Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 03:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2f32f1cadf5995b04811a844675c50c4779388a993caaf95c1215a441c720bafN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
2f32f1cadf5995b04811a844675c50c4779388a993caaf95c1215a441c720bafN.exe
-
Size
454KB
-
MD5
7c3a485f6d7bc56bac070859943e7d10
-
SHA1
6b6d8dddab20e57da09c6af1e034021ab2ce3142
-
SHA256
2f32f1cadf5995b04811a844675c50c4779388a993caaf95c1215a441c720baf
-
SHA512
a16d2ea271d83ee9557ae2e2b26146ce595c005705bdeb705d882d1c9adadce3c470b357b189c940382afd32ff28fd7b1bc6ff07c6751b95efa38a6861f8267f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2808-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3752-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1324-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/312-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/568-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/736-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/384-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/904-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1236-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/932-607-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-697-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-857-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-861-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-1055-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4428 jvvpp.exe 5088 jvpjp.exe 2304 i066000.exe 3976 04482.exe 3752 04080.exe 4180 bttnhh.exe 3128 424882.exe 3460 vjvvp.exe 4316 lrxxllf.exe 3972 tnntnn.exe 4604 826604.exe 4200 7vvvp.exe 4060 6222660.exe 4692 dddvp.exe 1324 8460004.exe 4836 6226000.exe 4852 8884888.exe 4012 tnnhhb.exe 5024 vjjdv.exe 1968 244248.exe 3440 48808.exe 312 s0420.exe 3276 828208.exe 4928 jdvjp.exe 808 8826426.exe 568 668682.exe 736 xrlfxll.exe 2576 ddddd.exe 232 vvvvp.exe 3104 4828282.exe 780 644046.exe 1432 lfllxxr.exe 384 3dddd.exe 4784 0488626.exe 1680 2848444.exe 3028 9ttnnn.exe 4608 3flffxx.exe 904 o808822.exe 5064 4822660.exe 4340 00260.exe 2176 pdddv.exe 5056 e28204.exe 4092 q28604.exe 1476 5hbtbn.exe 3700 824402.exe 2924 622266.exe 3940 pjdjd.exe 3396 82884.exe 4740 5rxrrrx.exe 4288 pjjjp.exe 2796 thhbbt.exe 3976 xrxrxlx.exe 3512 044480.exe 1620 8426000.exe 892 ddjjj.exe 4180 ttbnbb.exe 3128 nbhbbt.exe 4808 lrxrfxx.exe 3044 48466.exe 1668 406048.exe 4356 o444822.exe 2984 rfxrlfx.exe 4976 806600.exe 4604 4826600.exe -
resource yara_rule behavioral2/memory/2808-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/312-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/568-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/736-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/384-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/904-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1236-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2116-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3312-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/932-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-633-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 688222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02422.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g0660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 446600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 664248.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6888608.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6048826.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24022.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k46404.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 000080.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68484.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2808 wrote to memory of 4428 2808 2f32f1cadf5995b04811a844675c50c4779388a993caaf95c1215a441c720bafN.exe 83 PID 2808 wrote to memory of 4428 2808 2f32f1cadf5995b04811a844675c50c4779388a993caaf95c1215a441c720bafN.exe 83 PID 2808 wrote to memory of 4428 2808 2f32f1cadf5995b04811a844675c50c4779388a993caaf95c1215a441c720bafN.exe 83 PID 4428 wrote to memory of 5088 4428 jvvpp.exe 84 PID 4428 wrote to memory of 5088 4428 jvvpp.exe 84 PID 4428 wrote to memory of 5088 4428 jvvpp.exe 84 PID 5088 wrote to memory of 2304 5088 jvpjp.exe 85 PID 5088 wrote to memory of 2304 5088 jvpjp.exe 85 PID 5088 wrote to memory of 2304 5088 jvpjp.exe 85 PID 2304 wrote to memory of 3976 2304 i066000.exe 86 PID 2304 wrote to memory of 3976 2304 i066000.exe 86 PID 2304 wrote to memory of 3976 2304 i066000.exe 86 PID 3976 wrote to memory of 3752 3976 04482.exe 87 PID 3976 wrote to memory of 3752 3976 04482.exe 87 PID 3976 wrote to memory of 3752 3976 04482.exe 87 PID 3752 wrote to memory of 4180 3752 04080.exe 88 PID 3752 wrote to memory of 4180 3752 04080.exe 88 PID 3752 wrote to memory of 4180 3752 04080.exe 88 PID 4180 wrote to memory of 3128 4180 bttnhh.exe 89 PID 4180 wrote to memory of 3128 4180 bttnhh.exe 89 PID 4180 wrote to memory of 3128 4180 bttnhh.exe 89 PID 3128 wrote to memory of 3460 3128 424882.exe 90 PID 3128 wrote to memory of 3460 3128 424882.exe 90 PID 3128 wrote to memory of 3460 3128 424882.exe 90 PID 3460 wrote to memory of 4316 3460 vjvvp.exe 91 PID 3460 wrote to memory of 4316 3460 vjvvp.exe 91 PID 3460 wrote to memory of 4316 3460 vjvvp.exe 91 PID 4316 wrote to memory of 3972 4316 lrxxllf.exe 92 PID 4316 wrote to memory of 3972 4316 lrxxllf.exe 92 PID 4316 wrote to memory of 3972 4316 lrxxllf.exe 92 PID 3972 wrote to memory of 4604 3972 tnntnn.exe 93 PID 3972 wrote to memory of 4604 3972 tnntnn.exe 93 PID 3972 wrote to memory of 4604 3972 tnntnn.exe 93 PID 4604 wrote to memory of 4200 4604 826604.exe 94 PID 4604 wrote to memory of 4200 4604 826604.exe 94 PID 4604 wrote to memory of 4200 4604 826604.exe 94 PID 4200 wrote to memory of 4060 4200 7vvvp.exe 95 PID 4200 wrote to memory of 4060 4200 7vvvp.exe 95 PID 4200 wrote to memory of 4060 4200 7vvvp.exe 95 PID 4060 wrote to memory of 4692 4060 6222660.exe 96 PID 4060 wrote to memory of 4692 4060 6222660.exe 96 PID 4060 wrote to memory of 4692 4060 6222660.exe 96 PID 4692 wrote to memory of 1324 4692 dddvp.exe 97 PID 4692 wrote to memory of 1324 4692 dddvp.exe 97 PID 4692 wrote to memory of 1324 4692 dddvp.exe 97 PID 1324 wrote to memory of 4836 1324 8460004.exe 98 PID 1324 wrote to memory of 4836 1324 8460004.exe 98 PID 1324 wrote to memory of 4836 1324 8460004.exe 98 PID 4836 wrote to memory of 4852 4836 6226000.exe 99 PID 4836 wrote to memory of 4852 4836 6226000.exe 99 PID 4836 wrote to memory of 4852 4836 6226000.exe 99 PID 4852 wrote to memory of 4012 4852 8884888.exe 100 PID 4852 wrote to memory of 4012 4852 8884888.exe 100 PID 4852 wrote to memory of 4012 4852 8884888.exe 100 PID 4012 wrote to memory of 5024 4012 tnnhhb.exe 101 PID 4012 wrote to memory of 5024 4012 tnnhhb.exe 101 PID 4012 wrote to memory of 5024 4012 tnnhhb.exe 101 PID 5024 wrote to memory of 1968 5024 vjjdv.exe 102 PID 5024 wrote to memory of 1968 5024 vjjdv.exe 102 PID 5024 wrote to memory of 1968 5024 vjjdv.exe 102 PID 1968 wrote to memory of 3440 1968 244248.exe 103 PID 1968 wrote to memory of 3440 1968 244248.exe 103 PID 1968 wrote to memory of 3440 1968 244248.exe 103 PID 3440 wrote to memory of 312 3440 48808.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f32f1cadf5995b04811a844675c50c4779388a993caaf95c1215a441c720bafN.exe"C:\Users\Admin\AppData\Local\Temp\2f32f1cadf5995b04811a844675c50c4779388a993caaf95c1215a441c720bafN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\jvvpp.exec:\jvvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\jvpjp.exec:\jvpjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\i066000.exec:\i066000.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\04482.exec:\04482.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\04080.exec:\04080.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\bttnhh.exec:\bttnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\424882.exec:\424882.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\vjvvp.exec:\vjvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\lrxxllf.exec:\lrxxllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\tnntnn.exec:\tnntnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\826604.exec:\826604.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\7vvvp.exec:\7vvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\6222660.exec:\6222660.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\dddvp.exec:\dddvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\8460004.exec:\8460004.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\6226000.exec:\6226000.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\8884888.exec:\8884888.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\tnnhhb.exec:\tnnhhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\vjjdv.exec:\vjjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\244248.exec:\244248.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\48808.exec:\48808.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\s0420.exec:\s0420.exe23⤵
- Executes dropped EXE
PID:312 -
\??\c:\828208.exec:\828208.exe24⤵
- Executes dropped EXE
PID:3276 -
\??\c:\jdvjp.exec:\jdvjp.exe25⤵
- Executes dropped EXE
PID:4928 -
\??\c:\8826426.exec:\8826426.exe26⤵
- Executes dropped EXE
PID:808 -
\??\c:\668682.exec:\668682.exe27⤵
- Executes dropped EXE
PID:568 -
\??\c:\xrlfxll.exec:\xrlfxll.exe28⤵
- Executes dropped EXE
PID:736 -
\??\c:\ddddd.exec:\ddddd.exe29⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vvvvp.exec:\vvvvp.exe30⤵
- Executes dropped EXE
PID:232 -
\??\c:\4828282.exec:\4828282.exe31⤵
- Executes dropped EXE
PID:3104 -
\??\c:\644046.exec:\644046.exe32⤵
- Executes dropped EXE
PID:780 -
\??\c:\lfllxxr.exec:\lfllxxr.exe33⤵
- Executes dropped EXE
PID:1432 -
\??\c:\3dddd.exec:\3dddd.exe34⤵
- Executes dropped EXE
PID:384 -
\??\c:\0488626.exec:\0488626.exe35⤵
- Executes dropped EXE
PID:4784 -
\??\c:\2848444.exec:\2848444.exe36⤵
- Executes dropped EXE
PID:1680 -
\??\c:\9ttnnn.exec:\9ttnnn.exe37⤵
- Executes dropped EXE
PID:3028 -
\??\c:\3flffxx.exec:\3flffxx.exe38⤵
- Executes dropped EXE
PID:4608 -
\??\c:\o808822.exec:\o808822.exe39⤵
- Executes dropped EXE
PID:904 -
\??\c:\4822660.exec:\4822660.exe40⤵
- Executes dropped EXE
PID:5064 -
\??\c:\00260.exec:\00260.exe41⤵
- Executes dropped EXE
PID:4340 -
\??\c:\pdddv.exec:\pdddv.exe42⤵
- Executes dropped EXE
PID:2176 -
\??\c:\e28204.exec:\e28204.exe43⤵
- Executes dropped EXE
PID:5056 -
\??\c:\q28604.exec:\q28604.exe44⤵
- Executes dropped EXE
PID:4092 -
\??\c:\5hbtbn.exec:\5hbtbn.exe45⤵
- Executes dropped EXE
PID:1476 -
\??\c:\824402.exec:\824402.exe46⤵
- Executes dropped EXE
PID:3700 -
\??\c:\622266.exec:\622266.exe47⤵
- Executes dropped EXE
PID:2924 -
\??\c:\pjdjd.exec:\pjdjd.exe48⤵
- Executes dropped EXE
PID:3940 -
\??\c:\82884.exec:\82884.exe49⤵
- Executes dropped EXE
PID:3396 -
\??\c:\5rxrrrx.exec:\5rxrrrx.exe50⤵
- Executes dropped EXE
PID:4740 -
\??\c:\pjjjp.exec:\pjjjp.exe51⤵
- Executes dropped EXE
PID:4288 -
\??\c:\thhbbt.exec:\thhbbt.exe52⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xrxrxlx.exec:\xrxrxlx.exe53⤵
- Executes dropped EXE
PID:3976 -
\??\c:\044480.exec:\044480.exe54⤵
- Executes dropped EXE
PID:3512 -
\??\c:\8426000.exec:\8426000.exe55⤵
- Executes dropped EXE
PID:1620 -
\??\c:\ddjjj.exec:\ddjjj.exe56⤵
- Executes dropped EXE
PID:892 -
\??\c:\ttbnbb.exec:\ttbnbb.exe57⤵
- Executes dropped EXE
PID:4180 -
\??\c:\nbhbbt.exec:\nbhbbt.exe58⤵
- Executes dropped EXE
PID:3128 -
\??\c:\lrxrfxx.exec:\lrxrfxx.exe59⤵
- Executes dropped EXE
PID:4808 -
\??\c:\48466.exec:\48466.exe60⤵
- Executes dropped EXE
PID:3044 -
\??\c:\406048.exec:\406048.exe61⤵
- Executes dropped EXE
PID:1668 -
\??\c:\o444822.exec:\o444822.exe62⤵
- Executes dropped EXE
PID:4356 -
\??\c:\rfxrlfx.exec:\rfxrlfx.exe63⤵
- Executes dropped EXE
PID:2984 -
\??\c:\806600.exec:\806600.exe64⤵
- Executes dropped EXE
PID:4976 -
\??\c:\4826600.exec:\4826600.exe65⤵
- Executes dropped EXE
PID:4604 -
\??\c:\nhbbtn.exec:\nhbbtn.exe66⤵PID:1236
-
\??\c:\vjvjd.exec:\vjvjd.exe67⤵PID:1424
-
\??\c:\606060.exec:\606060.exe68⤵PID:4592
-
\??\c:\dpdpj.exec:\dpdpj.exe69⤵PID:3932
-
\??\c:\6200622.exec:\6200622.exe70⤵PID:2368
-
\??\c:\dvvjj.exec:\dvvjj.exe71⤵PID:3272
-
\??\c:\60488.exec:\60488.exe72⤵
- System Location Discovery: System Language Discovery
PID:2276 -
\??\c:\jjjdp.exec:\jjjdp.exe73⤵PID:5096
-
\??\c:\pjdvj.exec:\pjdvj.exe74⤵PID:4100
-
\??\c:\thnhbb.exec:\thnhbb.exe75⤵PID:2472
-
\??\c:\q00400.exec:\q00400.exe76⤵PID:1672
-
\??\c:\2244882.exec:\2244882.exe77⤵PID:4004
-
\??\c:\nhnbtn.exec:\nhnbtn.exe78⤵PID:5116
-
\??\c:\3bnbtn.exec:\3bnbtn.exe79⤵PID:1268
-
\??\c:\0064060.exec:\0064060.exe80⤵PID:2636
-
\??\c:\lrrfrlx.exec:\lrrfrlx.exe81⤵PID:2224
-
\??\c:\4226266.exec:\4226266.exe82⤵PID:1308
-
\??\c:\lrxrfxr.exec:\lrxrfxr.exe83⤵PID:4112
-
\??\c:\000826.exec:\000826.exe84⤵PID:772
-
\??\c:\o682604.exec:\o682604.exe85⤵PID:2612
-
\??\c:\7xrfxrf.exec:\7xrfxrf.exe86⤵PID:3492
-
\??\c:\64604.exec:\64604.exe87⤵PID:2200
-
\??\c:\844208.exec:\844208.exe88⤵PID:4036
-
\??\c:\hhhbhb.exec:\hhhbhb.exe89⤵PID:2116
-
\??\c:\280204.exec:\280204.exe90⤵PID:4132
-
\??\c:\ththbt.exec:\ththbt.exe91⤵PID:2540
-
\??\c:\i682604.exec:\i682604.exe92⤵PID:4916
-
\??\c:\202682.exec:\202682.exe93⤵PID:3312
-
\??\c:\xrfrlfx.exec:\xrfrlfx.exe94⤵PID:5040
-
\??\c:\o804228.exec:\o804228.exe95⤵PID:3344
-
\??\c:\4022604.exec:\4022604.exe96⤵PID:3408
-
\??\c:\e84848.exec:\e84848.exe97⤵PID:2028
-
\??\c:\k46404.exec:\k46404.exe98⤵
- System Location Discovery: System Language Discovery
PID:2976 -
\??\c:\m8460.exec:\m8460.exe99⤵PID:4784
-
\??\c:\688244.exec:\688244.exe100⤵PID:1680
-
\??\c:\4664428.exec:\4664428.exe101⤵PID:2160
-
\??\c:\w62004.exec:\w62004.exe102⤵PID:4608
-
\??\c:\0264268.exec:\0264268.exe103⤵PID:2928
-
\??\c:\260868.exec:\260868.exe104⤵PID:2268
-
\??\c:\w06226.exec:\w06226.exe105⤵PID:2900
-
\??\c:\00208.exec:\00208.exe106⤵PID:3936
-
\??\c:\4284888.exec:\4284888.exe107⤵PID:4280
-
\??\c:\xlfxlrl.exec:\xlfxlrl.exe108⤵PID:2764
-
\??\c:\682648.exec:\682648.exe109⤵PID:4092
-
\??\c:\tnnthh.exec:\tnnthh.exe110⤵PID:4924
-
\??\c:\7nnnbt.exec:\7nnnbt.exe111⤵PID:2272
-
\??\c:\btnntb.exec:\btnntb.exe112⤵PID:3268
-
\??\c:\822880.exec:\822880.exe113⤵PID:4536
-
\??\c:\1lfrlxr.exec:\1lfrlxr.exe114⤵PID:2348
-
\??\c:\2660442.exec:\2660442.exe115⤵PID:2972
-
\??\c:\688222.exec:\688222.exe116⤵
- System Location Discovery: System Language Discovery
PID:4500 -
\??\c:\fxfrxrx.exec:\fxfrxrx.exe117⤵PID:5084
-
\??\c:\jjvdd.exec:\jjvdd.exe118⤵PID:2496
-
\??\c:\86042.exec:\86042.exe119⤵PID:2072
-
\??\c:\2282642.exec:\2282642.exe120⤵PID:1700
-
\??\c:\jjppj.exec:\jjppj.exe121⤵PID:2880
-
\??\c:\8460888.exec:\8460888.exe122⤵PID:1548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-