Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 07:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fd37ed8c5959303f3e839baa335b7c75291da1ad44a2901f2dfd3afe2bacb19c.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
fd37ed8c5959303f3e839baa335b7c75291da1ad44a2901f2dfd3afe2bacb19c.exe
-
Size
455KB
-
MD5
bebb29b116de1f3c81a744a33a1134f9
-
SHA1
d98930ff343d63589463e2306cbdf70f4d68ccc5
-
SHA256
fd37ed8c5959303f3e839baa335b7c75291da1ad44a2901f2dfd3afe2bacb19c
-
SHA512
e96f55607bbf26f20b4d9a37a68aa54ae488689d8fd4e34eb7913666c14c9659aa094a396ee2bd865594ed4b7835a18a445d7ac0a5089847d829cf7585845d9e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRr:q7Tc2NYHUrAwfMp3CDRr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4500-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2680-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1852-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2748-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-657-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-697-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-752-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-780-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-822-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-1175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-1035-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1768-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1744-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4248-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1264-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3788-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3668 pjjdd.exe 2128 3xrrlff.exe 4576 rxffllr.exe 2660 tthbtt.exe 3792 pdpdp.exe 4500 frxxrrr.exe 4112 nnhtnb.exe 5044 djddv.exe 4588 9lfxlxr.exe 3540 bhhhnn.exe 3704 9vjvv.exe 1436 5bthbh.exe 4504 vdjjd.exe 3732 rlxrllx.exe 1796 nbthbb.exe 1620 vvjpd.exe 3600 bbhthn.exe 1076 dpjdp.exe 3788 xrllfrr.exe 4908 xrxrllf.exe 2792 nhbbhn.exe 4764 dvdvj.exe 1264 ffffllr.exe 1896 dpjvj.exe 3392 rlrrlrr.exe 748 vvvpd.exe 3680 frlxllr.exe 4584 ntttnh.exe 2960 dvddv.exe 2952 llfxlrf.exe 2224 3bbnbh.exe 2156 jddvp.exe 3300 3frlfxr.exe 940 7llxxrr.exe 1008 nhhtbn.exe 4472 dvdvp.exe 2480 fflxrxr.exe 2216 tthbbt.exe 856 pvdvv.exe 3604 rffrlfr.exe 2800 frxrrrr.exe 3584 nnhnhh.exe 4540 jpppp.exe 2380 vjvjv.exe 4912 rrlrlxl.exe 3888 hbbbtt.exe 2028 pvdvd.exe 3668 rrxlfrl.exe 3960 bnnhbb.exe 3548 hthnnh.exe 3396 vjdvp.exe 4368 fllrfxl.exe 3792 1nnhhb.exe 3480 vjvvp.exe 4424 fllxfxf.exe 4112 nttnhh.exe 3884 nhbtnb.exe 3892 7pjdv.exe 3964 9fflfxl.exe 2796 tnttbb.exe 3956 bhttnt.exe 3704 9lrllll.exe 3528 lxfxxrl.exe 532 9nbnhb.exe -
resource yara_rule behavioral2/memory/4500-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1852-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2748-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-780-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-1509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-1855-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-1860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-1175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-1084-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-1035-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3792-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3300-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1264-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3788-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3704-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-44-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rllxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlrlr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2752 wrote to memory of 3668 2752 fd37ed8c5959303f3e839baa335b7c75291da1ad44a2901f2dfd3afe2bacb19c.exe 83 PID 2752 wrote to memory of 3668 2752 fd37ed8c5959303f3e839baa335b7c75291da1ad44a2901f2dfd3afe2bacb19c.exe 83 PID 2752 wrote to memory of 3668 2752 fd37ed8c5959303f3e839baa335b7c75291da1ad44a2901f2dfd3afe2bacb19c.exe 83 PID 3668 wrote to memory of 2128 3668 pjjdd.exe 84 PID 3668 wrote to memory of 2128 3668 pjjdd.exe 84 PID 3668 wrote to memory of 2128 3668 pjjdd.exe 84 PID 2128 wrote to memory of 4576 2128 3xrrlff.exe 258 PID 2128 wrote to memory of 4576 2128 3xrrlff.exe 258 PID 2128 wrote to memory of 4576 2128 3xrrlff.exe 258 PID 4576 wrote to memory of 2660 4576 rxffllr.exe 86 PID 4576 wrote to memory of 2660 4576 rxffllr.exe 86 PID 4576 wrote to memory of 2660 4576 rxffllr.exe 86 PID 2660 wrote to memory of 3792 2660 tthbtt.exe 87 PID 2660 wrote to memory of 3792 2660 tthbtt.exe 87 PID 2660 wrote to memory of 3792 2660 tthbtt.exe 87 PID 3792 wrote to memory of 4500 3792 pdpdp.exe 88 PID 3792 wrote to memory of 4500 3792 pdpdp.exe 88 PID 3792 wrote to memory of 4500 3792 pdpdp.exe 88 PID 4500 wrote to memory of 4112 4500 frxxrrr.exe 89 PID 4500 wrote to memory of 4112 4500 frxxrrr.exe 89 PID 4500 wrote to memory of 4112 4500 frxxrrr.exe 89 PID 4112 wrote to memory of 5044 4112 nnhtnb.exe 90 PID 4112 wrote to memory of 5044 4112 nnhtnb.exe 90 PID 4112 wrote to memory of 5044 4112 nnhtnb.exe 90 PID 5044 wrote to memory of 4588 5044 djddv.exe 91 PID 5044 wrote to memory of 4588 5044 djddv.exe 91 PID 5044 wrote to memory of 4588 5044 djddv.exe 91 PID 4588 wrote to memory of 3540 4588 9lfxlxr.exe 92 PID 4588 wrote to memory of 3540 4588 9lfxlxr.exe 92 PID 4588 wrote to memory of 3540 4588 9lfxlxr.exe 92 PID 3540 wrote to memory of 3704 3540 bhhhnn.exe 93 PID 3540 wrote to memory of 3704 3540 bhhhnn.exe 93 PID 3540 wrote to memory of 3704 3540 bhhhnn.exe 93 PID 3704 wrote to memory of 1436 3704 9vjvv.exe 94 PID 3704 wrote to memory of 1436 3704 9vjvv.exe 94 PID 3704 wrote to memory of 1436 3704 9vjvv.exe 94 PID 1436 wrote to memory of 4504 1436 5bthbh.exe 95 PID 1436 wrote to memory of 4504 1436 5bthbh.exe 95 PID 1436 wrote to memory of 4504 1436 5bthbh.exe 95 PID 4504 wrote to memory of 3732 4504 vdjjd.exe 96 PID 4504 wrote to memory of 3732 4504 vdjjd.exe 96 PID 4504 wrote to memory of 3732 4504 vdjjd.exe 96 PID 3732 wrote to memory of 1796 3732 rlxrllx.exe 97 PID 3732 wrote to memory of 1796 3732 rlxrllx.exe 97 PID 3732 wrote to memory of 1796 3732 rlxrllx.exe 97 PID 1796 wrote to memory of 1620 1796 nbthbb.exe 98 PID 1796 wrote to memory of 1620 1796 nbthbb.exe 98 PID 1796 wrote to memory of 1620 1796 nbthbb.exe 98 PID 1620 wrote to memory of 3600 1620 vvjpd.exe 99 PID 1620 wrote to memory of 3600 1620 vvjpd.exe 99 PID 1620 wrote to memory of 3600 1620 vvjpd.exe 99 PID 3600 wrote to memory of 1076 3600 bbhthn.exe 100 PID 3600 wrote to memory of 1076 3600 bbhthn.exe 100 PID 3600 wrote to memory of 1076 3600 bbhthn.exe 100 PID 1076 wrote to memory of 3788 1076 dpjdp.exe 101 PID 1076 wrote to memory of 3788 1076 dpjdp.exe 101 PID 1076 wrote to memory of 3788 1076 dpjdp.exe 101 PID 3788 wrote to memory of 4908 3788 xrllfrr.exe 102 PID 3788 wrote to memory of 4908 3788 xrllfrr.exe 102 PID 3788 wrote to memory of 4908 3788 xrllfrr.exe 102 PID 4908 wrote to memory of 2792 4908 xrxrllf.exe 103 PID 4908 wrote to memory of 2792 4908 xrxrllf.exe 103 PID 4908 wrote to memory of 2792 4908 xrxrllf.exe 103 PID 2792 wrote to memory of 4764 2792 nhbbhn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd37ed8c5959303f3e839baa335b7c75291da1ad44a2901f2dfd3afe2bacb19c.exe"C:\Users\Admin\AppData\Local\Temp\fd37ed8c5959303f3e839baa335b7c75291da1ad44a2901f2dfd3afe2bacb19c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\pjjdd.exec:\pjjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\3xrrlff.exec:\3xrrlff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\rxffllr.exec:\rxffllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\tthbtt.exec:\tthbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\pdpdp.exec:\pdpdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\frxxrrr.exec:\frxxrrr.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\nnhtnb.exec:\nnhtnb.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\djddv.exec:\djddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\9lfxlxr.exec:\9lfxlxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\bhhhnn.exec:\bhhhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\9vjvv.exec:\9vjvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\5bthbh.exec:\5bthbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\vdjjd.exec:\vdjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\rlxrllx.exec:\rlxrllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\nbthbb.exec:\nbthbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\vvjpd.exec:\vvjpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\bbhthn.exec:\bbhthn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\dpjdp.exec:\dpjdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\xrllfrr.exec:\xrllfrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\xrxrllf.exec:\xrxrllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\nhbbhn.exec:\nhbbhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\dvdvj.exec:\dvdvj.exe23⤵
- Executes dropped EXE
PID:4764 -
\??\c:\ffffllr.exec:\ffffllr.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1264 -
\??\c:\dpjvj.exec:\dpjvj.exe25⤵
- Executes dropped EXE
PID:1896 -
\??\c:\rlrrlrr.exec:\rlrrlrr.exe26⤵
- Executes dropped EXE
PID:3392 -
\??\c:\vvvpd.exec:\vvvpd.exe27⤵
- Executes dropped EXE
PID:748 -
\??\c:\frlxllr.exec:\frlxllr.exe28⤵
- Executes dropped EXE
PID:3680 -
\??\c:\ntttnh.exec:\ntttnh.exe29⤵
- Executes dropped EXE
PID:4584 -
\??\c:\dvddv.exec:\dvddv.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2960 -
\??\c:\llfxlrf.exec:\llfxlrf.exe31⤵
- Executes dropped EXE
PID:2952 -
\??\c:\3bbnbh.exec:\3bbnbh.exe32⤵
- Executes dropped EXE
PID:2224 -
\??\c:\jddvp.exec:\jddvp.exe33⤵
- Executes dropped EXE
PID:2156 -
\??\c:\3frlfxr.exec:\3frlfxr.exe34⤵
- Executes dropped EXE
PID:3300 -
\??\c:\7llxxrr.exec:\7llxxrr.exe35⤵
- Executes dropped EXE
PID:940 -
\??\c:\nhhtbn.exec:\nhhtbn.exe36⤵
- Executes dropped EXE
PID:1008 -
\??\c:\dvdvp.exec:\dvdvp.exe37⤵
- Executes dropped EXE
PID:4472 -
\??\c:\fflxrxr.exec:\fflxrxr.exe38⤵
- Executes dropped EXE
PID:2480 -
\??\c:\tthbbt.exec:\tthbbt.exe39⤵
- Executes dropped EXE
PID:2216 -
\??\c:\pvdvv.exec:\pvdvv.exe40⤵
- Executes dropped EXE
PID:856 -
\??\c:\rffrlfr.exec:\rffrlfr.exe41⤵
- Executes dropped EXE
PID:3604 -
\??\c:\frxrrrr.exec:\frxrrrr.exe42⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nnhnhh.exec:\nnhnhh.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3584 -
\??\c:\jpppp.exec:\jpppp.exe44⤵
- Executes dropped EXE
PID:4540 -
\??\c:\vjvjv.exec:\vjvjv.exe45⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rrlrlxl.exec:\rrlrlxl.exe46⤵
- Executes dropped EXE
PID:4912 -
\??\c:\hbbbtt.exec:\hbbbtt.exe47⤵
- Executes dropped EXE
PID:3888 -
\??\c:\pvdvd.exec:\pvdvd.exe48⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rrxlfrl.exec:\rrxlfrl.exe49⤵
- Executes dropped EXE
PID:3668 -
\??\c:\bnnhbb.exec:\bnnhbb.exe50⤵
- Executes dropped EXE
PID:3960 -
\??\c:\hthnnh.exec:\hthnnh.exe51⤵
- Executes dropped EXE
PID:3548 -
\??\c:\vjdvp.exec:\vjdvp.exe52⤵
- Executes dropped EXE
PID:3396 -
\??\c:\fllrfxl.exec:\fllrfxl.exe53⤵
- Executes dropped EXE
PID:4368 -
\??\c:\1nnhhb.exec:\1nnhhb.exe54⤵
- Executes dropped EXE
PID:3792 -
\??\c:\vjvvp.exec:\vjvvp.exe55⤵
- Executes dropped EXE
PID:3480 -
\??\c:\fllxfxf.exec:\fllxfxf.exe56⤵
- Executes dropped EXE
PID:4424 -
\??\c:\nttnhh.exec:\nttnhh.exe57⤵
- Executes dropped EXE
PID:4112 -
\??\c:\nhbtnb.exec:\nhbtnb.exe58⤵
- Executes dropped EXE
PID:3884 -
\??\c:\7pjdv.exec:\7pjdv.exe59⤵
- Executes dropped EXE
PID:3892 -
\??\c:\9fflfxl.exec:\9fflfxl.exe60⤵
- Executes dropped EXE
PID:3964 -
\??\c:\tnttbb.exec:\tnttbb.exe61⤵
- Executes dropped EXE
PID:2796 -
\??\c:\bhttnt.exec:\bhttnt.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3956 -
\??\c:\9lrllll.exec:\9lrllll.exe63⤵
- Executes dropped EXE
PID:3704 -
\??\c:\lxfxxrl.exec:\lxfxxrl.exe64⤵
- Executes dropped EXE
PID:3528 -
\??\c:\9nbnhb.exec:\9nbnhb.exe65⤵
- Executes dropped EXE
PID:532 -
\??\c:\vjjvp.exec:\vjjvp.exe66⤵PID:4248
-
\??\c:\ffffxxx.exec:\ffffxxx.exe67⤵PID:3844
-
\??\c:\bntnhn.exec:\bntnhn.exe68⤵PID:2656
-
\??\c:\pvvpd.exec:\pvvpd.exe69⤵PID:3196
-
\??\c:\ppvpd.exec:\ppvpd.exe70⤵PID:1564
-
\??\c:\xrlxrfx.exec:\xrlxrfx.exe71⤵PID:592
-
\??\c:\bthbtn.exec:\bthbtn.exe72⤵PID:1716
-
\??\c:\jpvpj.exec:\jpvpj.exe73⤵PID:1356
-
\??\c:\pjjdd.exec:\pjjdd.exe74⤵PID:1684
-
\??\c:\lrxxllf.exec:\lrxxllf.exe75⤵
- System Location Discovery: System Language Discovery
PID:4100 -
\??\c:\tbnbbh.exec:\tbnbbh.exe76⤵PID:3124
-
\??\c:\nhbhbh.exec:\nhbhbh.exe77⤵
- System Location Discovery: System Language Discovery
PID:624 -
\??\c:\ppjjd.exec:\ppjjd.exe78⤵PID:1036
-
\??\c:\rlfxffl.exec:\rlfxffl.exe79⤵PID:1504
-
\??\c:\tbbhnt.exec:\tbbhnt.exe80⤵PID:2680
-
\??\c:\jjjvj.exec:\jjjvj.exe81⤵PID:4732
-
\??\c:\ddpdj.exec:\ddpdj.exe82⤵PID:1744
-
\??\c:\lrrlrff.exec:\lrrlrff.exe83⤵PID:3640
-
\??\c:\7bhbtt.exec:\7bhbtt.exe84⤵PID:4392
-
\??\c:\nnnhbb.exec:\nnnhbb.exe85⤵PID:3680
-
\??\c:\vvvpp.exec:\vvvpp.exe86⤵PID:1984
-
\??\c:\ffrlffx.exec:\ffrlffx.exe87⤵PID:2960
-
\??\c:\thhntn.exec:\thhntn.exe88⤵PID:2952
-
\??\c:\bbbttt.exec:\bbbttt.exe89⤵PID:852
-
\??\c:\jvdvj.exec:\jvdvj.exe90⤵PID:2156
-
\??\c:\flrlfff.exec:\flrlfff.exe91⤵PID:4344
-
\??\c:\xfxxfrx.exec:\xfxxfrx.exe92⤵PID:3632
-
\??\c:\bbbttt.exec:\bbbttt.exe93⤵PID:940
-
\??\c:\djvvj.exec:\djvvj.exe94⤵PID:1008
-
\??\c:\xrxrlll.exec:\xrxrlll.exe95⤵PID:1852
-
\??\c:\fxlrrxf.exec:\fxlrrxf.exe96⤵PID:1892
-
\??\c:\hnnhbt.exec:\hnnhbt.exe97⤵PID:2824
-
\??\c:\3vvpj.exec:\3vvpj.exe98⤵PID:4412
-
\??\c:\3ppjv.exec:\3ppjv.exe99⤵PID:3692
-
\??\c:\xrfrlxr.exec:\xrfrlxr.exe100⤵PID:2968
-
\??\c:\rrlfxrx.exec:\rrlfxrx.exe101⤵PID:5008
-
\??\c:\httnht.exec:\httnht.exe102⤵PID:2748
-
\??\c:\jppjd.exec:\jppjd.exe103⤵PID:900
-
\??\c:\1djpd.exec:\1djpd.exe104⤵PID:5100
-
\??\c:\llxrffx.exec:\llxrffx.exe105⤵PID:4320
-
\??\c:\nnhtnh.exec:\nnhtnh.exe106⤵PID:2752
-
\??\c:\btbntb.exec:\btbntb.exe107⤵PID:2244
-
\??\c:\9jdvj.exec:\9jdvj.exe108⤵PID:2028
-
\??\c:\ppjdp.exec:\ppjdp.exe109⤵PID:4228
-
\??\c:\1flfxxf.exec:\1flfxxf.exe110⤵PID:3724
-
\??\c:\tbnbtt.exec:\tbnbtt.exe111⤵PID:5032
-
\??\c:\tbthbh.exec:\tbthbh.exe112⤵PID:2092
-
\??\c:\5jpjj.exec:\5jpjj.exe113⤵PID:1776
-
\??\c:\lxffrlf.exec:\lxffrlf.exe114⤵PID:4888
-
\??\c:\1rrlllf.exec:\1rrlllf.exe115⤵PID:736
-
\??\c:\tthnth.exec:\tthnth.exe116⤵PID:4256
-
\??\c:\tnhbtb.exec:\tnhbtb.exe117⤵PID:5084
-
\??\c:\3jjdd.exec:\3jjdd.exe118⤵PID:1252
-
\??\c:\flxlffx.exec:\flxlffx.exe119⤵
- System Location Discovery: System Language Discovery
PID:4928 -
\??\c:\llxrxrl.exec:\llxrxrl.exe120⤵PID:2808
-
\??\c:\btbttt.exec:\btbttt.exe121⤵PID:3492
-
\??\c:\dpvjd.exec:\dpvjd.exe122⤵PID:3540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-