Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 00:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8ab6c819841b4f00c3ce622ba2207b2a7c69d68de982542c29c76920aff6f479.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
8ab6c819841b4f00c3ce622ba2207b2a7c69d68de982542c29c76920aff6f479.exe
-
Size
454KB
-
MD5
38b9ab2ef5fdb731341c869d37e0c3d5
-
SHA1
29a435a76c4e72b2ec75ed162b547b5e2a161074
-
SHA256
8ab6c819841b4f00c3ce622ba2207b2a7c69d68de982542c29c76920aff6f479
-
SHA512
df816ad040bb82870b8376662743eed5b27ab062a71452ea6818784f8db068dbc256bb901fbbcb7ba58b6bdab7dea06922e8142146eff7c30b572914bd6cc29b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3348-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/768-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1104-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1840-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1140-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-700-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-731-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-750-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-781-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-975-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-1009-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-1100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-1389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3348 pjjpj.exe 2928 frxlfxl.exe 4948 ttbhtn.exe 3584 jvdvv.exe 768 ffrlxxf.exe 3492 ttnhbb.exe 4464 nnnnnt.exe 4156 xrflrrf.exe 1396 xrfxfrx.exe 2856 nttnhh.exe 4764 dpjdv.exe 3592 bnbnhn.exe 1580 hbhbhb.exe 3844 thnhtt.exe 2192 dvvjd.exe 3104 pppjj.exe 2984 rrffxxr.exe 2824 tnbbbb.exe 3640 btnnhh.exe 1736 nnbbhh.exe 4392 3pppj.exe 2052 7ffxllx.exe 1104 rflfxxr.exe 4976 pppjd.exe 2044 rflrrll.exe 4132 9nnhbt.exe 4072 rfrxrrl.exe 2208 htbttt.exe 2136 nnhbhn.exe 916 rxrrrxx.exe 3632 7lrlxfx.exe 2920 tnhhth.exe 1484 pjjvp.exe 1416 rlfrrrl.exe 4776 5nbbtn.exe 3176 ppvpp.exe 3412 djppj.exe 4540 frlfxrl.exe 2140 hbnbtt.exe 4504 9vvjd.exe 1732 vppdv.exe 4188 xrrfrlf.exe 3936 hhnhhh.exe 2924 5dvpj.exe 1724 3lrfxrr.exe 3016 9bhbtt.exe 2588 dvdvj.exe 4332 rlrlfxf.exe 3508 tnttbt.exe 2580 ntbttt.exe 440 pjpjd.exe 3564 lllxlll.exe 1772 hbbnht.exe 3664 jjjdv.exe 3808 ffllxxf.exe 4532 ttbtnn.exe 4348 jvdvp.exe 1388 7rxrllf.exe 4724 nhttnn.exe 3080 nhbhnn.exe 1472 ddjjj.exe 1700 lfxrrxf.exe 1252 bthbnn.exe 2456 ppjpd.exe -
resource yara_rule behavioral2/memory/3348-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/768-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/768-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1104-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1840-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1140-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-750-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlffrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fflflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 3348 1968 8ab6c819841b4f00c3ce622ba2207b2a7c69d68de982542c29c76920aff6f479.exe 82 PID 1968 wrote to memory of 3348 1968 8ab6c819841b4f00c3ce622ba2207b2a7c69d68de982542c29c76920aff6f479.exe 82 PID 1968 wrote to memory of 3348 1968 8ab6c819841b4f00c3ce622ba2207b2a7c69d68de982542c29c76920aff6f479.exe 82 PID 3348 wrote to memory of 2928 3348 pjjpj.exe 83 PID 3348 wrote to memory of 2928 3348 pjjpj.exe 83 PID 3348 wrote to memory of 2928 3348 pjjpj.exe 83 PID 2928 wrote to memory of 4948 2928 frxlfxl.exe 84 PID 2928 wrote to memory of 4948 2928 frxlfxl.exe 84 PID 2928 wrote to memory of 4948 2928 frxlfxl.exe 84 PID 4948 wrote to memory of 3584 4948 ttbhtn.exe 85 PID 4948 wrote to memory of 3584 4948 ttbhtn.exe 85 PID 4948 wrote to memory of 3584 4948 ttbhtn.exe 85 PID 3584 wrote to memory of 768 3584 jvdvv.exe 86 PID 3584 wrote to memory of 768 3584 jvdvv.exe 86 PID 3584 wrote to memory of 768 3584 jvdvv.exe 86 PID 768 wrote to memory of 3492 768 ffrlxxf.exe 87 PID 768 wrote to memory of 3492 768 ffrlxxf.exe 87 PID 768 wrote to memory of 3492 768 ffrlxxf.exe 87 PID 3492 wrote to memory of 4464 3492 ttnhbb.exe 88 PID 3492 wrote to memory of 4464 3492 ttnhbb.exe 88 PID 3492 wrote to memory of 4464 3492 ttnhbb.exe 88 PID 4464 wrote to memory of 4156 4464 nnnnnt.exe 89 PID 4464 wrote to memory of 4156 4464 nnnnnt.exe 89 PID 4464 wrote to memory of 4156 4464 nnnnnt.exe 89 PID 4156 wrote to memory of 1396 4156 xrflrrf.exe 90 PID 4156 wrote to memory of 1396 4156 xrflrrf.exe 90 PID 4156 wrote to memory of 1396 4156 xrflrrf.exe 90 PID 1396 wrote to memory of 2856 1396 xrfxfrx.exe 91 PID 1396 wrote to memory of 2856 1396 xrfxfrx.exe 91 PID 1396 wrote to memory of 2856 1396 xrfxfrx.exe 91 PID 2856 wrote to memory of 4764 2856 nttnhh.exe 92 PID 2856 wrote to memory of 4764 2856 nttnhh.exe 92 PID 2856 wrote to memory of 4764 2856 nttnhh.exe 92 PID 4764 wrote to memory of 3592 4764 dpjdv.exe 93 PID 4764 wrote to memory of 3592 4764 dpjdv.exe 93 PID 4764 wrote to memory of 3592 4764 dpjdv.exe 93 PID 3592 wrote to memory of 1580 3592 bnbnhn.exe 94 PID 3592 wrote to memory of 1580 3592 bnbnhn.exe 94 PID 3592 wrote to memory of 1580 3592 bnbnhn.exe 94 PID 1580 wrote to memory of 3844 1580 hbhbhb.exe 95 PID 1580 wrote to memory of 3844 1580 hbhbhb.exe 95 PID 1580 wrote to memory of 3844 1580 hbhbhb.exe 95 PID 3844 wrote to memory of 2192 3844 thnhtt.exe 96 PID 3844 wrote to memory of 2192 3844 thnhtt.exe 96 PID 3844 wrote to memory of 2192 3844 thnhtt.exe 96 PID 2192 wrote to memory of 3104 2192 dvvjd.exe 97 PID 2192 wrote to memory of 3104 2192 dvvjd.exe 97 PID 2192 wrote to memory of 3104 2192 dvvjd.exe 97 PID 3104 wrote to memory of 2984 3104 pppjj.exe 98 PID 3104 wrote to memory of 2984 3104 pppjj.exe 98 PID 3104 wrote to memory of 2984 3104 pppjj.exe 98 PID 2984 wrote to memory of 2824 2984 rrffxxr.exe 99 PID 2984 wrote to memory of 2824 2984 rrffxxr.exe 99 PID 2984 wrote to memory of 2824 2984 rrffxxr.exe 99 PID 2824 wrote to memory of 3640 2824 tnbbbb.exe 100 PID 2824 wrote to memory of 3640 2824 tnbbbb.exe 100 PID 2824 wrote to memory of 3640 2824 tnbbbb.exe 100 PID 3640 wrote to memory of 1736 3640 btnnhh.exe 101 PID 3640 wrote to memory of 1736 3640 btnnhh.exe 101 PID 3640 wrote to memory of 1736 3640 btnnhh.exe 101 PID 1736 wrote to memory of 4392 1736 nnbbhh.exe 102 PID 1736 wrote to memory of 4392 1736 nnbbhh.exe 102 PID 1736 wrote to memory of 4392 1736 nnbbhh.exe 102 PID 4392 wrote to memory of 2052 4392 3pppj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ab6c819841b4f00c3ce622ba2207b2a7c69d68de982542c29c76920aff6f479.exe"C:\Users\Admin\AppData\Local\Temp\8ab6c819841b4f00c3ce622ba2207b2a7c69d68de982542c29c76920aff6f479.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\pjjpj.exec:\pjjpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\frxlfxl.exec:\frxlfxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\ttbhtn.exec:\ttbhtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\jvdvv.exec:\jvdvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\ffrlxxf.exec:\ffrlxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\ttnhbb.exec:\ttnhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\nnnnnt.exec:\nnnnnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\xrflrrf.exec:\xrflrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\xrfxfrx.exec:\xrfxfrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\nttnhh.exec:\nttnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\dpjdv.exec:\dpjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\bnbnhn.exec:\bnbnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\hbhbhb.exec:\hbhbhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\thnhtt.exec:\thnhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\dvvjd.exec:\dvvjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\pppjj.exec:\pppjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\rrffxxr.exec:\rrffxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\tnbbbb.exec:\tnbbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\btnnhh.exec:\btnnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\nnbbhh.exec:\nnbbhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\3pppj.exec:\3pppj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\7ffxllx.exec:\7ffxllx.exe23⤵
- Executes dropped EXE
PID:2052 -
\??\c:\rflfxxr.exec:\rflfxxr.exe24⤵
- Executes dropped EXE
PID:1104 -
\??\c:\pppjd.exec:\pppjd.exe25⤵
- Executes dropped EXE
PID:4976 -
\??\c:\rflrrll.exec:\rflrrll.exe26⤵
- Executes dropped EXE
PID:2044 -
\??\c:\9nnhbt.exec:\9nnhbt.exe27⤵
- Executes dropped EXE
PID:4132 -
\??\c:\rfrxrrl.exec:\rfrxrrl.exe28⤵
- Executes dropped EXE
PID:4072 -
\??\c:\htbttt.exec:\htbttt.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2208 -
\??\c:\nnhbhn.exec:\nnhbhn.exe30⤵
- Executes dropped EXE
PID:2136 -
\??\c:\rxrrrxx.exec:\rxrrrxx.exe31⤵
- Executes dropped EXE
PID:916 -
\??\c:\7lrlxfx.exec:\7lrlxfx.exe32⤵
- Executes dropped EXE
PID:3632 -
\??\c:\tnhhth.exec:\tnhhth.exe33⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pjjvp.exec:\pjjvp.exe34⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rlfrrrl.exec:\rlfrrrl.exe35⤵
- Executes dropped EXE
PID:1416 -
\??\c:\5nbbtn.exec:\5nbbtn.exe36⤵
- Executes dropped EXE
PID:4776 -
\??\c:\ppvpp.exec:\ppvpp.exe37⤵
- Executes dropped EXE
PID:3176 -
\??\c:\djppj.exec:\djppj.exe38⤵
- Executes dropped EXE
PID:3412 -
\??\c:\frlfxrl.exec:\frlfxrl.exe39⤵
- Executes dropped EXE
PID:4540 -
\??\c:\hbnbtt.exec:\hbnbtt.exe40⤵
- Executes dropped EXE
PID:2140 -
\??\c:\9vvjd.exec:\9vvjd.exe41⤵
- Executes dropped EXE
PID:4504 -
\??\c:\vppdv.exec:\vppdv.exe42⤵
- Executes dropped EXE
PID:1732 -
\??\c:\xrrfrlf.exec:\xrrfrlf.exe43⤵
- Executes dropped EXE
PID:4188 -
\??\c:\hhnhhh.exec:\hhnhhh.exe44⤵
- Executes dropped EXE
PID:3936 -
\??\c:\5dvpj.exec:\5dvpj.exe45⤵
- Executes dropped EXE
PID:2924 -
\??\c:\3lrfxrr.exec:\3lrfxrr.exe46⤵
- Executes dropped EXE
PID:1724 -
\??\c:\9bhbtt.exec:\9bhbtt.exe47⤵
- Executes dropped EXE
PID:3016 -
\??\c:\dvdvj.exec:\dvdvj.exe48⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rlrlfxf.exec:\rlrlfxf.exe49⤵
- Executes dropped EXE
PID:4332 -
\??\c:\tnttbt.exec:\tnttbt.exe50⤵
- Executes dropped EXE
PID:3508 -
\??\c:\ntbttt.exec:\ntbttt.exe51⤵
- Executes dropped EXE
PID:2580 -
\??\c:\pjpjd.exec:\pjpjd.exe52⤵
- Executes dropped EXE
PID:440 -
\??\c:\lllxlll.exec:\lllxlll.exe53⤵
- Executes dropped EXE
PID:3564 -
\??\c:\frrrlll.exec:\frrrlll.exe54⤵
- System Location Discovery: System Language Discovery
PID:2552 -
\??\c:\hbbnht.exec:\hbbnht.exe55⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jjjdv.exec:\jjjdv.exe56⤵
- Executes dropped EXE
PID:3664 -
\??\c:\ffllxxf.exec:\ffllxxf.exe57⤵
- Executes dropped EXE
PID:3808 -
\??\c:\ttbtnn.exec:\ttbtnn.exe58⤵
- Executes dropped EXE
PID:4532 -
\??\c:\jvdvp.exec:\jvdvp.exe59⤵
- Executes dropped EXE
PID:4348 -
\??\c:\7rxrllf.exec:\7rxrllf.exe60⤵
- Executes dropped EXE
PID:1388 -
\??\c:\nhttnn.exec:\nhttnn.exe61⤵
- Executes dropped EXE
PID:4724 -
\??\c:\nhbhnn.exec:\nhbhnn.exe62⤵
- Executes dropped EXE
PID:3080 -
\??\c:\ddjjj.exec:\ddjjj.exe63⤵
- Executes dropped EXE
PID:1472 -
\??\c:\lfxrrxf.exec:\lfxrrxf.exe64⤵
- Executes dropped EXE
PID:1700 -
\??\c:\bthbnn.exec:\bthbnn.exe65⤵
- Executes dropped EXE
PID:1252 -
\??\c:\ppjpd.exec:\ppjpd.exe66⤵
- Executes dropped EXE
PID:2456 -
\??\c:\xxlllrl.exec:\xxlllrl.exe67⤵PID:3304
-
\??\c:\hthhtb.exec:\hthhtb.exe68⤵PID:1396
-
\??\c:\pjjjp.exec:\pjjjp.exe69⤵PID:4548
-
\??\c:\3flrrff.exec:\3flrrff.exe70⤵PID:228
-
\??\c:\5tnhhh.exec:\5tnhhh.exe71⤵PID:2260
-
\??\c:\bbhnbh.exec:\bbhnbh.exe72⤵PID:4756
-
\??\c:\jppdj.exec:\jppdj.exe73⤵PID:3004
-
\??\c:\rrlrllr.exec:\rrlrllr.exe74⤵PID:2680
-
\??\c:\5hnttt.exec:\5hnttt.exe75⤵PID:1580
-
\??\c:\nnbbbh.exec:\nnbbbh.exe76⤵PID:3844
-
\??\c:\7djpp.exec:\7djpp.exe77⤵PID:5000
-
\??\c:\lrlflll.exec:\lrlflll.exe78⤵PID:4036
-
\??\c:\thnnnt.exec:\thnnnt.exe79⤵PID:3012
-
\??\c:\jjpdd.exec:\jjpdd.exe80⤵
- System Location Discovery: System Language Discovery
PID:4844 -
\??\c:\rrllfll.exec:\rrllfll.exe81⤵PID:3836
-
\??\c:\ffrrlrl.exec:\ffrrlrl.exe82⤵PID:2348
-
\??\c:\tbhhhh.exec:\tbhhhh.exe83⤵PID:1816
-
\??\c:\ppppd.exec:\ppppd.exe84⤵
- System Location Discovery: System Language Discovery
PID:2408 -
\??\c:\rfrrlll.exec:\rfrrlll.exe85⤵PID:3572
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe86⤵PID:2416
-
\??\c:\nbbhnn.exec:\nbbhnn.exe87⤵PID:4572
-
\??\c:\pjpdv.exec:\pjpdv.exe88⤵PID:4744
-
\??\c:\fxxxlll.exec:\fxxxlll.exe89⤵PID:840
-
\??\c:\7bhbbb.exec:\7bhbbb.exe90⤵PID:4976
-
\??\c:\jvdpj.exec:\jvdpj.exe91⤵PID:4280
-
\??\c:\frlffll.exec:\frlffll.exe92⤵PID:2148
-
\??\c:\llrrlrr.exec:\llrrlrr.exe93⤵PID:1048
-
\??\c:\bhtntt.exec:\bhtntt.exe94⤵PID:4428
-
\??\c:\ddpjd.exec:\ddpjd.exe95⤵PID:3576
-
\??\c:\frfllrr.exec:\frfllrr.exe96⤵PID:208
-
\??\c:\thhnnn.exec:\thhnnn.exe97⤵PID:2136
-
\??\c:\ntbbtb.exec:\ntbbtb.exe98⤵PID:916
-
\??\c:\fxlffxr.exec:\fxlffxr.exe99⤵PID:764
-
\??\c:\rlfxffx.exec:\rlfxffx.exe100⤵PID:2484
-
\??\c:\nnnhbt.exec:\nnnhbt.exe101⤵PID:60
-
\??\c:\vjdvv.exec:\vjdvv.exe102⤵PID:1484
-
\??\c:\vpdvv.exec:\vpdvv.exe103⤵PID:1636
-
\??\c:\lrxrlll.exec:\lrxrlll.exe104⤵PID:4776
-
\??\c:\tnhbtn.exec:\tnhbtn.exe105⤵PID:1348
-
\??\c:\vjdvd.exec:\vjdvd.exe106⤵PID:3460
-
\??\c:\xrffrrr.exec:\xrffrrr.exe107⤵PID:448
-
\??\c:\thtnnn.exec:\thtnnn.exe108⤵PID:3100
-
\??\c:\jdjdj.exec:\jdjdj.exe109⤵PID:4052
-
\??\c:\xrxxrxx.exec:\xrxxrxx.exe110⤵PID:3396
-
\??\c:\7hhttn.exec:\7hhttn.exe111⤵PID:4188
-
\??\c:\hnttnn.exec:\hnttnn.exe112⤵PID:3936
-
\??\c:\jdpjd.exec:\jdpjd.exe113⤵PID:1808
-
\??\c:\lfrllll.exec:\lfrllll.exe114⤵PID:4536
-
\??\c:\5btnnn.exec:\5btnnn.exe115⤵PID:1156
-
\??\c:\jvjjj.exec:\jvjjj.exe116⤵PID:1840
-
\??\c:\xxlllrl.exec:\xxlllrl.exe117⤵PID:3496
-
\??\c:\rrlxfxr.exec:\rrlxfxr.exe118⤵PID:3508
-
\??\c:\jpdvv.exec:\jpdvv.exe119⤵PID:392
-
\??\c:\jpddj.exec:\jpddj.exe120⤵PID:440
-
\??\c:\xxrrlfx.exec:\xxrrlfx.exe121⤵PID:3456
-
\??\c:\nhnttb.exec:\nhnttb.exe122⤵PID:3348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-