Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 19:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0db89d7bdc74a89788cf73a472e5a6a7434dc0802280f466ebb209a74956a5fb.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
0db89d7bdc74a89788cf73a472e5a6a7434dc0802280f466ebb209a74956a5fb.exe
-
Size
454KB
-
MD5
2f879bb10c1a39cb5635cba8daec8a7e
-
SHA1
4e422069cee7c15775f11d8520c21f5acfaed08b
-
SHA256
0db89d7bdc74a89788cf73a472e5a6a7434dc0802280f466ebb209a74956a5fb
-
SHA512
7aacecc1b6f69aec89297c3898b8df19bebd88368950a822a5ee349542183f0e32212d08e8cca7c714330fbb6f89a6eb6649cffd42422b1bc9d58b160d8a34b1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeD:q7Tc2NYHUrAwfMp3CDD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3760-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/768-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/840-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-783-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-832-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-842-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-940-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 228 hbbnhb.exe 2732 pjpjd.exe 3780 ddppv.exe 4644 lllrxxl.exe 4564 vjvdj.exe 3192 nhttnh.exe 3952 ppvpj.exe 3252 hbhbbb.exe 3508 dpdvp.exe 4048 flrrlfx.exe 1192 7dvpj.exe 1564 5nnbbb.exe 3732 9djvj.exe 3436 frffffx.exe 4556 tttnbb.exe 3856 9vvjv.exe 512 9jjvj.exe 4768 rxrlllx.exe 3808 5tthbt.exe 3924 thhbtn.exe 1308 jpjvj.exe 768 lffxflx.exe 1016 bhhthb.exe 2556 5jvdp.exe 4916 htbnnb.exe 1360 vjvjd.exe 2736 5ttbtt.exe 880 3ppdp.exe 3488 nbnbbn.exe 4160 pvvjd.exe 4840 xrfxlfx.exe 840 5bthtt.exe 2676 hnhthb.exe 2888 9pjvv.exe 736 1xrxlfr.exe 3716 rxxlxrl.exe 2380 htttnh.exe 4280 1ppdd.exe 2268 1vjvj.exe 3096 bnhbtn.exe 5064 dppjd.exe 4548 xrxxflx.exe 4148 ntthbt.exe 4376 dvpdj.exe 3176 vppdp.exe 2732 flrfrlf.exe 1088 xrlllll.exe 1112 vjdvp.exe 3276 jvjjd.exe 4984 9rrflfx.exe 1444 tttnhb.exe 1288 vvvpp.exe 1452 lfllflf.exe 4788 9xxrxrl.exe 1460 thbnbt.exe 3960 7jppp.exe 1336 xxxffxx.exe 3172 7fxrrlf.exe 3964 hnthbt.exe 1036 3pjdv.exe 5104 fxxrlll.exe 3916 1nbtbb.exe 3520 dpvpv.exe 3672 5lllrxf.exe -
resource yara_rule behavioral2/memory/3760-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/768-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/840-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-783-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3760 wrote to memory of 228 3760 0db89d7bdc74a89788cf73a472e5a6a7434dc0802280f466ebb209a74956a5fb.exe 84 PID 3760 wrote to memory of 228 3760 0db89d7bdc74a89788cf73a472e5a6a7434dc0802280f466ebb209a74956a5fb.exe 84 PID 3760 wrote to memory of 228 3760 0db89d7bdc74a89788cf73a472e5a6a7434dc0802280f466ebb209a74956a5fb.exe 84 PID 228 wrote to memory of 2732 228 hbbnhb.exe 85 PID 228 wrote to memory of 2732 228 hbbnhb.exe 85 PID 228 wrote to memory of 2732 228 hbbnhb.exe 85 PID 2732 wrote to memory of 3780 2732 pjpjd.exe 86 PID 2732 wrote to memory of 3780 2732 pjpjd.exe 86 PID 2732 wrote to memory of 3780 2732 pjpjd.exe 86 PID 3780 wrote to memory of 4644 3780 ddppv.exe 87 PID 3780 wrote to memory of 4644 3780 ddppv.exe 87 PID 3780 wrote to memory of 4644 3780 ddppv.exe 87 PID 4644 wrote to memory of 4564 4644 lllrxxl.exe 88 PID 4644 wrote to memory of 4564 4644 lllrxxl.exe 88 PID 4644 wrote to memory of 4564 4644 lllrxxl.exe 88 PID 4564 wrote to memory of 3192 4564 vjvdj.exe 89 PID 4564 wrote to memory of 3192 4564 vjvdj.exe 89 PID 4564 wrote to memory of 3192 4564 vjvdj.exe 89 PID 3192 wrote to memory of 3952 3192 nhttnh.exe 90 PID 3192 wrote to memory of 3952 3192 nhttnh.exe 90 PID 3192 wrote to memory of 3952 3192 nhttnh.exe 90 PID 3952 wrote to memory of 3252 3952 ppvpj.exe 91 PID 3952 wrote to memory of 3252 3952 ppvpj.exe 91 PID 3952 wrote to memory of 3252 3952 ppvpj.exe 91 PID 3252 wrote to memory of 3508 3252 hbhbbb.exe 92 PID 3252 wrote to memory of 3508 3252 hbhbbb.exe 92 PID 3252 wrote to memory of 3508 3252 hbhbbb.exe 92 PID 3508 wrote to memory of 4048 3508 dpdvp.exe 93 PID 3508 wrote to memory of 4048 3508 dpdvp.exe 93 PID 3508 wrote to memory of 4048 3508 dpdvp.exe 93 PID 4048 wrote to memory of 1192 4048 flrrlfx.exe 94 PID 4048 wrote to memory of 1192 4048 flrrlfx.exe 94 PID 4048 wrote to memory of 1192 4048 flrrlfx.exe 94 PID 1192 wrote to memory of 1564 1192 7dvpj.exe 95 PID 1192 wrote to memory of 1564 1192 7dvpj.exe 95 PID 1192 wrote to memory of 1564 1192 7dvpj.exe 95 PID 1564 wrote to memory of 3732 1564 5nnbbb.exe 96 PID 1564 wrote to memory of 3732 1564 5nnbbb.exe 96 PID 1564 wrote to memory of 3732 1564 5nnbbb.exe 96 PID 3732 wrote to memory of 3436 3732 9djvj.exe 97 PID 3732 wrote to memory of 3436 3732 9djvj.exe 97 PID 3732 wrote to memory of 3436 3732 9djvj.exe 97 PID 3436 wrote to memory of 4556 3436 frffffx.exe 98 PID 3436 wrote to memory of 4556 3436 frffffx.exe 98 PID 3436 wrote to memory of 4556 3436 frffffx.exe 98 PID 4556 wrote to memory of 3856 4556 tttnbb.exe 99 PID 4556 wrote to memory of 3856 4556 tttnbb.exe 99 PID 4556 wrote to memory of 3856 4556 tttnbb.exe 99 PID 3856 wrote to memory of 512 3856 9vvjv.exe 100 PID 3856 wrote to memory of 512 3856 9vvjv.exe 100 PID 3856 wrote to memory of 512 3856 9vvjv.exe 100 PID 512 wrote to memory of 4768 512 9jjvj.exe 101 PID 512 wrote to memory of 4768 512 9jjvj.exe 101 PID 512 wrote to memory of 4768 512 9jjvj.exe 101 PID 4768 wrote to memory of 3808 4768 rxrlllx.exe 102 PID 4768 wrote to memory of 3808 4768 rxrlllx.exe 102 PID 4768 wrote to memory of 3808 4768 rxrlllx.exe 102 PID 3808 wrote to memory of 3924 3808 5tthbt.exe 103 PID 3808 wrote to memory of 3924 3808 5tthbt.exe 103 PID 3808 wrote to memory of 3924 3808 5tthbt.exe 103 PID 3924 wrote to memory of 1308 3924 thhbtn.exe 104 PID 3924 wrote to memory of 1308 3924 thhbtn.exe 104 PID 3924 wrote to memory of 1308 3924 thhbtn.exe 104 PID 1308 wrote to memory of 768 1308 jpjvj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\0db89d7bdc74a89788cf73a472e5a6a7434dc0802280f466ebb209a74956a5fb.exe"C:\Users\Admin\AppData\Local\Temp\0db89d7bdc74a89788cf73a472e5a6a7434dc0802280f466ebb209a74956a5fb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\hbbnhb.exec:\hbbnhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\pjpjd.exec:\pjpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\ddppv.exec:\ddppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\lllrxxl.exec:\lllrxxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\vjvdj.exec:\vjvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\nhttnh.exec:\nhttnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\ppvpj.exec:\ppvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\hbhbbb.exec:\hbhbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\dpdvp.exec:\dpdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\flrrlfx.exec:\flrrlfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\7dvpj.exec:\7dvpj.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\5nnbbb.exec:\5nnbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\9djvj.exec:\9djvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\frffffx.exec:\frffffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\tttnbb.exec:\tttnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\9vvjv.exec:\9vvjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\9jjvj.exec:\9jjvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\rxrlllx.exec:\rxrlllx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\5tthbt.exec:\5tthbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\thhbtn.exec:\thhbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\jpjvj.exec:\jpjvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\lffxflx.exec:\lffxflx.exe23⤵
- Executes dropped EXE
PID:768 -
\??\c:\bhhthb.exec:\bhhthb.exe24⤵
- Executes dropped EXE
PID:1016 -
\??\c:\5jvdp.exec:\5jvdp.exe25⤵
- Executes dropped EXE
PID:2556 -
\??\c:\htbnnb.exec:\htbnnb.exe26⤵
- Executes dropped EXE
PID:4916 -
\??\c:\vjvjd.exec:\vjvjd.exe27⤵
- Executes dropped EXE
PID:1360 -
\??\c:\5ttbtt.exec:\5ttbtt.exe28⤵
- Executes dropped EXE
PID:2736 -
\??\c:\3ppdp.exec:\3ppdp.exe29⤵
- Executes dropped EXE
PID:880 -
\??\c:\nbnbbn.exec:\nbnbbn.exe30⤵
- Executes dropped EXE
PID:3488 -
\??\c:\pvvjd.exec:\pvvjd.exe31⤵
- Executes dropped EXE
PID:4160 -
\??\c:\xrfxlfx.exec:\xrfxlfx.exe32⤵
- Executes dropped EXE
PID:4840 -
\??\c:\5bthtt.exec:\5bthtt.exe33⤵
- Executes dropped EXE
PID:840 -
\??\c:\hnhthb.exec:\hnhthb.exe34⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9pjvv.exec:\9pjvv.exe35⤵
- Executes dropped EXE
PID:2888 -
\??\c:\1xrxlfr.exec:\1xrxlfr.exe36⤵
- Executes dropped EXE
PID:736 -
\??\c:\rxxlxrl.exec:\rxxlxrl.exe37⤵
- Executes dropped EXE
PID:3716 -
\??\c:\htttnh.exec:\htttnh.exe38⤵
- Executes dropped EXE
PID:2380 -
\??\c:\1ppdd.exec:\1ppdd.exe39⤵
- Executes dropped EXE
PID:4280 -
\??\c:\1vjvj.exec:\1vjvj.exe40⤵
- Executes dropped EXE
PID:2268 -
\??\c:\bnhbtn.exec:\bnhbtn.exe41⤵
- Executes dropped EXE
PID:3096 -
\??\c:\dppjd.exec:\dppjd.exe42⤵
- Executes dropped EXE
PID:5064 -
\??\c:\xrxxflx.exec:\xrxxflx.exe43⤵
- Executes dropped EXE
PID:4548 -
\??\c:\ntthbt.exec:\ntthbt.exe44⤵
- Executes dropped EXE
PID:4148 -
\??\c:\dvpdj.exec:\dvpdj.exe45⤵
- Executes dropped EXE
PID:4376 -
\??\c:\vppdp.exec:\vppdp.exe46⤵
- Executes dropped EXE
PID:3176 -
\??\c:\flrfrlf.exec:\flrfrlf.exe47⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xrlllll.exec:\xrlllll.exe48⤵
- Executes dropped EXE
PID:1088 -
\??\c:\vjdvp.exec:\vjdvp.exe49⤵
- Executes dropped EXE
PID:1112 -
\??\c:\jvjjd.exec:\jvjjd.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3276 -
\??\c:\9rrflfx.exec:\9rrflfx.exe51⤵
- Executes dropped EXE
PID:4984 -
\??\c:\tttnhb.exec:\tttnhb.exe52⤵
- Executes dropped EXE
PID:1444 -
\??\c:\vvvpp.exec:\vvvpp.exe53⤵
- Executes dropped EXE
PID:1288 -
\??\c:\lfllflf.exec:\lfllflf.exe54⤵
- Executes dropped EXE
PID:1452 -
\??\c:\9xxrxrl.exec:\9xxrxrl.exe55⤵
- Executes dropped EXE
PID:4788 -
\??\c:\thbnbt.exec:\thbnbt.exe56⤵
- Executes dropped EXE
PID:1460 -
\??\c:\7jppp.exec:\7jppp.exe57⤵
- Executes dropped EXE
PID:3960 -
\??\c:\xxxffxx.exec:\xxxffxx.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1336 -
\??\c:\7fxrrlf.exec:\7fxrrlf.exe59⤵
- Executes dropped EXE
PID:3172 -
\??\c:\hnthbt.exec:\hnthbt.exe60⤵
- Executes dropped EXE
PID:3964 -
\??\c:\3pjdv.exec:\3pjdv.exe61⤵
- Executes dropped EXE
PID:1036 -
\??\c:\fxxrlll.exec:\fxxrlll.exe62⤵
- Executes dropped EXE
PID:5104 -
\??\c:\1nbtbb.exec:\1nbtbb.exe63⤵
- Executes dropped EXE
PID:3916 -
\??\c:\dpvpv.exec:\dpvpv.exe64⤵
- Executes dropped EXE
PID:3520 -
\??\c:\5lllrxf.exec:\5lllrxf.exe65⤵
- Executes dropped EXE
PID:3672 -
\??\c:\xlrfrlx.exec:\xlrfrlx.exe66⤵PID:3064
-
\??\c:\1hthth.exec:\1hthth.exe67⤵PID:2084
-
\??\c:\dvdpd.exec:\dvdpd.exe68⤵PID:4780
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe69⤵PID:3832
-
\??\c:\fflfrlf.exec:\fflfrlf.exe70⤵PID:3728
-
\??\c:\nnhbtn.exec:\nnhbtn.exe71⤵PID:1008
-
\??\c:\vjpvv.exec:\vjpvv.exe72⤵PID:4204
-
\??\c:\xffxxxl.exec:\xffxxxl.exe73⤵PID:1996
-
\??\c:\nhbthh.exec:\nhbthh.exe74⤵PID:768
-
\??\c:\tntnbb.exec:\tntnbb.exe75⤵PID:2540
-
\??\c:\vpjvj.exec:\vpjvj.exe76⤵PID:1916
-
\??\c:\xlfxlfx.exec:\xlfxlfx.exe77⤵PID:1424
-
\??\c:\tnhtnh.exec:\tnhtnh.exe78⤵PID:4908
-
\??\c:\jjjjj.exec:\jjjjj.exe79⤵PID:3124
-
\??\c:\1jddv.exec:\1jddv.exe80⤵PID:2752
-
\??\c:\xflxxrr.exec:\xflxxrr.exe81⤵PID:2216
-
\??\c:\bnthhb.exec:\bnthhb.exe82⤵PID:2460
-
\??\c:\btnhbt.exec:\btnhbt.exe83⤵PID:4200
-
\??\c:\jpdjp.exec:\jpdjp.exe84⤵PID:4772
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe85⤵PID:2856
-
\??\c:\7ntnhb.exec:\7ntnhb.exe86⤵
- System Location Discovery: System Language Discovery
PID:4428 -
\??\c:\pppjj.exec:\pppjj.exe87⤵PID:4840
-
\??\c:\5frrffx.exec:\5frrffx.exe88⤵PID:3476
-
\??\c:\lffxrrl.exec:\lffxrrl.exe89⤵PID:3680
-
\??\c:\1htttt.exec:\1htttt.exe90⤵PID:1160
-
\??\c:\vdjdd.exec:\vdjdd.exe91⤵PID:4512
-
\??\c:\vjvvv.exec:\vjvvv.exe92⤵PID:4960
-
\??\c:\fflffxl.exec:\fflffxl.exe93⤵PID:4800
-
\??\c:\bbtnhh.exec:\bbtnhh.exe94⤵PID:5028
-
\??\c:\htbbhb.exec:\htbbhb.exe95⤵PID:892
-
\??\c:\dvvdv.exec:\dvvdv.exe96⤵PID:3080
-
\??\c:\7llfrlf.exec:\7llfrlf.exe97⤵PID:3684
-
\??\c:\btnbtn.exec:\btnbtn.exe98⤵PID:3108
-
\??\c:\dvpdp.exec:\dvpdp.exe99⤵PID:2276
-
\??\c:\1pvjd.exec:\1pvjd.exe100⤵PID:2848
-
\??\c:\5rlfffx.exec:\5rlfffx.exe101⤵PID:4816
-
\??\c:\hbnhnh.exec:\hbnhnh.exe102⤵PID:3356
-
\??\c:\jjvdp.exec:\jjvdp.exe103⤵PID:1188
-
\??\c:\jjpjd.exec:\jjpjd.exe104⤵PID:1084
-
\??\c:\5fxfrrl.exec:\5fxfrrl.exe105⤵PID:4644
-
\??\c:\nbbhbt.exec:\nbbhbt.exe106⤵PID:5000
-
\??\c:\jdvjj.exec:\jdvjj.exe107⤵PID:3664
-
\??\c:\5rrlxxr.exec:\5rrlxxr.exe108⤵PID:2176
-
\??\c:\nthbbt.exec:\nthbbt.exe109⤵PID:4880
-
\??\c:\hbbnbb.exec:\hbbnbb.exe110⤵PID:1452
-
\??\c:\pjjdd.exec:\pjjdd.exe111⤵PID:948
-
\??\c:\9rrlxxr.exec:\9rrlxxr.exe112⤵PID:3508
-
\??\c:\nbhbhh.exec:\nbhbhh.exe113⤵PID:2560
-
\??\c:\3dvjv.exec:\3dvjv.exe114⤵PID:4236
-
\??\c:\vvjvp.exec:\vvjvp.exe115⤵PID:3480
-
\??\c:\rrlfrlx.exec:\rrlfrlx.exe116⤵PID:2668
-
\??\c:\hhhhtt.exec:\hhhhtt.exe117⤵PID:1036
-
\??\c:\ttbthb.exec:\ttbthb.exe118⤵PID:3432
-
\??\c:\dvjvv.exec:\dvjvv.exe119⤵PID:3812
-
\??\c:\rlrrrlx.exec:\rlrrrlx.exe120⤵PID:4776
-
\??\c:\5tbnnn.exec:\5tbnnn.exe121⤵
- System Location Discovery: System Language Discovery
PID:3672 -
\??\c:\djjvp.exec:\djjvp.exe122⤵PID:4020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-