pppjj.exe92⤵PID:4372
-
\??\c:\xfrfxxr.exec:\xfrfxxr.exe93⤵PID:4800
-
\??\c:\bbtnnt.exec:\bbtnnt.exe94⤵PID:2044
-
\??\c:\dpjvj.exec:\dpjvj.exe95⤵PID:2460
-
\??\c:\rxffxll.exec:\rxffxll.exe96⤵PID:3096
-
\??\c:\bbbbbh.exec:\bbbbbh.exe97⤵PID:2728
-
\??\c:\jvjdd.exec:\jvjdd.exe98⤵PID:404
-
\??\c:\xrffxxr.exec:\xrffxxr.exe99⤵PID:2664
-
\??\c:\htbnnb.exec:\htbnnb.exe100⤵PID:5076
-
\??\c:\pjjjd.exec:\pjjjd.exe101⤵PID:3280
-
\??\c:\rrrlfff.exec:\rrrlfff.exe102⤵PID:5084
-
\??\c:\bhbbhh.exec:\bhbbhh.exe103⤵PID:3940
-
\??\c:\3jpjj.exec:\3jpjj.exe104⤵PID:4408
-
\??\c:\hhnbbh.exec:\hhnbbh.exe105⤵PID:2996
-
\??\c:\ddppj.exec:\ddppj.exe106⤵PID:4776
-
\??\c:\xrfffff.exec:\xrfffff.exe107⤵PID:2984
-
\??\c:\ttnttn.exec:\ttnttn.exe108⤵PID:2288
-
\??\c:\vvvjp.exec:\vvvjp.exe109⤵PID:1180
-
\??\c:\5lxrxff.exec:\5lxrxff.exe110⤵PID:4308
-
\??\c:\bbhhhh.exec:\bbhhhh.exe111⤵PID:2188
-
\??\c:\ppvdv.exec:\ppvdv.exe112⤵PID:1168
-
\??\c:\rrfllrr.exec:\rrfllrr.exe113⤵PID:4364
-
\??\c:\bbbbtb.exec:\bbbbtb.exe114⤵PID:4004
-
\??\c:\vvppj.exec:\vvppj.exe115⤵PID:4540
-
\??\c:\xxxrlll.exec:\xxxrlll.exe116⤵PID:1196
-
\??\c:\frlffff.exec:\frlffff.exe117⤵PID:3132
-
\??\c:\hntttt.exec:\hntttt.exe118⤵PID:3720
-
\??\c:\jjdvv.exec:\jjdvv.exe119⤵PID:3368
-
\??\c:\xflfxxr.exec:\xflfxxr.exe120⤵PID:5060
-
\??\c:\hthnth.exec:\hthnth.exe121⤵PID:1876
-
\??\c:\jdpjj.exec:\jdpjj.exe122⤵PID:4500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-