Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 18:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8f031300ac905803b26dfc208ff4ccf8ea6fccfcfe3ebbd7eeb863b016070faeN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
8f031300ac905803b26dfc208ff4ccf8ea6fccfcfe3ebbd7eeb863b016070faeN.exe
-
Size
455KB
-
MD5
ffbd551f4f4908b273d99f7fba1530a0
-
SHA1
5676726e87e07e574d9f7818ef12ef1de3997f53
-
SHA256
8f031300ac905803b26dfc208ff4ccf8ea6fccfcfe3ebbd7eeb863b016070fae
-
SHA512
9adaf6f6f31f2f04d2cb8e452a9d51f018c458eaac8326c49a8139fa2f9620f14208087c78c0f6d066225608500a9c99b4a79d4f43f6e7c2fa72224d5b559929
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeL:q7Tc2NYHUrAwfMp3CDL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3708-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3848-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/648-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4248-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/816-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1328-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2504-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/460-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/720-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-739-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-779-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3752-792-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-845-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-936-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-1081-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1856-1184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2156 jvpjv.exe 3536 3tnhbb.exe 3848 djpdv.exe 4904 djdvj.exe 4960 9hhttb.exe 4504 djjdv.exe 2292 nttnhb.exe 3116 lfllrlr.exe 3820 bhnhbt.exe 3176 btnhbn.exe 4564 5nhtnh.exe 3868 rlrxlfr.exe 648 1bttnn.exe 1992 ppdjv.exe 2432 thhhbh.exe 388 dddvp.exe 1956 vjpdv.exe 2520 rlfxlfx.exe 632 9vvpd.exe 4916 3vpdj.exe 1944 rlfrfxr.exe 4628 nbbthh.exe 4164 frfrlfx.exe 884 tnthbt.exe 64 xfxlfrf.exe 4844 1ppdv.exe 4936 btnhbt.exe 3580 nthhhh.exe 2492 5flxfrx.exe 1108 hhbbbt.exe 3752 xrxxxrx.exe 2300 5rrlffx.exe 1528 7vvpj.exe 3244 fxrlrlf.exe 3200 nhnhhh.exe 3304 jvddd.exe 4248 rfllfff.exe 5044 bththb.exe 532 bttnnn.exe 3488 jdpjj.exe 816 rlxrrxf.exe 1532 5hbtbb.exe 4728 vjpjd.exe 1328 dpddv.exe 780 5xrrffx.exe 2504 tntnnn.exe 3392 dvddv.exe 460 rllfxxr.exe 4352 htnhtt.exe 4324 jjjdd.exe 3708 jdvvp.exe 4776 lflfxff.exe 224 nhhbtn.exe 1960 3hhnnt.exe 4408 vjvpp.exe 228 xrrrrxx.exe 3188 tbnhbh.exe 2128 9jjdv.exe 684 jdvpd.exe 4708 rflfrfx.exe 3444 hhnnhh.exe 1700 hbbtnn.exe 3820 9jjdj.exe 4784 rlrlfff.exe -
resource yara_rule behavioral2/memory/3708-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3848-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/648-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1108-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/816-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2504-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/460-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/720-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-779-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-792-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-845-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-936-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-1081-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3708 wrote to memory of 2156 3708 8f031300ac905803b26dfc208ff4ccf8ea6fccfcfe3ebbd7eeb863b016070faeN.exe 82 PID 3708 wrote to memory of 2156 3708 8f031300ac905803b26dfc208ff4ccf8ea6fccfcfe3ebbd7eeb863b016070faeN.exe 82 PID 3708 wrote to memory of 2156 3708 8f031300ac905803b26dfc208ff4ccf8ea6fccfcfe3ebbd7eeb863b016070faeN.exe 82 PID 2156 wrote to memory of 3536 2156 jvpjv.exe 83 PID 2156 wrote to memory of 3536 2156 jvpjv.exe 83 PID 2156 wrote to memory of 3536 2156 jvpjv.exe 83 PID 3536 wrote to memory of 3848 3536 3tnhbb.exe 84 PID 3536 wrote to memory of 3848 3536 3tnhbb.exe 84 PID 3536 wrote to memory of 3848 3536 3tnhbb.exe 84 PID 3848 wrote to memory of 4904 3848 djpdv.exe 85 PID 3848 wrote to memory of 4904 3848 djpdv.exe 85 PID 3848 wrote to memory of 4904 3848 djpdv.exe 85 PID 4904 wrote to memory of 4960 4904 djdvj.exe 86 PID 4904 wrote to memory of 4960 4904 djdvj.exe 86 PID 4904 wrote to memory of 4960 4904 djdvj.exe 86 PID 4960 wrote to memory of 4504 4960 9hhttb.exe 87 PID 4960 wrote to memory of 4504 4960 9hhttb.exe 87 PID 4960 wrote to memory of 4504 4960 9hhttb.exe 87 PID 4504 wrote to memory of 2292 4504 djjdv.exe 88 PID 4504 wrote to memory of 2292 4504 djjdv.exe 88 PID 4504 wrote to memory of 2292 4504 djjdv.exe 88 PID 2292 wrote to memory of 3116 2292 nttnhb.exe 89 PID 2292 wrote to memory of 3116 2292 nttnhb.exe 89 PID 2292 wrote to memory of 3116 2292 nttnhb.exe 89 PID 3116 wrote to memory of 3820 3116 lfllrlr.exe 90 PID 3116 wrote to memory of 3820 3116 lfllrlr.exe 90 PID 3116 wrote to memory of 3820 3116 lfllrlr.exe 90 PID 3820 wrote to memory of 3176 3820 bhnhbt.exe 91 PID 3820 wrote to memory of 3176 3820 bhnhbt.exe 91 PID 3820 wrote to memory of 3176 3820 bhnhbt.exe 91 PID 3176 wrote to memory of 4564 3176 btnhbn.exe 92 PID 3176 wrote to memory of 4564 3176 btnhbn.exe 92 PID 3176 wrote to memory of 4564 3176 btnhbn.exe 92 PID 4564 wrote to memory of 3868 4564 5nhtnh.exe 93 PID 4564 wrote to memory of 3868 4564 5nhtnh.exe 93 PID 4564 wrote to memory of 3868 4564 5nhtnh.exe 93 PID 3868 wrote to memory of 648 3868 rlrxlfr.exe 94 PID 3868 wrote to memory of 648 3868 rlrxlfr.exe 94 PID 3868 wrote to memory of 648 3868 rlrxlfr.exe 94 PID 648 wrote to memory of 1992 648 1bttnn.exe 95 PID 648 wrote to memory of 1992 648 1bttnn.exe 95 PID 648 wrote to memory of 1992 648 1bttnn.exe 95 PID 1992 wrote to memory of 2432 1992 ppdjv.exe 96 PID 1992 wrote to memory of 2432 1992 ppdjv.exe 96 PID 1992 wrote to memory of 2432 1992 ppdjv.exe 96 PID 2432 wrote to memory of 388 2432 thhhbh.exe 97 PID 2432 wrote to memory of 388 2432 thhhbh.exe 97 PID 2432 wrote to memory of 388 2432 thhhbh.exe 97 PID 388 wrote to memory of 1956 388 dddvp.exe 98 PID 388 wrote to memory of 1956 388 dddvp.exe 98 PID 388 wrote to memory of 1956 388 dddvp.exe 98 PID 1956 wrote to memory of 2520 1956 vjpdv.exe 99 PID 1956 wrote to memory of 2520 1956 vjpdv.exe 99 PID 1956 wrote to memory of 2520 1956 vjpdv.exe 99 PID 2520 wrote to memory of 632 2520 rlfxlfx.exe 101 PID 2520 wrote to memory of 632 2520 rlfxlfx.exe 101 PID 2520 wrote to memory of 632 2520 rlfxlfx.exe 101 PID 632 wrote to memory of 4916 632 9vvpd.exe 102 PID 632 wrote to memory of 4916 632 9vvpd.exe 102 PID 632 wrote to memory of 4916 632 9vvpd.exe 102 PID 4916 wrote to memory of 1944 4916 3vpdj.exe 103 PID 4916 wrote to memory of 1944 4916 3vpdj.exe 103 PID 4916 wrote to memory of 1944 4916 3vpdj.exe 103 PID 1944 wrote to memory of 4628 1944 rlfrfxr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f031300ac905803b26dfc208ff4ccf8ea6fccfcfe3ebbd7eeb863b016070faeN.exe"C:\Users\Admin\AppData\Local\Temp\8f031300ac905803b26dfc208ff4ccf8ea6fccfcfe3ebbd7eeb863b016070faeN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\jvpjv.exec:\jvpjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\3tnhbb.exec:\3tnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\djpdv.exec:\djpdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\djdvj.exec:\djdvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\9hhttb.exec:\9hhttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\djjdv.exec:\djjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\nttnhb.exec:\nttnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\lfllrlr.exec:\lfllrlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\bhnhbt.exec:\bhnhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\btnhbn.exec:\btnhbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\5nhtnh.exec:\5nhtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\rlrxlfr.exec:\rlrxlfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\1bttnn.exec:\1bttnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\ppdjv.exec:\ppdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\thhhbh.exec:\thhhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\dddvp.exec:\dddvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\vjpdv.exec:\vjpdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\rlfxlfx.exec:\rlfxlfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\9vvpd.exec:\9vvpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\3vpdj.exec:\3vpdj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\rlfrfxr.exec:\rlfrfxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\nbbthh.exec:\nbbthh.exe23⤵
- Executes dropped EXE
PID:4628 -
\??\c:\frfrlfx.exec:\frfrlfx.exe24⤵
- Executes dropped EXE
PID:4164 -
\??\c:\tnthbt.exec:\tnthbt.exe25⤵
- Executes dropped EXE
PID:884 -
\??\c:\xfxlfrf.exec:\xfxlfrf.exe26⤵
- Executes dropped EXE
PID:64 -
\??\c:\1ppdv.exec:\1ppdv.exe27⤵
- Executes dropped EXE
PID:4844 -
\??\c:\btnhbt.exec:\btnhbt.exe28⤵
- Executes dropped EXE
PID:4936 -
\??\c:\nthhhh.exec:\nthhhh.exe29⤵
- Executes dropped EXE
PID:3580 -
\??\c:\5flxfrx.exec:\5flxfrx.exe30⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hhbbbt.exec:\hhbbbt.exe31⤵
- Executes dropped EXE
PID:1108 -
\??\c:\xrxxxrx.exec:\xrxxxrx.exe32⤵
- Executes dropped EXE
PID:3752 -
\??\c:\5rrlffx.exec:\5rrlffx.exe33⤵
- Executes dropped EXE
PID:2300 -
\??\c:\7vvpj.exec:\7vvpj.exe34⤵
- Executes dropped EXE
PID:1528 -
\??\c:\fxrlrlf.exec:\fxrlrlf.exe35⤵
- Executes dropped EXE
PID:3244 -
\??\c:\nhnhhh.exec:\nhnhhh.exe36⤵
- Executes dropped EXE
PID:3200 -
\??\c:\jvddd.exec:\jvddd.exe37⤵
- Executes dropped EXE
PID:3304 -
\??\c:\rfllfff.exec:\rfllfff.exe38⤵
- Executes dropped EXE
PID:4248 -
\??\c:\bththb.exec:\bththb.exe39⤵
- Executes dropped EXE
PID:5044 -
\??\c:\bttnnn.exec:\bttnnn.exe40⤵
- Executes dropped EXE
PID:532 -
\??\c:\jdpjj.exec:\jdpjj.exe41⤵
- Executes dropped EXE
PID:3488 -
\??\c:\rlxrrxf.exec:\rlxrrxf.exe42⤵
- Executes dropped EXE
PID:816 -
\??\c:\5hbtbb.exec:\5hbtbb.exe43⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vjpjd.exec:\vjpjd.exe44⤵
- Executes dropped EXE
PID:4728 -
\??\c:\dpddv.exec:\dpddv.exe45⤵
- Executes dropped EXE
PID:1328 -
\??\c:\5xrrffx.exec:\5xrrffx.exe46⤵
- Executes dropped EXE
PID:780 -
\??\c:\tntnnn.exec:\tntnnn.exe47⤵
- Executes dropped EXE
PID:2504 -
\??\c:\dvddv.exec:\dvddv.exe48⤵
- Executes dropped EXE
PID:3392 -
\??\c:\rllfxxr.exec:\rllfxxr.exe49⤵
- Executes dropped EXE
PID:460 -
\??\c:\htnhtt.exec:\htnhtt.exe50⤵
- Executes dropped EXE
PID:4352 -
\??\c:\jjjdd.exec:\jjjdd.exe51⤵
- Executes dropped EXE
PID:4324 -
\??\c:\jdvvp.exec:\jdvvp.exe52⤵
- Executes dropped EXE
PID:3708 -
\??\c:\lflfxff.exec:\lflfxff.exe53⤵
- Executes dropped EXE
PID:4776 -
\??\c:\nhhbtn.exec:\nhhbtn.exe54⤵
- Executes dropped EXE
PID:224 -
\??\c:\3hhnnt.exec:\3hhnnt.exe55⤵
- Executes dropped EXE
PID:1960 -
\??\c:\vjvpp.exec:\vjvpp.exe56⤵
- Executes dropped EXE
PID:4408 -
\??\c:\xrrrrxx.exec:\xrrrrxx.exe57⤵
- Executes dropped EXE
PID:228 -
\??\c:\tbnhbh.exec:\tbnhbh.exe58⤵
- Executes dropped EXE
PID:3188 -
\??\c:\9jjdv.exec:\9jjdv.exe59⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jdvpd.exec:\jdvpd.exe60⤵
- Executes dropped EXE
PID:684 -
\??\c:\rflfrfx.exec:\rflfrfx.exe61⤵
- Executes dropped EXE
PID:4708 -
\??\c:\hhnnhh.exec:\hhnnhh.exe62⤵
- Executes dropped EXE
PID:3444 -
\??\c:\hbbtnn.exec:\hbbtnn.exe63⤵
- Executes dropped EXE
PID:1700 -
\??\c:\9jjdj.exec:\9jjdj.exe64⤵
- Executes dropped EXE
PID:3820 -
\??\c:\rlrlfff.exec:\rlrlfff.exe65⤵
- Executes dropped EXE
PID:4784 -
\??\c:\nbtnhb.exec:\nbtnhb.exe66⤵PID:1512
-
\??\c:\3hnnnb.exec:\3hnnnb.exe67⤵PID:3668
-
\??\c:\dvddd.exec:\dvddd.exe68⤵PID:4996
-
\??\c:\rllffll.exec:\rllffll.exe69⤵PID:1228
-
\??\c:\ntnnbn.exec:\ntnnbn.exe70⤵PID:404
-
\??\c:\jddvp.exec:\jddvp.exe71⤵PID:4496
-
\??\c:\pjpjp.exec:\pjpjp.exe72⤵PID:2056
-
\??\c:\lxffrrl.exec:\lxffrrl.exe73⤵PID:4488
-
\??\c:\1htnhh.exec:\1htnhh.exe74⤵PID:3496
-
\??\c:\ddjjv.exec:\ddjjv.exe75⤵PID:3936
-
\??\c:\3ppjd.exec:\3ppjd.exe76⤵PID:2992
-
\??\c:\flxrllf.exec:\flxrllf.exe77⤵
- System Location Discovery: System Language Discovery
PID:3164 -
\??\c:\thnhbn.exec:\thnhbn.exe78⤵PID:1872
-
\??\c:\jvvvv.exec:\jvvvv.exe79⤵PID:1196
-
\??\c:\rrrlfrl.exec:\rrrlfrl.exe80⤵PID:2720
-
\??\c:\xxfxrxr.exec:\xxfxrxr.exe81⤵PID:2876
-
\??\c:\tntnnn.exec:\tntnnn.exe82⤵PID:1376
-
\??\c:\jdpjv.exec:\jdpjv.exe83⤵PID:3240
-
\??\c:\7llfrfx.exec:\7llfrfx.exe84⤵PID:5040
-
\??\c:\bhtnhh.exec:\bhtnhh.exe85⤵PID:884
-
\??\c:\dvjdj.exec:\dvjdj.exe86⤵PID:2708
-
\??\c:\vvjvp.exec:\vvjvp.exe87⤵PID:2684
-
\??\c:\rxfxllf.exec:\rxfxllf.exe88⤵PID:2872
-
\??\c:\hnbtnn.exec:\hnbtnn.exe89⤵PID:4016
-
\??\c:\dppjd.exec:\dppjd.exe90⤵PID:1672
-
\??\c:\fffxrrr.exec:\fffxrrr.exe91⤵PID:2996
-
\??\c:\llrxrrl.exec:\llrxrrl.exe92⤵PID:316
-
\??\c:\nhhbnt.exec:\nhhbnt.exe93⤵PID:1168
-
\??\c:\jvjdv.exec:\jvjdv.exe94⤵PID:2712
-
\??\c:\xlxrlll.exec:\xlxrlll.exe95⤵PID:1704
-
\??\c:\9lrrllf.exec:\9lrrllf.exe96⤵PID:4944
-
\??\c:\nnnhbn.exec:\nnnhbn.exe97⤵PID:4116
-
\??\c:\1hbbtt.exec:\1hbbtt.exe98⤵PID:4252
-
\??\c:\jvdvp.exec:\jvdvp.exe99⤵PID:4720
-
\??\c:\rrrfflf.exec:\rrrfflf.exe100⤵PID:720
-
\??\c:\bhbnhh.exec:\bhbnhh.exe101⤵PID:4248
-
\??\c:\dvvvp.exec:\dvvvp.exe102⤵PID:3600
-
\??\c:\llllfff.exec:\llllfff.exe103⤵PID:2220
-
\??\c:\bhthbb.exec:\bhthbb.exe104⤵PID:1008
-
\??\c:\nnthhh.exec:\nnthhh.exe105⤵PID:816
-
\??\c:\djpjd.exec:\djpjd.exe106⤵PID:1532
-
\??\c:\dvdvp.exec:\dvdvp.exe107⤵PID:1856
-
\??\c:\xrffrrr.exec:\xrffrrr.exe108⤵PID:1328
-
\??\c:\tnbbtt.exec:\tnbbtt.exe109⤵PID:2476
-
\??\c:\jvdvv.exec:\jvdvv.exe110⤵PID:2504
-
\??\c:\7rrrlxr.exec:\7rrrlxr.exe111⤵PID:5004
-
\??\c:\ffrlrrx.exec:\ffrlrrx.exe112⤵PID:4328
-
\??\c:\bnttnn.exec:\bnttnn.exe113⤵PID:3448
-
\??\c:\vjvjd.exec:\vjvjd.exe114⤵PID:3860
-
\??\c:\rxfxflf.exec:\rxfxflf.exe115⤵PID:3940
-
\??\c:\nbbhtb.exec:\nbbhtb.exe116⤵PID:4388
-
\??\c:\thhbtn.exec:\thhbtn.exe117⤵PID:3536
-
\??\c:\pvjdj.exec:\pvjdj.exe118⤵PID:4320
-
\??\c:\3lrlxxl.exec:\3lrlxxl.exe119⤵PID:4400
-
\??\c:\bbnbtn.exec:\bbnbtn.exe120⤵PID:5036
-
\??\c:\hhtntb.exec:\hhtntb.exe121⤵PID:3812
-
\??\c:\pjdvp.exec:\pjdvp.exe122⤵PID:1548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-