Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 20:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe
-
Size
456KB
-
MD5
671231fc6158870f2a2d6cd41136fe6e
-
SHA1
3150012d1855c4e9ce9d3340f44688a5218b49df
-
SHA256
2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25
-
SHA512
c7fde17396ad8b73a79adf7d576b4e11490642b2060955db211547eaf08d785a43c1b6c96bc397bbd506340c1f8d4665c17a635763c577837ffb90d04c54b81d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRV:q7Tc2NYHUrAwfMp3CDRV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2124-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/832-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2112-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3336-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1904-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/892-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2812-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-681-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-767-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-874-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-908-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-1122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-1249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/184-1786-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-1844-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-1921-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4276 djpdv.exe 3628 xrrlffx.exe 832 lflfxxx.exe 3496 bntnhh.exe 1496 jddvj.exe 2120 jjjjd.exe 2112 fllfxff.exe 452 bhtnnn.exe 2932 hbttnh.exe 3776 xrxrlll.exe 4648 dpdjd.exe 1108 lxlfrrl.exe 1016 dvddj.exe 4988 rxlxxxr.exe 3056 httthh.exe 3336 xfrllrr.exe 1712 tbbtnn.exe 1904 vdvpj.exe 4056 nhhbnn.exe 2328 5lxrffr.exe 2880 rrrllxx.exe 1400 btnhhh.exe 4320 rrxrllf.exe 2368 djvpj.exe 1576 frxrllf.exe 4736 bhnhbb.exe 5080 jvvvv.exe 388 djvpv.exe 3944 rllfxxr.exe 2204 pvvjd.exe 2440 rflffff.exe 2820 rlrlfff.exe 2140 9hnhtt.exe 1228 fxlrrxx.exe 2580 nttthh.exe 3968 nthttt.exe 2944 vvjdp.exe 1184 rxxrffl.exe 1360 tntnhb.exe 2496 frrllff.exe 1376 tnbtbt.exe 3892 jjvpp.exe 3952 jpjdv.exe 2152 fxrrlll.exe 3848 bbnhhh.exe 2696 1vpjd.exe 764 dvdvp.exe 2800 lxfxxxl.exe 3660 hhhbbb.exe 1460 jdpjv.exe 4276 lxxlfxr.exe 3320 lflxxrr.exe 892 tbnhbb.exe 832 pjjdv.exe 2024 rfffrrl.exe 3532 lfrrxxf.exe 4068 bttttt.exe 2120 pjjdv.exe 1772 7pvpp.exe 2984 frxxxxx.exe 3948 hbhbbb.exe 4132 dpppj.exe 3612 5vvvp.exe 2704 5lxrlfx.exe -
resource yara_rule behavioral2/memory/2124-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/832-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2112-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1108-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3336-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1712-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/892-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2704-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-767-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-874-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-908-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-1122-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfflxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrlll.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 4276 2124 2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe 83 PID 2124 wrote to memory of 4276 2124 2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe 83 PID 2124 wrote to memory of 4276 2124 2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe 83 PID 4276 wrote to memory of 3628 4276 djpdv.exe 84 PID 4276 wrote to memory of 3628 4276 djpdv.exe 84 PID 4276 wrote to memory of 3628 4276 djpdv.exe 84 PID 3628 wrote to memory of 832 3628 xrrlffx.exe 85 PID 3628 wrote to memory of 832 3628 xrrlffx.exe 85 PID 3628 wrote to memory of 832 3628 xrrlffx.exe 85 PID 832 wrote to memory of 3496 832 lflfxxx.exe 86 PID 832 wrote to memory of 3496 832 lflfxxx.exe 86 PID 832 wrote to memory of 3496 832 lflfxxx.exe 86 PID 3496 wrote to memory of 1496 3496 bntnhh.exe 87 PID 3496 wrote to memory of 1496 3496 bntnhh.exe 87 PID 3496 wrote to memory of 1496 3496 bntnhh.exe 87 PID 1496 wrote to memory of 2120 1496 jddvj.exe 88 PID 1496 wrote to memory of 2120 1496 jddvj.exe 88 PID 1496 wrote to memory of 2120 1496 jddvj.exe 88 PID 2120 wrote to memory of 2112 2120 jjjjd.exe 89 PID 2120 wrote to memory of 2112 2120 jjjjd.exe 89 PID 2120 wrote to memory of 2112 2120 jjjjd.exe 89 PID 2112 wrote to memory of 452 2112 fllfxff.exe 90 PID 2112 wrote to memory of 452 2112 fllfxff.exe 90 PID 2112 wrote to memory of 452 2112 fllfxff.exe 90 PID 452 wrote to memory of 2932 452 bhtnnn.exe 91 PID 452 wrote to memory of 2932 452 bhtnnn.exe 91 PID 452 wrote to memory of 2932 452 bhtnnn.exe 91 PID 2932 wrote to memory of 3776 2932 hbttnh.exe 92 PID 2932 wrote to memory of 3776 2932 hbttnh.exe 92 PID 2932 wrote to memory of 3776 2932 hbttnh.exe 92 PID 3776 wrote to memory of 4648 3776 xrxrlll.exe 93 PID 3776 wrote to memory of 4648 3776 xrxrlll.exe 93 PID 3776 wrote to memory of 4648 3776 xrxrlll.exe 93 PID 4648 wrote to memory of 1108 4648 dpdjd.exe 94 PID 4648 wrote to memory of 1108 4648 dpdjd.exe 94 PID 4648 wrote to memory of 1108 4648 dpdjd.exe 94 PID 1108 wrote to memory of 1016 1108 lxlfrrl.exe 95 PID 1108 wrote to memory of 1016 1108 lxlfrrl.exe 95 PID 1108 wrote to memory of 1016 1108 lxlfrrl.exe 95 PID 1016 wrote to memory of 4988 1016 dvddj.exe 96 PID 1016 wrote to memory of 4988 1016 dvddj.exe 96 PID 1016 wrote to memory of 4988 1016 dvddj.exe 96 PID 4988 wrote to memory of 3056 4988 rxlxxxr.exe 97 PID 4988 wrote to memory of 3056 4988 rxlxxxr.exe 97 PID 4988 wrote to memory of 3056 4988 rxlxxxr.exe 97 PID 3056 wrote to memory of 3336 3056 httthh.exe 98 PID 3056 wrote to memory of 3336 3056 httthh.exe 98 PID 3056 wrote to memory of 3336 3056 httthh.exe 98 PID 3336 wrote to memory of 1712 3336 xfrllrr.exe 99 PID 3336 wrote to memory of 1712 3336 xfrllrr.exe 99 PID 3336 wrote to memory of 1712 3336 xfrllrr.exe 99 PID 1712 wrote to memory of 1904 1712 tbbtnn.exe 100 PID 1712 wrote to memory of 1904 1712 tbbtnn.exe 100 PID 1712 wrote to memory of 1904 1712 tbbtnn.exe 100 PID 1904 wrote to memory of 4056 1904 vdvpj.exe 101 PID 1904 wrote to memory of 4056 1904 vdvpj.exe 101 PID 1904 wrote to memory of 4056 1904 vdvpj.exe 101 PID 4056 wrote to memory of 2328 4056 nhhbnn.exe 102 PID 4056 wrote to memory of 2328 4056 nhhbnn.exe 102 PID 4056 wrote to memory of 2328 4056 nhhbnn.exe 102 PID 2328 wrote to memory of 2880 2328 5lxrffr.exe 103 PID 2328 wrote to memory of 2880 2328 5lxrffr.exe 103 PID 2328 wrote to memory of 2880 2328 5lxrffr.exe 103 PID 2880 wrote to memory of 1400 2880 rrrllxx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe"C:\Users\Admin\AppData\Local\Temp\2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\djpdv.exec:\djpdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\xrrlffx.exec:\xrrlffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\lflfxxx.exec:\lflfxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\bntnhh.exec:\bntnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\jddvj.exec:\jddvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\jjjjd.exec:\jjjjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\fllfxff.exec:\fllfxff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\bhtnnn.exec:\bhtnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\hbttnh.exec:\hbttnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\xrxrlll.exec:\xrxrlll.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\dpdjd.exec:\dpdjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\lxlfrrl.exec:\lxlfrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\dvddj.exec:\dvddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\rxlxxxr.exec:\rxlxxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\httthh.exec:\httthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\xfrllrr.exec:\xfrllrr.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\tbbtnn.exec:\tbbtnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\vdvpj.exec:\vdvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\nhhbnn.exec:\nhhbnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\5lxrffr.exec:\5lxrffr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\rrrllxx.exec:\rrrllxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\btnhhh.exec:\btnhhh.exe23⤵
- Executes dropped EXE
PID:1400 -
\??\c:\rrxrllf.exec:\rrxrllf.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4320 -
\??\c:\djvpj.exec:\djvpj.exe25⤵
- Executes dropped EXE
PID:2368 -
\??\c:\frxrllf.exec:\frxrllf.exe26⤵
- Executes dropped EXE
PID:1576 -
\??\c:\bhnhbb.exec:\bhnhbb.exe27⤵
- Executes dropped EXE
PID:4736 -
\??\c:\jvvvv.exec:\jvvvv.exe28⤵
- Executes dropped EXE
PID:5080 -
\??\c:\djvpv.exec:\djvpv.exe29⤵
- Executes dropped EXE
PID:388 -
\??\c:\rllfxxr.exec:\rllfxxr.exe30⤵
- Executes dropped EXE
PID:3944 -
\??\c:\pvvjd.exec:\pvvjd.exe31⤵
- Executes dropped EXE
PID:2204 -
\??\c:\rflffff.exec:\rflffff.exe32⤵
- Executes dropped EXE
PID:2440 -
\??\c:\rlrlfff.exec:\rlrlfff.exe33⤵
- Executes dropped EXE
PID:2820 -
\??\c:\9hnhtt.exec:\9hnhtt.exe34⤵
- Executes dropped EXE
PID:2140 -
\??\c:\fxlrrxx.exec:\fxlrrxx.exe35⤵
- Executes dropped EXE
PID:1228 -
\??\c:\nttthh.exec:\nttthh.exe36⤵
- Executes dropped EXE
PID:2580 -
\??\c:\nthttt.exec:\nthttt.exe37⤵
- Executes dropped EXE
PID:3968 -
\??\c:\vvjdp.exec:\vvjdp.exe38⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rxxrffl.exec:\rxxrffl.exe39⤵
- Executes dropped EXE
PID:1184 -
\??\c:\tntnhb.exec:\tntnhb.exe40⤵
- Executes dropped EXE
PID:1360 -
\??\c:\frrllff.exec:\frrllff.exe41⤵
- Executes dropped EXE
PID:2496 -
\??\c:\tnbtbt.exec:\tnbtbt.exe42⤵
- Executes dropped EXE
PID:1376 -
\??\c:\jjvpp.exec:\jjvpp.exe43⤵
- Executes dropped EXE
PID:3892 -
\??\c:\jpjdv.exec:\jpjdv.exe44⤵
- Executes dropped EXE
PID:3952 -
\??\c:\fxrrlll.exec:\fxrrlll.exe45⤵
- Executes dropped EXE
PID:2152 -
\??\c:\bbnhhh.exec:\bbnhhh.exe46⤵
- Executes dropped EXE
PID:3848 -
\??\c:\1vpjd.exec:\1vpjd.exe47⤵
- Executes dropped EXE
PID:2696 -
\??\c:\dvdvp.exec:\dvdvp.exe48⤵
- Executes dropped EXE
PID:764 -
\??\c:\lxfxxxl.exec:\lxfxxxl.exe49⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hhhbbb.exec:\hhhbbb.exe50⤵
- Executes dropped EXE
PID:3660 -
\??\c:\bbnhtt.exec:\bbnhtt.exe51⤵PID:4552
-
\??\c:\jdpjv.exec:\jdpjv.exe52⤵
- Executes dropped EXE
PID:1460 -
\??\c:\lxxlfxr.exec:\lxxlfxr.exe53⤵
- Executes dropped EXE
PID:4276 -
\??\c:\lflxxrr.exec:\lflxxrr.exe54⤵
- Executes dropped EXE
PID:3320 -
\??\c:\tbnhbb.exec:\tbnhbb.exe55⤵
- Executes dropped EXE
PID:892 -
\??\c:\pjjdv.exec:\pjjdv.exe56⤵
- Executes dropped EXE
PID:832 -
\??\c:\rfffrrl.exec:\rfffrrl.exe57⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe58⤵
- Executes dropped EXE
PID:3532 -
\??\c:\bttttt.exec:\bttttt.exe59⤵
- Executes dropped EXE
PID:4068 -
\??\c:\pjjdv.exec:\pjjdv.exe60⤵
- Executes dropped EXE
PID:2120 -
\??\c:\7pvpp.exec:\7pvpp.exe61⤵
- Executes dropped EXE
PID:1772 -
\??\c:\frxxxxx.exec:\frxxxxx.exe62⤵
- Executes dropped EXE
PID:2984 -
\??\c:\hbhbbb.exec:\hbhbbb.exe63⤵
- Executes dropped EXE
PID:3948 -
\??\c:\dpppj.exec:\dpppj.exe64⤵
- Executes dropped EXE
PID:4132 -
\??\c:\5vvvp.exec:\5vvvp.exe65⤵
- Executes dropped EXE
PID:3612 -
\??\c:\5lxrlfx.exec:\5lxrlfx.exe66⤵
- Executes dropped EXE
PID:2704 -
\??\c:\thtnhh.exec:\thtnhh.exe67⤵PID:2148
-
\??\c:\djpjd.exec:\djpjd.exe68⤵PID:4348
-
\??\c:\jvdvp.exec:\jvdvp.exe69⤵PID:1664
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe70⤵PID:1600
-
\??\c:\bnttnn.exec:\bnttnn.exe71⤵PID:652
-
\??\c:\ddjdv.exec:\ddjdv.exe72⤵PID:4248
-
\??\c:\9lxrxxl.exec:\9lxrxxl.exe73⤵PID:4728
-
\??\c:\tbnttt.exec:\tbnttt.exe74⤵PID:3520
-
\??\c:\pjpdv.exec:\pjpdv.exe75⤵PID:2864
-
\??\c:\dvdpj.exec:\dvdpj.exe76⤵PID:3852
-
\??\c:\3xxfrrx.exec:\3xxfrrx.exe77⤵PID:4940
-
\??\c:\thbtnn.exec:\thbtnn.exe78⤵PID:4668
-
\??\c:\vdvpj.exec:\vdvpj.exe79⤵PID:3956
-
\??\c:\xxrxxxr.exec:\xxrxxxr.exe80⤵PID:2328
-
\??\c:\rlrlrrr.exec:\rlrlrrr.exe81⤵PID:4460
-
\??\c:\nhnnhh.exec:\nhnnhh.exe82⤵PID:1392
-
\??\c:\jjvvv.exec:\jjvvv.exe83⤵PID:1060
-
\??\c:\xllfrrx.exec:\xllfrrx.exe84⤵PID:5028
-
\??\c:\rlrlfff.exec:\rlrlfff.exe85⤵PID:3036
-
\??\c:\btnhbt.exec:\btnhbt.exe86⤵PID:364
-
\??\c:\pjjvv.exec:\pjjvv.exe87⤵PID:4700
-
\??\c:\frrxrlf.exec:\frrxrlf.exe88⤵PID:2396
-
\??\c:\bhtnnn.exec:\bhtnnn.exe89⤵PID:916
-
\??\c:\1btnbn.exec:\1btnbn.exe90⤵PID:2540
-
\??\c:\pjdvp.exec:\pjdvp.exe91⤵PID:2752
-
\??\c:\7rlxffr.exec:\7rlxffr.exe92⤵PID:1988
-
\??\c:\flxlfxl.exec:\flxlfxl.exe93⤵PID:3980
-
\??\c:\nttbnh.exec:\nttbnh.exe94⤵PID:2440
-
\??\c:\jvpjv.exec:\jvpjv.exe95⤵PID:3888
-
\??\c:\dppdj.exec:\dppdj.exe96⤵PID:1524
-
\??\c:\rlfrxrl.exec:\rlfrxrl.exe97⤵PID:2140
-
\??\c:\hbtthb.exec:\hbtthb.exe98⤵PID:3112
-
\??\c:\5hhbtt.exec:\5hhbtt.exe99⤵PID:3676
-
\??\c:\dpdvp.exec:\dpdvp.exe100⤵PID:4444
-
\??\c:\xllxlxr.exec:\xllxlxr.exe101⤵PID:4152
-
\??\c:\tbnhtn.exec:\tbnhtn.exe102⤵PID:2428
-
\??\c:\dvvvp.exec:\dvvvp.exe103⤵PID:3844
-
\??\c:\ddjdp.exec:\ddjdp.exe104⤵PID:1620
-
\??\c:\xfrfffx.exec:\xfrfffx.exe105⤵PID:1048
-
\??\c:\nnhtnh.exec:\nnhtnh.exe106⤵PID:4872
-
\??\c:\vdjvj.exec:\vdjvj.exe107⤵PID:5072
-
\??\c:\xrxlfff.exec:\xrxlfff.exe108⤵PID:2812
-
\??\c:\3ttnhh.exec:\3ttnhh.exe109⤵PID:2872
-
\??\c:\pddpp.exec:\pddpp.exe110⤵PID:2904
-
\??\c:\rrfrffx.exec:\rrfrffx.exe111⤵PID:2404
-
\??\c:\1bbthb.exec:\1bbthb.exe112⤵PID:4408
-
\??\c:\httthb.exec:\httthb.exe113⤵PID:4424
-
\??\c:\vvjdp.exec:\vvjdp.exe114⤵PID:2228
-
\??\c:\1rflxff.exec:\1rflxff.exe115⤵PID:548
-
\??\c:\9xxrfxr.exec:\9xxrfxr.exe116⤵PID:2460
-
\??\c:\ttbthb.exec:\ttbthb.exe117⤵PID:3628
-
\??\c:\djvjd.exec:\djvjd.exe118⤵PID:4976
-
\??\c:\9lflxrl.exec:\9lflxrl.exe119⤵PID:4060
-
\??\c:\bntnbh.exec:\bntnbh.exe120⤵PID:2260
-
\??\c:\tbhbtt.exec:\tbhbtt.exe121⤵PID:4332
-
\??\c:\jvdvp.exec:\jvdvp.exe122⤵PID:1284
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-