Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 06:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe
-
Size
455KB
-
MD5
ae8ed63179165cc2083fc1a495eaa401
-
SHA1
82061d558fc26e2b6b982c094516bf138d149e4e
-
SHA256
ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959
-
SHA512
3df7919f7e4bae3fcb55ff0892eaed46d0ac337431575d83c8d8e8f3e82dac5d232c0005d7519bcf1f2e3fa096ed1f4ee09eb871b85700be6029d5ab19f37ccb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRY:q7Tc2NYHUrAwfMp3CDRY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1888-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1324-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2748-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1248-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1256-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1104-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/352-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-732-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-1843-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-1980-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4840 9hbtnh.exe 2756 ddpjp.exe 3152 dvjjp.exe 2872 pdpjd.exe 1324 btbbtt.exe 4920 dvvpp.exe 4048 dpjvp.exe 2304 ttbbhb.exe 2748 jjjdv.exe 1248 xrrxxfx.exe 2868 tttntb.exe 2760 nbhbtt.exe 2004 jdjdp.exe 1488 ffllrxf.exe 1256 rffffrr.exe 32 tbbtnt.exe 2368 nbnhhh.exe 1704 pvdvp.exe 2992 vdddd.exe 4896 7xfxrxr.exe 1408 tntttb.exe 3416 jdjdd.exe 3136 rlrxxxr.exe 536 tthtbb.exe 4996 pppjd.exe 4272 ppppj.exe 4448 lfrrxxx.exe 516 thbbbb.exe 4348 nhnhbb.exe 1924 pvddd.exe 2344 fxfffxx.exe 1104 fxxxxxx.exe 3868 thhhbt.exe 3964 vvjvv.exe 3156 dvdvp.exe 4820 xrrlllr.exe 4660 nbtthn.exe 1744 nttthn.exe 1168 ddvpd.exe 5012 rrrllfx.exe 400 xxxfxxr.exe 2488 bntthb.exe 3280 pdpdp.exe 1128 rlxrlrr.exe 3032 xxfxffx.exe 3788 9hhbth.exe 2156 dddpv.exe 3928 ffxxxfx.exe 4768 rxxxllf.exe 4864 tnbbtn.exe 3864 dvdvd.exe 3852 xllrxxr.exe 4420 9rlfffx.exe 4708 tnbbnn.exe 3564 ppvpj.exe 2756 xxlxrff.exe 3452 hbbbbb.exe 1520 nnhhhn.exe 1540 jdddv.exe 4016 rrffllx.exe 4920 pjpjp.exe 4416 pjpjd.exe 4460 djvvv.exe 4124 7djjp.exe -
resource yara_rule behavioral2/memory/1888-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2748-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1248-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1256-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1104-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/352-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1568-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-646-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxlxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfffrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1888 wrote to memory of 4840 1888 ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe 82 PID 1888 wrote to memory of 4840 1888 ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe 82 PID 1888 wrote to memory of 4840 1888 ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe 82 PID 4840 wrote to memory of 2756 4840 9hbtnh.exe 83 PID 4840 wrote to memory of 2756 4840 9hbtnh.exe 83 PID 4840 wrote to memory of 2756 4840 9hbtnh.exe 83 PID 2756 wrote to memory of 3152 2756 ddpjp.exe 84 PID 2756 wrote to memory of 3152 2756 ddpjp.exe 84 PID 2756 wrote to memory of 3152 2756 ddpjp.exe 84 PID 3152 wrote to memory of 2872 3152 dvjjp.exe 85 PID 3152 wrote to memory of 2872 3152 dvjjp.exe 85 PID 3152 wrote to memory of 2872 3152 dvjjp.exe 85 PID 2872 wrote to memory of 1324 2872 pdpjd.exe 86 PID 2872 wrote to memory of 1324 2872 pdpjd.exe 86 PID 2872 wrote to memory of 1324 2872 pdpjd.exe 86 PID 1324 wrote to memory of 4920 1324 btbbtt.exe 87 PID 1324 wrote to memory of 4920 1324 btbbtt.exe 87 PID 1324 wrote to memory of 4920 1324 btbbtt.exe 87 PID 4920 wrote to memory of 4048 4920 dvvpp.exe 88 PID 4920 wrote to memory of 4048 4920 dvvpp.exe 88 PID 4920 wrote to memory of 4048 4920 dvvpp.exe 88 PID 4048 wrote to memory of 2304 4048 dpjvp.exe 89 PID 4048 wrote to memory of 2304 4048 dpjvp.exe 89 PID 4048 wrote to memory of 2304 4048 dpjvp.exe 89 PID 2304 wrote to memory of 2748 2304 ttbbhb.exe 90 PID 2304 wrote to memory of 2748 2304 ttbbhb.exe 90 PID 2304 wrote to memory of 2748 2304 ttbbhb.exe 90 PID 2748 wrote to memory of 1248 2748 jjjdv.exe 91 PID 2748 wrote to memory of 1248 2748 jjjdv.exe 91 PID 2748 wrote to memory of 1248 2748 jjjdv.exe 91 PID 1248 wrote to memory of 2868 1248 xrrxxfx.exe 92 PID 1248 wrote to memory of 2868 1248 xrrxxfx.exe 92 PID 1248 wrote to memory of 2868 1248 xrrxxfx.exe 92 PID 2868 wrote to memory of 2760 2868 tttntb.exe 93 PID 2868 wrote to memory of 2760 2868 tttntb.exe 93 PID 2868 wrote to memory of 2760 2868 tttntb.exe 93 PID 2760 wrote to memory of 2004 2760 nbhbtt.exe 94 PID 2760 wrote to memory of 2004 2760 nbhbtt.exe 94 PID 2760 wrote to memory of 2004 2760 nbhbtt.exe 94 PID 2004 wrote to memory of 1488 2004 jdjdp.exe 95 PID 2004 wrote to memory of 1488 2004 jdjdp.exe 95 PID 2004 wrote to memory of 1488 2004 jdjdp.exe 95 PID 1488 wrote to memory of 1256 1488 ffllrxf.exe 96 PID 1488 wrote to memory of 1256 1488 ffllrxf.exe 96 PID 1488 wrote to memory of 1256 1488 ffllrxf.exe 96 PID 1256 wrote to memory of 32 1256 rffffrr.exe 97 PID 1256 wrote to memory of 32 1256 rffffrr.exe 97 PID 1256 wrote to memory of 32 1256 rffffrr.exe 97 PID 32 wrote to memory of 2368 32 tbbtnt.exe 98 PID 32 wrote to memory of 2368 32 tbbtnt.exe 98 PID 32 wrote to memory of 2368 32 tbbtnt.exe 98 PID 2368 wrote to memory of 1704 2368 nbnhhh.exe 99 PID 2368 wrote to memory of 1704 2368 nbnhhh.exe 99 PID 2368 wrote to memory of 1704 2368 nbnhhh.exe 99 PID 1704 wrote to memory of 2992 1704 pvdvp.exe 100 PID 1704 wrote to memory of 2992 1704 pvdvp.exe 100 PID 1704 wrote to memory of 2992 1704 pvdvp.exe 100 PID 2992 wrote to memory of 4896 2992 vdddd.exe 101 PID 2992 wrote to memory of 4896 2992 vdddd.exe 101 PID 2992 wrote to memory of 4896 2992 vdddd.exe 101 PID 4896 wrote to memory of 1408 4896 7xfxrxr.exe 102 PID 4896 wrote to memory of 1408 4896 7xfxrxr.exe 102 PID 4896 wrote to memory of 1408 4896 7xfxrxr.exe 102 PID 1408 wrote to memory of 3416 1408 tntttb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe"C:\Users\Admin\AppData\Local\Temp\ebb10c0c9ced790d2e50bad25823a1578ba3d3f3810e50d7f66ba85c73598959.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\9hbtnh.exec:\9hbtnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\ddpjp.exec:\ddpjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\dvjjp.exec:\dvjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\pdpjd.exec:\pdpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\btbbtt.exec:\btbbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\dvvpp.exec:\dvvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\dpjvp.exec:\dpjvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\ttbbhb.exec:\ttbbhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\jjjdv.exec:\jjjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\xrrxxfx.exec:\xrrxxfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\tttntb.exec:\tttntb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\nbhbtt.exec:\nbhbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\jdjdp.exec:\jdjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\ffllrxf.exec:\ffllrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\rffffrr.exec:\rffffrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\tbbtnt.exec:\tbbtnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\nbnhhh.exec:\nbnhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\pvdvp.exec:\pvdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\vdddd.exec:\vdddd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\7xfxrxr.exec:\7xfxrxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\tntttb.exec:\tntttb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\jdjdd.exec:\jdjdd.exe23⤵
- Executes dropped EXE
PID:3416 -
\??\c:\rlrxxxr.exec:\rlrxxxr.exe24⤵
- Executes dropped EXE
PID:3136 -
\??\c:\tthtbb.exec:\tthtbb.exe25⤵
- Executes dropped EXE
PID:536 -
\??\c:\pppjd.exec:\pppjd.exe26⤵
- Executes dropped EXE
PID:4996 -
\??\c:\ppppj.exec:\ppppj.exe27⤵
- Executes dropped EXE
PID:4272 -
\??\c:\lfrrxxx.exec:\lfrrxxx.exe28⤵
- Executes dropped EXE
PID:4448 -
\??\c:\thbbbb.exec:\thbbbb.exe29⤵
- Executes dropped EXE
PID:516 -
\??\c:\nhnhbb.exec:\nhnhbb.exe30⤵
- Executes dropped EXE
PID:4348 -
\??\c:\pvddd.exec:\pvddd.exe31⤵
- Executes dropped EXE
PID:1924 -
\??\c:\fxfffxx.exec:\fxfffxx.exe32⤵
- Executes dropped EXE
PID:2344 -
\??\c:\fxxxxxx.exec:\fxxxxxx.exe33⤵
- Executes dropped EXE
PID:1104 -
\??\c:\thhhbt.exec:\thhhbt.exe34⤵
- Executes dropped EXE
PID:3868 -
\??\c:\vvjvv.exec:\vvjvv.exe35⤵
- Executes dropped EXE
PID:3964 -
\??\c:\dvdvp.exec:\dvdvp.exe36⤵
- Executes dropped EXE
PID:3156 -
\??\c:\xrrlllr.exec:\xrrlllr.exe37⤵
- Executes dropped EXE
PID:4820 -
\??\c:\nbtthn.exec:\nbtthn.exe38⤵
- Executes dropped EXE
PID:4660 -
\??\c:\nttthn.exec:\nttthn.exe39⤵
- Executes dropped EXE
PID:1744 -
\??\c:\ddvpd.exec:\ddvpd.exe40⤵
- Executes dropped EXE
PID:1168 -
\??\c:\rrrllfx.exec:\rrrllfx.exe41⤵
- Executes dropped EXE
PID:5012 -
\??\c:\xxxfxxr.exec:\xxxfxxr.exe42⤵
- Executes dropped EXE
PID:400 -
\??\c:\bntthb.exec:\bntthb.exe43⤵
- Executes dropped EXE
PID:2488 -
\??\c:\pdpdp.exec:\pdpdp.exe44⤵
- Executes dropped EXE
PID:3280 -
\??\c:\rlxrlrr.exec:\rlxrlrr.exe45⤵
- Executes dropped EXE
PID:1128 -
\??\c:\xxfxffx.exec:\xxfxffx.exe46⤵
- Executes dropped EXE
PID:3032 -
\??\c:\9hhbth.exec:\9hhbth.exe47⤵
- Executes dropped EXE
PID:3788 -
\??\c:\dddpv.exec:\dddpv.exe48⤵
- Executes dropped EXE
PID:2156 -
\??\c:\ffxxxfx.exec:\ffxxxfx.exe49⤵
- Executes dropped EXE
PID:3928 -
\??\c:\rxxxllf.exec:\rxxxllf.exe50⤵
- Executes dropped EXE
PID:4768 -
\??\c:\tnbbtn.exec:\tnbbtn.exe51⤵
- Executes dropped EXE
PID:4864 -
\??\c:\dvdvd.exec:\dvdvd.exe52⤵
- Executes dropped EXE
PID:3864 -
\??\c:\xllrxxr.exec:\xllrxxr.exe53⤵
- Executes dropped EXE
PID:3852 -
\??\c:\9rlfffx.exec:\9rlfffx.exe54⤵
- Executes dropped EXE
PID:4420 -
\??\c:\tnbbnn.exec:\tnbbnn.exe55⤵
- Executes dropped EXE
PID:4708 -
\??\c:\ppvpj.exec:\ppvpj.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3564 -
\??\c:\xxlxrff.exec:\xxlxrff.exe57⤵
- Executes dropped EXE
PID:2756 -
\??\c:\hbbbbb.exec:\hbbbbb.exe58⤵
- Executes dropped EXE
PID:3452 -
\??\c:\nnhhhn.exec:\nnhhhn.exe59⤵
- Executes dropped EXE
PID:1520 -
\??\c:\jdddv.exec:\jdddv.exe60⤵
- Executes dropped EXE
PID:1540 -
\??\c:\rrffllx.exec:\rrffllx.exe61⤵
- Executes dropped EXE
PID:4016 -
\??\c:\pjpjp.exec:\pjpjp.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4920 -
\??\c:\pjpjd.exec:\pjpjd.exe63⤵
- Executes dropped EXE
PID:4416 -
\??\c:\djvvv.exec:\djvvv.exe64⤵
- Executes dropped EXE
PID:4460 -
\??\c:\7djjp.exec:\7djjp.exe65⤵
- Executes dropped EXE
PID:4124 -
\??\c:\bbnhbt.exec:\bbnhbt.exe66⤵PID:4884
-
\??\c:\pdjdj.exec:\pdjdj.exe67⤵PID:1416
-
\??\c:\vvvdp.exec:\vvvdp.exe68⤵PID:3940
-
\??\c:\lflxrll.exec:\lflxrll.exe69⤵PID:2868
-
\??\c:\thhtht.exec:\thhtht.exe70⤵PID:3320
-
\??\c:\pjddv.exec:\pjddv.exe71⤵PID:2184
-
\??\c:\xffxlxf.exec:\xffxlxf.exe72⤵PID:2004
-
\??\c:\hbnbbb.exec:\hbnbbb.exe73⤵PID:608
-
\??\c:\ppjvp.exec:\ppjvp.exe74⤵PID:2676
-
\??\c:\ntttnn.exec:\ntttnn.exe75⤵PID:3440
-
\??\c:\fllffff.exec:\fllffff.exe76⤵PID:1524
-
\??\c:\nhhhhh.exec:\nhhhhh.exe77⤵PID:3872
-
\??\c:\pjpjd.exec:\pjpjd.exe78⤵
- System Location Discovery: System Language Discovery
PID:1612 -
\??\c:\frrrllf.exec:\frrrllf.exe79⤵PID:352
-
\??\c:\llrlffx.exec:\llrlffx.exe80⤵PID:4652
-
\??\c:\nntnnh.exec:\nntnnh.exe81⤵PID:1016
-
\??\c:\vppdd.exec:\vppdd.exe82⤵PID:1380
-
\??\c:\xrfffff.exec:\xrfffff.exe83⤵PID:648
-
\??\c:\hhhhbh.exec:\hhhhbh.exe84⤵PID:2636
-
\??\c:\vjvpj.exec:\vjvpj.exe85⤵PID:5036
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe86⤵PID:1056
-
\??\c:\bthbbb.exec:\bthbbb.exe87⤵PID:4272
-
\??\c:\hhnnhn.exec:\hhnnhn.exe88⤵PID:3260
-
\??\c:\ddppd.exec:\ddppd.exe89⤵PID:516
-
\??\c:\xrxlxff.exec:\xrxlxff.exe90⤵
- System Location Discovery: System Language Discovery
PID:3272 -
\??\c:\htbtnn.exec:\htbtnn.exe91⤵PID:1784
-
\??\c:\dvjdj.exec:\dvjdj.exe92⤵PID:1584
-
\??\c:\rxxrrll.exec:\rxxrrll.exe93⤵PID:3048
-
\??\c:\nhtnnb.exec:\nhtnnb.exe94⤵PID:2144
-
\??\c:\tnnnnn.exec:\tnnnnn.exe95⤵PID:3020
-
\??\c:\jvdvv.exec:\jvdvv.exe96⤵PID:4552
-
\??\c:\rxrrrrf.exec:\rxrrrrf.exe97⤵PID:2620
-
\??\c:\nbnhbb.exec:\nbnhbb.exe98⤵PID:4644
-
\??\c:\ddvvj.exec:\ddvvj.exe99⤵PID:964
-
\??\c:\llrrfll.exec:\llrrfll.exe100⤵PID:2596
-
\??\c:\ntbbhn.exec:\ntbbhn.exe101⤵PID:2444
-
\??\c:\7htnbb.exec:\7htnbb.exe102⤵PID:1260
-
\??\c:\ddddd.exec:\ddddd.exe103⤵PID:4740
-
\??\c:\lfllllr.exec:\lfllllr.exe104⤵PID:2956
-
\??\c:\hnhhtn.exec:\hnhhtn.exe105⤵PID:3280
-
\??\c:\jjppp.exec:\jjppp.exe106⤵PID:1128
-
\??\c:\1vppj.exec:\1vppj.exe107⤵PID:2456
-
\??\c:\rlxrrrl.exec:\rlxrrrl.exe108⤵PID:528
-
\??\c:\bnttth.exec:\bnttth.exe109⤵PID:1600
-
\??\c:\jjpjj.exec:\jjpjj.exe110⤵PID:3088
-
\??\c:\lxlllll.exec:\lxlllll.exe111⤵PID:3132
-
\??\c:\7xxxrrr.exec:\7xxxrrr.exe112⤵PID:2380
-
\??\c:\hbnhht.exec:\hbnhht.exe113⤵PID:2232
-
\??\c:\vppdv.exec:\vppdv.exe114⤵PID:2120
-
\??\c:\djvvv.exec:\djvvv.exe115⤵PID:3588
-
\??\c:\rrllllr.exec:\rrllllr.exe116⤵PID:1740
-
\??\c:\5nbbtb.exec:\5nbbtb.exe117⤵PID:4324
-
\??\c:\jdjjj.exec:\jdjjj.exe118⤵PID:4680
-
\??\c:\rflfxxx.exec:\rflfxxx.exe119⤵PID:3612
-
\??\c:\nhnnhh.exec:\nhnnhh.exe120⤵PID:448
-
\??\c:\bhtthb.exec:\bhtthb.exe121⤵PID:368
-
\??\c:\dppvd.exec:\dppvd.exe122⤵PID:2408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-