Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 14:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe
-
Size
454KB
-
MD5
628693ccd4c90ece9270f66e27bd2a9c
-
SHA1
e483ef841425e9ff206e6b053c17c2898410da04
-
SHA256
dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4
-
SHA512
eb1265ecc8d4935f45eaa3bba9ee91796360a6f5266b55fb5aaa5b99f3a5c3bf0ef47d54601a9b73ffb0deaace1ea121671caa9790163c8852b7b533be3e6335
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeb:q7Tc2NYHUrAwfMp3CDb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1948-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/744-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/756-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1508-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1272-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/752-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1760-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1756-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4208-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-682-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-692-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-808-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-917-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-933-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1984 5pjjj.exe 2476 lllxlfr.exe 744 bhnnnt.exe 880 pjjjd.exe 756 rxrrxlr.exe 2020 vvjjj.exe 4000 3hnnbn.exe 2008 rfxxxxr.exe 2356 bbnbtb.exe 3704 3xfxffl.exe 2140 ddjvj.exe 1624 lllfxlf.exe 3872 bnttnn.exe 2936 jdddd.exe 220 1lfffff.exe 2080 nhnhnn.exe 2424 ttbhtn.exe 964 vpdjp.exe 4724 9lxrlrl.exe 3812 bthhhb.exe 4320 rlfrfxl.exe 5052 nbnntn.exe 3488 ppdjd.exe 1508 bthnbn.exe 3184 jjjjd.exe 1364 9rlrrxx.exe 1912 9tnttb.exe 1272 xrllffx.exe 1476 3jpjd.exe 5080 ffffffl.exe 2940 xrrrrrx.exe 3724 7rrfxxr.exe 1020 jvjdd.exe 2648 5xffxfl.exe 2564 dpdjv.exe 4384 llrrrff.exe 604 nbhbbt.exe 2676 pvjjj.exe 3716 9xlrrfl.exe 3060 rlffrxl.exe 4224 bhbbnn.exe 4956 dpddv.exe 2188 ttnnhh.exe 4424 dvjjd.exe 4532 ffffffx.exe 2412 frlllll.exe 2884 3hhhhh.exe 2192 pvjdd.exe 2752 lflfrrl.exe 4212 bhhhbh.exe 3012 9vjjv.exe 400 xlffrfl.exe 1592 bhhhbb.exe 1888 7vddd.exe 548 lllffll.exe 3940 hhhbnt.exe 2060 tbnhhh.exe 640 jjjjj.exe 3360 rffxxxf.exe 880 jjddv.exe 1680 5rrlllf.exe 4452 nnntnt.exe 3628 pdpdd.exe 5064 xxxrrxx.exe -
resource yara_rule behavioral2/memory/1948-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/744-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1508-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1508-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1272-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/752-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4208-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-617-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1948 wrote to memory of 1984 1948 dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe 82 PID 1948 wrote to memory of 1984 1948 dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe 82 PID 1948 wrote to memory of 1984 1948 dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe 82 PID 1984 wrote to memory of 2476 1984 5pjjj.exe 83 PID 1984 wrote to memory of 2476 1984 5pjjj.exe 83 PID 1984 wrote to memory of 2476 1984 5pjjj.exe 83 PID 2476 wrote to memory of 744 2476 lllxlfr.exe 84 PID 2476 wrote to memory of 744 2476 lllxlfr.exe 84 PID 2476 wrote to memory of 744 2476 lllxlfr.exe 84 PID 744 wrote to memory of 880 744 bhnnnt.exe 85 PID 744 wrote to memory of 880 744 bhnnnt.exe 85 PID 744 wrote to memory of 880 744 bhnnnt.exe 85 PID 880 wrote to memory of 756 880 pjjjd.exe 86 PID 880 wrote to memory of 756 880 pjjjd.exe 86 PID 880 wrote to memory of 756 880 pjjjd.exe 86 PID 756 wrote to memory of 2020 756 rxrrxlr.exe 87 PID 756 wrote to memory of 2020 756 rxrrxlr.exe 87 PID 756 wrote to memory of 2020 756 rxrrxlr.exe 87 PID 2020 wrote to memory of 4000 2020 vvjjj.exe 88 PID 2020 wrote to memory of 4000 2020 vvjjj.exe 88 PID 2020 wrote to memory of 4000 2020 vvjjj.exe 88 PID 4000 wrote to memory of 2008 4000 3hnnbn.exe 89 PID 4000 wrote to memory of 2008 4000 3hnnbn.exe 89 PID 4000 wrote to memory of 2008 4000 3hnnbn.exe 89 PID 2008 wrote to memory of 2356 2008 rfxxxxr.exe 90 PID 2008 wrote to memory of 2356 2008 rfxxxxr.exe 90 PID 2008 wrote to memory of 2356 2008 rfxxxxr.exe 90 PID 2356 wrote to memory of 3704 2356 bbnbtb.exe 91 PID 2356 wrote to memory of 3704 2356 bbnbtb.exe 91 PID 2356 wrote to memory of 3704 2356 bbnbtb.exe 91 PID 3704 wrote to memory of 2140 3704 3xfxffl.exe 92 PID 3704 wrote to memory of 2140 3704 3xfxffl.exe 92 PID 3704 wrote to memory of 2140 3704 3xfxffl.exe 92 PID 2140 wrote to memory of 1624 2140 ddjvj.exe 93 PID 2140 wrote to memory of 1624 2140 ddjvj.exe 93 PID 2140 wrote to memory of 1624 2140 ddjvj.exe 93 PID 1624 wrote to memory of 3872 1624 lllfxlf.exe 94 PID 1624 wrote to memory of 3872 1624 lllfxlf.exe 94 PID 1624 wrote to memory of 3872 1624 lllfxlf.exe 94 PID 3872 wrote to memory of 2936 3872 bnttnn.exe 95 PID 3872 wrote to memory of 2936 3872 bnttnn.exe 95 PID 3872 wrote to memory of 2936 3872 bnttnn.exe 95 PID 2936 wrote to memory of 220 2936 jdddd.exe 96 PID 2936 wrote to memory of 220 2936 jdddd.exe 96 PID 2936 wrote to memory of 220 2936 jdddd.exe 96 PID 220 wrote to memory of 2080 220 1lfffff.exe 97 PID 220 wrote to memory of 2080 220 1lfffff.exe 97 PID 220 wrote to memory of 2080 220 1lfffff.exe 97 PID 2080 wrote to memory of 2424 2080 nhnhnn.exe 98 PID 2080 wrote to memory of 2424 2080 nhnhnn.exe 98 PID 2080 wrote to memory of 2424 2080 nhnhnn.exe 98 PID 2424 wrote to memory of 964 2424 ttbhtn.exe 99 PID 2424 wrote to memory of 964 2424 ttbhtn.exe 99 PID 2424 wrote to memory of 964 2424 ttbhtn.exe 99 PID 964 wrote to memory of 4724 964 vpdjp.exe 100 PID 964 wrote to memory of 4724 964 vpdjp.exe 100 PID 964 wrote to memory of 4724 964 vpdjp.exe 100 PID 4724 wrote to memory of 3812 4724 9lxrlrl.exe 101 PID 4724 wrote to memory of 3812 4724 9lxrlrl.exe 101 PID 4724 wrote to memory of 3812 4724 9lxrlrl.exe 101 PID 3812 wrote to memory of 4320 3812 bthhhb.exe 102 PID 3812 wrote to memory of 4320 3812 bthhhb.exe 102 PID 3812 wrote to memory of 4320 3812 bthhhb.exe 102 PID 4320 wrote to memory of 5052 4320 rlfrfxl.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe"C:\Users\Admin\AppData\Local\Temp\dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\5pjjj.exec:\5pjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\lllxlfr.exec:\lllxlfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\bhnnnt.exec:\bhnnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\pjjjd.exec:\pjjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\rxrrxlr.exec:\rxrrxlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\vvjjj.exec:\vvjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\3hnnbn.exec:\3hnnbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\rfxxxxr.exec:\rfxxxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\bbnbtb.exec:\bbnbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\3xfxffl.exec:\3xfxffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\ddjvj.exec:\ddjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\lllfxlf.exec:\lllfxlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\bnttnn.exec:\bnttnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\jdddd.exec:\jdddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\1lfffff.exec:\1lfffff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\nhnhnn.exec:\nhnhnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\ttbhtn.exec:\ttbhtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\vpdjp.exec:\vpdjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\9lxrlrl.exec:\9lxrlrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\bthhhb.exec:\bthhhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\rlfrfxl.exec:\rlfrfxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\nbnntn.exec:\nbnntn.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5052 -
\??\c:\ppdjd.exec:\ppdjd.exe24⤵
- Executes dropped EXE
PID:3488 -
\??\c:\bthnbn.exec:\bthnbn.exe25⤵
- Executes dropped EXE
PID:1508 -
\??\c:\jjjjd.exec:\jjjjd.exe26⤵
- Executes dropped EXE
PID:3184 -
\??\c:\9rlrrxx.exec:\9rlrrxx.exe27⤵
- Executes dropped EXE
PID:1364 -
\??\c:\9tnttb.exec:\9tnttb.exe28⤵
- Executes dropped EXE
PID:1912 -
\??\c:\xrllffx.exec:\xrllffx.exe29⤵
- Executes dropped EXE
PID:1272 -
\??\c:\3jpjd.exec:\3jpjd.exe30⤵
- Executes dropped EXE
PID:1476 -
\??\c:\ffffffl.exec:\ffffffl.exe31⤵
- Executes dropped EXE
PID:5080 -
\??\c:\xrrrrrx.exec:\xrrrrrx.exe32⤵
- Executes dropped EXE
PID:2940 -
\??\c:\7rrfxxr.exec:\7rrfxxr.exe33⤵
- Executes dropped EXE
PID:3724 -
\??\c:\jvjdd.exec:\jvjdd.exe34⤵
- Executes dropped EXE
PID:1020 -
\??\c:\5xffxfl.exec:\5xffxfl.exe35⤵
- Executes dropped EXE
PID:2648 -
\??\c:\dpdjv.exec:\dpdjv.exe36⤵
- Executes dropped EXE
PID:2564 -
\??\c:\llrrrff.exec:\llrrrff.exe37⤵
- Executes dropped EXE
PID:4384 -
\??\c:\nbhbbt.exec:\nbhbbt.exe38⤵
- Executes dropped EXE
PID:604 -
\??\c:\pvjjj.exec:\pvjjj.exe39⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9xlrrfl.exec:\9xlrrfl.exe40⤵
- Executes dropped EXE
PID:3716 -
\??\c:\rlffrxl.exec:\rlffrxl.exe41⤵
- Executes dropped EXE
PID:3060 -
\??\c:\bhbbnn.exec:\bhbbnn.exe42⤵
- Executes dropped EXE
PID:4224 -
\??\c:\dpddv.exec:\dpddv.exe43⤵
- Executes dropped EXE
PID:4956 -
\??\c:\ttnnhh.exec:\ttnnhh.exe44⤵
- Executes dropped EXE
PID:2188 -
\??\c:\dvjjd.exec:\dvjjd.exe45⤵
- Executes dropped EXE
PID:4424 -
\??\c:\ffffffx.exec:\ffffffx.exe46⤵
- Executes dropped EXE
PID:4532 -
\??\c:\frlllll.exec:\frlllll.exe47⤵
- Executes dropped EXE
PID:2412 -
\??\c:\3hhhhh.exec:\3hhhhh.exe48⤵
- Executes dropped EXE
PID:2884 -
\??\c:\pvjdd.exec:\pvjdd.exe49⤵
- Executes dropped EXE
PID:2192 -
\??\c:\lflfrrl.exec:\lflfrrl.exe50⤵
- Executes dropped EXE
PID:2752 -
\??\c:\bhhhbh.exec:\bhhhbh.exe51⤵
- Executes dropped EXE
PID:4212 -
\??\c:\9vjjv.exec:\9vjjv.exe52⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xlffrfl.exec:\xlffrfl.exe53⤵
- Executes dropped EXE
PID:400 -
\??\c:\bhhhbb.exec:\bhhhbb.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1592 -
\??\c:\7vddd.exec:\7vddd.exe55⤵
- Executes dropped EXE
PID:1888 -
\??\c:\lllffll.exec:\lllffll.exe56⤵
- Executes dropped EXE
PID:548 -
\??\c:\hhhbnt.exec:\hhhbnt.exe57⤵
- Executes dropped EXE
PID:3940 -
\??\c:\tbnhhh.exec:\tbnhhh.exe58⤵
- Executes dropped EXE
PID:2060 -
\??\c:\jjjjj.exec:\jjjjj.exe59⤵
- Executes dropped EXE
PID:640 -
\??\c:\rffxxxf.exec:\rffxxxf.exe60⤵
- Executes dropped EXE
PID:3360 -
\??\c:\jjddv.exec:\jjddv.exe61⤵
- Executes dropped EXE
PID:880 -
\??\c:\5rrlllf.exec:\5rrlllf.exe62⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nnntnt.exec:\nnntnt.exe63⤵
- Executes dropped EXE
PID:4452 -
\??\c:\pdpdd.exec:\pdpdd.exe64⤵
- Executes dropped EXE
PID:3628 -
\??\c:\xxxrrxx.exec:\xxxrrxx.exe65⤵
- Executes dropped EXE
PID:5064 -
\??\c:\9thhhn.exec:\9thhhn.exe66⤵PID:4944
-
\??\c:\5hhbtt.exec:\5hhbtt.exe67⤵PID:3948
-
\??\c:\vvvvp.exec:\vvvvp.exe68⤵PID:3596
-
\??\c:\rxllfff.exec:\rxllfff.exe69⤵PID:752
-
\??\c:\nnhhht.exec:\nnhhht.exe70⤵PID:1152
-
\??\c:\llllfff.exec:\llllfff.exe71⤵PID:1624
-
\??\c:\hnbhhn.exec:\hnbhhn.exe72⤵PID:1764
-
\??\c:\ntbhnn.exec:\ntbhnn.exe73⤵PID:3920
-
\??\c:\dppvv.exec:\dppvv.exe74⤵PID:2164
-
\??\c:\rffxxxx.exec:\rffxxxx.exe75⤵PID:244
-
\??\c:\7bbbbh.exec:\7bbbbh.exe76⤵PID:388
-
\??\c:\pjppp.exec:\pjppp.exe77⤵PID:3356
-
\??\c:\9xfxrrl.exec:\9xfxrrl.exe78⤵PID:2080
-
\??\c:\bhhntb.exec:\bhhntb.exe79⤵PID:412
-
\??\c:\pjjjj.exec:\pjjjj.exe80⤵PID:4972
-
\??\c:\ffrxflr.exec:\ffrxflr.exe81⤵PID:964
-
\??\c:\nntttb.exec:\nntttb.exe82⤵PID:4204
-
\??\c:\vvpjp.exec:\vvpjp.exe83⤵PID:3504
-
\??\c:\rrxxlfx.exec:\rrxxlfx.exe84⤵PID:2600
-
\??\c:\nntnnn.exec:\nntnnn.exe85⤵PID:1628
-
\??\c:\3vdvp.exec:\3vdvp.exe86⤵PID:3988
-
\??\c:\tnttbb.exec:\tnttbb.exe87⤵PID:3924
-
\??\c:\jvddj.exec:\jvddj.exe88⤵PID:3488
-
\??\c:\ffrrllr.exec:\ffrrllr.exe89⤵PID:1508
-
\??\c:\nbbbbh.exec:\nbbbbh.exe90⤵PID:4552
-
\??\c:\pvvvp.exec:\pvvvp.exe91⤵PID:3408
-
\??\c:\thbntn.exec:\thbntn.exe92⤵PID:3904
-
\??\c:\7ttnhh.exec:\7ttnhh.exe93⤵PID:868
-
\??\c:\jdvjj.exec:\jdvjj.exe94⤵PID:4912
-
\??\c:\fffllrr.exec:\fffllrr.exe95⤵
- System Location Discovery: System Language Discovery
PID:3788 -
\??\c:\btbbbb.exec:\btbbbb.exe96⤵PID:2984
-
\??\c:\dpvvv.exec:\dpvvv.exe97⤵PID:5008
-
\??\c:\rlxflxr.exec:\rlxflxr.exe98⤵PID:4544
-
\??\c:\bnttnn.exec:\bnttnn.exe99⤵PID:1456
-
\??\c:\7nhbtt.exec:\7nhbtt.exe100⤵PID:4916
-
\??\c:\fxxllll.exec:\fxxllll.exe101⤵PID:3724
-
\??\c:\tnnnnt.exec:\tnnnnt.exe102⤵PID:2928
-
\??\c:\hbnthh.exec:\hbnthh.exe103⤵PID:3852
-
\??\c:\dpdvd.exec:\dpdvd.exe104⤵PID:1124
-
\??\c:\7rfxrll.exec:\7rfxrll.exe105⤵PID:2788
-
\??\c:\bhhbnn.exec:\bhhbnn.exe106⤵PID:2628
-
\??\c:\pppjj.exec:\pppjj.exe107⤵PID:4232
-
\??\c:\5vdpj.exec:\5vdpj.exe108⤵PID:1760
-
\??\c:\1frrrrr.exec:\1frrrrr.exe109⤵PID:2488
-
\??\c:\hhbtbt.exec:\hhbtbt.exe110⤵PID:4596
-
\??\c:\vpddd.exec:\vpddd.exe111⤵PID:4068
-
\??\c:\xffxxxr.exec:\xffxxxr.exe112⤵PID:3452
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe113⤵PID:3404
-
\??\c:\vpvvp.exec:\vpvvp.exe114⤵PID:2184
-
\??\c:\vddpv.exec:\vddpv.exe115⤵PID:4428
-
\??\c:\rxllfrf.exec:\rxllfrf.exe116⤵PID:1704
-
\??\c:\bnhbtn.exec:\bnhbtn.exe117⤵PID:3392
-
\??\c:\9flfllf.exec:\9flfllf.exe118⤵PID:1768
-
\??\c:\xlrrllf.exec:\xlrrllf.exe119⤵PID:3252
-
\??\c:\hbhbbb.exec:\hbhbbb.exe120⤵
- System Location Discovery: System Language Discovery
PID:4296 -
\??\c:\7vpdd.exec:\7vpdd.exe121⤵PID:4344
-
\??\c:\1fflxfr.exec:\1fflxfr.exe122⤵PID:216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-