Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 09:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fe31971659c280308977f5092dec377e63c42d8df18c9d790fab2f08fd88ed57.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
fe31971659c280308977f5092dec377e63c42d8df18c9d790fab2f08fd88ed57.exe
-
Size
487KB
-
MD5
6ee38431c177f390173f0ab32b549408
-
SHA1
3bf399258a013dec7952affe25b0909579948802
-
SHA256
fe31971659c280308977f5092dec377e63c42d8df18c9d790fab2f08fd88ed57
-
SHA512
c523b1a2f4bc774621e6ff64221bb462f372f514c32061839c4852034a390fa5bbfb17d47e45fe393a59f36d2df6b1f3e677e7b116a48d7e0e22d22d89c84dfb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2CfNnkymTwaJ3tb:q7Tc2NYHUrAwfMHNnplsp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2588-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/756-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3828-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2492-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-992-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-1179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3492 djppv.exe 1928 rfffxfx.exe 4480 pvjdj.exe 756 vvvdj.exe 2368 ntbnnh.exe 1204 flxxflr.exe 2304 lrfffll.exe 5060 3pvjp.exe 2640 vdddv.exe 3668 fxffrrl.exe 5052 nnbbhh.exe 2080 ppjjv.exe 1596 5fxlfll.exe 2136 bbnhhn.exe 2232 9dpdj.exe 5040 nnnbnb.exe 2956 fxxxxfx.exe 4532 ddvvv.exe 2828 tbbbnt.exe 4872 1fffxfx.exe 1820 jpjjd.exe 760 hnbbhn.exe 2600 httbnb.exe 1152 vdjjd.exe 1932 thnthh.exe 3012 tbbbtt.exe 4664 1thhnb.exe 1720 hntthn.exe 4600 3jjjj.exe 2716 ffxxfff.exe 2688 5nbtbt.exe 2868 3rfxfxf.exe 4824 hhhbtt.exe 3824 jdpjj.exe 2968 lxffrxl.exe 3952 ntnhhn.exe 1460 ddppj.exe 3568 7ffllll.exe 2484 htbbhb.exe 1352 hbhhhh.exe 4492 vpdvp.exe 3828 5rxxlrr.exe 720 7bbbbh.exe 5028 vdvvj.exe 464 xlxlfrr.exe 4132 hnbtbb.exe 3552 pjppp.exe 2744 lfxxrxx.exe 4332 7ntntt.exe 4460 dpppj.exe 2492 ppjjj.exe 3232 xrfflll.exe 1144 ttnnnn.exe 1336 djvpd.exe 4480 xllrxrr.exe 2164 ttnbbh.exe 1160 vdppd.exe 2424 lxlffrr.exe 4196 hbnhbt.exe 2720 djjjp.exe 1576 ffflflf.exe 232 hhhhbh.exe 5072 jjppp.exe 4128 xfrrrll.exe -
resource yara_rule behavioral2/memory/2588-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3828-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2492-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-644-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2588 wrote to memory of 3492 2588 fe31971659c280308977f5092dec377e63c42d8df18c9d790fab2f08fd88ed57.exe 83 PID 2588 wrote to memory of 3492 2588 fe31971659c280308977f5092dec377e63c42d8df18c9d790fab2f08fd88ed57.exe 83 PID 2588 wrote to memory of 3492 2588 fe31971659c280308977f5092dec377e63c42d8df18c9d790fab2f08fd88ed57.exe 83 PID 3492 wrote to memory of 1928 3492 djppv.exe 84 PID 3492 wrote to memory of 1928 3492 djppv.exe 84 PID 3492 wrote to memory of 1928 3492 djppv.exe 84 PID 1928 wrote to memory of 4480 1928 rfffxfx.exe 85 PID 1928 wrote to memory of 4480 1928 rfffxfx.exe 85 PID 1928 wrote to memory of 4480 1928 rfffxfx.exe 85 PID 4480 wrote to memory of 756 4480 pvjdj.exe 86 PID 4480 wrote to memory of 756 4480 pvjdj.exe 86 PID 4480 wrote to memory of 756 4480 pvjdj.exe 86 PID 756 wrote to memory of 2368 756 vvvdj.exe 87 PID 756 wrote to memory of 2368 756 vvvdj.exe 87 PID 756 wrote to memory of 2368 756 vvvdj.exe 87 PID 2368 wrote to memory of 1204 2368 ntbnnh.exe 88 PID 2368 wrote to memory of 1204 2368 ntbnnh.exe 88 PID 2368 wrote to memory of 1204 2368 ntbnnh.exe 88 PID 1204 wrote to memory of 2304 1204 flxxflr.exe 89 PID 1204 wrote to memory of 2304 1204 flxxflr.exe 89 PID 1204 wrote to memory of 2304 1204 flxxflr.exe 89 PID 2304 wrote to memory of 5060 2304 lrfffll.exe 90 PID 2304 wrote to memory of 5060 2304 lrfffll.exe 90 PID 2304 wrote to memory of 5060 2304 lrfffll.exe 90 PID 5060 wrote to memory of 2640 5060 3pvjp.exe 91 PID 5060 wrote to memory of 2640 5060 3pvjp.exe 91 PID 5060 wrote to memory of 2640 5060 3pvjp.exe 91 PID 2640 wrote to memory of 3668 2640 vdddv.exe 92 PID 2640 wrote to memory of 3668 2640 vdddv.exe 92 PID 2640 wrote to memory of 3668 2640 vdddv.exe 92 PID 3668 wrote to memory of 5052 3668 fxffrrl.exe 93 PID 3668 wrote to memory of 5052 3668 fxffrrl.exe 93 PID 3668 wrote to memory of 5052 3668 fxffrrl.exe 93 PID 5052 wrote to memory of 2080 5052 nnbbhh.exe 94 PID 5052 wrote to memory of 2080 5052 nnbbhh.exe 94 PID 5052 wrote to memory of 2080 5052 nnbbhh.exe 94 PID 2080 wrote to memory of 1596 2080 ppjjv.exe 95 PID 2080 wrote to memory of 1596 2080 ppjjv.exe 95 PID 2080 wrote to memory of 1596 2080 ppjjv.exe 95 PID 1596 wrote to memory of 2136 1596 5fxlfll.exe 96 PID 1596 wrote to memory of 2136 1596 5fxlfll.exe 96 PID 1596 wrote to memory of 2136 1596 5fxlfll.exe 96 PID 2136 wrote to memory of 2232 2136 bbnhhn.exe 97 PID 2136 wrote to memory of 2232 2136 bbnhhn.exe 97 PID 2136 wrote to memory of 2232 2136 bbnhhn.exe 97 PID 2232 wrote to memory of 5040 2232 9dpdj.exe 98 PID 2232 wrote to memory of 5040 2232 9dpdj.exe 98 PID 2232 wrote to memory of 5040 2232 9dpdj.exe 98 PID 5040 wrote to memory of 2956 5040 nnnbnb.exe 99 PID 5040 wrote to memory of 2956 5040 nnnbnb.exe 99 PID 5040 wrote to memory of 2956 5040 nnnbnb.exe 99 PID 2956 wrote to memory of 4532 2956 fxxxxfx.exe 100 PID 2956 wrote to memory of 4532 2956 fxxxxfx.exe 100 PID 2956 wrote to memory of 4532 2956 fxxxxfx.exe 100 PID 4532 wrote to memory of 2828 4532 ddvvv.exe 101 PID 4532 wrote to memory of 2828 4532 ddvvv.exe 101 PID 4532 wrote to memory of 2828 4532 ddvvv.exe 101 PID 2828 wrote to memory of 4872 2828 tbbbnt.exe 102 PID 2828 wrote to memory of 4872 2828 tbbbnt.exe 102 PID 2828 wrote to memory of 4872 2828 tbbbnt.exe 102 PID 4872 wrote to memory of 1820 4872 1fffxfx.exe 103 PID 4872 wrote to memory of 1820 4872 1fffxfx.exe 103 PID 4872 wrote to memory of 1820 4872 1fffxfx.exe 103 PID 1820 wrote to memory of 760 1820 jpjjd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe31971659c280308977f5092dec377e63c42d8df18c9d790fab2f08fd88ed57.exe"C:\Users\Admin\AppData\Local\Temp\fe31971659c280308977f5092dec377e63c42d8df18c9d790fab2f08fd88ed57.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\djppv.exec:\djppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\rfffxfx.exec:\rfffxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\pvjdj.exec:\pvjdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\vvvdj.exec:\vvvdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\ntbnnh.exec:\ntbnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\flxxflr.exec:\flxxflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\lrfffll.exec:\lrfffll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\3pvjp.exec:\3pvjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\vdddv.exec:\vdddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\fxffrrl.exec:\fxffrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\nnbbhh.exec:\nnbbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\ppjjv.exec:\ppjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\5fxlfll.exec:\5fxlfll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\bbnhhn.exec:\bbnhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\9dpdj.exec:\9dpdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\nnnbnb.exec:\nnnbnb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\fxxxxfx.exec:\fxxxxfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\ddvvv.exec:\ddvvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\tbbbnt.exec:\tbbbnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\1fffxfx.exec:\1fffxfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\jpjjd.exec:\jpjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\hnbbhn.exec:\hnbbhn.exe23⤵
- Executes dropped EXE
PID:760 -
\??\c:\httbnb.exec:\httbnb.exe24⤵
- Executes dropped EXE
PID:2600 -
\??\c:\vdjjd.exec:\vdjjd.exe25⤵
- Executes dropped EXE
PID:1152 -
\??\c:\thnthh.exec:\thnthh.exe26⤵
- Executes dropped EXE
PID:1932 -
\??\c:\tbbbtt.exec:\tbbbtt.exe27⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1thhnb.exec:\1thhnb.exe28⤵
- Executes dropped EXE
PID:4664 -
\??\c:\hntthn.exec:\hntthn.exe29⤵
- Executes dropped EXE
PID:1720 -
\??\c:\3jjjj.exec:\3jjjj.exe30⤵
- Executes dropped EXE
PID:4600 -
\??\c:\ffxxfff.exec:\ffxxfff.exe31⤵
- Executes dropped EXE
PID:2716 -
\??\c:\5nbtbt.exec:\5nbtbt.exe32⤵
- Executes dropped EXE
PID:2688 -
\??\c:\3rfxfxf.exec:\3rfxfxf.exe33⤵
- Executes dropped EXE
PID:2868 -
\??\c:\hhhbtt.exec:\hhhbtt.exe34⤵
- Executes dropped EXE
PID:4824 -
\??\c:\jdpjj.exec:\jdpjj.exe35⤵
- Executes dropped EXE
PID:3824 -
\??\c:\lxffrxl.exec:\lxffrxl.exe36⤵
- Executes dropped EXE
PID:2968 -
\??\c:\ntnhhn.exec:\ntnhhn.exe37⤵
- Executes dropped EXE
PID:3952 -
\??\c:\ddppj.exec:\ddppj.exe38⤵
- Executes dropped EXE
PID:1460 -
\??\c:\7ffllll.exec:\7ffllll.exe39⤵
- Executes dropped EXE
PID:3568 -
\??\c:\htbbhb.exec:\htbbhb.exe40⤵
- Executes dropped EXE
PID:2484 -
\??\c:\hbhhhh.exec:\hbhhhh.exe41⤵
- Executes dropped EXE
PID:1352 -
\??\c:\vpdvp.exec:\vpdvp.exe42⤵
- Executes dropped EXE
PID:4492 -
\??\c:\5rxxlrr.exec:\5rxxlrr.exe43⤵
- Executes dropped EXE
PID:3828 -
\??\c:\7bbbbh.exec:\7bbbbh.exe44⤵
- Executes dropped EXE
PID:720 -
\??\c:\vdvvj.exec:\vdvvj.exe45⤵
- Executes dropped EXE
PID:5028 -
\??\c:\xlxlfrr.exec:\xlxlfrr.exe46⤵
- Executes dropped EXE
PID:464 -
\??\c:\hnbtbb.exec:\hnbtbb.exe47⤵
- Executes dropped EXE
PID:4132 -
\??\c:\pjppp.exec:\pjppp.exe48⤵
- Executes dropped EXE
PID:3552 -
\??\c:\lfxxrxx.exec:\lfxxrxx.exe49⤵
- Executes dropped EXE
PID:2744 -
\??\c:\7ntntt.exec:\7ntntt.exe50⤵
- Executes dropped EXE
PID:4332 -
\??\c:\dpppj.exec:\dpppj.exe51⤵
- Executes dropped EXE
PID:4460 -
\??\c:\ppjjj.exec:\ppjjj.exe52⤵
- Executes dropped EXE
PID:2492 -
\??\c:\xrfflll.exec:\xrfflll.exe53⤵
- Executes dropped EXE
PID:3232 -
\??\c:\ttnnnn.exec:\ttnnnn.exe54⤵
- Executes dropped EXE
PID:1144 -
\??\c:\djvpd.exec:\djvpd.exe55⤵
- Executes dropped EXE
PID:1336 -
\??\c:\xllrxrr.exec:\xllrxrr.exe56⤵
- Executes dropped EXE
PID:4480 -
\??\c:\ttnbbh.exec:\ttnbbh.exe57⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vdppd.exec:\vdppd.exe58⤵
- Executes dropped EXE
PID:1160 -
\??\c:\lxlffrr.exec:\lxlffrr.exe59⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hbnhbt.exec:\hbnhbt.exe60⤵
- Executes dropped EXE
PID:4196 -
\??\c:\djjjp.exec:\djjjp.exe61⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ffflflf.exec:\ffflflf.exe62⤵
- Executes dropped EXE
PID:1576 -
\??\c:\hhhhbh.exec:\hhhhbh.exe63⤵
- Executes dropped EXE
PID:232 -
\??\c:\jjppp.exec:\jjppp.exe64⤵
- Executes dropped EXE
PID:5072 -
\??\c:\xfrrrll.exec:\xfrrrll.exe65⤵
- Executes dropped EXE
PID:4128 -
\??\c:\bthbhh.exec:\bthbhh.exe66⤵PID:3980
-
\??\c:\nntbtt.exec:\nntbtt.exe67⤵PID:4764
-
\??\c:\pdjvp.exec:\pdjvp.exe68⤵PID:4344
-
\??\c:\llllllr.exec:\llllllr.exe69⤵PID:2408
-
\??\c:\bnnnhn.exec:\bnnnhn.exe70⤵PID:4572
-
\??\c:\vjvdd.exec:\vjvdd.exe71⤵PID:4148
-
\??\c:\lrffxfx.exec:\lrffxfx.exe72⤵PID:3616
-
\??\c:\rxffxlf.exec:\rxffxlf.exe73⤵PID:4692
-
\??\c:\7bttnn.exec:\7bttnn.exe74⤵PID:5084
-
\??\c:\vjppj.exec:\vjppj.exe75⤵PID:3404
-
\??\c:\fffffxx.exec:\fffffxx.exe76⤵PID:4804
-
\??\c:\xfxxfll.exec:\xfxxfll.exe77⤵PID:1108
-
\??\c:\ntbbtt.exec:\ntbbtt.exe78⤵PID:3044
-
\??\c:\pjvvp.exec:\pjvvp.exe79⤵PID:4892
-
\??\c:\rxffllx.exec:\rxffllx.exe80⤵PID:1464
-
\??\c:\bhtbhh.exec:\bhtbhh.exe81⤵PID:2828
-
\??\c:\pdvdd.exec:\pdvdd.exe82⤵PID:4872
-
\??\c:\frlrxff.exec:\frlrxff.exe83⤵PID:2260
-
\??\c:\bhhbbb.exec:\bhhbbb.exe84⤵PID:3768
-
\??\c:\vpdvv.exec:\vpdvv.exe85⤵PID:4068
-
\??\c:\flfffll.exec:\flfffll.exe86⤵PID:2208
-
\??\c:\tbbtnn.exec:\tbbtnn.exe87⤵PID:4604
-
\??\c:\vjvvv.exec:\vjvvv.exe88⤵PID:4632
-
\??\c:\7xxxrrr.exec:\7xxxrrr.exe89⤵PID:2580
-
\??\c:\hnnnnt.exec:\hnnnnt.exe90⤵PID:1900
-
\??\c:\1pvvp.exec:\1pvvp.exe91⤵PID:3644
-
\??\c:\rlxfxff.exec:\rlxfxff.exe92⤵PID:5012
-
\??\c:\9tbbbb.exec:\9tbbbb.exe93⤵PID:4352
-
\??\c:\pvjjp.exec:\pvjjp.exe94⤵PID:2016
-
\??\c:\9llrrrr.exec:\9llrrrr.exe95⤵PID:1120
-
\??\c:\bthhhh.exec:\bthhhh.exe96⤵PID:4384
-
\??\c:\5htnbb.exec:\5htnbb.exe97⤵PID:4908
-
\??\c:\lxrfflf.exec:\lxrfflf.exe98⤵PID:2436
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe99⤵PID:4556
-
\??\c:\nnttbb.exec:\nnttbb.exe100⤵PID:3108
-
\??\c:\ddjjj.exec:\ddjjj.exe101⤵PID:3664
-
\??\c:\flxxrrl.exec:\flxxrrl.exe102⤵PID:4836
-
\??\c:\5hhbth.exec:\5hhbth.exe103⤵PID:4972
-
\??\c:\vdvvp.exec:\vdvvp.exe104⤵PID:3004
-
\??\c:\dpjjd.exec:\dpjjd.exe105⤵PID:2484
-
\??\c:\rxxrffx.exec:\rxxrffx.exe106⤵PID:4272
-
\??\c:\nthhbb.exec:\nthhbb.exe107⤵PID:672
-
\??\c:\vvvvp.exec:\vvvvp.exe108⤵PID:4100
-
\??\c:\rrrxxrr.exec:\rrrxxrr.exe109⤵PID:2348
-
\??\c:\7rrlffx.exec:\7rrlffx.exe110⤵PID:1876
-
\??\c:\7ttttb.exec:\7ttttb.exe111⤵PID:4072
-
\??\c:\9djjp.exec:\9djjp.exe112⤵PID:3936
-
\??\c:\fflllll.exec:\fflllll.exe113⤵PID:2280
-
\??\c:\nbhbtb.exec:\nbhbtb.exe114⤵PID:3268
-
\??\c:\djjpd.exec:\djjpd.exe115⤵PID:4512
-
\??\c:\xfllxfr.exec:\xfllxfr.exe116⤵PID:5068
-
\??\c:\bhhhbn.exec:\bhhhbn.exe117⤵PID:3432
-
\??\c:\jpvvd.exec:\jpvvd.exe118⤵PID:2604
-
\??\c:\fxxxrxr.exec:\fxxxrxr.exe119⤵PID:3136
-
\??\c:\xxffllf.exec:\xxffllf.exe120⤵PID:1208
-
\??\c:\tntttb.exec:\tntttb.exe121⤵PID:456
-
\??\c:\djjvp.exec:\djjvp.exe122⤵PID:2684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-