Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d354798421e5e3f3196b7637eab823e73964e6db7fe4d8cfa9c5ebb3e75946ba.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d354798421e5e3f3196b7637eab823e73964e6db7fe4d8cfa9c5ebb3e75946ba.exe
-
Size
454KB
-
MD5
550c45de5c2b4519939890d0dc7dcb4e
-
SHA1
92abeae36c99e3983d3c694c61933805ae365168
-
SHA256
d354798421e5e3f3196b7637eab823e73964e6db7fe4d8cfa9c5ebb3e75946ba
-
SHA512
67afb6bb480ce849843e0964bf4ee9933acfcc43705b76c67e99a05a932dd9c2f8dc219aff32485ab38a0d64ea737ebf3d547c1813041fdd09f1a9f235a988c6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbej:q7Tc2NYHUrAwfMp3CDj
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2844-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1264-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4284-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4120-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3848-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4140-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/528-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/684-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/936-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-726-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-790-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2864-818-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-834-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-910-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-1074-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/460-1078-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-1100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4008 jjdvj.exe 544 7rfxlfx.exe 1640 pjpjv.exe 3840 pdjvj.exe 4864 lfxrlfx.exe 1264 vvdvp.exe 1436 thbttn.exe 2008 jdjdd.exe 408 3bhbbh.exe 1372 pjdvj.exe 1180 btnbtn.exe 4284 httthh.exe 2904 7hhbnn.exe 2976 pjdvp.exe 4120 tbbttb.exe 2972 vdjjd.exe 228 rffxrrr.exe 2608 nhbbtn.exe 3984 lxfxllf.exe 376 pvvjd.exe 1712 pdpvd.exe 3116 lxfrrrl.exe 5016 dvdvd.exe 1176 3ddvd.exe 4396 lxxrllf.exe 3848 thhbtn.exe 2336 7lrrxrx.exe 1736 httnhh.exe 2700 3rxrlll.exe 2372 nhnnnh.exe 3952 vdjdj.exe 3156 rrrlxfx.exe 1900 lrxrlll.exe 3636 jjjdd.exe 3528 lrxxxff.exe 2888 bhnhhb.exe 3692 tbbbnn.exe 1224 3djdv.exe 2864 llrlxxr.exe 4140 hhbbtt.exe 3468 pddjd.exe 2740 1lflflf.exe 4392 nhnhhh.exe 4388 nbthtt.exe 4176 pjddp.exe 528 fxxlfxr.exe 396 9tnbtn.exe 2388 jvpdp.exe 1088 fllffll.exe 3920 bhbthb.exe 3912 dppdv.exe 4924 pjjvj.exe 3744 flllxxr.exe 4540 5jdpd.exe 684 xrflxrx.exe 4576 nbhhbh.exe 1392 tnnbbt.exe 1168 pvvpp.exe 5028 xlrlrff.exe 5064 fffrfxl.exe 3788 bbbtnb.exe 464 dppjd.exe 2108 3xxrrrr.exe 2860 1nhtnh.exe -
resource yara_rule behavioral2/memory/2844-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1264-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4284-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4284-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3848-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4140-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/528-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/684-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/936-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2864-818-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-834-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2844 wrote to memory of 4008 2844 d354798421e5e3f3196b7637eab823e73964e6db7fe4d8cfa9c5ebb3e75946ba.exe 82 PID 2844 wrote to memory of 4008 2844 d354798421e5e3f3196b7637eab823e73964e6db7fe4d8cfa9c5ebb3e75946ba.exe 82 PID 2844 wrote to memory of 4008 2844 d354798421e5e3f3196b7637eab823e73964e6db7fe4d8cfa9c5ebb3e75946ba.exe 82 PID 4008 wrote to memory of 544 4008 jjdvj.exe 83 PID 4008 wrote to memory of 544 4008 jjdvj.exe 83 PID 4008 wrote to memory of 544 4008 jjdvj.exe 83 PID 544 wrote to memory of 1640 544 7rfxlfx.exe 84 PID 544 wrote to memory of 1640 544 7rfxlfx.exe 84 PID 544 wrote to memory of 1640 544 7rfxlfx.exe 84 PID 1640 wrote to memory of 3840 1640 pjpjv.exe 85 PID 1640 wrote to memory of 3840 1640 pjpjv.exe 85 PID 1640 wrote to memory of 3840 1640 pjpjv.exe 85 PID 3840 wrote to memory of 4864 3840 pdjvj.exe 86 PID 3840 wrote to memory of 4864 3840 pdjvj.exe 86 PID 3840 wrote to memory of 4864 3840 pdjvj.exe 86 PID 4864 wrote to memory of 1264 4864 lfxrlfx.exe 87 PID 4864 wrote to memory of 1264 4864 lfxrlfx.exe 87 PID 4864 wrote to memory of 1264 4864 lfxrlfx.exe 87 PID 1264 wrote to memory of 1436 1264 vvdvp.exe 88 PID 1264 wrote to memory of 1436 1264 vvdvp.exe 88 PID 1264 wrote to memory of 1436 1264 vvdvp.exe 88 PID 1436 wrote to memory of 2008 1436 thbttn.exe 89 PID 1436 wrote to memory of 2008 1436 thbttn.exe 89 PID 1436 wrote to memory of 2008 1436 thbttn.exe 89 PID 2008 wrote to memory of 408 2008 jdjdd.exe 90 PID 2008 wrote to memory of 408 2008 jdjdd.exe 90 PID 2008 wrote to memory of 408 2008 jdjdd.exe 90 PID 408 wrote to memory of 1372 408 3bhbbh.exe 91 PID 408 wrote to memory of 1372 408 3bhbbh.exe 91 PID 408 wrote to memory of 1372 408 3bhbbh.exe 91 PID 1372 wrote to memory of 1180 1372 pjdvj.exe 92 PID 1372 wrote to memory of 1180 1372 pjdvj.exe 92 PID 1372 wrote to memory of 1180 1372 pjdvj.exe 92 PID 1180 wrote to memory of 4284 1180 btnbtn.exe 93 PID 1180 wrote to memory of 4284 1180 btnbtn.exe 93 PID 1180 wrote to memory of 4284 1180 btnbtn.exe 93 PID 4284 wrote to memory of 2904 4284 httthh.exe 94 PID 4284 wrote to memory of 2904 4284 httthh.exe 94 PID 4284 wrote to memory of 2904 4284 httthh.exe 94 PID 2904 wrote to memory of 2976 2904 7hhbnn.exe 95 PID 2904 wrote to memory of 2976 2904 7hhbnn.exe 95 PID 2904 wrote to memory of 2976 2904 7hhbnn.exe 95 PID 2976 wrote to memory of 4120 2976 pjdvp.exe 96 PID 2976 wrote to memory of 4120 2976 pjdvp.exe 96 PID 2976 wrote to memory of 4120 2976 pjdvp.exe 96 PID 4120 wrote to memory of 2972 4120 tbbttb.exe 97 PID 4120 wrote to memory of 2972 4120 tbbttb.exe 97 PID 4120 wrote to memory of 2972 4120 tbbttb.exe 97 PID 2972 wrote to memory of 228 2972 vdjjd.exe 98 PID 2972 wrote to memory of 228 2972 vdjjd.exe 98 PID 2972 wrote to memory of 228 2972 vdjjd.exe 98 PID 228 wrote to memory of 2608 228 rffxrrr.exe 99 PID 228 wrote to memory of 2608 228 rffxrrr.exe 99 PID 228 wrote to memory of 2608 228 rffxrrr.exe 99 PID 2608 wrote to memory of 3984 2608 nhbbtn.exe 100 PID 2608 wrote to memory of 3984 2608 nhbbtn.exe 100 PID 2608 wrote to memory of 3984 2608 nhbbtn.exe 100 PID 3984 wrote to memory of 376 3984 lxfxllf.exe 101 PID 3984 wrote to memory of 376 3984 lxfxllf.exe 101 PID 3984 wrote to memory of 376 3984 lxfxllf.exe 101 PID 376 wrote to memory of 1712 376 pvvjd.exe 102 PID 376 wrote to memory of 1712 376 pvvjd.exe 102 PID 376 wrote to memory of 1712 376 pvvjd.exe 102 PID 1712 wrote to memory of 3116 1712 pdpvd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\d354798421e5e3f3196b7637eab823e73964e6db7fe4d8cfa9c5ebb3e75946ba.exe"C:\Users\Admin\AppData\Local\Temp\d354798421e5e3f3196b7637eab823e73964e6db7fe4d8cfa9c5ebb3e75946ba.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\jjdvj.exec:\jjdvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\7rfxlfx.exec:\7rfxlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\pjpjv.exec:\pjpjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\pdjvj.exec:\pdjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\vvdvp.exec:\vvdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\thbttn.exec:\thbttn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\jdjdd.exec:\jdjdd.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\3bhbbh.exec:\3bhbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\pjdvj.exec:\pjdvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\btnbtn.exec:\btnbtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\httthh.exec:\httthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\7hhbnn.exec:\7hhbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\pjdvp.exec:\pjdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\tbbttb.exec:\tbbttb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\vdjjd.exec:\vdjjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\rffxrrr.exec:\rffxrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\nhbbtn.exec:\nhbbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\lxfxllf.exec:\lxfxllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\pvvjd.exec:\pvvjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\pdpvd.exec:\pdpvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\lxfrrrl.exec:\lxfrrrl.exe23⤵
- Executes dropped EXE
PID:3116 -
\??\c:\dvdvd.exec:\dvdvd.exe24⤵
- Executes dropped EXE
PID:5016 -
\??\c:\3ddvd.exec:\3ddvd.exe25⤵
- Executes dropped EXE
PID:1176 -
\??\c:\lxxrllf.exec:\lxxrllf.exe26⤵
- Executes dropped EXE
PID:4396 -
\??\c:\thhbtn.exec:\thhbtn.exe27⤵
- Executes dropped EXE
PID:3848 -
\??\c:\7lrrxrx.exec:\7lrrxrx.exe28⤵
- Executes dropped EXE
PID:2336 -
\??\c:\httnhh.exec:\httnhh.exe29⤵
- Executes dropped EXE
PID:1736 -
\??\c:\3rxrlll.exec:\3rxrlll.exe30⤵
- Executes dropped EXE
PID:2700 -
\??\c:\nhnnnh.exec:\nhnnnh.exe31⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vdjdj.exec:\vdjdj.exe32⤵
- Executes dropped EXE
PID:3952 -
\??\c:\rrrlxfx.exec:\rrrlxfx.exe33⤵
- Executes dropped EXE
PID:3156 -
\??\c:\lrxrlll.exec:\lrxrlll.exe34⤵
- Executes dropped EXE
PID:1900 -
\??\c:\jjjdd.exec:\jjjdd.exe35⤵
- Executes dropped EXE
PID:3636 -
\??\c:\lrxxxff.exec:\lrxxxff.exe36⤵
- Executes dropped EXE
PID:3528 -
\??\c:\bhnhhb.exec:\bhnhhb.exe37⤵
- Executes dropped EXE
PID:2888 -
\??\c:\tbbbnn.exec:\tbbbnn.exe38⤵
- Executes dropped EXE
PID:3692 -
\??\c:\3djdv.exec:\3djdv.exe39⤵
- Executes dropped EXE
PID:1224 -
\??\c:\llrlxxr.exec:\llrlxxr.exe40⤵
- Executes dropped EXE
PID:2864 -
\??\c:\hhbbtt.exec:\hhbbtt.exe41⤵
- Executes dropped EXE
PID:4140 -
\??\c:\pddjd.exec:\pddjd.exe42⤵
- Executes dropped EXE
PID:3468 -
\??\c:\1lflflf.exec:\1lflflf.exe43⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nhnhhh.exec:\nhnhhh.exe44⤵
- Executes dropped EXE
PID:4392 -
\??\c:\nbthtt.exec:\nbthtt.exe45⤵
- Executes dropped EXE
PID:4388 -
\??\c:\pjddp.exec:\pjddp.exe46⤵
- Executes dropped EXE
PID:4176 -
\??\c:\fxxlfxr.exec:\fxxlfxr.exe47⤵
- Executes dropped EXE
PID:528 -
\??\c:\9tnbtn.exec:\9tnbtn.exe48⤵
- Executes dropped EXE
PID:396 -
\??\c:\jvpdp.exec:\jvpdp.exe49⤵
- Executes dropped EXE
PID:2388 -
\??\c:\fllffll.exec:\fllffll.exe50⤵
- Executes dropped EXE
PID:1088 -
\??\c:\bhbthb.exec:\bhbthb.exe51⤵
- Executes dropped EXE
PID:3920 -
\??\c:\dppdv.exec:\dppdv.exe52⤵
- Executes dropped EXE
PID:3912 -
\??\c:\pjjvj.exec:\pjjvj.exe53⤵
- Executes dropped EXE
PID:4924 -
\??\c:\flllxxr.exec:\flllxxr.exe54⤵
- Executes dropped EXE
PID:3744 -
\??\c:\5jdpd.exec:\5jdpd.exe55⤵
- Executes dropped EXE
PID:4540 -
\??\c:\xrflxrx.exec:\xrflxrx.exe56⤵
- Executes dropped EXE
PID:684 -
\??\c:\nbhhbh.exec:\nbhhbh.exe57⤵
- Executes dropped EXE
PID:4576 -
\??\c:\tnnbbt.exec:\tnnbbt.exe58⤵
- Executes dropped EXE
PID:1392 -
\??\c:\pvvpp.exec:\pvvpp.exe59⤵
- Executes dropped EXE
PID:1168 -
\??\c:\xlrlrff.exec:\xlrlrff.exe60⤵
- Executes dropped EXE
PID:5028 -
\??\c:\fffrfxl.exec:\fffrfxl.exe61⤵
- Executes dropped EXE
PID:5064 -
\??\c:\bbbtnb.exec:\bbbtnb.exe62⤵
- Executes dropped EXE
PID:3788 -
\??\c:\dppjd.exec:\dppjd.exe63⤵
- Executes dropped EXE
PID:464 -
\??\c:\3xxrrrr.exec:\3xxrrrr.exe64⤵
- Executes dropped EXE
PID:2108 -
\??\c:\1nhtnh.exec:\1nhtnh.exe65⤵
- Executes dropped EXE
PID:2860 -
\??\c:\3vpjv.exec:\3vpjv.exe66⤵PID:3076
-
\??\c:\frfrrlf.exec:\frfrrlf.exe67⤵PID:4932
-
\??\c:\nnttbn.exec:\nnttbn.exe68⤵PID:4100
-
\??\c:\ttthbt.exec:\ttthbt.exe69⤵PID:372
-
\??\c:\dpvpd.exec:\dpvpd.exe70⤵PID:2908
-
\??\c:\1xxrlrl.exec:\1xxrlrl.exe71⤵PID:228
-
\??\c:\5rllfff.exec:\5rllfff.exe72⤵PID:3756
-
\??\c:\bhnhbb.exec:\bhnhbb.exe73⤵PID:3984
-
\??\c:\djdpj.exec:\djdpj.exe74⤵PID:1552
-
\??\c:\5flfrxf.exec:\5flfrxf.exe75⤵PID:3456
-
\??\c:\httnhb.exec:\httnhb.exe76⤵PID:3604
-
\??\c:\nhhhbt.exec:\nhhhbt.exe77⤵PID:576
-
\??\c:\pvvjv.exec:\pvvjv.exe78⤵PID:1672
-
\??\c:\frlxlfr.exec:\frlxlfr.exe79⤵PID:1664
-
\??\c:\btnhtn.exec:\btnhtn.exe80⤵PID:4652
-
\??\c:\5pvpv.exec:\5pvpv.exe81⤵PID:960
-
\??\c:\dvpjv.exec:\dvpjv.exe82⤵PID:4040
-
\??\c:\lrffflf.exec:\lrffflf.exe83⤵PID:4168
-
\??\c:\htnbbt.exec:\htnbbt.exe84⤵PID:4052
-
\??\c:\pjdjv.exec:\pjdjv.exe85⤵PID:3720
-
\??\c:\jvpvp.exec:\jvpvp.exe86⤵PID:5052
-
\??\c:\fflfxxr.exec:\fflfxxr.exe87⤵PID:1684
-
\??\c:\9bhhbb.exec:\9bhhbb.exe88⤵PID:4424
-
\??\c:\djpdp.exec:\djpdp.exe89⤵PID:3344
-
\??\c:\rfxrfrl.exec:\rfxrfrl.exe90⤵PID:3024
-
\??\c:\bbbttt.exec:\bbbttt.exe91⤵PID:4596
-
\??\c:\httnnn.exec:\httnnn.exe92⤵PID:2992
-
\??\c:\jddpj.exec:\jddpj.exe93⤵PID:1936
-
\??\c:\xxxrllx.exec:\xxxrllx.exe94⤵PID:1860
-
\??\c:\btnhnh.exec:\btnhnh.exe95⤵PID:3528
-
\??\c:\vpjdv.exec:\vpjdv.exe96⤵PID:4340
-
\??\c:\xffrfrl.exec:\xffrfrl.exe97⤵PID:2236
-
\??\c:\5rxrxff.exec:\5rxrxff.exe98⤵PID:1224
-
\??\c:\bnnbtn.exec:\bnnbtn.exe99⤵PID:2864
-
\??\c:\jdvpj.exec:\jdvpj.exe100⤵PID:1624
-
\??\c:\rflfllf.exec:\rflfllf.exe101⤵PID:1144
-
\??\c:\9bhbbb.exec:\9bhbbb.exe102⤵PID:4476
-
\??\c:\5jdvp.exec:\5jdvp.exe103⤵PID:4680
-
\??\c:\dvjjp.exec:\dvjjp.exe104⤵PID:4700
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe105⤵PID:2664
-
\??\c:\hbbttn.exec:\hbbttn.exe106⤵PID:2844
-
\??\c:\vjdpd.exec:\vjdpd.exe107⤵PID:4008
-
\??\c:\3pjvj.exec:\3pjvj.exe108⤵PID:936
-
\??\c:\rflfxfx.exec:\rflfxfx.exe109⤵PID:2916
-
\??\c:\nhnbbt.exec:\nhnbbt.exe110⤵PID:3232
-
\??\c:\dvppd.exec:\dvppd.exe111⤵PID:2348
-
\??\c:\fxlxlfx.exec:\fxlxlfx.exe112⤵PID:3912
-
\??\c:\bbbnhb.exec:\bbbnhb.exe113⤵PID:4820
-
\??\c:\vvvpv.exec:\vvvpv.exe114⤵PID:3744
-
\??\c:\jdpjd.exec:\jdpjd.exe115⤵PID:4540
-
\??\c:\3rxxrrr.exec:\3rxxrrr.exe116⤵PID:684
-
\??\c:\3xxrllf.exec:\3xxrllf.exe117⤵PID:4576
-
\??\c:\tbbttt.exec:\tbbttt.exe118⤵PID:4024
-
\??\c:\dvjdv.exec:\dvjdv.exe119⤵PID:4484
-
\??\c:\jppjd.exec:\jppjd.exe120⤵PID:1284
-
\??\c:\lllfxrl.exec:\lllfxrl.exe121⤵PID:2668
-
\??\c:\ntbtbt.exec:\ntbtbt.exe122⤵PID:812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-