Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 15:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d32cf3b6fb5ff6615bc22c2cde2ce78102fcc7c5b28c996f75b71fbd28706f68N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
d32cf3b6fb5ff6615bc22c2cde2ce78102fcc7c5b28c996f75b71fbd28706f68N.exe
-
Size
456KB
-
MD5
084158837a3339f3957b1f7c035d1e30
-
SHA1
1cb61d1a98e4f80a474e1fb256dffb4597c763d3
-
SHA256
d32cf3b6fb5ff6615bc22c2cde2ce78102fcc7c5b28c996f75b71fbd28706f68
-
SHA512
a55e22642a9dd217695be4f62f49ddf6d714030928fddd521e7a91dc70dd450be271c772f5ef87775f16be3c0bb86f3a016729788ce978c699bb6408aaef6cbb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR2:q7Tc2NYHUrAwfMp3CDR2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3172-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1256-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1840-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3792-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/856-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-607-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-729-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-793-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-800-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-1346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-1368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 100 7pppp.exe 4104 5xxllll.exe 4500 hhtnnt.exe 3168 lflrlrr.exe 4256 9jvvp.exe 1256 7ttnnn.exe 4556 pjvvv.exe 3956 jjpjd.exe 2484 7bhbtt.exe 4280 pjpjj.exe 2436 7jddv.exe 4564 dpjdv.exe 4224 7xrfrff.exe 1472 7hbtnn.exe 2696 9jppp.exe 2432 rlrflll.exe 4868 rllfllr.exe 544 dpddj.exe 3936 rfxrlll.exe 4864 1jdvp.exe 1328 1rxrxxx.exe 5116 vpvpp.exe 3668 tnhhbh.exe 4260 1llllll.exe 1616 rllrrxx.exe 2084 tbbbtt.exe 4432 dpvvp.exe 4392 lxrllff.exe 1668 lllffff.exe 4240 5tnhbh.exe 4752 1xfxxxx.exe 2088 djjjj.exe 1156 rxfffff.exe 4328 jpvvv.exe 2284 5ffxxrr.exe 1684 djpjj.exe 2652 lffxrff.exe 2160 bntbtb.exe 4220 ddppv.exe 1696 llfxffr.exe 4976 hhhbtt.exe 3476 3jvpv.exe 3340 vjjvp.exe 2412 fxrfxxx.exe 2072 1jpjj.exe 4784 ddvvv.exe 4792 fxlfllr.exe 232 bbbbbb.exe 1944 9pddp.exe 4300 1rxxxxr.exe 4288 3tbtnn.exe 3172 vjppp.exe 1840 3jddd.exe 3860 1xfrlrl.exe 3948 bttttb.exe 1876 5vvpj.exe 1764 llrllll.exe 4588 nthbtn.exe 2228 7vvpj.exe 2324 lrfflrx.exe 2300 nhtnhb.exe 5072 pjjdd.exe 1936 fxllfxx.exe 4816 httnhh.exe -
resource yara_rule behavioral2/memory/3172-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1256-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1840-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3792-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/856-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-729-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jppp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3172 wrote to memory of 100 3172 d32cf3b6fb5ff6615bc22c2cde2ce78102fcc7c5b28c996f75b71fbd28706f68N.exe 82 PID 3172 wrote to memory of 100 3172 d32cf3b6fb5ff6615bc22c2cde2ce78102fcc7c5b28c996f75b71fbd28706f68N.exe 82 PID 3172 wrote to memory of 100 3172 d32cf3b6fb5ff6615bc22c2cde2ce78102fcc7c5b28c996f75b71fbd28706f68N.exe 82 PID 100 wrote to memory of 4104 100 7pppp.exe 83 PID 100 wrote to memory of 4104 100 7pppp.exe 83 PID 100 wrote to memory of 4104 100 7pppp.exe 83 PID 4104 wrote to memory of 4500 4104 5xxllll.exe 84 PID 4104 wrote to memory of 4500 4104 5xxllll.exe 84 PID 4104 wrote to memory of 4500 4104 5xxllll.exe 84 PID 4500 wrote to memory of 3168 4500 hhtnnt.exe 85 PID 4500 wrote to memory of 3168 4500 hhtnnt.exe 85 PID 4500 wrote to memory of 3168 4500 hhtnnt.exe 85 PID 3168 wrote to memory of 4256 3168 lflrlrr.exe 86 PID 3168 wrote to memory of 4256 3168 lflrlrr.exe 86 PID 3168 wrote to memory of 4256 3168 lflrlrr.exe 86 PID 4256 wrote to memory of 1256 4256 9jvvp.exe 87 PID 4256 wrote to memory of 1256 4256 9jvvp.exe 87 PID 4256 wrote to memory of 1256 4256 9jvvp.exe 87 PID 1256 wrote to memory of 4556 1256 7ttnnn.exe 88 PID 1256 wrote to memory of 4556 1256 7ttnnn.exe 88 PID 1256 wrote to memory of 4556 1256 7ttnnn.exe 88 PID 4556 wrote to memory of 3956 4556 pjvvv.exe 89 PID 4556 wrote to memory of 3956 4556 pjvvv.exe 89 PID 4556 wrote to memory of 3956 4556 pjvvv.exe 89 PID 3956 wrote to memory of 2484 3956 jjpjd.exe 90 PID 3956 wrote to memory of 2484 3956 jjpjd.exe 90 PID 3956 wrote to memory of 2484 3956 jjpjd.exe 90 PID 2484 wrote to memory of 4280 2484 7bhbtt.exe 91 PID 2484 wrote to memory of 4280 2484 7bhbtt.exe 91 PID 2484 wrote to memory of 4280 2484 7bhbtt.exe 91 PID 4280 wrote to memory of 2436 4280 pjpjj.exe 92 PID 4280 wrote to memory of 2436 4280 pjpjj.exe 92 PID 4280 wrote to memory of 2436 4280 pjpjj.exe 92 PID 2436 wrote to memory of 4564 2436 7jddv.exe 93 PID 2436 wrote to memory of 4564 2436 7jddv.exe 93 PID 2436 wrote to memory of 4564 2436 7jddv.exe 93 PID 4564 wrote to memory of 4224 4564 dpjdv.exe 94 PID 4564 wrote to memory of 4224 4564 dpjdv.exe 94 PID 4564 wrote to memory of 4224 4564 dpjdv.exe 94 PID 4224 wrote to memory of 1472 4224 7xrfrff.exe 95 PID 4224 wrote to memory of 1472 4224 7xrfrff.exe 95 PID 4224 wrote to memory of 1472 4224 7xrfrff.exe 95 PID 1472 wrote to memory of 2696 1472 7hbtnn.exe 96 PID 1472 wrote to memory of 2696 1472 7hbtnn.exe 96 PID 1472 wrote to memory of 2696 1472 7hbtnn.exe 96 PID 2696 wrote to memory of 2432 2696 9jppp.exe 97 PID 2696 wrote to memory of 2432 2696 9jppp.exe 97 PID 2696 wrote to memory of 2432 2696 9jppp.exe 97 PID 2432 wrote to memory of 4868 2432 rlrflll.exe 98 PID 2432 wrote to memory of 4868 2432 rlrflll.exe 98 PID 2432 wrote to memory of 4868 2432 rlrflll.exe 98 PID 4868 wrote to memory of 544 4868 rllfllr.exe 99 PID 4868 wrote to memory of 544 4868 rllfllr.exe 99 PID 4868 wrote to memory of 544 4868 rllfllr.exe 99 PID 544 wrote to memory of 3936 544 dpddj.exe 100 PID 544 wrote to memory of 3936 544 dpddj.exe 100 PID 544 wrote to memory of 3936 544 dpddj.exe 100 PID 3936 wrote to memory of 4864 3936 rfxrlll.exe 101 PID 3936 wrote to memory of 4864 3936 rfxrlll.exe 101 PID 3936 wrote to memory of 4864 3936 rfxrlll.exe 101 PID 4864 wrote to memory of 1328 4864 1jdvp.exe 102 PID 4864 wrote to memory of 1328 4864 1jdvp.exe 102 PID 4864 wrote to memory of 1328 4864 1jdvp.exe 102 PID 1328 wrote to memory of 5116 1328 1rxrxxx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\d32cf3b6fb5ff6615bc22c2cde2ce78102fcc7c5b28c996f75b71fbd28706f68N.exe"C:\Users\Admin\AppData\Local\Temp\d32cf3b6fb5ff6615bc22c2cde2ce78102fcc7c5b28c996f75b71fbd28706f68N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\7pppp.exec:\7pppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\5xxllll.exec:\5xxllll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\hhtnnt.exec:\hhtnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\lflrlrr.exec:\lflrlrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\9jvvp.exec:\9jvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\7ttnnn.exec:\7ttnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\pjvvv.exec:\pjvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\jjpjd.exec:\jjpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\7bhbtt.exec:\7bhbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\pjpjj.exec:\pjpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\7jddv.exec:\7jddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\dpjdv.exec:\dpjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\7xrfrff.exec:\7xrfrff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\7hbtnn.exec:\7hbtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\9jppp.exec:\9jppp.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\rlrflll.exec:\rlrflll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\rllfllr.exec:\rllfllr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\dpddj.exec:\dpddj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\rfxrlll.exec:\rfxrlll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\1jdvp.exec:\1jdvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\1rxrxxx.exec:\1rxrxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\vpvpp.exec:\vpvpp.exe23⤵
- Executes dropped EXE
PID:5116 -
\??\c:\tnhhbh.exec:\tnhhbh.exe24⤵
- Executes dropped EXE
PID:3668 -
\??\c:\1llllll.exec:\1llllll.exe25⤵
- Executes dropped EXE
PID:4260 -
\??\c:\rllrrxx.exec:\rllrrxx.exe26⤵
- Executes dropped EXE
PID:1616 -
\??\c:\tbbbtt.exec:\tbbbtt.exe27⤵
- Executes dropped EXE
PID:2084 -
\??\c:\dpvvp.exec:\dpvvp.exe28⤵
- Executes dropped EXE
PID:4432 -
\??\c:\lxrllff.exec:\lxrllff.exe29⤵
- Executes dropped EXE
PID:4392 -
\??\c:\lllffff.exec:\lllffff.exe30⤵
- Executes dropped EXE
PID:1668 -
\??\c:\5tnhbh.exec:\5tnhbh.exe31⤵
- Executes dropped EXE
PID:4240 -
\??\c:\1xfxxxx.exec:\1xfxxxx.exe32⤵
- Executes dropped EXE
PID:4752 -
\??\c:\djjjj.exec:\djjjj.exe33⤵
- Executes dropped EXE
PID:2088 -
\??\c:\rxfffff.exec:\rxfffff.exe34⤵
- Executes dropped EXE
PID:1156 -
\??\c:\jpvvv.exec:\jpvvv.exe35⤵
- Executes dropped EXE
PID:4328 -
\??\c:\5ffxxrr.exec:\5ffxxrr.exe36⤵
- Executes dropped EXE
PID:2284 -
\??\c:\djpjj.exec:\djpjj.exe37⤵
- Executes dropped EXE
PID:1684 -
\??\c:\lffxrff.exec:\lffxrff.exe38⤵
- Executes dropped EXE
PID:2652 -
\??\c:\bntbtb.exec:\bntbtb.exe39⤵
- Executes dropped EXE
PID:2160 -
\??\c:\ddppv.exec:\ddppv.exe40⤵
- Executes dropped EXE
PID:4220 -
\??\c:\llfxffr.exec:\llfxffr.exe41⤵
- Executes dropped EXE
PID:1696 -
\??\c:\hhhbtt.exec:\hhhbtt.exe42⤵
- Executes dropped EXE
PID:4976 -
\??\c:\3jvpv.exec:\3jvpv.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3476 -
\??\c:\vjjvp.exec:\vjjvp.exe44⤵
- Executes dropped EXE
PID:3340 -
\??\c:\fxrfxxx.exec:\fxrfxxx.exe45⤵
- Executes dropped EXE
PID:2412 -
\??\c:\1jpjj.exec:\1jpjj.exe46⤵
- Executes dropped EXE
PID:2072 -
\??\c:\ddvvv.exec:\ddvvv.exe47⤵
- Executes dropped EXE
PID:4784 -
\??\c:\fxlfllr.exec:\fxlfllr.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4792 -
\??\c:\bbbbbb.exec:\bbbbbb.exe49⤵
- Executes dropped EXE
PID:232 -
\??\c:\9pddp.exec:\9pddp.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1944 -
\??\c:\1rxxxxr.exec:\1rxxxxr.exe51⤵
- Executes dropped EXE
PID:4300 -
\??\c:\3tbtnn.exec:\3tbtnn.exe52⤵
- Executes dropped EXE
PID:4288 -
\??\c:\vjppp.exec:\vjppp.exe53⤵
- Executes dropped EXE
PID:3172 -
\??\c:\3jddd.exec:\3jddd.exe54⤵
- Executes dropped EXE
PID:1840 -
\??\c:\1xfrlrl.exec:\1xfrlrl.exe55⤵
- Executes dropped EXE
PID:3860 -
\??\c:\bttttb.exec:\bttttb.exe56⤵
- Executes dropped EXE
PID:3948 -
\??\c:\5vvpj.exec:\5vvpj.exe57⤵
- Executes dropped EXE
PID:1876 -
\??\c:\llrllll.exec:\llrllll.exe58⤵
- Executes dropped EXE
PID:1764 -
\??\c:\nthbtn.exec:\nthbtn.exe59⤵
- Executes dropped EXE
PID:4588 -
\??\c:\7vvpj.exec:\7vvpj.exe60⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lrfflrx.exec:\lrfflrx.exe61⤵
- Executes dropped EXE
PID:2324 -
\??\c:\nhtnhb.exec:\nhtnhb.exe62⤵
- Executes dropped EXE
PID:2300 -
\??\c:\pjjdd.exec:\pjjdd.exe63⤵
- Executes dropped EXE
PID:5072 -
\??\c:\fxllfxx.exec:\fxllfxx.exe64⤵
- Executes dropped EXE
PID:1936 -
\??\c:\httnhh.exec:\httnhh.exe65⤵
- Executes dropped EXE
PID:4816 -
\??\c:\ppppp.exec:\ppppp.exe66⤵PID:2484
-
\??\c:\jvdjj.exec:\jvdjj.exe67⤵PID:996
-
\??\c:\rlxlffx.exec:\rlxlffx.exe68⤵PID:1872
-
\??\c:\3hhbhh.exec:\3hhbhh.exe69⤵PID:4884
-
\??\c:\1dddv.exec:\1dddv.exe70⤵PID:3064
-
\??\c:\vppvp.exec:\vppvp.exe71⤵PID:3852
-
\??\c:\rlrlrlr.exec:\rlrlrlr.exe72⤵PID:676
-
\??\c:\5ntnnn.exec:\5ntnnn.exe73⤵PID:5012
-
\??\c:\jjjjj.exec:\jjjjj.exe74⤵
- System Location Discovery: System Language Discovery
PID:3776 -
\??\c:\fxllffx.exec:\fxllffx.exe75⤵PID:4712
-
\??\c:\hhhhbb.exec:\hhhhbb.exe76⤵PID:2452
-
\??\c:\9hnhbb.exec:\9hnhbb.exe77⤵PID:1132
-
\??\c:\jddvp.exec:\jddvp.exe78⤵PID:4768
-
\??\c:\flfxxxr.exec:\flfxxxr.exe79⤵PID:2424
-
\??\c:\tbnhhh.exec:\tbnhhh.exe80⤵
- System Location Discovery: System Language Discovery
PID:1348 -
\??\c:\ppvpp.exec:\ppvpp.exe81⤵PID:1960
-
\??\c:\fffxlfl.exec:\fffxlfl.exe82⤵PID:1268
-
\??\c:\nthhhh.exec:\nthhhh.exe83⤵PID:3708
-
\??\c:\5pvdd.exec:\5pvdd.exe84⤵PID:5116
-
\??\c:\fxxrrll.exec:\fxxrrll.exe85⤵PID:2828
-
\??\c:\9lrrlff.exec:\9lrrlff.exe86⤵PID:3448
-
\??\c:\dvdvp.exec:\dvdvp.exe87⤵PID:1644
-
\??\c:\9jpjj.exec:\9jpjj.exe88⤵PID:4384
-
\??\c:\xflfxrr.exec:\xflfxrr.exe89⤵PID:2444
-
\??\c:\bhhthh.exec:\bhhthh.exe90⤵PID:1612
-
\??\c:\3dvdv.exec:\3dvdv.exe91⤵PID:376
-
\??\c:\xllfxrl.exec:\xllfxrl.exe92⤵PID:4476
-
\??\c:\htntnn.exec:\htntnn.exe93⤵PID:4560
-
\??\c:\pjjvp.exec:\pjjvp.exe94⤵PID:3792
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe95⤵PID:4480
-
\??\c:\bbttnn.exec:\bbttnn.exe96⤵PID:4364
-
\??\c:\9pjdd.exec:\9pjdd.exe97⤵PID:3556
-
\??\c:\xflfxxx.exec:\xflfxxx.exe98⤵PID:4760
-
\??\c:\bntnhh.exec:\bntnhh.exe99⤵PID:2280
-
\??\c:\nnbtth.exec:\nnbtth.exe100⤵PID:1048
-
\??\c:\dvjvp.exec:\dvjvp.exe101⤵PID:2820
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe102⤵PID:3888
-
\??\c:\9nbtbb.exec:\9nbtbb.exe103⤵PID:2652
-
\??\c:\5vvpp.exec:\5vvpp.exe104⤵PID:4448
-
\??\c:\pvppp.exec:\pvppp.exe105⤵PID:4220
-
\??\c:\5flfxxr.exec:\5flfxxr.exe106⤵PID:4856
-
\??\c:\3nhbbt.exec:\3nhbbt.exe107⤵PID:3408
-
\??\c:\nhhnnn.exec:\nhhnnn.exe108⤵PID:4796
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe109⤵PID:5068
-
\??\c:\9ffxxxx.exec:\9ffxxxx.exe110⤵PID:2412
-
\??\c:\nnhbnn.exec:\nnhbnn.exe111⤵PID:5028
-
\??\c:\ppppv.exec:\ppppv.exe112⤵PID:856
-
\??\c:\5lrxrxr.exec:\5lrxrxr.exe113⤵PID:4756
-
\??\c:\nbhbbb.exec:\nbhbbb.exe114⤵PID:2956
-
\??\c:\ppvpp.exec:\ppvpp.exe115⤵PID:4436
-
\??\c:\xxffxxl.exec:\xxffxxl.exe116⤵PID:4304
-
\??\c:\hbnnnn.exec:\hbnnnn.exe117⤵PID:3536
-
\??\c:\vpvpv.exec:\vpvpv.exe118⤵PID:100
-
\??\c:\jjvpp.exec:\jjvpp.exe119⤵PID:1308
-
\??\c:\3bhnnt.exec:\3bhnnt.exe120⤵PID:3860
-
\??\c:\vvddd.exec:\vvddd.exe121⤵PID:2712
-
\??\c:\pddvp.exec:\pddvp.exe122⤵PID:4272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-