Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 20:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
23fec9c5d20af942dd5fef1ae117a4c1dc8744df534852fdf3ce2d807a1d94a5.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
150 seconds
General
-
Target
23fec9c5d20af942dd5fef1ae117a4c1dc8744df534852fdf3ce2d807a1d94a5.exe
-
Size
455KB
-
MD5
b993acf5ccc1da6c3745f4c467a82a25
-
SHA1
ab8d1302822117db6868e5ea336a1a8f11252cfc
-
SHA256
23fec9c5d20af942dd5fef1ae117a4c1dc8744df534852fdf3ce2d807a1d94a5
-
SHA512
de34da31c4d447e0530356a30239309de61348bdcc282adf7b5f7aaa24cc19653253c7b74753e81862a11ee0e70442b3d65ef0fee27a4a1fdac2aa65a43adbb9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRQ:q7Tc2NYHUrAwfMp3CDRQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3016-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/320-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/520-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/656-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3420-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/656-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-731-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-831-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-956-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-1366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4676 jppjv.exe 3584 hntnnn.exe 320 jvpdj.exe 4032 djjpj.exe 1132 rxllxfx.exe 208 vjvvd.exe 2964 btnthb.exe 4704 thhbtb.exe 3896 9xfxlfr.exe 3568 tthbbb.exe 408 nbhnhb.exe 3532 jvdpj.exe 368 vjpjv.exe 4184 bthbnh.exe 520 rrrrfxr.exe 4092 htthbt.exe 5092 3pdjv.exe 3184 pvvpj.exe 2128 hbhbhh.exe 4492 jvjdp.exe 964 5lfxffx.exe 4136 nbbthb.exe 2356 djvpp.exe 4860 5xfxxxf.exe 1496 vppjd.exe 4680 flrxxrr.exe 4760 xffrlfx.exe 1576 nttnbb.exe 2940 5jdvj.exe 1016 rrfxrrl.exe 4508 hnbnbt.exe 656 xrfxlfx.exe 2544 hhtnnt.exe 868 rfrlxrx.exe 4352 9hnhhh.exe 4688 7jjdv.exe 1156 xrrrllf.exe 3928 tnnhtt.exe 1296 vjjjj.exe 1584 9tntnn.exe 4960 dvdpj.exe 4064 7llxrrl.exe 848 bbttnh.exe 3856 dvdpj.exe 3584 lllfllf.exe 4992 nnnhbt.exe 1620 rxxrlfx.exe 1864 nhhhbb.exe 216 vvjjj.exe 1132 lrxlxrl.exe 3932 lrrlfff.exe 208 nnnhhh.exe 4784 jpppv.exe 2964 5ffrllf.exe 3876 nhtntt.exe 3428 5nnhbb.exe 3224 ppvpj.exe 3516 xrlrllr.exe 3116 htbttt.exe 408 3vpjd.exe 2164 jdpjp.exe 3420 xxxrlff.exe 2980 htbtnn.exe 1952 pdjjd.exe -
resource yara_rule behavioral2/memory/3016-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/520-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/656-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1296-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/656-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-731-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxfxxr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3016 wrote to memory of 4676 3016 23fec9c5d20af942dd5fef1ae117a4c1dc8744df534852fdf3ce2d807a1d94a5.exe 83 PID 3016 wrote to memory of 4676 3016 23fec9c5d20af942dd5fef1ae117a4c1dc8744df534852fdf3ce2d807a1d94a5.exe 83 PID 3016 wrote to memory of 4676 3016 23fec9c5d20af942dd5fef1ae117a4c1dc8744df534852fdf3ce2d807a1d94a5.exe 83 PID 4676 wrote to memory of 3584 4676 jppjv.exe 84 PID 4676 wrote to memory of 3584 4676 jppjv.exe 84 PID 4676 wrote to memory of 3584 4676 jppjv.exe 84 PID 3584 wrote to memory of 320 3584 hntnnn.exe 85 PID 3584 wrote to memory of 320 3584 hntnnn.exe 85 PID 3584 wrote to memory of 320 3584 hntnnn.exe 85 PID 320 wrote to memory of 4032 320 jvpdj.exe 86 PID 320 wrote to memory of 4032 320 jvpdj.exe 86 PID 320 wrote to memory of 4032 320 jvpdj.exe 86 PID 4032 wrote to memory of 1132 4032 djjpj.exe 87 PID 4032 wrote to memory of 1132 4032 djjpj.exe 87 PID 4032 wrote to memory of 1132 4032 djjpj.exe 87 PID 1132 wrote to memory of 208 1132 rxllxfx.exe 88 PID 1132 wrote to memory of 208 1132 rxllxfx.exe 88 PID 1132 wrote to memory of 208 1132 rxllxfx.exe 88 PID 208 wrote to memory of 2964 208 vjvvd.exe 89 PID 208 wrote to memory of 2964 208 vjvvd.exe 89 PID 208 wrote to memory of 2964 208 vjvvd.exe 89 PID 2964 wrote to memory of 4704 2964 btnthb.exe 90 PID 2964 wrote to memory of 4704 2964 btnthb.exe 90 PID 2964 wrote to memory of 4704 2964 btnthb.exe 90 PID 4704 wrote to memory of 3896 4704 thhbtb.exe 91 PID 4704 wrote to memory of 3896 4704 thhbtb.exe 91 PID 4704 wrote to memory of 3896 4704 thhbtb.exe 91 PID 3896 wrote to memory of 3568 3896 9xfxlfr.exe 92 PID 3896 wrote to memory of 3568 3896 9xfxlfr.exe 92 PID 3896 wrote to memory of 3568 3896 9xfxlfr.exe 92 PID 3568 wrote to memory of 408 3568 tthbbb.exe 93 PID 3568 wrote to memory of 408 3568 tthbbb.exe 93 PID 3568 wrote to memory of 408 3568 tthbbb.exe 93 PID 408 wrote to memory of 3532 408 nbhnhb.exe 94 PID 408 wrote to memory of 3532 408 nbhnhb.exe 94 PID 408 wrote to memory of 3532 408 nbhnhb.exe 94 PID 3532 wrote to memory of 368 3532 jvdpj.exe 95 PID 3532 wrote to memory of 368 3532 jvdpj.exe 95 PID 3532 wrote to memory of 368 3532 jvdpj.exe 95 PID 368 wrote to memory of 4184 368 vjpjv.exe 96 PID 368 wrote to memory of 4184 368 vjpjv.exe 96 PID 368 wrote to memory of 4184 368 vjpjv.exe 96 PID 4184 wrote to memory of 520 4184 bthbnh.exe 97 PID 4184 wrote to memory of 520 4184 bthbnh.exe 97 PID 4184 wrote to memory of 520 4184 bthbnh.exe 97 PID 520 wrote to memory of 4092 520 rrrrfxr.exe 98 PID 520 wrote to memory of 4092 520 rrrrfxr.exe 98 PID 520 wrote to memory of 4092 520 rrrrfxr.exe 98 PID 4092 wrote to memory of 5092 4092 htthbt.exe 99 PID 4092 wrote to memory of 5092 4092 htthbt.exe 99 PID 4092 wrote to memory of 5092 4092 htthbt.exe 99 PID 5092 wrote to memory of 3184 5092 3pdjv.exe 100 PID 5092 wrote to memory of 3184 5092 3pdjv.exe 100 PID 5092 wrote to memory of 3184 5092 3pdjv.exe 100 PID 3184 wrote to memory of 2128 3184 pvvpj.exe 101 PID 3184 wrote to memory of 2128 3184 pvvpj.exe 101 PID 3184 wrote to memory of 2128 3184 pvvpj.exe 101 PID 2128 wrote to memory of 4492 2128 hbhbhh.exe 102 PID 2128 wrote to memory of 4492 2128 hbhbhh.exe 102 PID 2128 wrote to memory of 4492 2128 hbhbhh.exe 102 PID 4492 wrote to memory of 964 4492 jvjdp.exe 103 PID 4492 wrote to memory of 964 4492 jvjdp.exe 103 PID 4492 wrote to memory of 964 4492 jvjdp.exe 103 PID 964 wrote to memory of 4136 964 5lfxffx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\23fec9c5d20af942dd5fef1ae117a4c1dc8744df534852fdf3ce2d807a1d94a5.exe"C:\Users\Admin\AppData\Local\Temp\23fec9c5d20af942dd5fef1ae117a4c1dc8744df534852fdf3ce2d807a1d94a5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\jppjv.exec:\jppjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\hntnnn.exec:\hntnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\jvpdj.exec:\jvpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\djjpj.exec:\djjpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\rxllxfx.exec:\rxllxfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\vjvvd.exec:\vjvvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\btnthb.exec:\btnthb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\thhbtb.exec:\thhbtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\9xfxlfr.exec:\9xfxlfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\tthbbb.exec:\tthbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\nbhnhb.exec:\nbhnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\jvdpj.exec:\jvdpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\vjpjv.exec:\vjpjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\bthbnh.exec:\bthbnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\rrrrfxr.exec:\rrrrfxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
\??\c:\htthbt.exec:\htthbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\3pdjv.exec:\3pdjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\pvvpj.exec:\pvvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\hbhbhh.exec:\hbhbhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\jvjdp.exec:\jvjdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\5lfxffx.exec:\5lfxffx.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\nbbthb.exec:\nbbthb.exe23⤵
- Executes dropped EXE
PID:4136 -
\??\c:\djvpp.exec:\djvpp.exe24⤵
- Executes dropped EXE
PID:2356 -
\??\c:\5xfxxxf.exec:\5xfxxxf.exe25⤵
- Executes dropped EXE
PID:4860 -
\??\c:\vppjd.exec:\vppjd.exe26⤵
- Executes dropped EXE
PID:1496 -
\??\c:\flrxxrr.exec:\flrxxrr.exe27⤵
- Executes dropped EXE
PID:4680 -
\??\c:\xffrlfx.exec:\xffrlfx.exe28⤵
- Executes dropped EXE
PID:4760 -
\??\c:\nttnbb.exec:\nttnbb.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1576 -
\??\c:\5jdvj.exec:\5jdvj.exe30⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe31⤵
- Executes dropped EXE
PID:1016 -
\??\c:\hnbnbt.exec:\hnbnbt.exe32⤵
- Executes dropped EXE
PID:4508 -
\??\c:\xrfxlfx.exec:\xrfxlfx.exe33⤵
- Executes dropped EXE
PID:656 -
\??\c:\hhtnnt.exec:\hhtnnt.exe34⤵
- Executes dropped EXE
PID:2544 -
\??\c:\rfrlxrx.exec:\rfrlxrx.exe35⤵
- Executes dropped EXE
PID:868 -
\??\c:\9hnhhh.exec:\9hnhhh.exe36⤵
- Executes dropped EXE
PID:4352 -
\??\c:\7jjdv.exec:\7jjdv.exe37⤵
- Executes dropped EXE
PID:4688 -
\??\c:\xrrrllf.exec:\xrrrllf.exe38⤵
- Executes dropped EXE
PID:1156 -
\??\c:\tnnhtt.exec:\tnnhtt.exe39⤵
- Executes dropped EXE
PID:3928 -
\??\c:\vjjjj.exec:\vjjjj.exe40⤵
- Executes dropped EXE
PID:1296 -
\??\c:\9tntnn.exec:\9tntnn.exe41⤵
- Executes dropped EXE
PID:1584 -
\??\c:\dvdpj.exec:\dvdpj.exe42⤵
- Executes dropped EXE
PID:4960 -
\??\c:\7llxrrl.exec:\7llxrrl.exe43⤵
- Executes dropped EXE
PID:4064 -
\??\c:\bbttnh.exec:\bbttnh.exe44⤵
- Executes dropped EXE
PID:848 -
\??\c:\dvdpj.exec:\dvdpj.exe45⤵
- Executes dropped EXE
PID:3856 -
\??\c:\lllfllf.exec:\lllfllf.exe46⤵
- Executes dropped EXE
PID:3584 -
\??\c:\nnnhbt.exec:\nnnhbt.exe47⤵
- Executes dropped EXE
PID:4992 -
\??\c:\rxxrlfx.exec:\rxxrlfx.exe48⤵
- Executes dropped EXE
PID:1620 -
\??\c:\nhhhbb.exec:\nhhhbb.exe49⤵
- Executes dropped EXE
PID:1864 -
\??\c:\vvjjj.exec:\vvjjj.exe50⤵
- Executes dropped EXE
PID:216 -
\??\c:\lrxlxrl.exec:\lrxlxrl.exe51⤵
- Executes dropped EXE
PID:1132 -
\??\c:\lrrlfff.exec:\lrrlfff.exe52⤵
- Executes dropped EXE
PID:3932 -
\??\c:\nnnhhh.exec:\nnnhhh.exe53⤵
- Executes dropped EXE
PID:208 -
\??\c:\jpppv.exec:\jpppv.exe54⤵
- Executes dropped EXE
PID:4784 -
\??\c:\5ffrllf.exec:\5ffrllf.exe55⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nhtntt.exec:\nhtntt.exe56⤵
- Executes dropped EXE
PID:3876 -
\??\c:\5nnhbb.exec:\5nnhbb.exe57⤵
- Executes dropped EXE
PID:3428 -
\??\c:\ppvpj.exec:\ppvpj.exe58⤵
- Executes dropped EXE
PID:3224 -
\??\c:\xrlrllr.exec:\xrlrllr.exe59⤵
- Executes dropped EXE
PID:3516 -
\??\c:\htbttt.exec:\htbttt.exe60⤵
- Executes dropped EXE
PID:3116 -
\??\c:\3vpjd.exec:\3vpjd.exe61⤵
- Executes dropped EXE
PID:408 -
\??\c:\jdpjp.exec:\jdpjp.exe62⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xxxrlff.exec:\xxxrlff.exe63⤵
- Executes dropped EXE
PID:3420 -
\??\c:\htbtnn.exec:\htbtnn.exe64⤵
- Executes dropped EXE
PID:2980 -
\??\c:\pdjjd.exec:\pdjjd.exe65⤵
- Executes dropped EXE
PID:1952 -
\??\c:\nhbnhh.exec:\nhbnhh.exe66⤵PID:1760
-
\??\c:\7vjdv.exec:\7vjdv.exe67⤵PID:2212
-
\??\c:\3dvpj.exec:\3dvpj.exe68⤵PID:5036
-
\??\c:\3rrlflf.exec:\3rrlflf.exe69⤵PID:3500
-
\??\c:\hnhbtn.exec:\hnhbtn.exe70⤵PID:3556
-
\??\c:\ppvpj.exec:\ppvpj.exe71⤵PID:2188
-
\??\c:\xxrxlfl.exec:\xxrxlfl.exe72⤵PID:640
-
\??\c:\tnhhbt.exec:\tnhhbt.exe73⤵PID:3424
-
\??\c:\hhhbtn.exec:\hhhbtn.exe74⤵PID:4136
-
\??\c:\vvvvp.exec:\vvvvp.exe75⤵PID:552
-
\??\c:\flllrll.exec:\flllrll.exe76⤵PID:3112
-
\??\c:\nbhbtt.exec:\nbhbtt.exe77⤵PID:3044
-
\??\c:\ppvpp.exec:\ppvpp.exe78⤵PID:4820
-
\??\c:\5pvjj.exec:\5pvjj.exe79⤵PID:4680
-
\??\c:\rllfrxx.exec:\rllfrxx.exe80⤵PID:4760
-
\??\c:\nhhtnn.exec:\nhhtnn.exe81⤵PID:4640
-
\??\c:\dpjdv.exec:\dpjdv.exe82⤵PID:544
-
\??\c:\9xxlxxl.exec:\9xxlxxl.exe83⤵PID:1736
-
\??\c:\rxflfxl.exec:\rxflfxl.exe84⤵PID:1408
-
\??\c:\5bhthb.exec:\5bhthb.exe85⤵PID:1968
-
\??\c:\dvjvj.exec:\dvjvj.exe86⤵PID:4508
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe87⤵PID:656
-
\??\c:\hbbtnn.exec:\hbbtnn.exe88⤵PID:3260
-
\??\c:\nntthh.exec:\nntthh.exe89⤵PID:4156
-
\??\c:\ddjdp.exec:\ddjdp.exe90⤵PID:5108
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe91⤵PID:2704
-
\??\c:\tnhttn.exec:\tnhttn.exe92⤵PID:864
-
\??\c:\bhhbtn.exec:\bhhbtn.exe93⤵PID:2656
-
\??\c:\jpvpd.exec:\jpvpd.exe94⤵PID:3928
-
\??\c:\xlrffxx.exec:\xlrffxx.exe95⤵PID:1784
-
\??\c:\9rxrflf.exec:\9rxrflf.exe96⤵PID:4340
-
\??\c:\bhnbnh.exec:\bhnbnh.exe97⤵PID:732
-
\??\c:\jjpjj.exec:\jjpjj.exe98⤵PID:2632
-
\??\c:\fxxrllf.exec:\fxxrllf.exe99⤵PID:4676
-
\??\c:\9hbtnh.exec:\9hbtnh.exe100⤵PID:4028
-
\??\c:\1pjjd.exec:\1pjjd.exe101⤵PID:2644
-
\??\c:\jpdpj.exec:\jpdpj.exe102⤵PID:4652
-
\??\c:\fxxrllf.exec:\fxxrllf.exe103⤵PID:4728
-
\??\c:\nbhtnh.exec:\nbhtnh.exe104⤵PID:3324
-
\??\c:\thtnbb.exec:\thtnbb.exe105⤵PID:4716
-
\??\c:\pjpdv.exec:\pjpdv.exe106⤵PID:3104
-
\??\c:\fxxrllf.exec:\fxxrllf.exe107⤵PID:4368
-
\??\c:\hbbtnn.exec:\hbbtnn.exe108⤵PID:4620
-
\??\c:\btnbtn.exec:\btnbtn.exe109⤵PID:2692
-
\??\c:\pvdvp.exec:\pvdvp.exe110⤵PID:4488
-
\??\c:\xxxrlrl.exec:\xxxrlrl.exe111⤵
- System Location Discovery: System Language Discovery
PID:2180 -
\??\c:\tbhbhb.exec:\tbhbhb.exe112⤵PID:3896
-
\??\c:\hhnhbt.exec:\hhnhbt.exe113⤵PID:388
-
\??\c:\dpvpj.exec:\dpvpj.exe114⤵PID:860
-
\??\c:\lffrfxr.exec:\lffrfxr.exe115⤵PID:2776
-
\??\c:\thnhht.exec:\thnhht.exe116⤵PID:2792
-
\??\c:\dvvpj.exec:\dvvpj.exe117⤵PID:4152
-
\??\c:\jjdpj.exec:\jjdpj.exe118⤵PID:4160
-
\??\c:\xrxrlff.exec:\xrxrlff.exe119⤵PID:2672
-
\??\c:\hbbbnt.exec:\hbbbnt.exe120⤵PID:3560
-
\??\c:\hhtnbh.exec:\hhtnbh.exe121⤵PID:2820
-
\??\c:\dpjvp.exec:\dpjvp.exe122⤵PID:2624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-