Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 21:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d01f42349817694078c03067dfed4e4aec0529bc53330a19bd349c21fd91be6.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
2d01f42349817694078c03067dfed4e4aec0529bc53330a19bd349c21fd91be6.exe
-
Size
454KB
-
MD5
61764303652d6a655389b0245e33b332
-
SHA1
bf4a11aa41d00830f6e295f56435ac096c08f901
-
SHA256
2d01f42349817694078c03067dfed4e4aec0529bc53330a19bd349c21fd91be6
-
SHA512
6cfb3ddb8910e9f03aa6f0e8187759561f072a2dce35e79d5645d0c8795bc1f42eb0d1962caa357a9e927267ece1169376df72f76ba3b60fbc3d56b7b2264cd9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeto:q7Tc2NYHUrAwfMp3CDto
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3112-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3368-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/776-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-681-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-685-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-788-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-822-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-868-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-1167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-1677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4796 7xlrlxl.exe 2880 jpjdv.exe 808 bhbnhh.exe 452 bnhbbt.exe 2888 dddvp.exe 3176 bhnhhh.exe 3748 vdjjd.exe 4400 bntnbb.exe 3384 tbnhhn.exe 2208 pjpjd.exe 2732 9xfffff.exe 1588 xxxxrxx.exe 3036 tthhhh.exe 2052 thnnhh.exe 552 1lrllll.exe 3996 rrrrlxx.exe 2296 hbttbn.exe 3460 1vpvj.exe 2964 xffxrrr.exe 4084 bhbbtn.exe 464 1jjdd.exe 3368 llrlrrr.exe 628 nhnttt.exe 1668 pjppj.exe 1452 nttnhh.exe 4992 jddvv.exe 776 nnhbbb.exe 4952 jjppp.exe 1956 hbhbbt.exe 4896 pdpjp.exe 4144 hbbttn.exe 1044 3jpjj.exe 404 xfrrflx.exe 2508 tbtbtt.exe 3796 xxxrxxf.exe 2036 llrllfx.exe 1776 bhhhhb.exe 3216 ppjvp.exe 1000 ntbtbb.exe 5108 vjvjp.exe 3648 5xlflrr.exe 2184 nnhhtt.exe 2316 ppppj.exe 2528 jvjvj.exe 2636 llrlfrl.exe 4980 hntttt.exe 3416 9vjpj.exe 1500 3ppjv.exe 1916 3xxxrrr.exe 2056 xlrxffl.exe 1932 3tbtnh.exe 4416 5jdvp.exe 4828 frxrfrl.exe 1488 xrrlrlr.exe 4300 hhbtnn.exe 808 frrlfxr.exe 5036 hnnhhh.exe 4304 jppvp.exe 4040 7vppj.exe 3204 llrrrrx.exe 3276 rflfxxr.exe 3940 bbhbbb.exe 5116 dvvpj.exe 1252 ppvpv.exe -
resource yara_rule behavioral2/memory/3112-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/776-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/776-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4140-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-822-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttbn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3112 wrote to memory of 4796 3112 2d01f42349817694078c03067dfed4e4aec0529bc53330a19bd349c21fd91be6.exe 83 PID 3112 wrote to memory of 4796 3112 2d01f42349817694078c03067dfed4e4aec0529bc53330a19bd349c21fd91be6.exe 83 PID 3112 wrote to memory of 4796 3112 2d01f42349817694078c03067dfed4e4aec0529bc53330a19bd349c21fd91be6.exe 83 PID 4796 wrote to memory of 2880 4796 7xlrlxl.exe 84 PID 4796 wrote to memory of 2880 4796 7xlrlxl.exe 84 PID 4796 wrote to memory of 2880 4796 7xlrlxl.exe 84 PID 2880 wrote to memory of 808 2880 jpjdv.exe 85 PID 2880 wrote to memory of 808 2880 jpjdv.exe 85 PID 2880 wrote to memory of 808 2880 jpjdv.exe 85 PID 808 wrote to memory of 452 808 bhbnhh.exe 86 PID 808 wrote to memory of 452 808 bhbnhh.exe 86 PID 808 wrote to memory of 452 808 bhbnhh.exe 86 PID 452 wrote to memory of 2888 452 bnhbbt.exe 87 PID 452 wrote to memory of 2888 452 bnhbbt.exe 87 PID 452 wrote to memory of 2888 452 bnhbbt.exe 87 PID 2888 wrote to memory of 3176 2888 dddvp.exe 88 PID 2888 wrote to memory of 3176 2888 dddvp.exe 88 PID 2888 wrote to memory of 3176 2888 dddvp.exe 88 PID 3176 wrote to memory of 3748 3176 bhnhhh.exe 89 PID 3176 wrote to memory of 3748 3176 bhnhhh.exe 89 PID 3176 wrote to memory of 3748 3176 bhnhhh.exe 89 PID 3748 wrote to memory of 4400 3748 vdjjd.exe 90 PID 3748 wrote to memory of 4400 3748 vdjjd.exe 90 PID 3748 wrote to memory of 4400 3748 vdjjd.exe 90 PID 4400 wrote to memory of 3384 4400 bntnbb.exe 91 PID 4400 wrote to memory of 3384 4400 bntnbb.exe 91 PID 4400 wrote to memory of 3384 4400 bntnbb.exe 91 PID 3384 wrote to memory of 2208 3384 tbnhhn.exe 92 PID 3384 wrote to memory of 2208 3384 tbnhhn.exe 92 PID 3384 wrote to memory of 2208 3384 tbnhhn.exe 92 PID 2208 wrote to memory of 2732 2208 pjpjd.exe 93 PID 2208 wrote to memory of 2732 2208 pjpjd.exe 93 PID 2208 wrote to memory of 2732 2208 pjpjd.exe 93 PID 2732 wrote to memory of 1588 2732 9xfffff.exe 94 PID 2732 wrote to memory of 1588 2732 9xfffff.exe 94 PID 2732 wrote to memory of 1588 2732 9xfffff.exe 94 PID 1588 wrote to memory of 3036 1588 xxxxrxx.exe 95 PID 1588 wrote to memory of 3036 1588 xxxxrxx.exe 95 PID 1588 wrote to memory of 3036 1588 xxxxrxx.exe 95 PID 3036 wrote to memory of 2052 3036 tthhhh.exe 96 PID 3036 wrote to memory of 2052 3036 tthhhh.exe 96 PID 3036 wrote to memory of 2052 3036 tthhhh.exe 96 PID 2052 wrote to memory of 552 2052 thnnhh.exe 97 PID 2052 wrote to memory of 552 2052 thnnhh.exe 97 PID 2052 wrote to memory of 552 2052 thnnhh.exe 97 PID 552 wrote to memory of 3996 552 1lrllll.exe 98 PID 552 wrote to memory of 3996 552 1lrllll.exe 98 PID 552 wrote to memory of 3996 552 1lrllll.exe 98 PID 3996 wrote to memory of 2296 3996 rrrrlxx.exe 99 PID 3996 wrote to memory of 2296 3996 rrrrlxx.exe 99 PID 3996 wrote to memory of 2296 3996 rrrrlxx.exe 99 PID 2296 wrote to memory of 3460 2296 hbttbn.exe 100 PID 2296 wrote to memory of 3460 2296 hbttbn.exe 100 PID 2296 wrote to memory of 3460 2296 hbttbn.exe 100 PID 3460 wrote to memory of 2964 3460 1vpvj.exe 101 PID 3460 wrote to memory of 2964 3460 1vpvj.exe 101 PID 3460 wrote to memory of 2964 3460 1vpvj.exe 101 PID 2964 wrote to memory of 4084 2964 xffxrrr.exe 102 PID 2964 wrote to memory of 4084 2964 xffxrrr.exe 102 PID 2964 wrote to memory of 4084 2964 xffxrrr.exe 102 PID 4084 wrote to memory of 464 4084 bhbbtn.exe 103 PID 4084 wrote to memory of 464 4084 bhbbtn.exe 103 PID 4084 wrote to memory of 464 4084 bhbbtn.exe 103 PID 464 wrote to memory of 3368 464 1jjdd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d01f42349817694078c03067dfed4e4aec0529bc53330a19bd349c21fd91be6.exe"C:\Users\Admin\AppData\Local\Temp\2d01f42349817694078c03067dfed4e4aec0529bc53330a19bd349c21fd91be6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\7xlrlxl.exec:\7xlrlxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\jpjdv.exec:\jpjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\bhbnhh.exec:\bhbnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\bnhbbt.exec:\bnhbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\dddvp.exec:\dddvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\bhnhhh.exec:\bhnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\vdjjd.exec:\vdjjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\bntnbb.exec:\bntnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\tbnhhn.exec:\tbnhhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\pjpjd.exec:\pjpjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\9xfffff.exec:\9xfffff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\xxxxrxx.exec:\xxxxrxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\tthhhh.exec:\tthhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\thnnhh.exec:\thnnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\1lrllll.exec:\1lrllll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\rrrrlxx.exec:\rrrrlxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\hbttbn.exec:\hbttbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\1vpvj.exec:\1vpvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\xffxrrr.exec:\xffxrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\bhbbtn.exec:\bhbbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\1jjdd.exec:\1jjdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\llrlrrr.exec:\llrlrrr.exe23⤵
- Executes dropped EXE
PID:3368 -
\??\c:\nhnttt.exec:\nhnttt.exe24⤵
- Executes dropped EXE
PID:628 -
\??\c:\pjppj.exec:\pjppj.exe25⤵
- Executes dropped EXE
PID:1668 -
\??\c:\nttnhh.exec:\nttnhh.exe26⤵
- Executes dropped EXE
PID:1452 -
\??\c:\jddvv.exec:\jddvv.exe27⤵
- Executes dropped EXE
PID:4992 -
\??\c:\nnhbbb.exec:\nnhbbb.exe28⤵
- Executes dropped EXE
PID:776 -
\??\c:\jjppp.exec:\jjppp.exe29⤵
- Executes dropped EXE
PID:4952 -
\??\c:\hbhbbt.exec:\hbhbbt.exe30⤵
- Executes dropped EXE
PID:1956 -
\??\c:\pdpjp.exec:\pdpjp.exe31⤵
- Executes dropped EXE
PID:4896 -
\??\c:\hbbttn.exec:\hbbttn.exe32⤵
- Executes dropped EXE
PID:4144 -
\??\c:\3jpjj.exec:\3jpjj.exe33⤵
- Executes dropped EXE
PID:1044 -
\??\c:\xfrrflx.exec:\xfrrflx.exe34⤵
- Executes dropped EXE
PID:404 -
\??\c:\tbtbtt.exec:\tbtbtt.exe35⤵
- Executes dropped EXE
PID:2508 -
\??\c:\xxxrxxf.exec:\xxxrxxf.exe36⤵
- Executes dropped EXE
PID:3796 -
\??\c:\llrllfx.exec:\llrllfx.exe37⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bhhhhb.exec:\bhhhhb.exe38⤵
- Executes dropped EXE
PID:1776 -
\??\c:\ppjvp.exec:\ppjvp.exe39⤵
- Executes dropped EXE
PID:3216 -
\??\c:\ntbtbb.exec:\ntbtbb.exe40⤵
- Executes dropped EXE
PID:1000 -
\??\c:\vjvjp.exec:\vjvjp.exe41⤵
- Executes dropped EXE
PID:5108 -
\??\c:\5xlflrr.exec:\5xlflrr.exe42⤵
- Executes dropped EXE
PID:3648 -
\??\c:\nnhhtt.exec:\nnhhtt.exe43⤵
- Executes dropped EXE
PID:2184 -
\??\c:\ppppj.exec:\ppppj.exe44⤵
- Executes dropped EXE
PID:2316 -
\??\c:\jvjvj.exec:\jvjvj.exe45⤵
- Executes dropped EXE
PID:2528 -
\??\c:\llrlfrl.exec:\llrlfrl.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\hntttt.exec:\hntttt.exe47⤵
- Executes dropped EXE
PID:4980 -
\??\c:\9vjpj.exec:\9vjpj.exe48⤵
- Executes dropped EXE
PID:3416 -
\??\c:\3ppjv.exec:\3ppjv.exe49⤵
- Executes dropped EXE
PID:1500 -
\??\c:\3xxxrrr.exec:\3xxxrrr.exe50⤵
- Executes dropped EXE
PID:1916 -
\??\c:\xlrxffl.exec:\xlrxffl.exe51⤵
- Executes dropped EXE
PID:2056 -
\??\c:\3tbtnh.exec:\3tbtnh.exe52⤵
- Executes dropped EXE
PID:1932 -
\??\c:\5jdvp.exec:\5jdvp.exe53⤵
- Executes dropped EXE
PID:4416 -
\??\c:\frxrfrl.exec:\frxrfrl.exe54⤵
- Executes dropped EXE
PID:4828 -
\??\c:\xrrlrlr.exec:\xrrlrlr.exe55⤵
- Executes dropped EXE
PID:1488 -
\??\c:\hhbtnn.exec:\hhbtnn.exe56⤵
- Executes dropped EXE
PID:4300 -
\??\c:\frrlfxr.exec:\frrlfxr.exe57⤵
- Executes dropped EXE
PID:808 -
\??\c:\hnnhhh.exec:\hnnhhh.exe58⤵
- Executes dropped EXE
PID:5036 -
\??\c:\jppvp.exec:\jppvp.exe59⤵
- Executes dropped EXE
PID:4304 -
\??\c:\7vppj.exec:\7vppj.exe60⤵
- Executes dropped EXE
PID:4040 -
\??\c:\llrrrrx.exec:\llrrrrx.exe61⤵
- Executes dropped EXE
PID:3204 -
\??\c:\rflfxxr.exec:\rflfxxr.exe62⤵
- Executes dropped EXE
PID:3276 -
\??\c:\bbhbbb.exec:\bbhbbb.exe63⤵
- Executes dropped EXE
PID:3940 -
\??\c:\dvvpj.exec:\dvvpj.exe64⤵
- Executes dropped EXE
PID:5116 -
\??\c:\ppvpv.exec:\ppvpv.exe65⤵
- Executes dropped EXE
PID:1252 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe66⤵PID:2364
-
\??\c:\bttntt.exec:\bttntt.exe67⤵PID:3148
-
\??\c:\9jpjv.exec:\9jpjv.exe68⤵PID:640
-
\??\c:\ppjdv.exec:\ppjdv.exe69⤵PID:4296
-
\??\c:\3rlxrlf.exec:\3rlxrlf.exe70⤵PID:3912
-
\??\c:\5ttnnn.exec:\5ttnnn.exe71⤵PID:920
-
\??\c:\hbnhbb.exec:\hbnhbb.exe72⤵PID:5076
-
\??\c:\1djdv.exec:\1djdv.exe73⤵PID:556
-
\??\c:\lrxxrfl.exec:\lrxxrfl.exe74⤵PID:872
-
\??\c:\hbbntn.exec:\hbbntn.exe75⤵PID:4248
-
\??\c:\jdjdv.exec:\jdjdv.exe76⤵PID:2808
-
\??\c:\djvpd.exec:\djvpd.exe77⤵PID:4404
-
\??\c:\lffllrl.exec:\lffllrl.exe78⤵PID:2424
-
\??\c:\5nbtnn.exec:\5nbtnn.exe79⤵PID:1920
-
\??\c:\dppjv.exec:\dppjv.exe80⤵PID:212
-
\??\c:\dpppd.exec:\dpppd.exe81⤵PID:4372
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe82⤵PID:3376
-
\??\c:\hhthnn.exec:\hhthnn.exe83⤵PID:2044
-
\??\c:\pjvdj.exec:\pjvdj.exe84⤵
- System Location Discovery: System Language Discovery
PID:1820 -
\??\c:\vjjdv.exec:\vjjdv.exe85⤵PID:976
-
\??\c:\lllxlfx.exec:\lllxlfx.exe86⤵PID:2088
-
\??\c:\1nttnn.exec:\1nttnn.exe87⤵PID:4636
-
\??\c:\9vvpj.exec:\9vvpj.exe88⤵PID:4820
-
\??\c:\dddpp.exec:\dddpp.exe89⤵PID:756
-
\??\c:\bttnbb.exec:\bttnbb.exe90⤵PID:4852
-
\??\c:\btbthh.exec:\btbthh.exe91⤵PID:1056
-
\??\c:\pddpj.exec:\pddpj.exe92⤵PID:4616
-
\??\c:\3frrrrx.exec:\3frrrrx.exe93⤵PID:4280
-
\??\c:\hnnnhh.exec:\hnnnhh.exe94⤵PID:3068
-
\??\c:\bhbhbh.exec:\bhbhbh.exe95⤵PID:4468
-
\??\c:\vvvpj.exec:\vvvpj.exe96⤵PID:944
-
\??\c:\xfffrrf.exec:\xfffrrf.exe97⤵PID:4260
-
\??\c:\frrlfxr.exec:\frrlfxr.exe98⤵PID:4888
-
\??\c:\btnhbb.exec:\btnhbb.exe99⤵PID:1516
-
\??\c:\pdddv.exec:\pdddv.exe100⤵PID:1816
-
\??\c:\9rlfrrl.exec:\9rlfrrl.exe101⤵PID:1008
-
\??\c:\htttnn.exec:\htttnn.exe102⤵PID:2640
-
\??\c:\tntnnb.exec:\tntnnb.exe103⤵PID:4484
-
\??\c:\vvjdv.exec:\vvjdv.exe104⤵PID:2328
-
\??\c:\rrxrfxr.exec:\rrxrfxr.exe105⤵PID:1092
-
\??\c:\nnhnbb.exec:\nnhnbb.exe106⤵PID:2336
-
\??\c:\hbnhtn.exec:\hbnhtn.exe107⤵PID:2244
-
\??\c:\5vpvp.exec:\5vpvp.exe108⤵PID:1032
-
\??\c:\rfrflfl.exec:\rfrflfl.exe109⤵PID:5092
-
\??\c:\7bnbtb.exec:\7bnbtb.exe110⤵PID:4316
-
\??\c:\pjjvj.exec:\pjjvj.exe111⤵PID:1540
-
\??\c:\5pjdd.exec:\5pjdd.exe112⤵PID:2720
-
\??\c:\xfxrlll.exec:\xfxrlll.exe113⤵PID:3252
-
\??\c:\7tbntt.exec:\7tbntt.exe114⤵PID:1916
-
\??\c:\pvppj.exec:\pvppj.exe115⤵PID:2056
-
\??\c:\jpvpd.exec:\jpvpd.exe116⤵PID:2376
-
\??\c:\rflfrrl.exec:\rflfrrl.exe117⤵PID:372
-
\??\c:\bbthtt.exec:\bbthtt.exe118⤵PID:2880
-
\??\c:\1ttnhb.exec:\1ttnhb.exe119⤵PID:2124
-
\??\c:\pjpjj.exec:\pjpjj.exe120⤵PID:4724
-
\??\c:\frxrrlr.exec:\frxrrlr.exe121⤵PID:1924
-
\??\c:\tthbnh.exec:\tthbnh.exe122⤵PID:5036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-