Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 17:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe
-
Size
453KB
-
MD5
5371c3a06b6d83729c37424b9e530779
-
SHA1
20437b26ae33536fa4a6ed40a3fde9daedf11d4a
-
SHA256
8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051
-
SHA512
9ce002f23ee512d45eac1003c9fddffef9cf1471771985248d9bc88556099de427362e4e23bbe0d358624570d438384e85229f42bc82417dc86516a4a4b08972
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1804-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/688-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/932-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2988-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1348-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/768-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2196-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-655-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-960-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-1247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-1398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-1549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2312 ddpjj.exe 3392 bthhnh.exe 2080 rrrlfff.exe 3188 bbhhbh.exe 3480 xrfflxf.exe 5044 hbhnhh.exe 3624 rlfxxfr.exe 760 tnbttt.exe 1972 3flxffl.exe 4168 3ttnhb.exe 3524 pjdvd.exe 3252 xrffffr.exe 2164 bthbbb.exe 2716 hhbbtn.exe 2596 jjpjj.exe 688 lfffxrx.exe 2848 btbbhh.exe 532 xxffxff.exe 700 5djjp.exe 4896 rxxlxlx.exe 2800 hhhbtt.exe 2464 jjjdd.exe 3756 xxrllff.exe 4580 vpjdd.exe 548 ffffffx.exe 2348 ffxrllf.exe 4748 hnbtnn.exe 2336 vjpjj.exe 3492 fxxfxxf.exe 3056 nntntt.exe 3984 dvdvv.exe 4832 jvdvp.exe 2556 xllrrlr.exe 1152 9tbtbb.exe 3940 pdddv.exe 1712 frrlfxx.exe 4548 btttbb.exe 4372 1ntnhn.exe 2648 vvjpd.exe 3424 rxrrrlf.exe 2528 nhhbhh.exe 4568 lffxxxr.exe 932 nhhbhb.exe 1432 vjjjd.exe 3964 pjjdd.exe 4304 9rlfrfx.exe 5104 bntnhb.exe 4376 3ddvp.exe 436 1fffxxx.exe 2728 bhnhbb.exe 468 9pvvv.exe 5112 xxlflfl.exe 4180 nhnntn.exe 2268 9tbtnt.exe 3972 djjvp.exe 1576 lxxxlxx.exe 2980 hbbbbb.exe 2780 vpvpj.exe 3500 lxrllll.exe 4500 lllrrll.exe 4088 hnbnth.exe 3368 vjpjv.exe 2988 lflfxxl.exe 3404 hhhbnn.exe -
resource yara_rule behavioral2/memory/1804-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/688-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/932-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1432-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2988-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1348-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/768-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1100-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-687-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxlfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhnb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1804 wrote to memory of 2312 1804 8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe 82 PID 1804 wrote to memory of 2312 1804 8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe 82 PID 1804 wrote to memory of 2312 1804 8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe 82 PID 2312 wrote to memory of 3392 2312 ddpjj.exe 83 PID 2312 wrote to memory of 3392 2312 ddpjj.exe 83 PID 2312 wrote to memory of 3392 2312 ddpjj.exe 83 PID 3392 wrote to memory of 2080 3392 bthhnh.exe 84 PID 3392 wrote to memory of 2080 3392 bthhnh.exe 84 PID 3392 wrote to memory of 2080 3392 bthhnh.exe 84 PID 2080 wrote to memory of 3188 2080 rrrlfff.exe 85 PID 2080 wrote to memory of 3188 2080 rrrlfff.exe 85 PID 2080 wrote to memory of 3188 2080 rrrlfff.exe 85 PID 3188 wrote to memory of 3480 3188 bbhhbh.exe 86 PID 3188 wrote to memory of 3480 3188 bbhhbh.exe 86 PID 3188 wrote to memory of 3480 3188 bbhhbh.exe 86 PID 3480 wrote to memory of 5044 3480 xrfflxf.exe 87 PID 3480 wrote to memory of 5044 3480 xrfflxf.exe 87 PID 3480 wrote to memory of 5044 3480 xrfflxf.exe 87 PID 5044 wrote to memory of 3624 5044 hbhnhh.exe 88 PID 5044 wrote to memory of 3624 5044 hbhnhh.exe 88 PID 5044 wrote to memory of 3624 5044 hbhnhh.exe 88 PID 3624 wrote to memory of 760 3624 rlfxxfr.exe 89 PID 3624 wrote to memory of 760 3624 rlfxxfr.exe 89 PID 3624 wrote to memory of 760 3624 rlfxxfr.exe 89 PID 760 wrote to memory of 1972 760 tnbttt.exe 90 PID 760 wrote to memory of 1972 760 tnbttt.exe 90 PID 760 wrote to memory of 1972 760 tnbttt.exe 90 PID 1972 wrote to memory of 4168 1972 3flxffl.exe 91 PID 1972 wrote to memory of 4168 1972 3flxffl.exe 91 PID 1972 wrote to memory of 4168 1972 3flxffl.exe 91 PID 4168 wrote to memory of 3524 4168 3ttnhb.exe 92 PID 4168 wrote to memory of 3524 4168 3ttnhb.exe 92 PID 4168 wrote to memory of 3524 4168 3ttnhb.exe 92 PID 3524 wrote to memory of 3252 3524 pjdvd.exe 93 PID 3524 wrote to memory of 3252 3524 pjdvd.exe 93 PID 3524 wrote to memory of 3252 3524 pjdvd.exe 93 PID 3252 wrote to memory of 2164 3252 xrffffr.exe 94 PID 3252 wrote to memory of 2164 3252 xrffffr.exe 94 PID 3252 wrote to memory of 2164 3252 xrffffr.exe 94 PID 2164 wrote to memory of 2716 2164 bthbbb.exe 95 PID 2164 wrote to memory of 2716 2164 bthbbb.exe 95 PID 2164 wrote to memory of 2716 2164 bthbbb.exe 95 PID 2716 wrote to memory of 2596 2716 hhbbtn.exe 96 PID 2716 wrote to memory of 2596 2716 hhbbtn.exe 96 PID 2716 wrote to memory of 2596 2716 hhbbtn.exe 96 PID 2596 wrote to memory of 688 2596 jjpjj.exe 97 PID 2596 wrote to memory of 688 2596 jjpjj.exe 97 PID 2596 wrote to memory of 688 2596 jjpjj.exe 97 PID 688 wrote to memory of 2848 688 lfffxrx.exe 98 PID 688 wrote to memory of 2848 688 lfffxrx.exe 98 PID 688 wrote to memory of 2848 688 lfffxrx.exe 98 PID 2848 wrote to memory of 532 2848 btbbhh.exe 99 PID 2848 wrote to memory of 532 2848 btbbhh.exe 99 PID 2848 wrote to memory of 532 2848 btbbhh.exe 99 PID 532 wrote to memory of 700 532 xxffxff.exe 100 PID 532 wrote to memory of 700 532 xxffxff.exe 100 PID 532 wrote to memory of 700 532 xxffxff.exe 100 PID 700 wrote to memory of 4896 700 5djjp.exe 101 PID 700 wrote to memory of 4896 700 5djjp.exe 101 PID 700 wrote to memory of 4896 700 5djjp.exe 101 PID 4896 wrote to memory of 2800 4896 rxxlxlx.exe 102 PID 4896 wrote to memory of 2800 4896 rxxlxlx.exe 102 PID 4896 wrote to memory of 2800 4896 rxxlxlx.exe 102 PID 2800 wrote to memory of 2464 2800 hhhbtt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe"C:\Users\Admin\AppData\Local\Temp\8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\ddpjj.exec:\ddpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\bthhnh.exec:\bthhnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\rrrlfff.exec:\rrrlfff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\bbhhbh.exec:\bbhhbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\xrfflxf.exec:\xrfflxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\hbhnhh.exec:\hbhnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\rlfxxfr.exec:\rlfxxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\tnbttt.exec:\tnbttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\3flxffl.exec:\3flxffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\3ttnhb.exec:\3ttnhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\pjdvd.exec:\pjdvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\xrffffr.exec:\xrffffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\bthbbb.exec:\bthbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\hhbbtn.exec:\hhbbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\jjpjj.exec:\jjpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\lfffxrx.exec:\lfffxrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\btbbhh.exec:\btbbhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\xxffxff.exec:\xxffxff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\5djjp.exec:\5djjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\rxxlxlx.exec:\rxxlxlx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\hhhbtt.exec:\hhhbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\jjjdd.exec:\jjjdd.exe23⤵
- Executes dropped EXE
PID:2464 -
\??\c:\xxrllff.exec:\xxrllff.exe24⤵
- Executes dropped EXE
PID:3756 -
\??\c:\vpjdd.exec:\vpjdd.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4580 -
\??\c:\ffffffx.exec:\ffffffx.exe26⤵
- Executes dropped EXE
PID:548 -
\??\c:\ffxrllf.exec:\ffxrllf.exe27⤵
- Executes dropped EXE
PID:2348 -
\??\c:\hnbtnn.exec:\hnbtnn.exe28⤵
- Executes dropped EXE
PID:4748 -
\??\c:\vjpjj.exec:\vjpjj.exe29⤵
- Executes dropped EXE
PID:2336 -
\??\c:\fxxfxxf.exec:\fxxfxxf.exe30⤵
- Executes dropped EXE
PID:3492 -
\??\c:\nntntt.exec:\nntntt.exe31⤵
- Executes dropped EXE
PID:3056 -
\??\c:\dvdvv.exec:\dvdvv.exe32⤵
- Executes dropped EXE
PID:3984 -
\??\c:\jvdvp.exec:\jvdvp.exe33⤵
- Executes dropped EXE
PID:4832 -
\??\c:\xllrrlr.exec:\xllrrlr.exe34⤵
- Executes dropped EXE
PID:2556 -
\??\c:\9tbtbb.exec:\9tbtbb.exe35⤵
- Executes dropped EXE
PID:1152 -
\??\c:\pdddv.exec:\pdddv.exe36⤵
- Executes dropped EXE
PID:3940 -
\??\c:\frrlfxx.exec:\frrlfxx.exe37⤵
- Executes dropped EXE
PID:1712 -
\??\c:\btttbb.exec:\btttbb.exe38⤵
- Executes dropped EXE
PID:4548 -
\??\c:\1ntnhn.exec:\1ntnhn.exe39⤵
- Executes dropped EXE
PID:4372 -
\??\c:\vvjpd.exec:\vvjpd.exe40⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rxrrrlf.exec:\rxrrrlf.exe41⤵
- Executes dropped EXE
PID:3424 -
\??\c:\nhhbhh.exec:\nhhbhh.exe42⤵
- Executes dropped EXE
PID:2528 -
\??\c:\lffxxxr.exec:\lffxxxr.exe43⤵
- Executes dropped EXE
PID:4568 -
\??\c:\nhhbhb.exec:\nhhbhb.exe44⤵
- Executes dropped EXE
PID:932 -
\??\c:\vjjjd.exec:\vjjjd.exe45⤵
- Executes dropped EXE
PID:1432 -
\??\c:\pjjdd.exec:\pjjdd.exe46⤵
- Executes dropped EXE
PID:3964 -
\??\c:\9rlfrfx.exec:\9rlfrfx.exe47⤵
- Executes dropped EXE
PID:4304 -
\??\c:\bntnhb.exec:\bntnhb.exe48⤵
- Executes dropped EXE
PID:5104 -
\??\c:\3ddvp.exec:\3ddvp.exe49⤵
- Executes dropped EXE
PID:4376 -
\??\c:\1fffxxx.exec:\1fffxxx.exe50⤵
- Executes dropped EXE
PID:436 -
\??\c:\bhnhbb.exec:\bhnhbb.exe51⤵
- Executes dropped EXE
PID:2728 -
\??\c:\9pvvv.exec:\9pvvv.exe52⤵
- Executes dropped EXE
PID:468 -
\??\c:\xxlflfl.exec:\xxlflfl.exe53⤵
- Executes dropped EXE
PID:5112 -
\??\c:\nhnntn.exec:\nhnntn.exe54⤵
- Executes dropped EXE
PID:4180 -
\??\c:\9tbtnt.exec:\9tbtnt.exe55⤵
- Executes dropped EXE
PID:2268 -
\??\c:\djjvp.exec:\djjvp.exe56⤵
- Executes dropped EXE
PID:3972 -
\??\c:\lxxxlxx.exec:\lxxxlxx.exe57⤵
- Executes dropped EXE
PID:1576 -
\??\c:\hbbbbb.exec:\hbbbbb.exe58⤵
- Executes dropped EXE
PID:2980 -
\??\c:\vpvpj.exec:\vpvpj.exe59⤵
- Executes dropped EXE
PID:2780 -
\??\c:\lxrllll.exec:\lxrllll.exe60⤵
- Executes dropped EXE
PID:3500 -
\??\c:\lllrrll.exec:\lllrrll.exe61⤵
- Executes dropped EXE
PID:4500 -
\??\c:\hnbnth.exec:\hnbnth.exe62⤵
- Executes dropped EXE
PID:4088 -
\??\c:\vjpjv.exec:\vjpjv.exe63⤵
- Executes dropped EXE
PID:3368 -
\??\c:\lflfxxl.exec:\lflfxxl.exe64⤵
- Executes dropped EXE
PID:2988 -
\??\c:\hhhbnn.exec:\hhhbnn.exe65⤵
- Executes dropped EXE
PID:3404 -
\??\c:\1vvjd.exec:\1vvjd.exe66⤵PID:1092
-
\??\c:\7ddpj.exec:\7ddpj.exe67⤵PID:4668
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe68⤵PID:1928
-
\??\c:\3hhtnh.exec:\3hhtnh.exe69⤵PID:5116
-
\??\c:\7dpjd.exec:\7dpjd.exe70⤵PID:4940
-
\??\c:\pdvjd.exec:\pdvjd.exe71⤵PID:1944
-
\??\c:\fflxrlf.exec:\fflxrlf.exe72⤵PID:2596
-
\??\c:\btthbb.exec:\btthbb.exe73⤵PID:688
-
\??\c:\thtnhb.exec:\thtnhb.exe74⤵PID:1428
-
\??\c:\3ppjd.exec:\3ppjd.exe75⤵PID:1348
-
\??\c:\lllfxrl.exec:\lllfxrl.exe76⤵PID:3432
-
\??\c:\lflflfl.exec:\lflflfl.exe77⤵PID:700
-
\??\c:\nhtnht.exec:\nhtnht.exe78⤵PID:2644
-
\??\c:\7vvjd.exec:\7vvjd.exe79⤵PID:2800
-
\??\c:\flrlffr.exec:\flrlffr.exe80⤵PID:2392
-
\??\c:\7htntt.exec:\7htntt.exe81⤵PID:2464
-
\??\c:\httbtn.exec:\httbtn.exe82⤵PID:2264
-
\??\c:\djdpj.exec:\djdpj.exe83⤵PID:3180
-
\??\c:\xffrllf.exec:\xffrllf.exe84⤵PID:1620
-
\??\c:\7tbtbb.exec:\7tbtbb.exe85⤵PID:4588
-
\??\c:\djvpp.exec:\djvpp.exe86⤵PID:1760
-
\??\c:\vvjjd.exec:\vvjjd.exe87⤵PID:876
-
\??\c:\fxfxlfr.exec:\fxfxlfr.exe88⤵PID:432
-
\??\c:\flxrllf.exec:\flxrllf.exe89⤵PID:1212
-
\??\c:\bnnhtn.exec:\bnnhtn.exe90⤵PID:2544
-
\??\c:\jjvdp.exec:\jjvdp.exe91⤵PID:1824
-
\??\c:\lffxrlf.exec:\lffxrlf.exe92⤵PID:2640
-
\??\c:\1bbttt.exec:\1bbttt.exe93⤵PID:640
-
\??\c:\jdpjj.exec:\jdpjj.exe94⤵PID:1196
-
\??\c:\lxrrflf.exec:\lxrrflf.exe95⤵PID:1152
-
\??\c:\xlfxrlx.exec:\xlfxrlx.exe96⤵PID:2200
-
\??\c:\tnttnh.exec:\tnttnh.exe97⤵PID:3940
-
\??\c:\7pppj.exec:\7pppj.exe98⤵PID:3668
-
\??\c:\7xrlrlf.exec:\7xrlrlf.exe99⤵PID:2168
-
\??\c:\thnbtn.exec:\thnbtn.exe100⤵PID:4372
-
\??\c:\pdjjd.exec:\pdjjd.exe101⤵PID:3264
-
\??\c:\frxflfl.exec:\frxflfl.exe102⤵PID:1664
-
\??\c:\xrrfxxr.exec:\xrrfxxr.exe103⤵PID:1568
-
\??\c:\5hbtnn.exec:\5hbtnn.exe104⤵PID:4568
-
\??\c:\5vvjj.exec:\5vvjj.exe105⤵PID:932
-
\??\c:\djjdj.exec:\djjdj.exe106⤵PID:5048
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe107⤵PID:3396
-
\??\c:\bthhbb.exec:\bthhbb.exe108⤵PID:1248
-
\??\c:\nntttn.exec:\nntttn.exe109⤵PID:644
-
\??\c:\5ppvd.exec:\5ppvd.exe110⤵PID:4592
-
\??\c:\rllfxxx.exec:\rllfxxx.exe111⤵PID:4376
-
\??\c:\7ntnbb.exec:\7ntnbb.exe112⤵PID:436
-
\??\c:\7hnhht.exec:\7hnhht.exe113⤵PID:540
-
\??\c:\9ppvv.exec:\9ppvv.exe114⤵PID:468
-
\??\c:\flrflrl.exec:\flrflrl.exe115⤵PID:4560
-
\??\c:\thnhhh.exec:\thnhhh.exe116⤵PID:4228
-
\??\c:\djpjj.exec:\djpjj.exe117⤵PID:2268
-
\??\c:\flrlxrl.exec:\flrlxrl.exe118⤵PID:3972
-
\??\c:\fxfxxrx.exec:\fxfxxrx.exe119⤵PID:1576
-
\??\c:\ttthbt.exec:\ttthbt.exe120⤵PID:2980
-
\??\c:\jppjd.exec:\jppjd.exe121⤵PID:1572
-
\??\c:\xrxrlfx.exec:\xrxrlfx.exe122⤵PID:4504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-