Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 00:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7cad845c390787136b63cd0f71bc79b10572c9d8012787964ee429649e96defd.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
7cad845c390787136b63cd0f71bc79b10572c9d8012787964ee429649e96defd.exe
-
Size
453KB
-
MD5
e397452dc86f606cdd1b549c9585d421
-
SHA1
46d32cfd288736519e766c6aecde1e1cc449ca79
-
SHA256
7cad845c390787136b63cd0f71bc79b10572c9d8012787964ee429649e96defd
-
SHA512
2c2006e58da996254e20e335b306e70d70723308bd9798f86cb9f662f72f64436cc956ff4b133abaecb0138923824f8d9bf9106a8f67156868b653173739eb1c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAber:q7Tc2NYHUrAwfMp3CDr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/5088-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/716-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2100-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1516-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/384-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1148-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/688-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3344-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-825-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2472-971-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-1083-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2100 djjdd.exe 1720 hbbttt.exe 3980 jdddv.exe 716 rfrrrrf.exe 1544 xlxxrlf.exe 4700 vjjdv.exe 3612 fxxlxxl.exe 2512 rlfxfxr.exe 3260 3djdp.exe 4760 lffxrlf.exe 4152 hnhbtt.exe 5104 9llxfxr.exe 4900 bttttt.exe 464 tbbbtn.exe 4520 vvjdd.exe 2500 vjpjj.exe 3236 flrlffx.exe 1424 xrrlfxr.exe 868 vvjdv.exe 4836 5ffrllf.exe 1932 nntttt.exe 1448 jvjjd.exe 2060 5rfxrrl.exe 4768 djddv.exe 1516 lffxrrl.exe 3060 ppdvd.exe 2472 lrrlffl.exe 5020 vdjjd.exe 4348 7lxrflr.exe 3924 dvvdd.exe 748 lfllxxl.exe 1792 dpvpj.exe 2320 rrfxfff.exe 1592 5dvpv.exe 2244 jjdvj.exe 2236 rlrrllf.exe 3884 vdvvp.exe 3600 rlxrllx.exe 3044 pddjj.exe 1376 tnhhbb.exe 1380 1jvpd.exe 5084 xlrfxrl.exe 1912 flxxrrr.exe 4680 hnbthn.exe 1892 9jjvp.exe 3844 lfffrlx.exe 4364 tnthnh.exe 2616 pppjv.exe 4212 dpvvv.exe 4612 1llfffl.exe 3428 3hnhbb.exe 512 tthbtt.exe 1736 3ppjd.exe 2256 xflfrrx.exe 4964 tnnhbb.exe 3952 jvdvv.exe 4012 flrlllf.exe 384 1fxlfff.exe 3612 btbttn.exe 1148 ppvpj.exe 4792 flrrrrr.exe 688 tbnhbt.exe 4716 9pdvd.exe 1040 pjpjd.exe -
resource yara_rule behavioral2/memory/5088-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/716-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1516-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/384-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/688-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3344-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-825-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-940-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5088 wrote to memory of 2100 5088 7cad845c390787136b63cd0f71bc79b10572c9d8012787964ee429649e96defd.exe 84 PID 5088 wrote to memory of 2100 5088 7cad845c390787136b63cd0f71bc79b10572c9d8012787964ee429649e96defd.exe 84 PID 5088 wrote to memory of 2100 5088 7cad845c390787136b63cd0f71bc79b10572c9d8012787964ee429649e96defd.exe 84 PID 2100 wrote to memory of 1720 2100 djjdd.exe 85 PID 2100 wrote to memory of 1720 2100 djjdd.exe 85 PID 2100 wrote to memory of 1720 2100 djjdd.exe 85 PID 1720 wrote to memory of 3980 1720 hbbttt.exe 86 PID 1720 wrote to memory of 3980 1720 hbbttt.exe 86 PID 1720 wrote to memory of 3980 1720 hbbttt.exe 86 PID 3980 wrote to memory of 716 3980 jdddv.exe 87 PID 3980 wrote to memory of 716 3980 jdddv.exe 87 PID 3980 wrote to memory of 716 3980 jdddv.exe 87 PID 716 wrote to memory of 1544 716 rfrrrrf.exe 88 PID 716 wrote to memory of 1544 716 rfrrrrf.exe 88 PID 716 wrote to memory of 1544 716 rfrrrrf.exe 88 PID 1544 wrote to memory of 4700 1544 xlxxrlf.exe 89 PID 1544 wrote to memory of 4700 1544 xlxxrlf.exe 89 PID 1544 wrote to memory of 4700 1544 xlxxrlf.exe 89 PID 4700 wrote to memory of 3612 4700 vjjdv.exe 90 PID 4700 wrote to memory of 3612 4700 vjjdv.exe 90 PID 4700 wrote to memory of 3612 4700 vjjdv.exe 90 PID 3612 wrote to memory of 2512 3612 fxxlxxl.exe 91 PID 3612 wrote to memory of 2512 3612 fxxlxxl.exe 91 PID 3612 wrote to memory of 2512 3612 fxxlxxl.exe 91 PID 2512 wrote to memory of 3260 2512 rlfxfxr.exe 92 PID 2512 wrote to memory of 3260 2512 rlfxfxr.exe 92 PID 2512 wrote to memory of 3260 2512 rlfxfxr.exe 92 PID 3260 wrote to memory of 4760 3260 3djdp.exe 93 PID 3260 wrote to memory of 4760 3260 3djdp.exe 93 PID 3260 wrote to memory of 4760 3260 3djdp.exe 93 PID 4760 wrote to memory of 4152 4760 lffxrlf.exe 94 PID 4760 wrote to memory of 4152 4760 lffxrlf.exe 94 PID 4760 wrote to memory of 4152 4760 lffxrlf.exe 94 PID 4152 wrote to memory of 5104 4152 hnhbtt.exe 95 PID 4152 wrote to memory of 5104 4152 hnhbtt.exe 95 PID 4152 wrote to memory of 5104 4152 hnhbtt.exe 95 PID 5104 wrote to memory of 4900 5104 9llxfxr.exe 96 PID 5104 wrote to memory of 4900 5104 9llxfxr.exe 96 PID 5104 wrote to memory of 4900 5104 9llxfxr.exe 96 PID 4900 wrote to memory of 464 4900 bttttt.exe 97 PID 4900 wrote to memory of 464 4900 bttttt.exe 97 PID 4900 wrote to memory of 464 4900 bttttt.exe 97 PID 464 wrote to memory of 4520 464 tbbbtn.exe 98 PID 464 wrote to memory of 4520 464 tbbbtn.exe 98 PID 464 wrote to memory of 4520 464 tbbbtn.exe 98 PID 4520 wrote to memory of 2500 4520 vvjdd.exe 99 PID 4520 wrote to memory of 2500 4520 vvjdd.exe 99 PID 4520 wrote to memory of 2500 4520 vvjdd.exe 99 PID 2500 wrote to memory of 3236 2500 vjpjj.exe 100 PID 2500 wrote to memory of 3236 2500 vjpjj.exe 100 PID 2500 wrote to memory of 3236 2500 vjpjj.exe 100 PID 3236 wrote to memory of 1424 3236 flrlffx.exe 101 PID 3236 wrote to memory of 1424 3236 flrlffx.exe 101 PID 3236 wrote to memory of 1424 3236 flrlffx.exe 101 PID 1424 wrote to memory of 868 1424 xrrlfxr.exe 102 PID 1424 wrote to memory of 868 1424 xrrlfxr.exe 102 PID 1424 wrote to memory of 868 1424 xrrlfxr.exe 102 PID 868 wrote to memory of 4836 868 vvjdv.exe 103 PID 868 wrote to memory of 4836 868 vvjdv.exe 103 PID 868 wrote to memory of 4836 868 vvjdv.exe 103 PID 4836 wrote to memory of 1932 4836 5ffrllf.exe 104 PID 4836 wrote to memory of 1932 4836 5ffrllf.exe 104 PID 4836 wrote to memory of 1932 4836 5ffrllf.exe 104 PID 1932 wrote to memory of 1448 1932 nntttt.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cad845c390787136b63cd0f71bc79b10572c9d8012787964ee429649e96defd.exe"C:\Users\Admin\AppData\Local\Temp\7cad845c390787136b63cd0f71bc79b10572c9d8012787964ee429649e96defd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\djjdd.exec:\djjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\hbbttt.exec:\hbbttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\jdddv.exec:\jdddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\rfrrrrf.exec:\rfrrrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\xlxxrlf.exec:\xlxxrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\vjjdv.exec:\vjjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\fxxlxxl.exec:\fxxlxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\rlfxfxr.exec:\rlfxfxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\3djdp.exec:\3djdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\lffxrlf.exec:\lffxrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\hnhbtt.exec:\hnhbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\9llxfxr.exec:\9llxfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\bttttt.exec:\bttttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\tbbbtn.exec:\tbbbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\vvjdd.exec:\vvjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\vjpjj.exec:\vjpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\flrlffx.exec:\flrlffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\vvjdv.exec:\vvjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\5ffrllf.exec:\5ffrllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\nntttt.exec:\nntttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\jvjjd.exec:\jvjjd.exe23⤵
- Executes dropped EXE
PID:1448 -
\??\c:\5rfxrrl.exec:\5rfxrrl.exe24⤵
- Executes dropped EXE
PID:2060 -
\??\c:\djddv.exec:\djddv.exe25⤵
- Executes dropped EXE
PID:4768 -
\??\c:\lffxrrl.exec:\lffxrrl.exe26⤵
- Executes dropped EXE
PID:1516 -
\??\c:\ppdvd.exec:\ppdvd.exe27⤵
- Executes dropped EXE
PID:3060 -
\??\c:\lrrlffl.exec:\lrrlffl.exe28⤵
- Executes dropped EXE
PID:2472 -
\??\c:\vdjjd.exec:\vdjjd.exe29⤵
- Executes dropped EXE
PID:5020 -
\??\c:\7lxrflr.exec:\7lxrflr.exe30⤵
- Executes dropped EXE
PID:4348 -
\??\c:\dvvdd.exec:\dvvdd.exe31⤵
- Executes dropped EXE
PID:3924 -
\??\c:\lfllxxl.exec:\lfllxxl.exe32⤵
- Executes dropped EXE
PID:748 -
\??\c:\dpvpj.exec:\dpvpj.exe33⤵
- Executes dropped EXE
PID:1792 -
\??\c:\rrfxfff.exec:\rrfxfff.exe34⤵
- Executes dropped EXE
PID:2320 -
\??\c:\5dvpv.exec:\5dvpv.exe35⤵
- Executes dropped EXE
PID:1592 -
\??\c:\jjdvj.exec:\jjdvj.exe36⤵
- Executes dropped EXE
PID:2244 -
\??\c:\rlrrllf.exec:\rlrrllf.exe37⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vdvvp.exec:\vdvvp.exe38⤵
- Executes dropped EXE
PID:3884 -
\??\c:\rlxrllx.exec:\rlxrllx.exe39⤵
- Executes dropped EXE
PID:3600 -
\??\c:\pddjj.exec:\pddjj.exe40⤵
- Executes dropped EXE
PID:3044 -
\??\c:\tnhhbb.exec:\tnhhbb.exe41⤵
- Executes dropped EXE
PID:1376 -
\??\c:\1jvpd.exec:\1jvpd.exe42⤵
- Executes dropped EXE
PID:1380 -
\??\c:\xlrfxrl.exec:\xlrfxrl.exe43⤵
- Executes dropped EXE
PID:5084 -
\??\c:\flxxrrr.exec:\flxxrrr.exe44⤵
- Executes dropped EXE
PID:1912 -
\??\c:\hnbthn.exec:\hnbthn.exe45⤵
- Executes dropped EXE
PID:4680 -
\??\c:\9jjvp.exec:\9jjvp.exe46⤵
- Executes dropped EXE
PID:1892 -
\??\c:\lfffrlx.exec:\lfffrlx.exe47⤵
- Executes dropped EXE
PID:3844 -
\??\c:\tnthnh.exec:\tnthnh.exe48⤵
- Executes dropped EXE
PID:4364 -
\??\c:\pppjv.exec:\pppjv.exe49⤵
- Executes dropped EXE
PID:2616 -
\??\c:\dpvvv.exec:\dpvvv.exe50⤵
- Executes dropped EXE
PID:4212 -
\??\c:\1llfffl.exec:\1llfffl.exe51⤵
- Executes dropped EXE
PID:4612 -
\??\c:\3hnhbb.exec:\3hnhbb.exe52⤵
- Executes dropped EXE
PID:3428 -
\??\c:\tthbtt.exec:\tthbtt.exe53⤵
- Executes dropped EXE
PID:512 -
\??\c:\3ppjd.exec:\3ppjd.exe54⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xflfrrx.exec:\xflfrrx.exe55⤵
- Executes dropped EXE
PID:2256 -
\??\c:\tnnhbb.exec:\tnnhbb.exe56⤵
- Executes dropped EXE
PID:4964 -
\??\c:\jvdvv.exec:\jvdvv.exe57⤵
- Executes dropped EXE
PID:3952 -
\??\c:\flrlllf.exec:\flrlllf.exe58⤵
- Executes dropped EXE
PID:4012 -
\??\c:\1fxlfff.exec:\1fxlfff.exe59⤵
- Executes dropped EXE
PID:384 -
\??\c:\btbttn.exec:\btbttn.exe60⤵
- Executes dropped EXE
PID:3612 -
\??\c:\ppvpj.exec:\ppvpj.exe61⤵
- Executes dropped EXE
PID:1148 -
\??\c:\flrrrrr.exec:\flrrrrr.exe62⤵
- Executes dropped EXE
PID:4792 -
\??\c:\tbnhbt.exec:\tbnhbt.exe63⤵
- Executes dropped EXE
PID:688 -
\??\c:\9pdvd.exec:\9pdvd.exe64⤵
- Executes dropped EXE
PID:4716 -
\??\c:\pjpjd.exec:\pjpjd.exe65⤵
- Executes dropped EXE
PID:1040 -
\??\c:\lfllxff.exec:\lfllxff.exe66⤵PID:4484
-
\??\c:\hhnnht.exec:\hhnnht.exe67⤵PID:3624
-
\??\c:\ppddd.exec:\ppddd.exe68⤵PID:464
-
\??\c:\vdjpd.exec:\vdjpd.exe69⤵PID:2636
-
\??\c:\lrxfxxx.exec:\lrxfxxx.exe70⤵PID:4520
-
\??\c:\nhhtnn.exec:\nhhtnn.exe71⤵PID:3496
-
\??\c:\dvjdv.exec:\dvjdv.exe72⤵PID:5060
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe73⤵PID:4624
-
\??\c:\frxxrlf.exec:\frxxrlf.exe74⤵PID:5028
-
\??\c:\thtnhh.exec:\thtnhh.exe75⤵PID:3028
-
\??\c:\vpjdj.exec:\vpjdj.exe76⤵PID:1652
-
\??\c:\rfrlffx.exec:\rfrlffx.exe77⤵PID:4696
-
\??\c:\tttnhb.exec:\tttnhb.exe78⤵PID:2088
-
\??\c:\dddvp.exec:\dddvp.exe79⤵PID:1876
-
\??\c:\lfrfrfx.exec:\lfrfrfx.exe80⤵PID:624
-
\??\c:\xrrllll.exec:\xrrllll.exe81⤵PID:4072
-
\??\c:\tbhbtn.exec:\tbhbtn.exe82⤵PID:5064
-
\??\c:\ddjdp.exec:\ddjdp.exe83⤵PID:4984
-
\??\c:\lrxrxrl.exec:\lrxrxrl.exe84⤵PID:4856
-
\??\c:\tnnhbb.exec:\tnnhbb.exe85⤵PID:2168
-
\??\c:\jjjdv.exec:\jjjdv.exe86⤵PID:1056
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe87⤵PID:4356
-
\??\c:\tbbtnn.exec:\tbbtnn.exe88⤵PID:5036
-
\??\c:\hthtnn.exec:\hthtnn.exe89⤵PID:4348
-
\??\c:\7dpjd.exec:\7dpjd.exe90⤵PID:940
-
\??\c:\xxlxrlf.exec:\xxlxrlf.exe91⤵PID:4112
-
\??\c:\5lrlffx.exec:\5lrlffx.exe92⤵PID:3052
-
\??\c:\nhnnnn.exec:\nhnnnn.exe93⤵PID:4432
-
\??\c:\1btnhh.exec:\1btnhh.exe94⤵PID:2084
-
\??\c:\jjvpv.exec:\jjvpv.exe95⤵PID:1592
-
\??\c:\1xrfrlx.exec:\1xrfrlx.exe96⤵PID:2244
-
\??\c:\hhhbtt.exec:\hhhbtt.exe97⤵PID:1368
-
\??\c:\1vpdp.exec:\1vpdp.exe98⤵PID:1456
-
\??\c:\frrrlfx.exec:\frrrlfx.exe99⤵PID:4236
-
\??\c:\lflffff.exec:\lflffff.exe100⤵PID:3968
-
\??\c:\nbtnht.exec:\nbtnht.exe101⤵PID:4544
-
\??\c:\pjjpj.exec:\pjjpj.exe102⤵PID:2176
-
\??\c:\vpvpj.exec:\vpvpj.exe103⤵PID:1816
-
\??\c:\xxlrxxf.exec:\xxlrxxf.exe104⤵PID:3480
-
\??\c:\ttntbb.exec:\ttntbb.exe105⤵PID:1916
-
\??\c:\jvdvv.exec:\jvdvv.exe106⤵PID:3192
-
\??\c:\jjjdp.exec:\jjjdp.exe107⤵PID:2924
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe108⤵PID:5100
-
\??\c:\bbnnhb.exec:\bbnnhb.exe109⤵PID:4876
-
\??\c:\ntnbtt.exec:\ntnbtt.exe110⤵PID:5056
-
\??\c:\1pjdv.exec:\1pjdv.exe111⤵PID:4280
-
\??\c:\1rxllll.exec:\1rxllll.exe112⤵PID:3980
-
\??\c:\7thhbb.exec:\7thhbb.exe113⤵PID:3128
-
\??\c:\bhnhtt.exec:\bhnhtt.exe114⤵PID:2480
-
\??\c:\jpvpj.exec:\jpvpj.exe115⤵PID:964
-
\??\c:\1frlrrr.exec:\1frlrrr.exe116⤵PID:3476
-
\??\c:\bttnhb.exec:\bttnhb.exe117⤵PID:912
-
\??\c:\nhhhhb.exec:\nhhhhb.exe118⤵PID:3436
-
\??\c:\djvvp.exec:\djvvp.exe119⤵PID:452
-
\??\c:\rllfxlf.exec:\rllfxlf.exe120⤵PID:1672
-
\??\c:\hbhbbb.exec:\hbhbbb.exe121⤵PID:1188
-
\??\c:\jdjdv.exec:\jdjdv.exe122⤵PID:212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-