Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 01:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a650db69d805c629016e5705102f67b67ad7d55b8adcd2647b048d01f3aab36c.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a650db69d805c629016e5705102f67b67ad7d55b8adcd2647b048d01f3aab36c.exe
-
Size
454KB
-
MD5
f8f6ec6fadaf04363fd0418180be5de2
-
SHA1
38e5b815fa41c5809c14e98a5ea577ed524661a9
-
SHA256
a650db69d805c629016e5705102f67b67ad7d55b8adcd2647b048d01f3aab36c
-
SHA512
99f2e9b4e8db08abe7a1ee59ae39871863bbb04fbeed8799f1883d242791492bfd60470878c1c52152775ce3ffa86452df8cac4d92c581e16358543a7d877e82
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeM:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4532-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1740-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/604-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2748-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1120-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/776-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-607-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/836-729-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-761-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-770-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1852-905-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-1020-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-1101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-1471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-1953-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3128 3jddv.exe 1740 pjjvp.exe 1216 jpdvp.exe 2952 xxffxff.exe 2020 pdvjv.exe 1620 5bbnhh.exe 4872 1xxrllf.exe 1892 btthbt.exe 2684 7ddjj.exe 4312 ddvjd.exe 3864 rxfxfxr.exe 3836 dvpdp.exe 2848 lxxrlfx.exe 604 fxfxlxr.exe 3144 1jpdp.exe 2180 llxrrrr.exe 4736 bhnhnh.exe 3976 jvjjj.exe 4796 nhnhhh.exe 1476 nhnhbt.exe 2824 bnnnhh.exe 860 rrllfxr.exe 3672 frrrlll.exe 1648 tttnnn.exe 2948 bhnntt.exe 2260 rxrxrxl.exe 4212 bhnbbn.exe 2748 vjdpd.exe 2068 djppv.exe 4360 rlxxrxx.exe 3536 lxxxrrr.exe 3324 jjppv.exe 4264 rrlffll.exe 444 rrxxffl.exe 2920 hhhnhh.exe 3616 jjjdv.exe 1792 vvvpj.exe 1568 5hbbtt.exe 2432 vpvvp.exe 2768 flxxxxx.exe 4792 3bhbtb.exe 2672 vvppp.exe 3624 rrxrlfl.exe 1036 tntnnn.exe 1228 vvvpj.exe 4804 pdjvp.exe 1940 rffxxxr.exe 3660 nhbnhh.exe 4296 djdpd.exe 1868 ffflrrx.exe 1524 llrxffx.exe 976 nnnhbt.exe 1740 jdddd.exe 408 3fxlfrl.exe 1216 fffxxxx.exe 2668 9bbbtt.exe 872 hnnnhn.exe 2024 djvjd.exe 232 frfxrrl.exe 4252 llrrrrr.exe 3548 btbttb.exe 3872 jppdp.exe 4280 rrrlflr.exe 3772 9htnhb.exe -
resource yara_rule behavioral2/memory/4532-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/604-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2748-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/776-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-770-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-867-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-883-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1852-905-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4532 wrote to memory of 3128 4532 a650db69d805c629016e5705102f67b67ad7d55b8adcd2647b048d01f3aab36c.exe 83 PID 4532 wrote to memory of 3128 4532 a650db69d805c629016e5705102f67b67ad7d55b8adcd2647b048d01f3aab36c.exe 83 PID 4532 wrote to memory of 3128 4532 a650db69d805c629016e5705102f67b67ad7d55b8adcd2647b048d01f3aab36c.exe 83 PID 3128 wrote to memory of 1740 3128 3jddv.exe 84 PID 3128 wrote to memory of 1740 3128 3jddv.exe 84 PID 3128 wrote to memory of 1740 3128 3jddv.exe 84 PID 1740 wrote to memory of 1216 1740 pjjvp.exe 85 PID 1740 wrote to memory of 1216 1740 pjjvp.exe 85 PID 1740 wrote to memory of 1216 1740 pjjvp.exe 85 PID 1216 wrote to memory of 2952 1216 jpdvp.exe 86 PID 1216 wrote to memory of 2952 1216 jpdvp.exe 86 PID 1216 wrote to memory of 2952 1216 jpdvp.exe 86 PID 2952 wrote to memory of 2020 2952 xxffxff.exe 87 PID 2952 wrote to memory of 2020 2952 xxffxff.exe 87 PID 2952 wrote to memory of 2020 2952 xxffxff.exe 87 PID 2020 wrote to memory of 1620 2020 pdvjv.exe 88 PID 2020 wrote to memory of 1620 2020 pdvjv.exe 88 PID 2020 wrote to memory of 1620 2020 pdvjv.exe 88 PID 1620 wrote to memory of 4872 1620 5bbnhh.exe 89 PID 1620 wrote to memory of 4872 1620 5bbnhh.exe 89 PID 1620 wrote to memory of 4872 1620 5bbnhh.exe 89 PID 4872 wrote to memory of 1892 4872 1xxrllf.exe 90 PID 4872 wrote to memory of 1892 4872 1xxrllf.exe 90 PID 4872 wrote to memory of 1892 4872 1xxrllf.exe 90 PID 1892 wrote to memory of 2684 1892 btthbt.exe 91 PID 1892 wrote to memory of 2684 1892 btthbt.exe 91 PID 1892 wrote to memory of 2684 1892 btthbt.exe 91 PID 2684 wrote to memory of 4312 2684 7ddjj.exe 92 PID 2684 wrote to memory of 4312 2684 7ddjj.exe 92 PID 2684 wrote to memory of 4312 2684 7ddjj.exe 92 PID 4312 wrote to memory of 3864 4312 ddvjd.exe 93 PID 4312 wrote to memory of 3864 4312 ddvjd.exe 93 PID 4312 wrote to memory of 3864 4312 ddvjd.exe 93 PID 3864 wrote to memory of 3836 3864 rxfxfxr.exe 94 PID 3864 wrote to memory of 3836 3864 rxfxfxr.exe 94 PID 3864 wrote to memory of 3836 3864 rxfxfxr.exe 94 PID 3836 wrote to memory of 2848 3836 dvpdp.exe 95 PID 3836 wrote to memory of 2848 3836 dvpdp.exe 95 PID 3836 wrote to memory of 2848 3836 dvpdp.exe 95 PID 2848 wrote to memory of 604 2848 lxxrlfx.exe 96 PID 2848 wrote to memory of 604 2848 lxxrlfx.exe 96 PID 2848 wrote to memory of 604 2848 lxxrlfx.exe 96 PID 604 wrote to memory of 3144 604 fxfxlxr.exe 97 PID 604 wrote to memory of 3144 604 fxfxlxr.exe 97 PID 604 wrote to memory of 3144 604 fxfxlxr.exe 97 PID 3144 wrote to memory of 2180 3144 1jpdp.exe 98 PID 3144 wrote to memory of 2180 3144 1jpdp.exe 98 PID 3144 wrote to memory of 2180 3144 1jpdp.exe 98 PID 2180 wrote to memory of 4736 2180 llxrrrr.exe 99 PID 2180 wrote to memory of 4736 2180 llxrrrr.exe 99 PID 2180 wrote to memory of 4736 2180 llxrrrr.exe 99 PID 4736 wrote to memory of 3976 4736 bhnhnh.exe 100 PID 4736 wrote to memory of 3976 4736 bhnhnh.exe 100 PID 4736 wrote to memory of 3976 4736 bhnhnh.exe 100 PID 3976 wrote to memory of 4796 3976 jvjjj.exe 101 PID 3976 wrote to memory of 4796 3976 jvjjj.exe 101 PID 3976 wrote to memory of 4796 3976 jvjjj.exe 101 PID 4796 wrote to memory of 1476 4796 nhnhhh.exe 102 PID 4796 wrote to memory of 1476 4796 nhnhhh.exe 102 PID 4796 wrote to memory of 1476 4796 nhnhhh.exe 102 PID 1476 wrote to memory of 2824 1476 nhnhbt.exe 103 PID 1476 wrote to memory of 2824 1476 nhnhbt.exe 103 PID 1476 wrote to memory of 2824 1476 nhnhbt.exe 103 PID 2824 wrote to memory of 860 2824 bnnnhh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\a650db69d805c629016e5705102f67b67ad7d55b8adcd2647b048d01f3aab36c.exe"C:\Users\Admin\AppData\Local\Temp\a650db69d805c629016e5705102f67b67ad7d55b8adcd2647b048d01f3aab36c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\3jddv.exec:\3jddv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\pjjvp.exec:\pjjvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\jpdvp.exec:\jpdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\xxffxff.exec:\xxffxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\pdvjv.exec:\pdvjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\5bbnhh.exec:\5bbnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\1xxrllf.exec:\1xxrllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\btthbt.exec:\btthbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\7ddjj.exec:\7ddjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\ddvjd.exec:\ddvjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\rxfxfxr.exec:\rxfxfxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\dvpdp.exec:\dvpdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\fxfxlxr.exec:\fxfxlxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\1jpdp.exec:\1jpdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\llxrrrr.exec:\llxrrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\bhnhnh.exec:\bhnhnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\jvjjj.exec:\jvjjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\nhnhhh.exec:\nhnhhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\nhnhbt.exec:\nhnhbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\bnnnhh.exec:\bnnnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\rrllfxr.exec:\rrllfxr.exe23⤵
- Executes dropped EXE
PID:860 -
\??\c:\frrrlll.exec:\frrrlll.exe24⤵
- Executes dropped EXE
PID:3672 -
\??\c:\tttnnn.exec:\tttnnn.exe25⤵
- Executes dropped EXE
PID:1648 -
\??\c:\bhnntt.exec:\bhnntt.exe26⤵
- Executes dropped EXE
PID:2948 -
\??\c:\rxrxrxl.exec:\rxrxrxl.exe27⤵
- Executes dropped EXE
PID:2260 -
\??\c:\bhnbbn.exec:\bhnbbn.exe28⤵
- Executes dropped EXE
PID:4212 -
\??\c:\vjdpd.exec:\vjdpd.exe29⤵
- Executes dropped EXE
PID:2748 -
\??\c:\djppv.exec:\djppv.exe30⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rlxxrxx.exec:\rlxxrxx.exe31⤵
- Executes dropped EXE
PID:4360 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe32⤵
- Executes dropped EXE
PID:3536 -
\??\c:\jjppv.exec:\jjppv.exe33⤵
- Executes dropped EXE
PID:3324 -
\??\c:\rrlffll.exec:\rrlffll.exe34⤵
- Executes dropped EXE
PID:4264 -
\??\c:\rrxxffl.exec:\rrxxffl.exe35⤵
- Executes dropped EXE
PID:444 -
\??\c:\hhhnhh.exec:\hhhnhh.exe36⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jjjdv.exec:\jjjdv.exe37⤵
- Executes dropped EXE
PID:3616 -
\??\c:\vvvpj.exec:\vvvpj.exe38⤵
- Executes dropped EXE
PID:1792 -
\??\c:\5hbbtt.exec:\5hbbtt.exe39⤵
- Executes dropped EXE
PID:1568 -
\??\c:\vpvvp.exec:\vpvvp.exe40⤵
- Executes dropped EXE
PID:2432 -
\??\c:\flxxxxx.exec:\flxxxxx.exe41⤵
- Executes dropped EXE
PID:2768 -
\??\c:\3bhbtb.exec:\3bhbtb.exe42⤵
- Executes dropped EXE
PID:4792 -
\??\c:\vvppp.exec:\vvppp.exe43⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rrxrlfl.exec:\rrxrlfl.exe44⤵
- Executes dropped EXE
PID:3624 -
\??\c:\tntnnn.exec:\tntnnn.exe45⤵
- Executes dropped EXE
PID:1036 -
\??\c:\vvvpj.exec:\vvvpj.exe46⤵
- Executes dropped EXE
PID:1228 -
\??\c:\pdjvp.exec:\pdjvp.exe47⤵
- Executes dropped EXE
PID:4804 -
\??\c:\rffxxxr.exec:\rffxxxr.exe48⤵
- Executes dropped EXE
PID:1940 -
\??\c:\nhbnhh.exec:\nhbnhh.exe49⤵
- Executes dropped EXE
PID:3660 -
\??\c:\djdpd.exec:\djdpd.exe50⤵
- Executes dropped EXE
PID:4296 -
\??\c:\ffflrrx.exec:\ffflrrx.exe51⤵
- Executes dropped EXE
PID:1868 -
\??\c:\llrxffx.exec:\llrxffx.exe52⤵
- Executes dropped EXE
PID:1524 -
\??\c:\nnnhbt.exec:\nnnhbt.exe53⤵
- Executes dropped EXE
PID:976 -
\??\c:\jdddd.exec:\jdddd.exe54⤵
- Executes dropped EXE
PID:1740 -
\??\c:\3fxlfrl.exec:\3fxlfrl.exe55⤵
- Executes dropped EXE
PID:408 -
\??\c:\fffxxxx.exec:\fffxxxx.exe56⤵
- Executes dropped EXE
PID:1216 -
\??\c:\9bbbtt.exec:\9bbbtt.exe57⤵
- Executes dropped EXE
PID:2668 -
\??\c:\hnnnhn.exec:\hnnnhn.exe58⤵
- Executes dropped EXE
PID:872 -
\??\c:\djvjd.exec:\djvjd.exe59⤵
- Executes dropped EXE
PID:2024 -
\??\c:\frfxrrl.exec:\frfxrrl.exe60⤵
- Executes dropped EXE
PID:232 -
\??\c:\llrrrrr.exec:\llrrrrr.exe61⤵
- Executes dropped EXE
PID:4252 -
\??\c:\btbttb.exec:\btbttb.exe62⤵
- Executes dropped EXE
PID:3548 -
\??\c:\jppdp.exec:\jppdp.exe63⤵
- Executes dropped EXE
PID:3872 -
\??\c:\rrrlflr.exec:\rrrlflr.exe64⤵
- Executes dropped EXE
PID:4280 -
\??\c:\9htnhb.exec:\9htnhb.exe65⤵
- Executes dropped EXE
PID:3772 -
\??\c:\jjddv.exec:\jjddv.exe66⤵PID:2808
-
\??\c:\7vpjv.exec:\7vpjv.exe67⤵PID:3876
-
\??\c:\fffxrxx.exec:\fffxrxx.exe68⤵PID:3304
-
\??\c:\hhbtnn.exec:\hhbtnn.exe69⤵PID:4080
-
\??\c:\jdddv.exec:\jdddv.exe70⤵PID:3864
-
\??\c:\pdvvv.exec:\pdvvv.exe71⤵
- System Location Discovery: System Language Discovery
PID:4764 -
\??\c:\rxxrrxx.exec:\rxxrrxx.exe72⤵PID:3496
-
\??\c:\5ntntn.exec:\5ntntn.exe73⤵PID:3300
-
\??\c:\9vvvv.exec:\9vvvv.exe74⤵PID:4284
-
\??\c:\rlrllrr.exec:\rlrllrr.exe75⤵PID:840
-
\??\c:\frrfrlf.exec:\frrfrlf.exe76⤵PID:1120
-
\??\c:\bhbbtn.exec:\bhbbtn.exe77⤵PID:3140
-
\??\c:\vjpjd.exec:\vjpjd.exe78⤵PID:3552
-
\??\c:\xxrllfx.exec:\xxrllfx.exe79⤵PID:460
-
\??\c:\flrrlll.exec:\flrrlll.exe80⤵PID:216
-
\??\c:\hnhtbb.exec:\hnhtbb.exe81⤵PID:5040
-
\??\c:\ddddd.exec:\ddddd.exe82⤵PID:3248
-
\??\c:\vjpvp.exec:\vjpvp.exe83⤵PID:2132
-
\??\c:\5rfxrrl.exec:\5rfxrrl.exe84⤵PID:648
-
\??\c:\nhhhbb.exec:\nhhhbb.exe85⤵PID:4076
-
\??\c:\jjpjv.exec:\jjpjv.exe86⤵PID:3444
-
\??\c:\vjdvv.exec:\vjdvv.exe87⤵PID:4336
-
\??\c:\lrrlxrf.exec:\lrrlxrf.exe88⤵PID:4640
-
\??\c:\9bttnt.exec:\9bttnt.exe89⤵PID:4776
-
\??\c:\dpvvd.exec:\dpvvd.exe90⤵PID:3640
-
\??\c:\vdvvp.exec:\vdvvp.exe91⤵PID:2540
-
\??\c:\9flffxr.exec:\9flffxr.exe92⤵PID:3452
-
\??\c:\9hhtnb.exec:\9hhtnb.exe93⤵PID:2968
-
\??\c:\7pdvj.exec:\7pdvj.exe94⤵PID:4424
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe95⤵PID:2056
-
\??\c:\bhhbnh.exec:\bhhbnh.exe96⤵PID:432
-
\??\c:\hnnhhh.exec:\hnnhhh.exe97⤵PID:1488
-
\??\c:\vdvpv.exec:\vdvpv.exe98⤵PID:3964
-
\??\c:\fxffxxr.exec:\fxffxxr.exe99⤵PID:4264
-
\??\c:\5bbbbb.exec:\5bbbbb.exe100⤵PID:444
-
\??\c:\hbhhhn.exec:\hbhhhn.exe101⤵PID:4452
-
\??\c:\9jvvd.exec:\9jvvd.exe102⤵PID:3616
-
\??\c:\lxxfrlf.exec:\lxxfrlf.exe103⤵PID:2228
-
\??\c:\rrllfff.exec:\rrllfff.exe104⤵PID:2544
-
\??\c:\bbbbtb.exec:\bbbbtb.exe105⤵PID:3356
-
\??\c:\jdvvp.exec:\jdvvp.exe106⤵PID:1480
-
\??\c:\1pdvd.exec:\1pdvd.exe107⤵PID:2044
-
\??\c:\rfllfff.exec:\rfllfff.exe108⤵PID:3544
-
\??\c:\9thbbt.exec:\9thbbt.exe109⤵PID:2928
-
\??\c:\pvpjp.exec:\pvpjp.exe110⤵PID:3148
-
\??\c:\djpjj.exec:\djpjj.exe111⤵PID:2372
-
\??\c:\rffxrrf.exec:\rffxrrf.exe112⤵PID:1004
-
\??\c:\9bbbtb.exec:\9bbbtb.exe113⤵PID:1516
-
\??\c:\ppjdp.exec:\ppjdp.exe114⤵PID:3212
-
\??\c:\lllffxr.exec:\lllffxr.exe115⤵PID:4276
-
\??\c:\3flflll.exec:\3flflll.exe116⤵PID:2732
-
\??\c:\nnnnhh.exec:\nnnnhh.exe117⤵PID:3948
-
\??\c:\jvjdd.exec:\jvjdd.exe118⤵PID:2216
-
\??\c:\rfffxxx.exec:\rfffxxx.exe119⤵PID:2120
-
\??\c:\1hhbbt.exec:\1hhbbt.exe120⤵PID:2040
-
\??\c:\vpjpj.exec:\vpjpj.exe121⤵PID:2304
-
\??\c:\ppppj.exec:\ppppj.exe122⤵PID:1336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-