Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2024, 01:21
Static task
static1
Behavioral task
behavioral1
Sample
c2c7a57024071e3ec41e4b7a514779c6fc474dc18a66e8a5d127f72efbbfb971.exe
Resource
win7-20240729-en
General
-
Target
c2c7a57024071e3ec41e4b7a514779c6fc474dc18a66e8a5d127f72efbbfb971.exe
-
Size
335KB
-
MD5
c7e65263044b25374e11257a6d551e1e
-
SHA1
fb642cbbbcd2a2c74e6cbe5012e9be3bcfb66423
-
SHA256
c2c7a57024071e3ec41e4b7a514779c6fc474dc18a66e8a5d127f72efbbfb971
-
SHA512
7a6e24486a6cf1adda67fd072edffc23b689ed0e9be95d7a7bf306f34c973a808beb648891dd12c5722948b421b52a80180346ac81ee1f2ee7550fa6b2c2d5c1
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhR:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1956-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2504-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/944-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/800-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-957-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2480-998-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-1366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-1458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1920 c020004.exe 4912 a8828.exe 3056 jdjjp.exe 4512 246082.exe 5032 pjpdv.exe 116 vppdp.exe 4036 dvvdv.exe 4224 pvjvp.exe 4860 tbbttt.exe 3796 hbhnhb.exe 4228 08004.exe 1724 04020.exe 2556 tbthtn.exe 2444 vjjpj.exe 4176 bbbbtb.exe 4128 nnhtbt.exe 2504 240488.exe 3180 hhhhhn.exe 4104 224444.exe 1672 m4660.exe 2940 pvdvp.exe 4476 c284608.exe 1976 286246.exe 4648 42268.exe 4720 7tbbht.exe 3492 44868.exe 2632 bhbtnt.exe 4124 djppj.exe 1364 nhnthh.exe 4936 82884.exe 4656 26828.exe 2736 6080466.exe 800 bhnhbb.exe 1640 lxrlrrf.exe 2740 208848.exe 2212 xflfxxr.exe 4832 hbbtnn.exe 1580 llrlffr.exe 4676 280488.exe 4056 rlrlfll.exe 2368 48482.exe 4444 pddvj.exe 4032 llxrfff.exe 1952 fxllrxx.exe 4728 082682.exe 4584 8066000.exe 2180 7lrlfff.exe 4456 xrxfxff.exe 840 04660.exe 896 rlrffll.exe 2664 24448.exe 3976 lfrrfll.exe 2448 jvjjp.exe 5044 0800422.exe 1444 xrrlfff.exe 456 22844.exe 5032 4824000.exe 4432 bnbbnh.exe 1916 1xxrllx.exe 2628 6062662.exe 4944 tnbbbn.exe 3800 2800448.exe 2284 w04242.exe 4684 vvddv.exe -
resource yara_rule behavioral2/memory/1956-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2504-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/944-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/800-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-667-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i864884.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g4020.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rllfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 226062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20486.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 202604.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24642.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a8828.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6062662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 224226.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffrrr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1956 wrote to memory of 1920 1956 c2c7a57024071e3ec41e4b7a514779c6fc474dc18a66e8a5d127f72efbbfb971.exe 83 PID 1956 wrote to memory of 1920 1956 c2c7a57024071e3ec41e4b7a514779c6fc474dc18a66e8a5d127f72efbbfb971.exe 83 PID 1956 wrote to memory of 1920 1956 c2c7a57024071e3ec41e4b7a514779c6fc474dc18a66e8a5d127f72efbbfb971.exe 83 PID 1920 wrote to memory of 4912 1920 c020004.exe 84 PID 1920 wrote to memory of 4912 1920 c020004.exe 84 PID 1920 wrote to memory of 4912 1920 c020004.exe 84 PID 4912 wrote to memory of 3056 4912 a8828.exe 85 PID 4912 wrote to memory of 3056 4912 a8828.exe 85 PID 4912 wrote to memory of 3056 4912 a8828.exe 85 PID 3056 wrote to memory of 4512 3056 jdjjp.exe 86 PID 3056 wrote to memory of 4512 3056 jdjjp.exe 86 PID 3056 wrote to memory of 4512 3056 jdjjp.exe 86 PID 4512 wrote to memory of 5032 4512 246082.exe 139 PID 4512 wrote to memory of 5032 4512 246082.exe 139 PID 4512 wrote to memory of 5032 4512 246082.exe 139 PID 5032 wrote to memory of 116 5032 pjpdv.exe 88 PID 5032 wrote to memory of 116 5032 pjpdv.exe 88 PID 5032 wrote to memory of 116 5032 pjpdv.exe 88 PID 116 wrote to memory of 4036 116 vppdp.exe 89 PID 116 wrote to memory of 4036 116 vppdp.exe 89 PID 116 wrote to memory of 4036 116 vppdp.exe 89 PID 4036 wrote to memory of 4224 4036 dvvdv.exe 90 PID 4036 wrote to memory of 4224 4036 dvvdv.exe 90 PID 4036 wrote to memory of 4224 4036 dvvdv.exe 90 PID 4224 wrote to memory of 4860 4224 pvjvp.exe 91 PID 4224 wrote to memory of 4860 4224 pvjvp.exe 91 PID 4224 wrote to memory of 4860 4224 pvjvp.exe 91 PID 4860 wrote to memory of 3796 4860 tbbttt.exe 92 PID 4860 wrote to memory of 3796 4860 tbbttt.exe 92 PID 4860 wrote to memory of 3796 4860 tbbttt.exe 92 PID 3796 wrote to memory of 4228 3796 hbhnhb.exe 93 PID 3796 wrote to memory of 4228 3796 hbhnhb.exe 93 PID 3796 wrote to memory of 4228 3796 hbhnhb.exe 93 PID 4228 wrote to memory of 1724 4228 08004.exe 94 PID 4228 wrote to memory of 1724 4228 08004.exe 94 PID 4228 wrote to memory of 1724 4228 08004.exe 94 PID 1724 wrote to memory of 2556 1724 04020.exe 95 PID 1724 wrote to memory of 2556 1724 04020.exe 95 PID 1724 wrote to memory of 2556 1724 04020.exe 95 PID 2556 wrote to memory of 2444 2556 tbthtn.exe 96 PID 2556 wrote to memory of 2444 2556 tbthtn.exe 96 PID 2556 wrote to memory of 2444 2556 tbthtn.exe 96 PID 2444 wrote to memory of 4176 2444 vjjpj.exe 97 PID 2444 wrote to memory of 4176 2444 vjjpj.exe 97 PID 2444 wrote to memory of 4176 2444 vjjpj.exe 97 PID 4176 wrote to memory of 4128 4176 bbbbtb.exe 98 PID 4176 wrote to memory of 4128 4176 bbbbtb.exe 98 PID 4176 wrote to memory of 4128 4176 bbbbtb.exe 98 PID 4128 wrote to memory of 2504 4128 nnhtbt.exe 99 PID 4128 wrote to memory of 2504 4128 nnhtbt.exe 99 PID 4128 wrote to memory of 2504 4128 nnhtbt.exe 99 PID 2504 wrote to memory of 3180 2504 240488.exe 100 PID 2504 wrote to memory of 3180 2504 240488.exe 100 PID 2504 wrote to memory of 3180 2504 240488.exe 100 PID 3180 wrote to memory of 4104 3180 hhhhhn.exe 101 PID 3180 wrote to memory of 4104 3180 hhhhhn.exe 101 PID 3180 wrote to memory of 4104 3180 hhhhhn.exe 101 PID 4104 wrote to memory of 1672 4104 224444.exe 102 PID 4104 wrote to memory of 1672 4104 224444.exe 102 PID 4104 wrote to memory of 1672 4104 224444.exe 102 PID 1672 wrote to memory of 2940 1672 m4660.exe 103 PID 1672 wrote to memory of 2940 1672 m4660.exe 103 PID 1672 wrote to memory of 2940 1672 m4660.exe 103 PID 2940 wrote to memory of 4476 2940 pvdvp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2c7a57024071e3ec41e4b7a514779c6fc474dc18a66e8a5d127f72efbbfb971.exe"C:\Users\Admin\AppData\Local\Temp\c2c7a57024071e3ec41e4b7a514779c6fc474dc18a66e8a5d127f72efbbfb971.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\c020004.exec:\c020004.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\a8828.exec:\a8828.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\jdjjp.exec:\jdjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\246082.exec:\246082.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\pjpdv.exec:\pjpdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\vppdp.exec:\vppdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\dvvdv.exec:\dvvdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\pvjvp.exec:\pvjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\tbbttt.exec:\tbbttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\hbhnhb.exec:\hbhnhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\08004.exec:\08004.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\04020.exec:\04020.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\tbthtn.exec:\tbthtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\vjjpj.exec:\vjjpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\bbbbtb.exec:\bbbbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\nnhtbt.exec:\nnhtbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\240488.exec:\240488.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\hhhhhn.exec:\hhhhhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\224444.exec:\224444.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\m4660.exec:\m4660.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\pvdvp.exec:\pvdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\c284608.exec:\c284608.exe23⤵
- Executes dropped EXE
PID:4476 -
\??\c:\286246.exec:\286246.exe24⤵
- Executes dropped EXE
PID:1976 -
\??\c:\42268.exec:\42268.exe25⤵
- Executes dropped EXE
PID:4648 -
\??\c:\7tbbht.exec:\7tbbht.exe26⤵
- Executes dropped EXE
PID:4720 -
\??\c:\44868.exec:\44868.exe27⤵
- Executes dropped EXE
PID:3492 -
\??\c:\bhbtnt.exec:\bhbtnt.exe28⤵
- Executes dropped EXE
PID:2632 -
\??\c:\djppj.exec:\djppj.exe29⤵
- Executes dropped EXE
PID:4124 -
\??\c:\nhnthh.exec:\nhnthh.exe30⤵
- Executes dropped EXE
PID:1364 -
\??\c:\82884.exec:\82884.exe31⤵
- Executes dropped EXE
PID:4936 -
\??\c:\26828.exec:\26828.exe32⤵
- Executes dropped EXE
PID:4656 -
\??\c:\6080466.exec:\6080466.exe33⤵
- Executes dropped EXE
PID:2736 -
\??\c:\bhnhbb.exec:\bhnhbb.exe34⤵
- Executes dropped EXE
PID:800 -
\??\c:\lxrlrrf.exec:\lxrlrrf.exe35⤵
- Executes dropped EXE
PID:1640 -
\??\c:\208848.exec:\208848.exe36⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xflfxxr.exec:\xflfxxr.exe37⤵
- Executes dropped EXE
PID:2212 -
\??\c:\hbbtnn.exec:\hbbtnn.exe38⤵
- Executes dropped EXE
PID:4832 -
\??\c:\llrlffr.exec:\llrlffr.exe39⤵
- Executes dropped EXE
PID:1580 -
\??\c:\280488.exec:\280488.exe40⤵
- Executes dropped EXE
PID:4676 -
\??\c:\rlrlfll.exec:\rlrlfll.exe41⤵
- Executes dropped EXE
PID:4056 -
\??\c:\48482.exec:\48482.exe42⤵
- Executes dropped EXE
PID:2368 -
\??\c:\pddvj.exec:\pddvj.exe43⤵
- Executes dropped EXE
PID:4444 -
\??\c:\llxrfff.exec:\llxrfff.exe44⤵
- Executes dropped EXE
PID:4032 -
\??\c:\fxllrxx.exec:\fxllrxx.exe45⤵
- Executes dropped EXE
PID:1952 -
\??\c:\082682.exec:\082682.exe46⤵
- Executes dropped EXE
PID:4728 -
\??\c:\8066000.exec:\8066000.exe47⤵
- Executes dropped EXE
PID:4584 -
\??\c:\7lrlfff.exec:\7lrlfff.exe48⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xrxfxff.exec:\xrxfxff.exe49⤵
- Executes dropped EXE
PID:4456 -
\??\c:\04660.exec:\04660.exe50⤵
- Executes dropped EXE
PID:840 -
\??\c:\rlrffll.exec:\rlrffll.exe51⤵
- Executes dropped EXE
PID:896 -
\??\c:\24448.exec:\24448.exe52⤵
- Executes dropped EXE
PID:2664 -
\??\c:\lfrrfll.exec:\lfrrfll.exe53⤵
- Executes dropped EXE
PID:3976 -
\??\c:\jvjjp.exec:\jvjjp.exe54⤵
- Executes dropped EXE
PID:2448 -
\??\c:\0800422.exec:\0800422.exe55⤵
- Executes dropped EXE
PID:5044 -
\??\c:\xrrlfff.exec:\xrrlfff.exe56⤵
- Executes dropped EXE
PID:1444 -
\??\c:\22844.exec:\22844.exe57⤵
- Executes dropped EXE
PID:456 -
\??\c:\4824000.exec:\4824000.exe58⤵
- Executes dropped EXE
PID:5032 -
\??\c:\bnbbnh.exec:\bnbbnh.exe59⤵
- Executes dropped EXE
PID:4432 -
\??\c:\1xxrllx.exec:\1xxrllx.exe60⤵
- Executes dropped EXE
PID:1916 -
\??\c:\6062662.exec:\6062662.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2628 -
\??\c:\tnbbbn.exec:\tnbbbn.exe62⤵
- Executes dropped EXE
PID:4944 -
\??\c:\2800448.exec:\2800448.exe63⤵
- Executes dropped EXE
PID:3800 -
\??\c:\w04242.exec:\w04242.exe64⤵
- Executes dropped EXE
PID:2284 -
\??\c:\vvddv.exec:\vvddv.exe65⤵
- Executes dropped EXE
PID:4684 -
\??\c:\0428222.exec:\0428222.exe66⤵PID:2268
-
\??\c:\u240404.exec:\u240404.exe67⤵PID:3692
-
\??\c:\2000446.exec:\2000446.exe68⤵PID:3436
-
\??\c:\6844800.exec:\6844800.exe69⤵PID:2936
-
\??\c:\rllffxr.exec:\rllffxr.exe70⤵PID:1224
-
\??\c:\rlrlxrx.exec:\rlrlxrx.exe71⤵
- System Location Discovery: System Language Discovery
PID:2296 -
\??\c:\0400000.exec:\0400000.exe72⤵PID:1228
-
\??\c:\s0882.exec:\s0882.exe73⤵PID:4968
-
\??\c:\g6048.exec:\g6048.exe74⤵PID:4288
-
\??\c:\w68266.exec:\w68266.exe75⤵PID:212
-
\??\c:\s8044.exec:\s8044.exe76⤵PID:944
-
\??\c:\xlxrrrl.exec:\xlxrrrl.exe77⤵PID:1656
-
\??\c:\046688.exec:\046688.exe78⤵PID:3288
-
\??\c:\xrrlfff.exec:\xrrlfff.exe79⤵PID:4212
-
\??\c:\w00062.exec:\w00062.exe80⤵PID:1424
-
\??\c:\dpdjj.exec:\dpdjj.exe81⤵PID:4940
-
\??\c:\48268.exec:\48268.exe82⤵PID:3492
-
\??\c:\bbnntt.exec:\bbnntt.exe83⤵PID:1836
-
\??\c:\k02600.exec:\k02600.exe84⤵PID:4956
-
\??\c:\tnbhhh.exec:\tnbhhh.exe85⤵PID:3484
-
\??\c:\46260.exec:\46260.exe86⤵PID:2516
-
\??\c:\26226.exec:\26226.exe87⤵PID:4560
-
\??\c:\204884.exec:\204884.exe88⤵PID:800
-
\??\c:\o644882.exec:\o644882.exe89⤵PID:2428
-
\??\c:\4406660.exec:\4406660.exe90⤵PID:3524
-
\??\c:\rfxrrfr.exec:\rfxrrfr.exe91⤵PID:2984
-
\??\c:\8244888.exec:\8244888.exe92⤵PID:3192
-
\??\c:\488266.exec:\488266.exe93⤵PID:2488
-
\??\c:\fffxrrr.exec:\fffxrrr.exe94⤵PID:1728
-
\??\c:\224888.exec:\224888.exe95⤵PID:2772
-
\??\c:\2842466.exec:\2842466.exe96⤵PID:3640
-
\??\c:\9vjdd.exec:\9vjdd.exe97⤵
- System Location Discovery: System Language Discovery
PID:1812 -
\??\c:\1vpdv.exec:\1vpdv.exe98⤵PID:4996
-
\??\c:\a4042.exec:\a4042.exe99⤵PID:4588
-
\??\c:\1xlfrfx.exec:\1xlfrfx.exe100⤵PID:1068
-
\??\c:\dvpjv.exec:\dvpjv.exe101⤵PID:2876
-
\??\c:\4460882.exec:\4460882.exe102⤵PID:3860
-
\??\c:\040820.exec:\040820.exe103⤵PID:3960
-
\??\c:\6240022.exec:\6240022.exe104⤵PID:3976
-
\??\c:\dpvvp.exec:\dpvvp.exe105⤵PID:2008
-
\??\c:\a4682.exec:\a4682.exe106⤵PID:4452
-
\??\c:\bntnnn.exec:\bntnnn.exe107⤵PID:1808
-
\??\c:\48400.exec:\48400.exe108⤵PID:5044
-
\??\c:\3hnbtn.exec:\3hnbtn.exe109⤵PID:2196
-
\??\c:\dddpp.exec:\dddpp.exe110⤵PID:488
-
\??\c:\1xfxxxx.exec:\1xfxxxx.exe111⤵PID:4652
-
\??\c:\2644668.exec:\2644668.exe112⤵PID:3520
-
\??\c:\fffxxxr.exec:\fffxxxr.exe113⤵PID:2720
-
\??\c:\xxxrrrf.exec:\xxxrrrf.exe114⤵PID:1916
-
\??\c:\fxlllrr.exec:\fxlllrr.exe115⤵PID:1988
-
\??\c:\dddvv.exec:\dddvv.exe116⤵PID:4300
-
\??\c:\vvvvp.exec:\vvvvp.exe117⤵PID:4696
-
\??\c:\ddjdd.exec:\ddjdd.exe118⤵PID:4036
-
\??\c:\680488.exec:\680488.exe119⤵PID:4700
-
\??\c:\1pdpj.exec:\1pdpj.exe120⤵PID:3800
-
\??\c:\ddpjp.exec:\ddpjp.exe121⤵PID:5056
-
\??\c:\4460448.exec:\4460448.exe122⤵PID:3928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-