Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 20:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe
-
Size
454KB
-
MD5
b08059df499c6b915ba8fe6e31f29e72
-
SHA1
f2745afbd5e4062b79c5c14fcc39dc17ce9027be
-
SHA256
2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e
-
SHA512
1cf2b7329b9a4e9ed497a0d774fd772f621550f38b173e31dd7096ca49e3cd15f0b53457d00afd78a60f9dfe8f66f9c8e755d4804c22b1f1510d27d98a306b12
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetX:q7Tc2NYHUrAwfMp3CDtX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2560-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2116-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/784-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1852-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1088-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1732-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3908-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3884-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/320-702-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-1051-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-1434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4988 jppjd.exe 2876 llrlfxr.exe 2400 bbhbnn.exe 536 pvvpj.exe 4088 fxxlrrx.exe 2116 btbttn.exe 2144 xrfxllr.exe 4524 jpjdd.exe 4972 rffrllx.exe 2304 nnbbnn.exe 2780 llfrlrl.exe 1644 ddddv.exe 2136 rxlfxrl.exe 4080 1fxrllf.exe 2848 bnbtnh.exe 4964 vddvv.exe 1604 rlrllfr.exe 4768 nbhbtn.exe 1336 3rlxflr.exe 784 ddvpj.exe 2960 lrrfffx.exe 3944 vjppj.exe 4676 xflffxr.exe 4092 nhbthh.exe 1348 ntbthb.exe 4452 9flfxxr.exe 2708 ffllllr.exe 4868 pjdvv.exe 552 xflfxrl.exe 4836 ththnh.exe 4292 jvdvp.exe 2372 3ffrllf.exe 1852 pdjdp.exe 1088 5nnnhh.exe 2076 jpvpp.exe 4828 fxlllxr.exe 1312 btbbhh.exe 2844 vpjjj.exe 3780 lrfxxxr.exe 4484 5vvpj.exe 3448 3djvp.exe 3580 1nnbtt.exe 4276 nhttbb.exe 1732 vvjdj.exe 1724 lxfxfxr.exe 4968 fxxfxxr.exe 3908 hhbtnh.exe 3112 jvjdv.exe 2788 7fxrffx.exe 876 hbbtbb.exe 4088 jpvpp.exe 5012 jdjjd.exe 4112 rrrfxlf.exe 4612 thntnn.exe 4884 3jjdv.exe 3520 vvvpp.exe 3716 rrrrlrl.exe 3688 nntnnn.exe 2204 hbhbtn.exe 996 pjppj.exe 1968 lffxllx.exe 5008 frxrlfx.exe 972 nbhbtt.exe 2464 vjpjv.exe -
resource yara_rule behavioral2/memory/2560-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2116-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/784-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1852-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1088-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1732-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3908-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3884-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-702-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3htnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2560 wrote to memory of 4988 2560 2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe 82 PID 2560 wrote to memory of 4988 2560 2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe 82 PID 2560 wrote to memory of 4988 2560 2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe 82 PID 4988 wrote to memory of 2876 4988 jppjd.exe 83 PID 4988 wrote to memory of 2876 4988 jppjd.exe 83 PID 4988 wrote to memory of 2876 4988 jppjd.exe 83 PID 2876 wrote to memory of 2400 2876 llrlfxr.exe 84 PID 2876 wrote to memory of 2400 2876 llrlfxr.exe 84 PID 2876 wrote to memory of 2400 2876 llrlfxr.exe 84 PID 2400 wrote to memory of 536 2400 bbhbnn.exe 85 PID 2400 wrote to memory of 536 2400 bbhbnn.exe 85 PID 2400 wrote to memory of 536 2400 bbhbnn.exe 85 PID 536 wrote to memory of 4088 536 pvvpj.exe 86 PID 536 wrote to memory of 4088 536 pvvpj.exe 86 PID 536 wrote to memory of 4088 536 pvvpj.exe 86 PID 4088 wrote to memory of 2116 4088 fxxlrrx.exe 87 PID 4088 wrote to memory of 2116 4088 fxxlrrx.exe 87 PID 4088 wrote to memory of 2116 4088 fxxlrrx.exe 87 PID 2116 wrote to memory of 2144 2116 btbttn.exe 88 PID 2116 wrote to memory of 2144 2116 btbttn.exe 88 PID 2116 wrote to memory of 2144 2116 btbttn.exe 88 PID 2144 wrote to memory of 4524 2144 xrfxllr.exe 89 PID 2144 wrote to memory of 4524 2144 xrfxllr.exe 89 PID 2144 wrote to memory of 4524 2144 xrfxllr.exe 89 PID 4524 wrote to memory of 4972 4524 jpjdd.exe 90 PID 4524 wrote to memory of 4972 4524 jpjdd.exe 90 PID 4524 wrote to memory of 4972 4524 jpjdd.exe 90 PID 4972 wrote to memory of 2304 4972 rffrllx.exe 91 PID 4972 wrote to memory of 2304 4972 rffrllx.exe 91 PID 4972 wrote to memory of 2304 4972 rffrllx.exe 91 PID 2304 wrote to memory of 2780 2304 nnbbnn.exe 92 PID 2304 wrote to memory of 2780 2304 nnbbnn.exe 92 PID 2304 wrote to memory of 2780 2304 nnbbnn.exe 92 PID 2780 wrote to memory of 1644 2780 llfrlrl.exe 93 PID 2780 wrote to memory of 1644 2780 llfrlrl.exe 93 PID 2780 wrote to memory of 1644 2780 llfrlrl.exe 93 PID 1644 wrote to memory of 2136 1644 ddddv.exe 94 PID 1644 wrote to memory of 2136 1644 ddddv.exe 94 PID 1644 wrote to memory of 2136 1644 ddddv.exe 94 PID 2136 wrote to memory of 4080 2136 rxlfxrl.exe 95 PID 2136 wrote to memory of 4080 2136 rxlfxrl.exe 95 PID 2136 wrote to memory of 4080 2136 rxlfxrl.exe 95 PID 4080 wrote to memory of 2848 4080 1fxrllf.exe 96 PID 4080 wrote to memory of 2848 4080 1fxrllf.exe 96 PID 4080 wrote to memory of 2848 4080 1fxrllf.exe 96 PID 2848 wrote to memory of 4964 2848 bnbtnh.exe 97 PID 2848 wrote to memory of 4964 2848 bnbtnh.exe 97 PID 2848 wrote to memory of 4964 2848 bnbtnh.exe 97 PID 4964 wrote to memory of 1604 4964 vddvv.exe 98 PID 4964 wrote to memory of 1604 4964 vddvv.exe 98 PID 4964 wrote to memory of 1604 4964 vddvv.exe 98 PID 1604 wrote to memory of 4768 1604 rlrllfr.exe 99 PID 1604 wrote to memory of 4768 1604 rlrllfr.exe 99 PID 1604 wrote to memory of 4768 1604 rlrllfr.exe 99 PID 4768 wrote to memory of 1336 4768 nbhbtn.exe 100 PID 4768 wrote to memory of 1336 4768 nbhbtn.exe 100 PID 4768 wrote to memory of 1336 4768 nbhbtn.exe 100 PID 1336 wrote to memory of 784 1336 3rlxflr.exe 101 PID 1336 wrote to memory of 784 1336 3rlxflr.exe 101 PID 1336 wrote to memory of 784 1336 3rlxflr.exe 101 PID 784 wrote to memory of 2960 784 ddvpj.exe 102 PID 784 wrote to memory of 2960 784 ddvpj.exe 102 PID 784 wrote to memory of 2960 784 ddvpj.exe 102 PID 2960 wrote to memory of 3944 2960 lrrfffx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe"C:\Users\Admin\AppData\Local\Temp\2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\jppjd.exec:\jppjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\llrlfxr.exec:\llrlfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\bbhbnn.exec:\bbhbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\pvvpj.exec:\pvvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\fxxlrrx.exec:\fxxlrrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\btbttn.exec:\btbttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\xrfxllr.exec:\xrfxllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\jpjdd.exec:\jpjdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\rffrllx.exec:\rffrllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\nnbbnn.exec:\nnbbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\llfrlrl.exec:\llfrlrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\ddddv.exec:\ddddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\rxlfxrl.exec:\rxlfxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\1fxrllf.exec:\1fxrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\bnbtnh.exec:\bnbtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\vddvv.exec:\vddvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\rlrllfr.exec:\rlrllfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\nbhbtn.exec:\nbhbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\3rlxflr.exec:\3rlxflr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\ddvpj.exec:\ddvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\lrrfffx.exec:\lrrfffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\vjppj.exec:\vjppj.exe23⤵
- Executes dropped EXE
PID:3944 -
\??\c:\xflffxr.exec:\xflffxr.exe24⤵
- Executes dropped EXE
PID:4676 -
\??\c:\nhbthh.exec:\nhbthh.exe25⤵
- Executes dropped EXE
PID:4092 -
\??\c:\ntbthb.exec:\ntbthb.exe26⤵
- Executes dropped EXE
PID:1348 -
\??\c:\9flfxxr.exec:\9flfxxr.exe27⤵
- Executes dropped EXE
PID:4452 -
\??\c:\ffllllr.exec:\ffllllr.exe28⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pjdvv.exec:\pjdvv.exe29⤵
- Executes dropped EXE
PID:4868 -
\??\c:\xflfxrl.exec:\xflfxrl.exe30⤵
- Executes dropped EXE
PID:552 -
\??\c:\ththnh.exec:\ththnh.exe31⤵
- Executes dropped EXE
PID:4836 -
\??\c:\jvdvp.exec:\jvdvp.exe32⤵
- Executes dropped EXE
PID:4292 -
\??\c:\3ffrllf.exec:\3ffrllf.exe33⤵
- Executes dropped EXE
PID:2372 -
\??\c:\pdjdp.exec:\pdjdp.exe34⤵
- Executes dropped EXE
PID:1852 -
\??\c:\5nnnhh.exec:\5nnnhh.exe35⤵
- Executes dropped EXE
PID:1088 -
\??\c:\jpvpp.exec:\jpvpp.exe36⤵
- Executes dropped EXE
PID:2076 -
\??\c:\fxlllxr.exec:\fxlllxr.exe37⤵
- Executes dropped EXE
PID:4828 -
\??\c:\btbbhh.exec:\btbbhh.exe38⤵
- Executes dropped EXE
PID:1312 -
\??\c:\vpjjj.exec:\vpjjj.exe39⤵
- Executes dropped EXE
PID:2844 -
\??\c:\lrfxxxr.exec:\lrfxxxr.exe40⤵
- Executes dropped EXE
PID:3780 -
\??\c:\5vvpj.exec:\5vvpj.exe41⤵
- Executes dropped EXE
PID:4484 -
\??\c:\3djvp.exec:\3djvp.exe42⤵
- Executes dropped EXE
PID:3448 -
\??\c:\1nnbtt.exec:\1nnbtt.exe43⤵
- Executes dropped EXE
PID:3580 -
\??\c:\nhttbb.exec:\nhttbb.exe44⤵
- Executes dropped EXE
PID:4276 -
\??\c:\vvjdj.exec:\vvjdj.exe45⤵
- Executes dropped EXE
PID:1732 -
\??\c:\lxfxfxr.exec:\lxfxfxr.exe46⤵
- Executes dropped EXE
PID:1724 -
\??\c:\fxxfxxr.exec:\fxxfxxr.exe47⤵
- Executes dropped EXE
PID:4968 -
\??\c:\hhbtnh.exec:\hhbtnh.exe48⤵
- Executes dropped EXE
PID:3908 -
\??\c:\jvjdv.exec:\jvjdv.exe49⤵
- Executes dropped EXE
PID:3112 -
\??\c:\7fxrffx.exec:\7fxrffx.exe50⤵
- Executes dropped EXE
PID:2788 -
\??\c:\hbbtbb.exec:\hbbtbb.exe51⤵
- Executes dropped EXE
PID:876 -
\??\c:\jpvpp.exec:\jpvpp.exe52⤵
- Executes dropped EXE
PID:4088 -
\??\c:\jdjjd.exec:\jdjjd.exe53⤵
- Executes dropped EXE
PID:5012 -
\??\c:\rrrfxlf.exec:\rrrfxlf.exe54⤵
- Executes dropped EXE
PID:4112 -
\??\c:\thntnn.exec:\thntnn.exe55⤵
- Executes dropped EXE
PID:4612 -
\??\c:\3jjdv.exec:\3jjdv.exe56⤵
- Executes dropped EXE
PID:4884 -
\??\c:\vvvpp.exec:\vvvpp.exe57⤵
- Executes dropped EXE
PID:3520 -
\??\c:\rrrrlrl.exec:\rrrrlrl.exe58⤵
- Executes dropped EXE
PID:3716 -
\??\c:\nntnnn.exec:\nntnnn.exe59⤵
- Executes dropped EXE
PID:3688 -
\??\c:\hbhbtn.exec:\hbhbtn.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2204 -
\??\c:\pjppj.exec:\pjppj.exe61⤵
- Executes dropped EXE
PID:996 -
\??\c:\lffxllx.exec:\lffxllx.exe62⤵
- Executes dropped EXE
PID:1968 -
\??\c:\frxrlfx.exec:\frxrlfx.exe63⤵
- Executes dropped EXE
PID:5008 -
\??\c:\nbhbtt.exec:\nbhbtt.exe64⤵
- Executes dropped EXE
PID:972 -
\??\c:\vjpjv.exec:\vjpjv.exe65⤵
- Executes dropped EXE
PID:2464 -
\??\c:\vjpjj.exec:\vjpjj.exe66⤵PID:1660
-
\??\c:\rlrfxxr.exec:\rlrfxxr.exe67⤵PID:2828
-
\??\c:\tnbtbb.exec:\tnbtbb.exe68⤵PID:3668
-
\??\c:\ntbtnb.exec:\ntbtnb.exe69⤵PID:1568
-
\??\c:\djjdv.exec:\djjdv.exe70⤵PID:1604
-
\??\c:\fxxxxrf.exec:\fxxxxrf.exe71⤵PID:1176
-
\??\c:\nhtbtn.exec:\nhtbtn.exe72⤵PID:5000
-
\??\c:\5vvjd.exec:\5vvjd.exe73⤵PID:404
-
\??\c:\rrrrlll.exec:\rrrrlll.exe74⤵PID:784
-
\??\c:\lxlllll.exec:\lxlllll.exe75⤵PID:900
-
\??\c:\nnhhtn.exec:\nnhhtn.exe76⤵PID:4680
-
\??\c:\vppjj.exec:\vppjj.exe77⤵PID:656
-
\??\c:\frxrllx.exec:\frxrllx.exe78⤵PID:3540
-
\??\c:\nnbtnh.exec:\nnbtnh.exe79⤵PID:4328
-
\??\c:\vpvpp.exec:\vpvpp.exe80⤵PID:532
-
\??\c:\jvvvp.exec:\jvvvp.exe81⤵PID:3596
-
\??\c:\1rxxrrl.exec:\1rxxrrl.exe82⤵PID:2944
-
\??\c:\thnhhh.exec:\thnhhh.exe83⤵PID:888
-
\??\c:\7jpjv.exec:\7jpjv.exe84⤵PID:2456
-
\??\c:\vpdjd.exec:\vpdjd.exe85⤵PID:3884
-
\??\c:\lflfffx.exec:\lflfffx.exe86⤵PID:1200
-
\??\c:\7xxrrrl.exec:\7xxrrrl.exe87⤵PID:612
-
\??\c:\tnnbtt.exec:\tnnbtt.exe88⤵PID:1648
-
\??\c:\pdpjp.exec:\pdpjp.exe89⤵PID:5024
-
\??\c:\rxfxrrf.exec:\rxfxrrf.exe90⤵PID:2260
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe91⤵PID:4848
-
\??\c:\tnbbnt.exec:\tnbbnt.exe92⤵PID:4448
-
\??\c:\vpvjj.exec:\vpvjj.exe93⤵PID:2372
-
\??\c:\ffrxxxr.exec:\ffrxxxr.exe94⤵PID:1852
-
\??\c:\xlrllxx.exec:\xlrllxx.exe95⤵PID:3348
-
\??\c:\9nnhhh.exec:\9nnhhh.exe96⤵PID:4432
-
\??\c:\jvdvp.exec:\jvdvp.exe97⤵PID:4560
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe98⤵PID:2112
-
\??\c:\rrxxffr.exec:\rrxxffr.exe99⤵PID:3064
-
\??\c:\tnbnhh.exec:\tnbnhh.exe100⤵PID:2852
-
\??\c:\jvdpp.exec:\jvdpp.exe101⤵PID:5064
-
\??\c:\pvpjv.exec:\pvpjv.exe102⤵PID:4844
-
\??\c:\xrfxrxr.exec:\xrfxrxr.exe103⤵PID:3120
-
\??\c:\xllffxx.exec:\xllffxx.exe104⤵PID:4280
-
\??\c:\thnhbb.exec:\thnhbb.exe105⤵PID:4020
-
\??\c:\vjdvp.exec:\vjdvp.exe106⤵PID:2560
-
\??\c:\vpvpj.exec:\vpvpj.exe107⤵PID:4804
-
\??\c:\nbbtbn.exec:\nbbtbn.exe108⤵PID:2032
-
\??\c:\jpppj.exec:\jpppj.exe109⤵PID:4392
-
\??\c:\5xxxrrl.exec:\5xxxrrl.exe110⤵PID:2400
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe111⤵PID:4796
-
\??\c:\nbbttt.exec:\nbbttt.exe112⤵PID:2412
-
\??\c:\pjjjp.exec:\pjjjp.exe113⤵PID:2264
-
\??\c:\rlfxffl.exec:\rlfxffl.exe114⤵PID:4580
-
\??\c:\xlxrrfx.exec:\xlxrrfx.exe115⤵PID:1480
-
\??\c:\tnnhbb.exec:\tnnhbb.exe116⤵PID:4816
-
\??\c:\dvjdd.exec:\dvjdd.exe117⤵PID:1112
-
\??\c:\llxrfxf.exec:\llxrfxf.exe118⤵PID:2240
-
\??\c:\7lllflf.exec:\7lllflf.exe119⤵PID:3376
-
\??\c:\tttntt.exec:\tttntt.exe120⤵PID:3896
-
\??\c:\vpvpj.exec:\vpvpj.exe121⤵PID:4688
-
\??\c:\ddvvv.exec:\ddvvv.exe122⤵PID:4564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-