Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 18:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0268e51090b6f67b95d7ebc17dd2aa8eb92895274b0ee834156d94ec1f0b114a.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
0268e51090b6f67b95d7ebc17dd2aa8eb92895274b0ee834156d94ec1f0b114a.exe
-
Size
453KB
-
MD5
49ffc5ddc1d5920cba2294df033f510a
-
SHA1
73504d05d9a44c5936a7d764ac09f43f33e05916
-
SHA256
0268e51090b6f67b95d7ebc17dd2aa8eb92895274b0ee834156d94ec1f0b114a
-
SHA512
95ac284fc611f87a1a27ec564d729bef24e6e8f05d3e11342f22526f850f03f4e5d481f303575018d1cfee6642340c0ef14555fde3ad6ff1d91c6f8b52f4f96e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbef:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2308-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/884-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/836-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/848-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/840-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1744-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2748-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-683-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-783-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-832-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-927-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-1021-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-1046-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-1108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-1241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 872 vpdjd.exe 2808 tnhbbb.exe 4932 vjppj.exe 4692 1vddj.exe 4528 3rlfxfx.exe 3448 jjpjj.exe 1728 ppddd.exe 5108 jpppj.exe 2376 jddvp.exe 1940 llflfxx.exe 2448 vjvpd.exe 4200 nbbnhb.exe 1608 rxllffx.exe 392 5jdvp.exe 4300 pjppp.exe 3852 9ffxrrr.exe 4676 bntnhb.exe 1620 vpvpj.exe 2764 flrxrlf.exe 1208 pjvpp.exe 3760 vvvpj.exe 2096 nbbbtn.exe 1388 5hbtht.exe 3516 pppjd.exe 2400 tttnhh.exe 4212 ppjvd.exe 3040 tnnnhh.exe 4276 dvvpj.exe 2240 nnbtht.exe 3600 btttnn.exe 884 tnnbtt.exe 1204 htntnn.exe 3788 vvpdj.exe 3724 flrlxrx.exe 1876 tbnhbh.exe 1936 ddjvp.exe 836 rxxlxlx.exe 5048 frlfxxr.exe 4044 pjdvp.exe 4584 5jpdj.exe 1540 xrlfrlx.exe 4476 tnthtn.exe 3496 1jpjj.exe 1932 dpvjd.exe 1060 5rxrflx.exe 4460 htttnt.exe 848 7dvpd.exe 3444 5jvjd.exe 840 lxfxrlf.exe 4512 5hnhtt.exe 2460 9vvjd.exe 2592 3xfxflf.exe 4004 xrrlfxr.exe 2252 nnbnhb.exe 4572 vppjj.exe 3656 lxfxrlf.exe 4756 rlrfrlx.exe 4668 btthbb.exe 3960 1xrfxrf.exe 3668 rlfxrlf.exe 4592 3tthtn.exe 1744 pdjvd.exe 1092 lfrlxrl.exe 3992 hthbtn.exe -
resource yara_rule behavioral2/memory/2308-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/884-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/848-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/840-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2748-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-783-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-891-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-901-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2308 wrote to memory of 872 2308 0268e51090b6f67b95d7ebc17dd2aa8eb92895274b0ee834156d94ec1f0b114a.exe 82 PID 2308 wrote to memory of 872 2308 0268e51090b6f67b95d7ebc17dd2aa8eb92895274b0ee834156d94ec1f0b114a.exe 82 PID 2308 wrote to memory of 872 2308 0268e51090b6f67b95d7ebc17dd2aa8eb92895274b0ee834156d94ec1f0b114a.exe 82 PID 872 wrote to memory of 2808 872 vpdjd.exe 83 PID 872 wrote to memory of 2808 872 vpdjd.exe 83 PID 872 wrote to memory of 2808 872 vpdjd.exe 83 PID 2808 wrote to memory of 4932 2808 tnhbbb.exe 84 PID 2808 wrote to memory of 4932 2808 tnhbbb.exe 84 PID 2808 wrote to memory of 4932 2808 tnhbbb.exe 84 PID 4932 wrote to memory of 4692 4932 vjppj.exe 85 PID 4932 wrote to memory of 4692 4932 vjppj.exe 85 PID 4932 wrote to memory of 4692 4932 vjppj.exe 85 PID 4692 wrote to memory of 4528 4692 1vddj.exe 86 PID 4692 wrote to memory of 4528 4692 1vddj.exe 86 PID 4692 wrote to memory of 4528 4692 1vddj.exe 86 PID 4528 wrote to memory of 3448 4528 3rlfxfx.exe 87 PID 4528 wrote to memory of 3448 4528 3rlfxfx.exe 87 PID 4528 wrote to memory of 3448 4528 3rlfxfx.exe 87 PID 3448 wrote to memory of 1728 3448 jjpjj.exe 88 PID 3448 wrote to memory of 1728 3448 jjpjj.exe 88 PID 3448 wrote to memory of 1728 3448 jjpjj.exe 88 PID 1728 wrote to memory of 5108 1728 ppddd.exe 89 PID 1728 wrote to memory of 5108 1728 ppddd.exe 89 PID 1728 wrote to memory of 5108 1728 ppddd.exe 89 PID 5108 wrote to memory of 2376 5108 jpppj.exe 90 PID 5108 wrote to memory of 2376 5108 jpppj.exe 90 PID 5108 wrote to memory of 2376 5108 jpppj.exe 90 PID 2376 wrote to memory of 1940 2376 jddvp.exe 91 PID 2376 wrote to memory of 1940 2376 jddvp.exe 91 PID 2376 wrote to memory of 1940 2376 jddvp.exe 91 PID 1940 wrote to memory of 2448 1940 llflfxx.exe 92 PID 1940 wrote to memory of 2448 1940 llflfxx.exe 92 PID 1940 wrote to memory of 2448 1940 llflfxx.exe 92 PID 2448 wrote to memory of 4200 2448 vjvpd.exe 93 PID 2448 wrote to memory of 4200 2448 vjvpd.exe 93 PID 2448 wrote to memory of 4200 2448 vjvpd.exe 93 PID 4200 wrote to memory of 1608 4200 nbbnhb.exe 94 PID 4200 wrote to memory of 1608 4200 nbbnhb.exe 94 PID 4200 wrote to memory of 1608 4200 nbbnhb.exe 94 PID 1608 wrote to memory of 392 1608 rxllffx.exe 95 PID 1608 wrote to memory of 392 1608 rxllffx.exe 95 PID 1608 wrote to memory of 392 1608 rxllffx.exe 95 PID 392 wrote to memory of 4300 392 5jdvp.exe 96 PID 392 wrote to memory of 4300 392 5jdvp.exe 96 PID 392 wrote to memory of 4300 392 5jdvp.exe 96 PID 4300 wrote to memory of 3852 4300 pjppp.exe 97 PID 4300 wrote to memory of 3852 4300 pjppp.exe 97 PID 4300 wrote to memory of 3852 4300 pjppp.exe 97 PID 3852 wrote to memory of 4676 3852 9ffxrrr.exe 98 PID 3852 wrote to memory of 4676 3852 9ffxrrr.exe 98 PID 3852 wrote to memory of 4676 3852 9ffxrrr.exe 98 PID 4676 wrote to memory of 1620 4676 bntnhb.exe 99 PID 4676 wrote to memory of 1620 4676 bntnhb.exe 99 PID 4676 wrote to memory of 1620 4676 bntnhb.exe 99 PID 1620 wrote to memory of 2764 1620 vpvpj.exe 100 PID 1620 wrote to memory of 2764 1620 vpvpj.exe 100 PID 1620 wrote to memory of 2764 1620 vpvpj.exe 100 PID 2764 wrote to memory of 1208 2764 flrxrlf.exe 101 PID 2764 wrote to memory of 1208 2764 flrxrlf.exe 101 PID 2764 wrote to memory of 1208 2764 flrxrlf.exe 101 PID 1208 wrote to memory of 3760 1208 pjvpp.exe 102 PID 1208 wrote to memory of 3760 1208 pjvpp.exe 102 PID 1208 wrote to memory of 3760 1208 pjvpp.exe 102 PID 3760 wrote to memory of 2096 3760 vvvpj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0268e51090b6f67b95d7ebc17dd2aa8eb92895274b0ee834156d94ec1f0b114a.exe"C:\Users\Admin\AppData\Local\Temp\0268e51090b6f67b95d7ebc17dd2aa8eb92895274b0ee834156d94ec1f0b114a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\vpdjd.exec:\vpdjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\tnhbbb.exec:\tnhbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\vjppj.exec:\vjppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\1vddj.exec:\1vddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\3rlfxfx.exec:\3rlfxfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\jjpjj.exec:\jjpjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\ppddd.exec:\ppddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\jpppj.exec:\jpppj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\jddvp.exec:\jddvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\llflfxx.exec:\llflfxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\vjvpd.exec:\vjvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\nbbnhb.exec:\nbbnhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\rxllffx.exec:\rxllffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\5jdvp.exec:\5jdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\pjppp.exec:\pjppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\9ffxrrr.exec:\9ffxrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\bntnhb.exec:\bntnhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\vpvpj.exec:\vpvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\flrxrlf.exec:\flrxrlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\pjvpp.exec:\pjvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\vvvpj.exec:\vvvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\nbbbtn.exec:\nbbbtn.exe23⤵
- Executes dropped EXE
PID:2096 -
\??\c:\5hbtht.exec:\5hbtht.exe24⤵
- Executes dropped EXE
PID:1388 -
\??\c:\pppjd.exec:\pppjd.exe25⤵
- Executes dropped EXE
PID:3516 -
\??\c:\tttnhh.exec:\tttnhh.exe26⤵
- Executes dropped EXE
PID:2400 -
\??\c:\ppjvd.exec:\ppjvd.exe27⤵
- Executes dropped EXE
PID:4212 -
\??\c:\tnnnhh.exec:\tnnnhh.exe28⤵
- Executes dropped EXE
PID:3040 -
\??\c:\dvvpj.exec:\dvvpj.exe29⤵
- Executes dropped EXE
PID:4276 -
\??\c:\nnbtht.exec:\nnbtht.exe30⤵
- Executes dropped EXE
PID:2240 -
\??\c:\btttnn.exec:\btttnn.exe31⤵
- Executes dropped EXE
PID:3600 -
\??\c:\tnnbtt.exec:\tnnbtt.exe32⤵
- Executes dropped EXE
PID:884 -
\??\c:\htntnn.exec:\htntnn.exe33⤵
- Executes dropped EXE
PID:1204 -
\??\c:\vvpdj.exec:\vvpdj.exe34⤵
- Executes dropped EXE
PID:3788 -
\??\c:\flrlxrx.exec:\flrlxrx.exe35⤵
- Executes dropped EXE
PID:3724 -
\??\c:\tbnhbh.exec:\tbnhbh.exe36⤵
- Executes dropped EXE
PID:1876 -
\??\c:\ddjvp.exec:\ddjvp.exe37⤵
- Executes dropped EXE
PID:1936 -
\??\c:\rxxlxlx.exec:\rxxlxlx.exe38⤵
- Executes dropped EXE
PID:836 -
\??\c:\frlfxxr.exec:\frlfxxr.exe39⤵
- Executes dropped EXE
PID:5048 -
\??\c:\pjdvp.exec:\pjdvp.exe40⤵
- Executes dropped EXE
PID:4044 -
\??\c:\5jpdj.exec:\5jpdj.exe41⤵
- Executes dropped EXE
PID:4584 -
\??\c:\xrlfrlx.exec:\xrlfrlx.exe42⤵
- Executes dropped EXE
PID:1540 -
\??\c:\tnthtn.exec:\tnthtn.exe43⤵
- Executes dropped EXE
PID:4476 -
\??\c:\1jpjj.exec:\1jpjj.exe44⤵
- Executes dropped EXE
PID:3496 -
\??\c:\dpvjd.exec:\dpvjd.exe45⤵
- Executes dropped EXE
PID:1932 -
\??\c:\5rxrflx.exec:\5rxrflx.exe46⤵
- Executes dropped EXE
PID:1060 -
\??\c:\htttnt.exec:\htttnt.exe47⤵
- Executes dropped EXE
PID:4460 -
\??\c:\7dvpd.exec:\7dvpd.exe48⤵
- Executes dropped EXE
PID:848 -
\??\c:\5jvjd.exec:\5jvjd.exe49⤵
- Executes dropped EXE
PID:3444 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe50⤵
- Executes dropped EXE
PID:840 -
\??\c:\5hnhtt.exec:\5hnhtt.exe51⤵
- Executes dropped EXE
PID:4512 -
\??\c:\9vvjd.exec:\9vvjd.exe52⤵
- Executes dropped EXE
PID:2460 -
\??\c:\3xfxflf.exec:\3xfxflf.exe53⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe54⤵
- Executes dropped EXE
PID:4004 -
\??\c:\nnbnhb.exec:\nnbnhb.exe55⤵
- Executes dropped EXE
PID:2252 -
\??\c:\vppjj.exec:\vppjj.exe56⤵
- Executes dropped EXE
PID:4572 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe57⤵
- Executes dropped EXE
PID:3656 -
\??\c:\rlrfrlx.exec:\rlrfrlx.exe58⤵
- Executes dropped EXE
PID:4756 -
\??\c:\btthbb.exec:\btthbb.exe59⤵
- Executes dropped EXE
PID:4668 -
\??\c:\1xrfxrf.exec:\1xrfxrf.exe60⤵
- Executes dropped EXE
PID:3960 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe61⤵
- Executes dropped EXE
PID:3668 -
\??\c:\3tthtn.exec:\3tthtn.exe62⤵
- Executes dropped EXE
PID:4592 -
\??\c:\pdjvd.exec:\pdjvd.exe63⤵
- Executes dropped EXE
PID:1744 -
\??\c:\lfrlxrl.exec:\lfrlxrl.exe64⤵
- Executes dropped EXE
PID:1092 -
\??\c:\hthbtn.exec:\hthbtn.exe65⤵
- Executes dropped EXE
PID:3992 -
\??\c:\3jjdp.exec:\3jjdp.exe66⤵PID:4792
-
\??\c:\jpvpj.exec:\jpvpj.exe67⤵PID:348
-
\??\c:\3lrllll.exec:\3lrllll.exe68⤵PID:2932
-
\??\c:\btbtbt.exec:\btbtbt.exe69⤵PID:2448
-
\??\c:\9jjvd.exec:\9jjvd.exe70⤵PID:2912
-
\??\c:\9lfrlfr.exec:\9lfrlfr.exe71⤵PID:1976
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe72⤵PID:4872
-
\??\c:\nhhnhb.exec:\nhhnhb.exe73⤵PID:3232
-
\??\c:\jdpjj.exec:\jdpjj.exe74⤵PID:4600
-
\??\c:\xfxxrrr.exec:\xfxxrrr.exe75⤵PID:3852
-
\??\c:\bnnnnn.exec:\bnnnnn.exe76⤵PID:4372
-
\??\c:\5dpjv.exec:\5dpjv.exe77⤵PID:1368
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe78⤵PID:2772
-
\??\c:\5fxxrrr.exec:\5fxxrrr.exe79⤵PID:812
-
\??\c:\btthhb.exec:\btthhb.exe80⤵PID:3468
-
\??\c:\jjjdv.exec:\jjjdv.exe81⤵PID:3760
-
\??\c:\ffxrxrx.exec:\ffxrxrx.exe82⤵PID:1912
-
\??\c:\fffxxxr.exec:\fffxxxr.exe83⤵PID:3132
-
\??\c:\9ntnnn.exec:\9ntnnn.exe84⤵PID:5024
-
\??\c:\vvvpj.exec:\vvvpj.exe85⤵PID:4804
-
\??\c:\xxrlfxr.exec:\xxrlfxr.exe86⤵PID:1100
-
\??\c:\1llffff.exec:\1llffff.exe87⤵PID:3996
-
\??\c:\tnnnhh.exec:\tnnnhh.exe88⤵PID:536
-
\??\c:\dvdvp.exec:\dvdvp.exe89⤵PID:2980
-
\??\c:\rrrfxfx.exec:\rrrfxfx.exe90⤵PID:3040
-
\??\c:\5bhhhn.exec:\5bhhhn.exe91⤵PID:2892
-
\??\c:\jpvpp.exec:\jpvpp.exe92⤵PID:2868
-
\??\c:\vvjdv.exec:\vvjdv.exe93⤵PID:3064
-
\??\c:\lxfxllx.exec:\lxfxllx.exe94⤵PID:2312
-
\??\c:\hbthtn.exec:\hbthtn.exe95⤵PID:4260
-
\??\c:\dvjdv.exec:\dvjdv.exe96⤵PID:404
-
\??\c:\ffrlllf.exec:\ffrlllf.exe97⤵PID:4024
-
\??\c:\7ttnnn.exec:\7ttnnn.exe98⤵PID:4404
-
\??\c:\9nnttb.exec:\9nnttb.exe99⤵PID:1812
-
\??\c:\vvjjp.exec:\vvjjp.exe100⤵PID:2800
-
\??\c:\rffxrrl.exec:\rffxrrl.exe101⤵PID:4360
-
\??\c:\9lrrrrr.exec:\9lrrrrr.exe102⤵PID:4484
-
\??\c:\bnntnn.exec:\bnntnn.exe103⤵PID:3536
-
\??\c:\pvddj.exec:\pvddj.exe104⤵PID:3928
-
\??\c:\fxffxxr.exec:\fxffxxr.exe105⤵PID:4788
-
\??\c:\hhnnnt.exec:\hhnnnt.exe106⤵PID:3236
-
\??\c:\vvvvv.exec:\vvvvv.exe107⤵PID:2748
-
\??\c:\lrxfflf.exec:\lrxfflf.exe108⤵PID:4496
-
\??\c:\thnhht.exec:\thnhht.exe109⤵PID:1820
-
\??\c:\tnbbbb.exec:\tnbbbb.exe110⤵PID:4452
-
\??\c:\pddvj.exec:\pddvj.exe111⤵PID:2484
-
\??\c:\lfffxxr.exec:\lfffxxr.exe112⤵PID:4368
-
\??\c:\tbhbbb.exec:\tbhbbb.exe113⤵PID:452
-
\??\c:\bhtntn.exec:\bhtntn.exe114⤵PID:3660
-
\??\c:\pjjdd.exec:\pjjdd.exe115⤵PID:4392
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe116⤵PID:2308
-
\??\c:\1llfffx.exec:\1llfffx.exe117⤵PID:4628
-
\??\c:\1tnhhh.exec:\1tnhhh.exe118⤵PID:3652
-
\??\c:\djpdj.exec:\djpdj.exe119⤵PID:3512
-
\??\c:\5frlfxr.exec:\5frlfxr.exe120⤵PID:4988
-
\??\c:\7tnhbh.exec:\7tnhbh.exe121⤵PID:3920
-
\??\c:\hhtttt.exec:\hhtttt.exe122⤵PID:2288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-