Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 19:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6ada709b13ddf1b6e2b3ab7a682cd49b36f65bbcfe11f11e37421e5b09dcd9aa.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
6ada709b13ddf1b6e2b3ab7a682cd49b36f65bbcfe11f11e37421e5b09dcd9aa.exe
-
Size
454KB
-
MD5
3417e432e29d44198908240198612d81
-
SHA1
d7023b8746b50d29167d7775e5a3068f8c6f7bc4
-
SHA256
6ada709b13ddf1b6e2b3ab7a682cd49b36f65bbcfe11f11e37421e5b09dcd9aa
-
SHA512
d1416ca8fa1c907a6a559c0797e3caed6779703ab01f67c525cc144a6c4b563c39717b2cf7ac7dcb847192bacc090f1437dbf0325e84c87d8ed1f639c10511be
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1964-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/776-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2072-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/656-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/752-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1088-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1120-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-784-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-866-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-1048-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-1417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2796 ppjpp.exe 1164 bnbthn.exe 2428 jpvvp.exe 4892 9ffxrll.exe 4508 9nnnhn.exe 1316 ppvpj.exe 1304 1xfrllx.exe 4828 bbnnnn.exe 4484 5rxflfl.exe 2924 vjjjj.exe 4400 ddvdd.exe 1496 5nnntb.exe 776 3tbhhn.exe 3180 bbttbh.exe 4016 vjddj.exe 4540 lxffflf.exe 468 xxxlflf.exe 3228 rfrlllf.exe 2736 hbhbbb.exe 2212 vjpjv.exe 3156 hnbtnn.exe 3124 rrlfxfl.exe 876 hbnhtt.exe 4940 9xlfrrl.exe 2728 xfrfxrl.exe 2072 7xfxrrl.exe 3660 xxfxlll.exe 5092 7vvpj.exe 5028 tnhbbb.exe 2232 xxrlffx.exe 3732 tnbtbt.exe 2976 dvdjj.exe 1308 llrrllf.exe 228 djpjv.exe 1260 dppvp.exe 1444 lrlxfxf.exe 1640 bbnhbb.exe 3608 pjjdv.exe 1528 fxlffff.exe 3696 5hnnnn.exe 4864 jpvvp.exe 3340 jvppd.exe 1216 1bbtbb.exe 3564 tnbthh.exe 112 pppjv.exe 4352 frxrllf.exe 5056 ntbbtt.exe 2992 dvpjj.exe 4296 vpdvv.exe 4332 rlrrrrx.exe 4032 htnhbb.exe 3636 btttbh.exe 656 rlxrlfx.exe 4452 9xfxrxx.exe 4624 hnhhtt.exe 4560 djjdj.exe 3736 fflllrr.exe 2316 hhhnbh.exe 4196 dpvvj.exe 448 xxfrrll.exe 3936 btbbbb.exe 3528 dvvvp.exe 1116 lxlrrxf.exe 4384 rxxrxff.exe -
resource yara_rule behavioral2/memory/1964-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1164-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/776-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2072-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/656-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/752-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1088-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1164-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-866-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2796 1964 6ada709b13ddf1b6e2b3ab7a682cd49b36f65bbcfe11f11e37421e5b09dcd9aa.exe 82 PID 1964 wrote to memory of 2796 1964 6ada709b13ddf1b6e2b3ab7a682cd49b36f65bbcfe11f11e37421e5b09dcd9aa.exe 82 PID 1964 wrote to memory of 2796 1964 6ada709b13ddf1b6e2b3ab7a682cd49b36f65bbcfe11f11e37421e5b09dcd9aa.exe 82 PID 2796 wrote to memory of 1164 2796 ppjpp.exe 83 PID 2796 wrote to memory of 1164 2796 ppjpp.exe 83 PID 2796 wrote to memory of 1164 2796 ppjpp.exe 83 PID 1164 wrote to memory of 2428 1164 bnbthn.exe 84 PID 1164 wrote to memory of 2428 1164 bnbthn.exe 84 PID 1164 wrote to memory of 2428 1164 bnbthn.exe 84 PID 2428 wrote to memory of 4892 2428 jpvvp.exe 85 PID 2428 wrote to memory of 4892 2428 jpvvp.exe 85 PID 2428 wrote to memory of 4892 2428 jpvvp.exe 85 PID 4892 wrote to memory of 4508 4892 9ffxrll.exe 86 PID 4892 wrote to memory of 4508 4892 9ffxrll.exe 86 PID 4892 wrote to memory of 4508 4892 9ffxrll.exe 86 PID 4508 wrote to memory of 1316 4508 9nnnhn.exe 87 PID 4508 wrote to memory of 1316 4508 9nnnhn.exe 87 PID 4508 wrote to memory of 1316 4508 9nnnhn.exe 87 PID 1316 wrote to memory of 1304 1316 ppvpj.exe 88 PID 1316 wrote to memory of 1304 1316 ppvpj.exe 88 PID 1316 wrote to memory of 1304 1316 ppvpj.exe 88 PID 1304 wrote to memory of 4828 1304 1xfrllx.exe 89 PID 1304 wrote to memory of 4828 1304 1xfrllx.exe 89 PID 1304 wrote to memory of 4828 1304 1xfrllx.exe 89 PID 4828 wrote to memory of 4484 4828 bbnnnn.exe 90 PID 4828 wrote to memory of 4484 4828 bbnnnn.exe 90 PID 4828 wrote to memory of 4484 4828 bbnnnn.exe 90 PID 4484 wrote to memory of 2924 4484 5rxflfl.exe 91 PID 4484 wrote to memory of 2924 4484 5rxflfl.exe 91 PID 4484 wrote to memory of 2924 4484 5rxflfl.exe 91 PID 2924 wrote to memory of 4400 2924 vjjjj.exe 92 PID 2924 wrote to memory of 4400 2924 vjjjj.exe 92 PID 2924 wrote to memory of 4400 2924 vjjjj.exe 92 PID 4400 wrote to memory of 1496 4400 ddvdd.exe 93 PID 4400 wrote to memory of 1496 4400 ddvdd.exe 93 PID 4400 wrote to memory of 1496 4400 ddvdd.exe 93 PID 1496 wrote to memory of 776 1496 5nnntb.exe 94 PID 1496 wrote to memory of 776 1496 5nnntb.exe 94 PID 1496 wrote to memory of 776 1496 5nnntb.exe 94 PID 776 wrote to memory of 3180 776 3tbhhn.exe 95 PID 776 wrote to memory of 3180 776 3tbhhn.exe 95 PID 776 wrote to memory of 3180 776 3tbhhn.exe 95 PID 3180 wrote to memory of 4016 3180 bbttbh.exe 96 PID 3180 wrote to memory of 4016 3180 bbttbh.exe 96 PID 3180 wrote to memory of 4016 3180 bbttbh.exe 96 PID 4016 wrote to memory of 4540 4016 vjddj.exe 97 PID 4016 wrote to memory of 4540 4016 vjddj.exe 97 PID 4016 wrote to memory of 4540 4016 vjddj.exe 97 PID 4540 wrote to memory of 468 4540 lxffflf.exe 98 PID 4540 wrote to memory of 468 4540 lxffflf.exe 98 PID 4540 wrote to memory of 468 4540 lxffflf.exe 98 PID 468 wrote to memory of 3228 468 xxxlflf.exe 99 PID 468 wrote to memory of 3228 468 xxxlflf.exe 99 PID 468 wrote to memory of 3228 468 xxxlflf.exe 99 PID 3228 wrote to memory of 2736 3228 rfrlllf.exe 100 PID 3228 wrote to memory of 2736 3228 rfrlllf.exe 100 PID 3228 wrote to memory of 2736 3228 rfrlllf.exe 100 PID 2736 wrote to memory of 2212 2736 hbhbbb.exe 101 PID 2736 wrote to memory of 2212 2736 hbhbbb.exe 101 PID 2736 wrote to memory of 2212 2736 hbhbbb.exe 101 PID 2212 wrote to memory of 3156 2212 vjpjv.exe 102 PID 2212 wrote to memory of 3156 2212 vjpjv.exe 102 PID 2212 wrote to memory of 3156 2212 vjpjv.exe 102 PID 3156 wrote to memory of 3124 3156 hnbtnn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ada709b13ddf1b6e2b3ab7a682cd49b36f65bbcfe11f11e37421e5b09dcd9aa.exe"C:\Users\Admin\AppData\Local\Temp\6ada709b13ddf1b6e2b3ab7a682cd49b36f65bbcfe11f11e37421e5b09dcd9aa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\ppjpp.exec:\ppjpp.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\bnbthn.exec:\bnbthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\jpvvp.exec:\jpvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\9ffxrll.exec:\9ffxrll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\9nnnhn.exec:\9nnnhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\ppvpj.exec:\ppvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\1xfrllx.exec:\1xfrllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\bbnnnn.exec:\bbnnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\5rxflfl.exec:\5rxflfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\vjjjj.exec:\vjjjj.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\ddvdd.exec:\ddvdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\5nnntb.exec:\5nnntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\3tbhhn.exec:\3tbhhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\bbttbh.exec:\bbttbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\vjddj.exec:\vjddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\lxffflf.exec:\lxffflf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\xxxlflf.exec:\xxxlflf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\rfrlllf.exec:\rfrlllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\hbhbbb.exec:\hbhbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\vjpjv.exec:\vjpjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\hnbtnn.exec:\hnbtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\rrlfxfl.exec:\rrlfxfl.exe23⤵
- Executes dropped EXE
PID:3124 -
\??\c:\hbnhtt.exec:\hbnhtt.exe24⤵
- Executes dropped EXE
PID:876 -
\??\c:\9xlfrrl.exec:\9xlfrrl.exe25⤵
- Executes dropped EXE
PID:4940 -
\??\c:\xfrfxrl.exec:\xfrfxrl.exe26⤵
- Executes dropped EXE
PID:2728 -
\??\c:\7xfxrrl.exec:\7xfxrrl.exe27⤵
- Executes dropped EXE
PID:2072 -
\??\c:\xxfxlll.exec:\xxfxlll.exe28⤵
- Executes dropped EXE
PID:3660 -
\??\c:\7vvpj.exec:\7vvpj.exe29⤵
- Executes dropped EXE
PID:5092 -
\??\c:\tnhbbb.exec:\tnhbbb.exe30⤵
- Executes dropped EXE
PID:5028 -
\??\c:\xxrlffx.exec:\xxrlffx.exe31⤵
- Executes dropped EXE
PID:2232 -
\??\c:\tnbtbt.exec:\tnbtbt.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3732 -
\??\c:\dvdjj.exec:\dvdjj.exe33⤵
- Executes dropped EXE
PID:2976 -
\??\c:\llrrllf.exec:\llrrllf.exe34⤵
- Executes dropped EXE
PID:1308 -
\??\c:\djpjv.exec:\djpjv.exe35⤵
- Executes dropped EXE
PID:228 -
\??\c:\dppvp.exec:\dppvp.exe36⤵
- Executes dropped EXE
PID:1260 -
\??\c:\lrlxfxf.exec:\lrlxfxf.exe37⤵
- Executes dropped EXE
PID:1444 -
\??\c:\bbnhbb.exec:\bbnhbb.exe38⤵
- Executes dropped EXE
PID:1640 -
\??\c:\pjjdv.exec:\pjjdv.exe39⤵
- Executes dropped EXE
PID:3608 -
\??\c:\fxlffff.exec:\fxlffff.exe40⤵
- Executes dropped EXE
PID:1528 -
\??\c:\5hnnnn.exec:\5hnnnn.exe41⤵
- Executes dropped EXE
PID:3696 -
\??\c:\jpvvp.exec:\jpvvp.exe42⤵
- Executes dropped EXE
PID:4864 -
\??\c:\jvppd.exec:\jvppd.exe43⤵
- Executes dropped EXE
PID:3340 -
\??\c:\1bbtbb.exec:\1bbtbb.exe44⤵
- Executes dropped EXE
PID:1216 -
\??\c:\tnbthh.exec:\tnbthh.exe45⤵
- Executes dropped EXE
PID:3564 -
\??\c:\pppjv.exec:\pppjv.exe46⤵
- Executes dropped EXE
PID:112 -
\??\c:\frxrllf.exec:\frxrllf.exe47⤵
- Executes dropped EXE
PID:4352 -
\??\c:\ntbbtt.exec:\ntbbtt.exe48⤵
- Executes dropped EXE
PID:5056 -
\??\c:\dvpjj.exec:\dvpjj.exe49⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vpdvv.exec:\vpdvv.exe50⤵
- Executes dropped EXE
PID:4296 -
\??\c:\rlrrrrx.exec:\rlrrrrx.exe51⤵
- Executes dropped EXE
PID:4332 -
\??\c:\htnhbb.exec:\htnhbb.exe52⤵
- Executes dropped EXE
PID:4032 -
\??\c:\btttbh.exec:\btttbh.exe53⤵
- Executes dropped EXE
PID:3636 -
\??\c:\rlxrlfx.exec:\rlxrlfx.exe54⤵
- Executes dropped EXE
PID:656 -
\??\c:\9xfxrxx.exec:\9xfxrxx.exe55⤵
- Executes dropped EXE
PID:4452 -
\??\c:\hnhhtt.exec:\hnhhtt.exe56⤵
- Executes dropped EXE
PID:4624 -
\??\c:\djjdj.exec:\djjdj.exe57⤵
- Executes dropped EXE
PID:4560 -
\??\c:\fflllrr.exec:\fflllrr.exe58⤵
- Executes dropped EXE
PID:3736 -
\??\c:\hhhnbh.exec:\hhhnbh.exe59⤵
- Executes dropped EXE
PID:2316 -
\??\c:\dpvvj.exec:\dpvvj.exe60⤵
- Executes dropped EXE
PID:4196 -
\??\c:\xxfrrll.exec:\xxfrrll.exe61⤵
- Executes dropped EXE
PID:448 -
\??\c:\btbbbb.exec:\btbbbb.exe62⤵
- Executes dropped EXE
PID:3936 -
\??\c:\dvvvp.exec:\dvvvp.exe63⤵
- Executes dropped EXE
PID:3528 -
\??\c:\lxlrrxf.exec:\lxlrrxf.exe64⤵
- Executes dropped EXE
PID:1116 -
\??\c:\rxxrxff.exec:\rxxrxff.exe65⤵
- Executes dropped EXE
PID:4384 -
\??\c:\nbbbtt.exec:\nbbbtt.exe66⤵PID:4872
-
\??\c:\jvddd.exec:\jvddd.exe67⤵PID:2280
-
\??\c:\bhthtb.exec:\bhthtb.exe68⤵PID:2156
-
\??\c:\dvdjd.exec:\dvdjd.exe69⤵PID:4928
-
\??\c:\vppvp.exec:\vppvp.exe70⤵PID:4640
-
\??\c:\rllfrxr.exec:\rllfrxr.exe71⤵PID:1864
-
\??\c:\bbtnbb.exec:\bbtnbb.exe72⤵PID:3764
-
\??\c:\nnbhnt.exec:\nnbhnt.exe73⤵PID:3256
-
\??\c:\pvdvp.exec:\pvdvp.exe74⤵PID:752
-
\??\c:\lxflrrl.exec:\lxflrrl.exe75⤵PID:5052
-
\??\c:\xrxrlfx.exec:\xrxrlfx.exe76⤵PID:1792
-
\??\c:\btnnhb.exec:\btnnhb.exe77⤵PID:4796
-
\??\c:\1pdpj.exec:\1pdpj.exe78⤵PID:1088
-
\??\c:\rfrlxxr.exec:\rfrlxxr.exe79⤵PID:4020
-
\??\c:\ffllfxr.exec:\ffllfxr.exe80⤵PID:468
-
\??\c:\btttnn.exec:\btttnn.exe81⤵PID:4404
-
\??\c:\ddjjv.exec:\ddjjv.exe82⤵PID:4044
-
\??\c:\fxrlxrr.exec:\fxrlxrr.exe83⤵PID:3024
-
\??\c:\tnnnhh.exec:\tnnnhh.exe84⤵PID:3700
-
\??\c:\pjpjd.exec:\pjpjd.exe85⤵PID:1364
-
\??\c:\jvpjv.exec:\jvpjv.exe86⤵PID:1120
-
\??\c:\xrrfxrf.exec:\xrrfxrf.exe87⤵PID:3332
-
\??\c:\nhbbtt.exec:\nhbbtt.exe88⤵PID:4316
-
\??\c:\9djdp.exec:\9djdp.exe89⤵PID:3224
-
\??\c:\pddjd.exec:\pddjd.exe90⤵PID:4940
-
\??\c:\xxfffxx.exec:\xxfffxx.exe91⤵PID:3668
-
\??\c:\bnnnhh.exec:\bnnnhh.exe92⤵PID:3976
-
\??\c:\hhbbhh.exec:\hhbbhh.exe93⤵PID:2508
-
\??\c:\ppvvj.exec:\ppvvj.exe94⤵PID:1368
-
\??\c:\9fffrlf.exec:\9fffrlf.exe95⤵PID:3576
-
\??\c:\tnnnhh.exec:\tnnnhh.exe96⤵PID:4232
-
\??\c:\9bbbtt.exec:\9bbbtt.exe97⤵PID:2164
-
\??\c:\vvvpp.exec:\vvvpp.exe98⤵PID:2232
-
\??\c:\llfxffr.exec:\llfxffr.exe99⤵PID:3292
-
\??\c:\thtntn.exec:\thtntn.exe100⤵PID:3928
-
\??\c:\jjjdp.exec:\jjjdp.exe101⤵PID:2052
-
\??\c:\1ddpd.exec:\1ddpd.exe102⤵PID:1468
-
\??\c:\3xfflfl.exec:\3xfflfl.exe103⤵PID:1472
-
\??\c:\nhbtnh.exec:\nhbtnh.exe104⤵PID:2088
-
\??\c:\dvvpd.exec:\dvvpd.exe105⤵PID:3664
-
\??\c:\1rrrllf.exec:\1rrrllf.exe106⤵PID:5012
-
\??\c:\fxrrrrl.exec:\fxrrrrl.exe107⤵PID:1400
-
\??\c:\hbbnhb.exec:\hbbnhb.exe108⤵PID:4480
-
\??\c:\ddpjj.exec:\ddpjj.exe109⤵PID:1540
-
\??\c:\lrfxrxr.exec:\lrfxrxr.exe110⤵PID:3036
-
\??\c:\1tnnhh.exec:\1tnnhh.exe111⤵PID:1724
-
\??\c:\nnhhnb.exec:\nnhhnb.exe112⤵PID:3904
-
\??\c:\jvjdd.exec:\jvjdd.exe113⤵PID:3132
-
\??\c:\frffxff.exec:\frffxff.exe114⤵PID:2668
-
\??\c:\xflllll.exec:\xflllll.exe115⤵PID:672
-
\??\c:\nnthbt.exec:\nnthbt.exe116⤵PID:888
-
\??\c:\pjppj.exec:\pjppj.exe117⤵PID:2992
-
\??\c:\vjddd.exec:\vjddd.exe118⤵PID:556
-
\??\c:\fxrrlrr.exec:\fxrrlrr.exe119⤵PID:4332
-
\??\c:\nhbthn.exec:\nhbthn.exe120⤵PID:4192
-
\??\c:\ppvvp.exec:\ppvvp.exe121⤵PID:1048
-
\??\c:\pdddv.exec:\pdddv.exe122⤵PID:2648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-