Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 01:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a1c7bcdbea7d4a27c3bb4c254cbe7fb2a93937e2ee812fdd8a255b3c15e3eef6.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a1c7bcdbea7d4a27c3bb4c254cbe7fb2a93937e2ee812fdd8a255b3c15e3eef6.exe
-
Size
453KB
-
MD5
5c608f30b7ae2164e8b1670a1e1bd270
-
SHA1
f861e7ec850942d6b6ffca7f5f4b7774b415f12d
-
SHA256
a1c7bcdbea7d4a27c3bb4c254cbe7fb2a93937e2ee812fdd8a255b3c15e3eef6
-
SHA512
c1ee64d60172d901adc7e88a6c34a59d0d0df6c6d6a14b98f1f3f02b3f7a113ec15948c654594c5dbdb0f3533d998ac5ff6aaf944699be25d9676598677a87c1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbel:q7Tc2NYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3028-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1088-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3816-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2560-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1104-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1784-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1084-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1088-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/816-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3908-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1104-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/840-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-868-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-893-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-973-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-983-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-1018-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-1045-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4992 pjjjd.exe 2848 bnttnn.exe 4936 1djvv.exe 1088 nnnbth.exe 3816 btnnhb.exe 3668 tntnnh.exe 3664 xlfxrrl.exe 3700 1dvpj.exe 2428 nbhbtt.exe 1312 5pjdp.exe 2560 9bbnbt.exe 2116 pdjpd.exe 3480 nbhbtt.exe 3436 vpjdv.exe 3520 rxxlffr.exe 1632 pjdjd.exe 3812 lllxrlx.exe 2160 thhbtn.exe 1196 bnthhh.exe 2124 jjpjv.exe 1008 tnnhhh.exe 4724 vjdpj.exe 1104 rxrrflf.exe 3016 ntntnb.exe 2120 llxrxxf.exe 2708 dvjdv.exe 5048 xlrffxf.exe 952 htnhbt.exe 2256 rxxxllr.exe 1784 dpdjp.exe 1352 rlxrffx.exe 2192 jvpjd.exe 1912 3rlxrfx.exe 1160 5hbtbb.exe 4512 5djdv.exe 4124 7ddpp.exe 4480 xxlflfl.exe 3036 3tthbb.exe 4580 jdvdv.exe 3684 frlxlfx.exe 4524 hbhbnn.exe 3760 nbthtt.exe 4816 vppjd.exe 4992 lfxlxxx.exe 2420 9tnnhn.exe 4644 pvdvp.exe 1084 dpvpp.exe 1088 rxlfxxr.exe 816 bbbthh.exe 2144 jpvdv.exe 2172 3ffxllf.exe 1168 1fllfll.exe 2380 bhhbtt.exe 2304 pdpjj.exe 1336 flrflfx.exe 3908 tbhhbt.exe 2384 jjjdp.exe 2312 ppjdv.exe 4400 xrlxxfl.exe 2116 nbthhb.exe 2400 dppjv.exe 4408 jvddv.exe 3916 rrxrlfx.exe 3444 nbnhnn.exe -
resource yara_rule behavioral2/memory/3028-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1088-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3816-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2560-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1104-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/816-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1088-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/816-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3908-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1104-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/840-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-868-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xfxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3028 wrote to memory of 4992 3028 a1c7bcdbea7d4a27c3bb4c254cbe7fb2a93937e2ee812fdd8a255b3c15e3eef6.exe 84 PID 3028 wrote to memory of 4992 3028 a1c7bcdbea7d4a27c3bb4c254cbe7fb2a93937e2ee812fdd8a255b3c15e3eef6.exe 84 PID 3028 wrote to memory of 4992 3028 a1c7bcdbea7d4a27c3bb4c254cbe7fb2a93937e2ee812fdd8a255b3c15e3eef6.exe 84 PID 4992 wrote to memory of 2848 4992 pjjjd.exe 85 PID 4992 wrote to memory of 2848 4992 pjjjd.exe 85 PID 4992 wrote to memory of 2848 4992 pjjjd.exe 85 PID 2848 wrote to memory of 4936 2848 bnttnn.exe 86 PID 2848 wrote to memory of 4936 2848 bnttnn.exe 86 PID 2848 wrote to memory of 4936 2848 bnttnn.exe 86 PID 4936 wrote to memory of 1088 4936 1djvv.exe 87 PID 4936 wrote to memory of 1088 4936 1djvv.exe 87 PID 4936 wrote to memory of 1088 4936 1djvv.exe 87 PID 1088 wrote to memory of 3816 1088 nnnbth.exe 88 PID 1088 wrote to memory of 3816 1088 nnnbth.exe 88 PID 1088 wrote to memory of 3816 1088 nnnbth.exe 88 PID 3816 wrote to memory of 3668 3816 btnnhb.exe 89 PID 3816 wrote to memory of 3668 3816 btnnhb.exe 89 PID 3816 wrote to memory of 3668 3816 btnnhb.exe 89 PID 3668 wrote to memory of 3664 3668 tntnnh.exe 90 PID 3668 wrote to memory of 3664 3668 tntnnh.exe 90 PID 3668 wrote to memory of 3664 3668 tntnnh.exe 90 PID 3664 wrote to memory of 3700 3664 xlfxrrl.exe 91 PID 3664 wrote to memory of 3700 3664 xlfxrrl.exe 91 PID 3664 wrote to memory of 3700 3664 xlfxrrl.exe 91 PID 3700 wrote to memory of 2428 3700 1dvpj.exe 92 PID 3700 wrote to memory of 2428 3700 1dvpj.exe 92 PID 3700 wrote to memory of 2428 3700 1dvpj.exe 92 PID 2428 wrote to memory of 1312 2428 nbhbtt.exe 93 PID 2428 wrote to memory of 1312 2428 nbhbtt.exe 93 PID 2428 wrote to memory of 1312 2428 nbhbtt.exe 93 PID 1312 wrote to memory of 2560 1312 5pjdp.exe 94 PID 1312 wrote to memory of 2560 1312 5pjdp.exe 94 PID 1312 wrote to memory of 2560 1312 5pjdp.exe 94 PID 2560 wrote to memory of 2116 2560 9bbnbt.exe 95 PID 2560 wrote to memory of 2116 2560 9bbnbt.exe 95 PID 2560 wrote to memory of 2116 2560 9bbnbt.exe 95 PID 2116 wrote to memory of 3480 2116 pdjpd.exe 96 PID 2116 wrote to memory of 3480 2116 pdjpd.exe 96 PID 2116 wrote to memory of 3480 2116 pdjpd.exe 96 PID 3480 wrote to memory of 3436 3480 nbhbtt.exe 97 PID 3480 wrote to memory of 3436 3480 nbhbtt.exe 97 PID 3480 wrote to memory of 3436 3480 nbhbtt.exe 97 PID 3436 wrote to memory of 3520 3436 vpjdv.exe 98 PID 3436 wrote to memory of 3520 3436 vpjdv.exe 98 PID 3436 wrote to memory of 3520 3436 vpjdv.exe 98 PID 3520 wrote to memory of 1632 3520 rxxlffr.exe 99 PID 3520 wrote to memory of 1632 3520 rxxlffr.exe 99 PID 3520 wrote to memory of 1632 3520 rxxlffr.exe 99 PID 1632 wrote to memory of 3812 1632 pjdjd.exe 100 PID 1632 wrote to memory of 3812 1632 pjdjd.exe 100 PID 1632 wrote to memory of 3812 1632 pjdjd.exe 100 PID 3812 wrote to memory of 2160 3812 lllxrlx.exe 101 PID 3812 wrote to memory of 2160 3812 lllxrlx.exe 101 PID 3812 wrote to memory of 2160 3812 lllxrlx.exe 101 PID 2160 wrote to memory of 1196 2160 thhbtn.exe 102 PID 2160 wrote to memory of 1196 2160 thhbtn.exe 102 PID 2160 wrote to memory of 1196 2160 thhbtn.exe 102 PID 1196 wrote to memory of 2124 1196 bnthhh.exe 103 PID 1196 wrote to memory of 2124 1196 bnthhh.exe 103 PID 1196 wrote to memory of 2124 1196 bnthhh.exe 103 PID 2124 wrote to memory of 1008 2124 jjpjv.exe 104 PID 2124 wrote to memory of 1008 2124 jjpjv.exe 104 PID 2124 wrote to memory of 1008 2124 jjpjv.exe 104 PID 1008 wrote to memory of 4724 1008 tnnhhh.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1c7bcdbea7d4a27c3bb4c254cbe7fb2a93937e2ee812fdd8a255b3c15e3eef6.exe"C:\Users\Admin\AppData\Local\Temp\a1c7bcdbea7d4a27c3bb4c254cbe7fb2a93937e2ee812fdd8a255b3c15e3eef6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\pjjjd.exec:\pjjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\bnttnn.exec:\bnttnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\1djvv.exec:\1djvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\nnnbth.exec:\nnnbth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\btnnhb.exec:\btnnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\tntnnh.exec:\tntnnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\xlfxrrl.exec:\xlfxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\1dvpj.exec:\1dvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\nbhbtt.exec:\nbhbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\5pjdp.exec:\5pjdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\9bbnbt.exec:\9bbnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\pdjpd.exec:\pdjpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\nbhbtt.exec:\nbhbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\vpjdv.exec:\vpjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\rxxlffr.exec:\rxxlffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\pjdjd.exec:\pjdjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\lllxrlx.exec:\lllxrlx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\thhbtn.exec:\thhbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\bnthhh.exec:\bnthhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\jjpjv.exec:\jjpjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\tnnhhh.exec:\tnnhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\vjdpj.exec:\vjdpj.exe23⤵
- Executes dropped EXE
PID:4724 -
\??\c:\rxrrflf.exec:\rxrrflf.exe24⤵
- Executes dropped EXE
PID:1104 -
\??\c:\ntntnb.exec:\ntntnb.exe25⤵
- Executes dropped EXE
PID:3016 -
\??\c:\llxrxxf.exec:\llxrxxf.exe26⤵
- Executes dropped EXE
PID:2120 -
\??\c:\dvjdv.exec:\dvjdv.exe27⤵
- Executes dropped EXE
PID:2708 -
\??\c:\xlrffxf.exec:\xlrffxf.exe28⤵
- Executes dropped EXE
PID:5048 -
\??\c:\htnhbt.exec:\htnhbt.exe29⤵
- Executes dropped EXE
PID:952 -
\??\c:\rxxxllr.exec:\rxxxllr.exe30⤵
- Executes dropped EXE
PID:2256 -
\??\c:\dpdjp.exec:\dpdjp.exe31⤵
- Executes dropped EXE
PID:1784 -
\??\c:\rlxrffx.exec:\rlxrffx.exe32⤵
- Executes dropped EXE
PID:1352 -
\??\c:\jvpjd.exec:\jvpjd.exe33⤵
- Executes dropped EXE
PID:2192 -
\??\c:\3rlxrfx.exec:\3rlxrfx.exe34⤵
- Executes dropped EXE
PID:1912 -
\??\c:\5hbtbb.exec:\5hbtbb.exe35⤵
- Executes dropped EXE
PID:1160 -
\??\c:\5djdv.exec:\5djdv.exe36⤵
- Executes dropped EXE
PID:4512 -
\??\c:\7ddpp.exec:\7ddpp.exe37⤵
- Executes dropped EXE
PID:4124 -
\??\c:\xxlflfl.exec:\xxlflfl.exe38⤵
- Executes dropped EXE
PID:4480 -
\??\c:\3tthbb.exec:\3tthbb.exe39⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jdvdv.exec:\jdvdv.exe40⤵
- Executes dropped EXE
PID:4580 -
\??\c:\frlxlfx.exec:\frlxlfx.exe41⤵
- Executes dropped EXE
PID:3684 -
\??\c:\hbhbnn.exec:\hbhbnn.exe42⤵
- Executes dropped EXE
PID:4524 -
\??\c:\nbthtt.exec:\nbthtt.exe43⤵
- Executes dropped EXE
PID:3760 -
\??\c:\vppjd.exec:\vppjd.exe44⤵
- Executes dropped EXE
PID:4816 -
\??\c:\lfxlxxx.exec:\lfxlxxx.exe45⤵
- Executes dropped EXE
PID:4992 -
\??\c:\9tnnhn.exec:\9tnnhn.exe46⤵
- Executes dropped EXE
PID:2420 -
\??\c:\pvdvp.exec:\pvdvp.exe47⤵
- Executes dropped EXE
PID:4644 -
\??\c:\dpvpp.exec:\dpvpp.exe48⤵
- Executes dropped EXE
PID:1084 -
\??\c:\rxlfxxr.exec:\rxlfxxr.exe49⤵
- Executes dropped EXE
PID:1088 -
\??\c:\bbbthh.exec:\bbbthh.exe50⤵
- Executes dropped EXE
PID:816 -
\??\c:\jpvdv.exec:\jpvdv.exe51⤵
- Executes dropped EXE
PID:2144 -
\??\c:\3ffxllf.exec:\3ffxllf.exe52⤵
- Executes dropped EXE
PID:2172 -
\??\c:\1fllfll.exec:\1fllfll.exe53⤵
- Executes dropped EXE
PID:1168 -
\??\c:\bhhbtt.exec:\bhhbtt.exe54⤵
- Executes dropped EXE
PID:2380 -
\??\c:\pdpjj.exec:\pdpjj.exe55⤵
- Executes dropped EXE
PID:2304 -
\??\c:\flrflfx.exec:\flrflfx.exe56⤵
- Executes dropped EXE
PID:1336 -
\??\c:\tbhhbt.exec:\tbhhbt.exe57⤵
- Executes dropped EXE
PID:3908 -
\??\c:\jjjdp.exec:\jjjdp.exe58⤵
- Executes dropped EXE
PID:2384 -
\??\c:\ppjdv.exec:\ppjdv.exe59⤵
- Executes dropped EXE
PID:2312 -
\??\c:\xrlxxfl.exec:\xrlxxfl.exe60⤵
- Executes dropped EXE
PID:4400 -
\??\c:\nbthhb.exec:\nbthhb.exe61⤵
- Executes dropped EXE
PID:2116 -
\??\c:\dppjv.exec:\dppjv.exe62⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jvddv.exec:\jvddv.exe63⤵
- Executes dropped EXE
PID:4408 -
\??\c:\rrxrlfx.exec:\rrxrlfx.exe64⤵
- Executes dropped EXE
PID:3916 -
\??\c:\nbnhnn.exec:\nbnhnn.exe65⤵
- Executes dropped EXE
PID:3444 -
\??\c:\thnbhb.exec:\thnbhb.exe66⤵PID:4864
-
\??\c:\dpddp.exec:\dpddp.exe67⤵PID:3832
-
\??\c:\flxrfxx.exec:\flxrfxx.exe68⤵PID:3692
-
\??\c:\hntnnh.exec:\hntnnh.exe69⤵PID:2160
-
\??\c:\bhthbt.exec:\bhthbt.exe70⤵PID:1196
-
\??\c:\pddvp.exec:\pddvp.exe71⤵
- System Location Discovery: System Language Discovery
PID:1472 -
\??\c:\nnbhnb.exec:\nnbhnb.exe72⤵PID:2124
-
\??\c:\vpvpp.exec:\vpvpp.exe73⤵PID:5020
-
\??\c:\7rxlllf.exec:\7rxlllf.exe74⤵PID:5112
-
\??\c:\nbbtnh.exec:\nbbtnh.exe75⤵
- System Location Discovery: System Language Discovery
PID:4544 -
\??\c:\bnnhhb.exec:\bnnhhb.exe76⤵PID:1104
-
\??\c:\9vjjd.exec:\9vjjd.exe77⤵PID:812
-
\??\c:\rrlxxxx.exec:\rrlxxxx.exe78⤵PID:1360
-
\??\c:\tntnhh.exec:\tntnhh.exe79⤵PID:456
-
\??\c:\jdvpj.exec:\jdvpj.exe80⤵PID:2752
-
\??\c:\9lfrffx.exec:\9lfrffx.exe81⤵PID:404
-
\??\c:\1hbbth.exec:\1hbbth.exe82⤵PID:3488
-
\??\c:\vdpjv.exec:\vdpjv.exe83⤵PID:4636
-
\??\c:\jpdvj.exec:\jpdvj.exe84⤵PID:2256
-
\??\c:\flllffx.exec:\flllffx.exe85⤵PID:840
-
\??\c:\bhbttt.exec:\bhbttt.exe86⤵PID:3100
-
\??\c:\vpddp.exec:\vpddp.exe87⤵PID:1548
-
\??\c:\rxffxxr.exec:\rxffxxr.exe88⤵PID:2992
-
\??\c:\1rxrlff.exec:\1rxrlff.exe89⤵PID:1732
-
\??\c:\tntntt.exec:\tntntt.exe90⤵PID:2268
-
\??\c:\pvdvj.exec:\pvdvj.exe91⤵PID:628
-
\??\c:\llrrrlf.exec:\llrrrlf.exe92⤵PID:4660
-
\??\c:\xffxrlf.exec:\xffxrlf.exe93⤵PID:4900
-
\??\c:\hbbtnn.exec:\hbbtnn.exe94⤵PID:2100
-
\??\c:\dppdv.exec:\dppdv.exe95⤵PID:4500
-
\??\c:\rllrrll.exec:\rllrrll.exe96⤵PID:4516
-
\??\c:\9htntt.exec:\9htntt.exe97⤵PID:228
-
\??\c:\ntnhbt.exec:\ntnhbt.exe98⤵PID:3148
-
\??\c:\vjjpd.exec:\vjjpd.exe99⤵PID:1228
-
\??\c:\lfrrrxf.exec:\lfrrrxf.exe100⤵PID:2848
-
\??\c:\5nbbtt.exec:\5nbbtt.exe101⤵PID:1704
-
\??\c:\ntbhhh.exec:\ntbhhh.exe102⤵
- System Location Discovery: System Language Discovery
PID:3188 -
\??\c:\djppv.exec:\djppv.exe103⤵PID:1084
-
\??\c:\fllfflf.exec:\fllfflf.exe104⤵PID:3192
-
\??\c:\flfflxf.exec:\flfflxf.exe105⤵PID:3276
-
\??\c:\hnbbbb.exec:\hnbbbb.exe106⤵PID:3668
-
\??\c:\9ddvd.exec:\9ddvd.exe107⤵PID:1288
-
\??\c:\llxrlll.exec:\llxrlll.exe108⤵PID:1276
-
\??\c:\7hbttt.exec:\7hbttt.exe109⤵PID:2620
-
\??\c:\bbbthh.exec:\bbbthh.exe110⤵PID:848
-
\??\c:\vvjdd.exec:\vvjdd.exe111⤵PID:2632
-
\??\c:\rlrllff.exec:\rlrllff.exe112⤵PID:1192
-
\??\c:\bnnnnn.exec:\bnnnnn.exe113⤵PID:2300
-
\??\c:\pvpvv.exec:\pvpvv.exe114⤵PID:3172
-
\??\c:\5jvpv.exec:\5jvpv.exe115⤵PID:3732
-
\??\c:\xlrfxlx.exec:\xlrfxlx.exe116⤵PID:4084
-
\??\c:\bhntth.exec:\bhntth.exe117⤵PID:3712
-
\??\c:\3vvpj.exec:\3vvpj.exe118⤵PID:232
-
\??\c:\lrfrfll.exec:\lrfrfll.exe119⤵PID:3856
-
\??\c:\rrlffff.exec:\rrlffff.exe120⤵PID:3672
-
\??\c:\httnhb.exec:\httnhb.exe121⤵PID:532
-
\??\c:\vjpjd.exec:\vjpjd.exe122⤵PID:720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-