Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 19:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1059e3f9885ba44e386bfdccb4dffffb72cd1ac52617b408987a46f17f8f713a.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
150 seconds
General
-
Target
1059e3f9885ba44e386bfdccb4dffffb72cd1ac52617b408987a46f17f8f713a.exe
-
Size
453KB
-
MD5
309cf5664152150b0b76a54ada527794
-
SHA1
0590568a2a5433d59efd56c36ab8bc5009486cc5
-
SHA256
1059e3f9885ba44e386bfdccb4dffffb72cd1ac52617b408987a46f17f8f713a
-
SHA512
44af26fcee99182cbb09695fca3f8f6b4a7d2d053dd9ac8c8ac9ec319781191631aae9ac28d7a781b597423de438ea2f99b19d2d4aa8d2f55f693a25daa24c43
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1388-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/716-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2624-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1348-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2680-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-745-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-773-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-807-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-820-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-920-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-1484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-1554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3396 xlrlllf.exe 4796 vjpjj.exe 3508 frxrrrl.exe 2136 nthbbh.exe 4048 jpvvv.exe 2124 1hhbbn.exe 3876 9ffxrrl.exe 5000 hbhbbb.exe 1220 xflfxxr.exe 2732 nnbbhb.exe 3084 ttbbhh.exe 2228 vvddv.exe 4972 3rxrrrl.exe 3864 xrxrrrr.exe 1032 bhtnhb.exe 464 pdjjv.exe 1456 rlxxffl.exe 1980 bthhhb.exe 116 dvjdd.exe 4524 bnnhtt.exe 1460 jpjjd.exe 4224 btbtnh.exe 716 jjddv.exe 3676 tnhhtt.exe 1380 dvjdd.exe 5048 7ffxrrl.exe 1784 jddjd.exe 1716 bhbbbb.exe 5068 1djjd.exe 5084 jdpjj.exe 2624 nntntb.exe 3148 nbnhhh.exe 5080 nhnntn.exe 1820 lxfxxxr.exe 1660 vpvpp.exe 2756 bbhhnt.exe 4468 9jvvv.exe 2452 5pvpj.exe 3744 rxffllx.exe 4328 bthhnn.exe 4340 jjdvp.exe 4040 rrxrllf.exe 384 nbhhbh.exe 1348 vvjdv.exe 2276 vpvvp.exe 2248 fxffxxx.exe 2024 5hnnhn.exe 1828 jvdpv.exe 4780 3rxxxfx.exe 4592 bbttnn.exe 3832 hnhbbb.exe 3672 1dddv.exe 1276 ffffxxr.exe 2132 rffxrrl.exe 1844 bbbtnb.exe 1004 jjjdv.exe 2240 3rxrrrr.exe 2228 thhbtt.exe 216 vjpjj.exe 2476 pvdjj.exe 364 7flfxxf.exe 3444 hhtthh.exe 2312 bttnnh.exe 4112 vpvpj.exe -
resource yara_rule behavioral2/memory/1388-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/716-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2624-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1348-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-745-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-807-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-820-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1388 wrote to memory of 3396 1388 1059e3f9885ba44e386bfdccb4dffffb72cd1ac52617b408987a46f17f8f713a.exe 83 PID 1388 wrote to memory of 3396 1388 1059e3f9885ba44e386bfdccb4dffffb72cd1ac52617b408987a46f17f8f713a.exe 83 PID 1388 wrote to memory of 3396 1388 1059e3f9885ba44e386bfdccb4dffffb72cd1ac52617b408987a46f17f8f713a.exe 83 PID 3396 wrote to memory of 4796 3396 xlrlllf.exe 84 PID 3396 wrote to memory of 4796 3396 xlrlllf.exe 84 PID 3396 wrote to memory of 4796 3396 xlrlllf.exe 84 PID 4796 wrote to memory of 3508 4796 vjpjj.exe 85 PID 4796 wrote to memory of 3508 4796 vjpjj.exe 85 PID 4796 wrote to memory of 3508 4796 vjpjj.exe 85 PID 3508 wrote to memory of 2136 3508 frxrrrl.exe 86 PID 3508 wrote to memory of 2136 3508 frxrrrl.exe 86 PID 3508 wrote to memory of 2136 3508 frxrrrl.exe 86 PID 2136 wrote to memory of 4048 2136 nthbbh.exe 87 PID 2136 wrote to memory of 4048 2136 nthbbh.exe 87 PID 2136 wrote to memory of 4048 2136 nthbbh.exe 87 PID 4048 wrote to memory of 2124 4048 jpvvv.exe 88 PID 4048 wrote to memory of 2124 4048 jpvvv.exe 88 PID 4048 wrote to memory of 2124 4048 jpvvv.exe 88 PID 2124 wrote to memory of 3876 2124 1hhbbn.exe 89 PID 2124 wrote to memory of 3876 2124 1hhbbn.exe 89 PID 2124 wrote to memory of 3876 2124 1hhbbn.exe 89 PID 3876 wrote to memory of 5000 3876 9ffxrrl.exe 90 PID 3876 wrote to memory of 5000 3876 9ffxrrl.exe 90 PID 3876 wrote to memory of 5000 3876 9ffxrrl.exe 90 PID 5000 wrote to memory of 1220 5000 hbhbbb.exe 91 PID 5000 wrote to memory of 1220 5000 hbhbbb.exe 91 PID 5000 wrote to memory of 1220 5000 hbhbbb.exe 91 PID 1220 wrote to memory of 2732 1220 xflfxxr.exe 92 PID 1220 wrote to memory of 2732 1220 xflfxxr.exe 92 PID 1220 wrote to memory of 2732 1220 xflfxxr.exe 92 PID 2732 wrote to memory of 3084 2732 nnbbhb.exe 93 PID 2732 wrote to memory of 3084 2732 nnbbhb.exe 93 PID 2732 wrote to memory of 3084 2732 nnbbhb.exe 93 PID 3084 wrote to memory of 2228 3084 ttbbhh.exe 94 PID 3084 wrote to memory of 2228 3084 ttbbhh.exe 94 PID 3084 wrote to memory of 2228 3084 ttbbhh.exe 94 PID 2228 wrote to memory of 4972 2228 vvddv.exe 95 PID 2228 wrote to memory of 4972 2228 vvddv.exe 95 PID 2228 wrote to memory of 4972 2228 vvddv.exe 95 PID 4972 wrote to memory of 3864 4972 3rxrrrl.exe 96 PID 4972 wrote to memory of 3864 4972 3rxrrrl.exe 96 PID 4972 wrote to memory of 3864 4972 3rxrrrl.exe 96 PID 3864 wrote to memory of 1032 3864 xrxrrrr.exe 97 PID 3864 wrote to memory of 1032 3864 xrxrrrr.exe 97 PID 3864 wrote to memory of 1032 3864 xrxrrrr.exe 97 PID 1032 wrote to memory of 464 1032 bhtnhb.exe 98 PID 1032 wrote to memory of 464 1032 bhtnhb.exe 98 PID 1032 wrote to memory of 464 1032 bhtnhb.exe 98 PID 464 wrote to memory of 1456 464 pdjjv.exe 99 PID 464 wrote to memory of 1456 464 pdjjv.exe 99 PID 464 wrote to memory of 1456 464 pdjjv.exe 99 PID 1456 wrote to memory of 1980 1456 rlxxffl.exe 100 PID 1456 wrote to memory of 1980 1456 rlxxffl.exe 100 PID 1456 wrote to memory of 1980 1456 rlxxffl.exe 100 PID 1980 wrote to memory of 116 1980 bthhhb.exe 101 PID 1980 wrote to memory of 116 1980 bthhhb.exe 101 PID 1980 wrote to memory of 116 1980 bthhhb.exe 101 PID 116 wrote to memory of 4524 116 dvjdd.exe 102 PID 116 wrote to memory of 4524 116 dvjdd.exe 102 PID 116 wrote to memory of 4524 116 dvjdd.exe 102 PID 4524 wrote to memory of 1460 4524 bnnhtt.exe 103 PID 4524 wrote to memory of 1460 4524 bnnhtt.exe 103 PID 4524 wrote to memory of 1460 4524 bnnhtt.exe 103 PID 1460 wrote to memory of 4224 1460 jpjjd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\1059e3f9885ba44e386bfdccb4dffffb72cd1ac52617b408987a46f17f8f713a.exe"C:\Users\Admin\AppData\Local\Temp\1059e3f9885ba44e386bfdccb4dffffb72cd1ac52617b408987a46f17f8f713a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\xlrlllf.exec:\xlrlllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\vjpjj.exec:\vjpjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\frxrrrl.exec:\frxrrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\nthbbh.exec:\nthbbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\jpvvv.exec:\jpvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\1hhbbn.exec:\1hhbbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\9ffxrrl.exec:\9ffxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\hbhbbb.exec:\hbhbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\xflfxxr.exec:\xflfxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\nnbbhb.exec:\nnbbhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\ttbbhh.exec:\ttbbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\vvddv.exec:\vvddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\3rxrrrl.exec:\3rxrrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\bhtnhb.exec:\bhtnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\pdjjv.exec:\pdjjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\rlxxffl.exec:\rlxxffl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\bthhhb.exec:\bthhhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\dvjdd.exec:\dvjdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\bnnhtt.exec:\bnnhtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\jpjjd.exec:\jpjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\btbtnh.exec:\btbtnh.exe23⤵
- Executes dropped EXE
PID:4224 -
\??\c:\jjddv.exec:\jjddv.exe24⤵
- Executes dropped EXE
PID:716 -
\??\c:\tnhhtt.exec:\tnhhtt.exe25⤵
- Executes dropped EXE
PID:3676 -
\??\c:\dvjdd.exec:\dvjdd.exe26⤵
- Executes dropped EXE
PID:1380 -
\??\c:\7ffxrrl.exec:\7ffxrrl.exe27⤵
- Executes dropped EXE
PID:5048 -
\??\c:\jddjd.exec:\jddjd.exe28⤵
- Executes dropped EXE
PID:1784 -
\??\c:\bhbbbb.exec:\bhbbbb.exe29⤵
- Executes dropped EXE
PID:1716 -
\??\c:\1djjd.exec:\1djjd.exe30⤵
- Executes dropped EXE
PID:5068 -
\??\c:\jdpjj.exec:\jdpjj.exe31⤵
- Executes dropped EXE
PID:5084 -
\??\c:\nntntb.exec:\nntntb.exe32⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nbnhhh.exec:\nbnhhh.exe33⤵
- Executes dropped EXE
PID:3148 -
\??\c:\nhnntn.exec:\nhnntn.exe34⤵
- Executes dropped EXE
PID:5080 -
\??\c:\lxfxxxr.exec:\lxfxxxr.exe35⤵
- Executes dropped EXE
PID:1820 -
\??\c:\vpvpp.exec:\vpvpp.exe36⤵
- Executes dropped EXE
PID:1660 -
\??\c:\bbhhnt.exec:\bbhhnt.exe37⤵
- Executes dropped EXE
PID:2756 -
\??\c:\9jvvv.exec:\9jvvv.exe38⤵
- Executes dropped EXE
PID:4468 -
\??\c:\5pvpj.exec:\5pvpj.exe39⤵
- Executes dropped EXE
PID:2452 -
\??\c:\rxffllx.exec:\rxffllx.exe40⤵
- Executes dropped EXE
PID:3744 -
\??\c:\bthhnn.exec:\bthhnn.exe41⤵
- Executes dropped EXE
PID:4328 -
\??\c:\jjdvp.exec:\jjdvp.exe42⤵
- Executes dropped EXE
PID:4340 -
\??\c:\rrxrllf.exec:\rrxrllf.exe43⤵
- Executes dropped EXE
PID:4040 -
\??\c:\nbhhbh.exec:\nbhhbh.exe44⤵
- Executes dropped EXE
PID:384 -
\??\c:\vvjdv.exec:\vvjdv.exe45⤵
- Executes dropped EXE
PID:1348 -
\??\c:\vpvvp.exec:\vpvvp.exe46⤵
- Executes dropped EXE
PID:2276 -
\??\c:\fxffxxx.exec:\fxffxxx.exe47⤵
- Executes dropped EXE
PID:2248 -
\??\c:\5hnnhn.exec:\5hnnhn.exe48⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jvdpv.exec:\jvdpv.exe49⤵
- Executes dropped EXE
PID:1828 -
\??\c:\3rxxxfx.exec:\3rxxxfx.exe50⤵
- Executes dropped EXE
PID:4780 -
\??\c:\bbttnn.exec:\bbttnn.exe51⤵
- Executes dropped EXE
PID:4592 -
\??\c:\hnhbbb.exec:\hnhbbb.exe52⤵
- Executes dropped EXE
PID:3832 -
\??\c:\1dddv.exec:\1dddv.exe53⤵
- Executes dropped EXE
PID:3672 -
\??\c:\ffffxxr.exec:\ffffxxr.exe54⤵
- Executes dropped EXE
PID:1276 -
\??\c:\rffxrrl.exec:\rffxrrl.exe55⤵
- Executes dropped EXE
PID:2132 -
\??\c:\bbbtnb.exec:\bbbtnb.exe56⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jjjdv.exec:\jjjdv.exe57⤵
- Executes dropped EXE
PID:1004 -
\??\c:\3rxrrrr.exec:\3rxrrrr.exe58⤵
- Executes dropped EXE
PID:2240 -
\??\c:\thhbtt.exec:\thhbtt.exe59⤵
- Executes dropped EXE
PID:2228 -
\??\c:\vjpjj.exec:\vjpjj.exe60⤵
- Executes dropped EXE
PID:216 -
\??\c:\pvdjj.exec:\pvdjj.exe61⤵
- Executes dropped EXE
PID:2476 -
\??\c:\7flfxxf.exec:\7flfxxf.exe62⤵
- Executes dropped EXE
PID:364 -
\??\c:\hhtthh.exec:\hhtthh.exe63⤵
- Executes dropped EXE
PID:3444 -
\??\c:\bttnnh.exec:\bttnnh.exe64⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vpvpj.exec:\vpvpj.exe65⤵
- Executes dropped EXE
PID:4112 -
\??\c:\fxxlflf.exec:\fxxlflf.exe66⤵PID:1456
-
\??\c:\9htbbt.exec:\9htbbt.exe67⤵PID:3936
-
\??\c:\3bhbtb.exec:\3bhbtb.exe68⤵PID:4408
-
\??\c:\djpvd.exec:\djpvd.exe69⤵PID:3988
-
\??\c:\ffffrrl.exec:\ffffrrl.exe70⤵PID:4752
-
\??\c:\7nbbhn.exec:\7nbbhn.exe71⤵PID:1964
-
\??\c:\hbhhhh.exec:\hbhhhh.exe72⤵PID:2680
-
\??\c:\jdjdd.exec:\jdjdd.exe73⤵PID:3768
-
\??\c:\flllfff.exec:\flllfff.exe74⤵PID:2372
-
\??\c:\hbbhbh.exec:\hbbhbh.exe75⤵PID:2176
-
\??\c:\jvpjj.exec:\jvpjj.exe76⤵PID:4192
-
\??\c:\pjpjd.exec:\pjpjd.exe77⤵PID:1380
-
\??\c:\fxrrrxx.exec:\fxrrrxx.exe78⤵PID:4148
-
\??\c:\9xxrxfr.exec:\9xxrxfr.exe79⤵PID:2952
-
\??\c:\9hnhbb.exec:\9hnhbb.exe80⤵PID:1780
-
\??\c:\ddppv.exec:\ddppv.exe81⤵PID:4300
-
\??\c:\7jpjp.exec:\7jpjp.exe82⤵PID:4304
-
\??\c:\llxrllf.exec:\llxrllf.exe83⤵PID:5084
-
\??\c:\bbtnbb.exec:\bbtnbb.exe84⤵PID:2020
-
\??\c:\dvjdd.exec:\dvjdd.exe85⤵PID:3144
-
\??\c:\lrllfff.exec:\lrllfff.exe86⤵PID:396
-
\??\c:\nhnnhh.exec:\nhnnhh.exe87⤵PID:4380
-
\??\c:\ppvpj.exec:\ppvpj.exe88⤵PID:1556
-
\??\c:\vvvpj.exec:\vvvpj.exe89⤵PID:4652
-
\??\c:\xrrrffr.exec:\xrrrffr.exe90⤵PID:4108
-
\??\c:\hthhbb.exec:\hthhbb.exe91⤵PID:4420
-
\??\c:\pvdvj.exec:\pvdvj.exe92⤵PID:4132
-
\??\c:\llllfff.exec:\llllfff.exe93⤵PID:3284
-
\??\c:\9fxrllf.exec:\9fxrllf.exe94⤵PID:1412
-
\??\c:\1nhbhn.exec:\1nhbhn.exe95⤵PID:3360
-
\??\c:\vvjdd.exec:\vvjdd.exe96⤵PID:3068
-
\??\c:\xfxrfff.exec:\xfxrfff.exe97⤵PID:3628
-
\??\c:\fffrllx.exec:\fffrllx.exe98⤵PID:4832
-
\??\c:\btbtnn.exec:\btbtnn.exe99⤵PID:3184
-
\??\c:\5pppv.exec:\5pppv.exe100⤵PID:2784
-
\??\c:\5jpjj.exec:\5jpjj.exe101⤵PID:2776
-
\??\c:\ffffxxx.exec:\ffffxxx.exe102⤵PID:3168
-
\??\c:\bbnhbb.exec:\bbnhbb.exe103⤵PID:2828
-
\??\c:\dvvpj.exec:\dvvpj.exe104⤵PID:628
-
\??\c:\llxrxxr.exec:\llxrxxr.exe105⤵PID:2124
-
\??\c:\hbhbtt.exec:\hbhbtt.exe106⤵PID:1856
-
\??\c:\pdddv.exec:\pdddv.exe107⤵PID:3200
-
\??\c:\rlrrlll.exec:\rlrrlll.exe108⤵PID:3616
-
\??\c:\tbnnhh.exec:\tbnnhh.exe109⤵
- System Location Discovery: System Language Discovery
PID:1276 -
\??\c:\hbhbtt.exec:\hbhbtt.exe110⤵PID:3320
-
\??\c:\vpddv.exec:\vpddv.exe111⤵PID:1300
-
\??\c:\rfrrllf.exec:\rfrrllf.exe112⤵PID:1844
-
\??\c:\tttnhb.exec:\tttnhb.exe113⤵PID:1216
-
\??\c:\jjjdv.exec:\jjjdv.exe114⤵PID:4776
-
\??\c:\dddvp.exec:\dddvp.exe115⤵PID:4184
-
\??\c:\xxxrllf.exec:\xxxrllf.exe116⤵PID:4416
-
\??\c:\nhtnhh.exec:\nhtnhh.exe117⤵PID:4472
-
\??\c:\jdpjd.exec:\jdpjd.exe118⤵PID:4552
-
\??\c:\7lrlxxx.exec:\7lrlxxx.exe119⤵PID:4732
-
\??\c:\bthbtt.exec:\bthbtt.exe120⤵PID:3420
-
\??\c:\3vvpp.exec:\3vvpp.exe121⤵PID:3444
-
\??\c:\rxffrlr.exec:\rxffrlr.exe122⤵PID:4656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-