Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 21:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
78ca8635cd1f0fef69a3a8b6d209720123e15be14274de2e5dfd71662e5752a3.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
78ca8635cd1f0fef69a3a8b6d209720123e15be14274de2e5dfd71662e5752a3.exe
-
Size
453KB
-
MD5
dc8c26447520c37deb9e094975c04789
-
SHA1
bf5e02804da24184a3801e374d67e619057b3952
-
SHA256
78ca8635cd1f0fef69a3a8b6d209720123e15be14274de2e5dfd71662e5752a3
-
SHA512
fd6f4724182b1072e337f8fd6a2d52a6c7087e7f21cb2a9b5872049c473d0bca3f3c9c14a135765f5645f5d95674456c1a506807c2ef48050d24f5bc6f1921cb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeA:q7Tc2NYHUrAwfMp3CDA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1064-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/320-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/112-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2068-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/700-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2472-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-715-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-761-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-813-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-892-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-998-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-1544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 32 ppjvj.exe 1640 btbttb.exe 4996 hntnbb.exe 4972 vpjdd.exe 1976 xflfrlf.exe 2156 bntnhb.exe 4044 jvvpp.exe 2636 7llffxx.exe 4920 nbhbtn.exe 320 bhhtnh.exe 2436 1nnhhb.exe 4952 llrfxxr.exe 2428 htbttn.exe 5068 rllfxxr.exe 3976 tttnhh.exe 1484 9vvpd.exe 4832 lxfxrlf.exe 4048 xrrfxrl.exe 2828 vpvpj.exe 3864 pppvd.exe 3404 7flxfff.exe 4836 3hbnht.exe 2464 dddpj.exe 1560 xfffrll.exe 2612 xxfrrlf.exe 1700 5bbtnh.exe 4628 djjdp.exe 3860 rfrxlfr.exe 3256 xfxlxll.exe 4392 1jjvp.exe 2400 nnhbtn.exe 3292 xflfrlr.exe 2740 djjdp.exe 112 rfrllfl.exe 3012 tntnhh.exe 4404 vdvpj.exe 4408 xflfxrl.exe 3512 thhbtn.exe 1020 ddjdj.exe 2448 1rlfrrl.exe 332 bbtthb.exe 3972 ppjdp.exe 2076 1xrxllx.exe 3528 5hnbtn.exe 3484 3ddpd.exe 2616 pdpdj.exe 3232 rllfxxr.exe 2192 hbhbhh.exe 4300 ppjvp.exe 2176 rxrfxrl.exe 2244 lrlxrll.exe 1216 httnbb.exe 2068 jpvjv.exe 1460 xxxrfxr.exe 1492 tbbtht.exe 3644 ppjdj.exe 700 dvvjj.exe 876 lxxrfxr.exe 4124 hnnnhb.exe 816 vvdpj.exe 3616 5jdvp.exe 4312 xlxlrlx.exe 4240 5hnbbb.exe 624 pppjp.exe -
resource yara_rule behavioral2/memory/1064-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/32-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/112-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/700-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-605-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfrlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1064 wrote to memory of 32 1064 78ca8635cd1f0fef69a3a8b6d209720123e15be14274de2e5dfd71662e5752a3.exe 83 PID 1064 wrote to memory of 32 1064 78ca8635cd1f0fef69a3a8b6d209720123e15be14274de2e5dfd71662e5752a3.exe 83 PID 1064 wrote to memory of 32 1064 78ca8635cd1f0fef69a3a8b6d209720123e15be14274de2e5dfd71662e5752a3.exe 83 PID 32 wrote to memory of 1640 32 ppjvj.exe 84 PID 32 wrote to memory of 1640 32 ppjvj.exe 84 PID 32 wrote to memory of 1640 32 ppjvj.exe 84 PID 1640 wrote to memory of 4996 1640 btbttb.exe 85 PID 1640 wrote to memory of 4996 1640 btbttb.exe 85 PID 1640 wrote to memory of 4996 1640 btbttb.exe 85 PID 4996 wrote to memory of 4972 4996 hntnbb.exe 86 PID 4996 wrote to memory of 4972 4996 hntnbb.exe 86 PID 4996 wrote to memory of 4972 4996 hntnbb.exe 86 PID 4972 wrote to memory of 1976 4972 vpjdd.exe 87 PID 4972 wrote to memory of 1976 4972 vpjdd.exe 87 PID 4972 wrote to memory of 1976 4972 vpjdd.exe 87 PID 1976 wrote to memory of 2156 1976 xflfrlf.exe 88 PID 1976 wrote to memory of 2156 1976 xflfrlf.exe 88 PID 1976 wrote to memory of 2156 1976 xflfrlf.exe 88 PID 2156 wrote to memory of 4044 2156 bntnhb.exe 89 PID 2156 wrote to memory of 4044 2156 bntnhb.exe 89 PID 2156 wrote to memory of 4044 2156 bntnhb.exe 89 PID 4044 wrote to memory of 2636 4044 jvvpp.exe 90 PID 4044 wrote to memory of 2636 4044 jvvpp.exe 90 PID 4044 wrote to memory of 2636 4044 jvvpp.exe 90 PID 2636 wrote to memory of 4920 2636 7llffxx.exe 91 PID 2636 wrote to memory of 4920 2636 7llffxx.exe 91 PID 2636 wrote to memory of 4920 2636 7llffxx.exe 91 PID 4920 wrote to memory of 320 4920 nbhbtn.exe 92 PID 4920 wrote to memory of 320 4920 nbhbtn.exe 92 PID 4920 wrote to memory of 320 4920 nbhbtn.exe 92 PID 320 wrote to memory of 2436 320 bhhtnh.exe 93 PID 320 wrote to memory of 2436 320 bhhtnh.exe 93 PID 320 wrote to memory of 2436 320 bhhtnh.exe 93 PID 2436 wrote to memory of 4952 2436 1nnhhb.exe 94 PID 2436 wrote to memory of 4952 2436 1nnhhb.exe 94 PID 2436 wrote to memory of 4952 2436 1nnhhb.exe 94 PID 4952 wrote to memory of 2428 4952 llrfxxr.exe 95 PID 4952 wrote to memory of 2428 4952 llrfxxr.exe 95 PID 4952 wrote to memory of 2428 4952 llrfxxr.exe 95 PID 2428 wrote to memory of 5068 2428 htbttn.exe 96 PID 2428 wrote to memory of 5068 2428 htbttn.exe 96 PID 2428 wrote to memory of 5068 2428 htbttn.exe 96 PID 5068 wrote to memory of 3976 5068 rllfxxr.exe 97 PID 5068 wrote to memory of 3976 5068 rllfxxr.exe 97 PID 5068 wrote to memory of 3976 5068 rllfxxr.exe 97 PID 3976 wrote to memory of 1484 3976 tttnhh.exe 98 PID 3976 wrote to memory of 1484 3976 tttnhh.exe 98 PID 3976 wrote to memory of 1484 3976 tttnhh.exe 98 PID 1484 wrote to memory of 4832 1484 9vvpd.exe 99 PID 1484 wrote to memory of 4832 1484 9vvpd.exe 99 PID 1484 wrote to memory of 4832 1484 9vvpd.exe 99 PID 4832 wrote to memory of 4048 4832 lxfxrlf.exe 100 PID 4832 wrote to memory of 4048 4832 lxfxrlf.exe 100 PID 4832 wrote to memory of 4048 4832 lxfxrlf.exe 100 PID 4048 wrote to memory of 2828 4048 xrrfxrl.exe 101 PID 4048 wrote to memory of 2828 4048 xrrfxrl.exe 101 PID 4048 wrote to memory of 2828 4048 xrrfxrl.exe 101 PID 2828 wrote to memory of 3864 2828 vpvpj.exe 102 PID 2828 wrote to memory of 3864 2828 vpvpj.exe 102 PID 2828 wrote to memory of 3864 2828 vpvpj.exe 102 PID 3864 wrote to memory of 3404 3864 pppvd.exe 103 PID 3864 wrote to memory of 3404 3864 pppvd.exe 103 PID 3864 wrote to memory of 3404 3864 pppvd.exe 103 PID 3404 wrote to memory of 4836 3404 7flxfff.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\78ca8635cd1f0fef69a3a8b6d209720123e15be14274de2e5dfd71662e5752a3.exe"C:\Users\Admin\AppData\Local\Temp\78ca8635cd1f0fef69a3a8b6d209720123e15be14274de2e5dfd71662e5752a3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\ppjvj.exec:\ppjvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\btbttb.exec:\btbttb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\hntnbb.exec:\hntnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\vpjdd.exec:\vpjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\xflfrlf.exec:\xflfrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\bntnhb.exec:\bntnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\jvvpp.exec:\jvvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\7llffxx.exec:\7llffxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\nbhbtn.exec:\nbhbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\bhhtnh.exec:\bhhtnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\1nnhhb.exec:\1nnhhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\llrfxxr.exec:\llrfxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\htbttn.exec:\htbttn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\rllfxxr.exec:\rllfxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\tttnhh.exec:\tttnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\9vvpd.exec:\9vvpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\xrrfxrl.exec:\xrrfxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\vpvpj.exec:\vpvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\pppvd.exec:\pppvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\7flxfff.exec:\7flxfff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\3hbnht.exec:\3hbnht.exe23⤵
- Executes dropped EXE
PID:4836 -
\??\c:\dddpj.exec:\dddpj.exe24⤵
- Executes dropped EXE
PID:2464 -
\??\c:\xfffrll.exec:\xfffrll.exe25⤵
- Executes dropped EXE
PID:1560 -
\??\c:\xxfrrlf.exec:\xxfrrlf.exe26⤵
- Executes dropped EXE
PID:2612 -
\??\c:\5bbtnh.exec:\5bbtnh.exe27⤵
- Executes dropped EXE
PID:1700 -
\??\c:\djjdp.exec:\djjdp.exe28⤵
- Executes dropped EXE
PID:4628 -
\??\c:\rfrxlfr.exec:\rfrxlfr.exe29⤵
- Executes dropped EXE
PID:3860 -
\??\c:\xfxlxll.exec:\xfxlxll.exe30⤵
- Executes dropped EXE
PID:3256 -
\??\c:\1jjvp.exec:\1jjvp.exe31⤵
- Executes dropped EXE
PID:4392 -
\??\c:\nnhbtn.exec:\nnhbtn.exe32⤵
- Executes dropped EXE
PID:2400 -
\??\c:\xflfrlr.exec:\xflfrlr.exe33⤵
- Executes dropped EXE
PID:3292 -
\??\c:\djjdp.exec:\djjdp.exe34⤵
- Executes dropped EXE
PID:2740 -
\??\c:\rfrllfl.exec:\rfrllfl.exe35⤵
- Executes dropped EXE
PID:112 -
\??\c:\tntnhh.exec:\tntnhh.exe36⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vdvpj.exec:\vdvpj.exe37⤵
- Executes dropped EXE
PID:4404 -
\??\c:\xflfxrl.exec:\xflfxrl.exe38⤵
- Executes dropped EXE
PID:4408 -
\??\c:\thhbtn.exec:\thhbtn.exe39⤵
- Executes dropped EXE
PID:3512 -
\??\c:\ddjdj.exec:\ddjdj.exe40⤵
- Executes dropped EXE
PID:1020 -
\??\c:\1rlfrrl.exec:\1rlfrrl.exe41⤵
- Executes dropped EXE
PID:2448 -
\??\c:\bbtthb.exec:\bbtthb.exe42⤵
- Executes dropped EXE
PID:332 -
\??\c:\ppjdp.exec:\ppjdp.exe43⤵
- Executes dropped EXE
PID:3972 -
\??\c:\1xrxllx.exec:\1xrxllx.exe44⤵
- Executes dropped EXE
PID:2076 -
\??\c:\5hnbtn.exec:\5hnbtn.exe45⤵
- Executes dropped EXE
PID:3528 -
\??\c:\3ddpd.exec:\3ddpd.exe46⤵
- Executes dropped EXE
PID:3484 -
\??\c:\pdpdj.exec:\pdpdj.exe47⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rllfxxr.exec:\rllfxxr.exe48⤵
- Executes dropped EXE
PID:3232 -
\??\c:\hbhbhh.exec:\hbhbhh.exe49⤵
- Executes dropped EXE
PID:2192 -
\??\c:\ppjvp.exec:\ppjvp.exe50⤵
- Executes dropped EXE
PID:4300 -
\??\c:\rxrfxrl.exec:\rxrfxrl.exe51⤵
- Executes dropped EXE
PID:2176 -
\??\c:\lrlxrll.exec:\lrlxrll.exe52⤵
- Executes dropped EXE
PID:2244 -
\??\c:\httnbb.exec:\httnbb.exe53⤵
- Executes dropped EXE
PID:1216 -
\??\c:\jpvjv.exec:\jpvjv.exe54⤵
- Executes dropped EXE
PID:2068 -
\??\c:\xxxrfxr.exec:\xxxrfxr.exe55⤵
- Executes dropped EXE
PID:1460 -
\??\c:\tbbtht.exec:\tbbtht.exe56⤵
- Executes dropped EXE
PID:1492 -
\??\c:\ppjdj.exec:\ppjdj.exe57⤵
- Executes dropped EXE
PID:3644 -
\??\c:\dvvjj.exec:\dvvjj.exe58⤵
- Executes dropped EXE
PID:700 -
\??\c:\lxxrfxr.exec:\lxxrfxr.exe59⤵
- Executes dropped EXE
PID:876 -
\??\c:\hnnnhb.exec:\hnnnhb.exe60⤵
- Executes dropped EXE
PID:4124 -
\??\c:\vvdpj.exec:\vvdpj.exe61⤵
- Executes dropped EXE
PID:816 -
\??\c:\5jdvp.exec:\5jdvp.exe62⤵
- Executes dropped EXE
PID:3616 -
\??\c:\xlxlrlx.exec:\xlxlrlx.exe63⤵
- Executes dropped EXE
PID:4312 -
\??\c:\5hnbbb.exec:\5hnbbb.exe64⤵
- Executes dropped EXE
PID:4240 -
\??\c:\pppjp.exec:\pppjp.exe65⤵
- Executes dropped EXE
PID:624 -
\??\c:\9llfrll.exec:\9llfrll.exe66⤵PID:4736
-
\??\c:\lxrlfxr.exec:\lxrlfxr.exe67⤵PID:2436
-
\??\c:\tnbnhb.exec:\tnbnhb.exe68⤵PID:696
-
\??\c:\pdddv.exec:\pdddv.exe69⤵PID:2428
-
\??\c:\5rrfxrr.exec:\5rrfxrr.exe70⤵PID:1624
-
\??\c:\ttbbnh.exec:\ttbbnh.exe71⤵PID:4148
-
\??\c:\dpvpp.exec:\dpvpp.exe72⤵PID:4540
-
\??\c:\pjjvj.exec:\pjjvj.exe73⤵PID:1300
-
\??\c:\xxrfrrl.exec:\xxrfrrl.exe74⤵PID:5108
-
\??\c:\nbbthb.exec:\nbbthb.exe75⤵PID:4048
-
\??\c:\vppjd.exec:\vppjd.exe76⤵PID:4436
-
\??\c:\rflfxrl.exec:\rflfxrl.exe77⤵PID:2752
-
\??\c:\xxfxfxr.exec:\xxfxfxr.exe78⤵PID:2472
-
\??\c:\9nhbhb.exec:\9nhbhb.exe79⤵PID:640
-
\??\c:\3vvpj.exec:\3vvpj.exe80⤵PID:3600
-
\??\c:\fxlffxx.exec:\fxlffxx.exe81⤵PID:3580
-
\??\c:\nnnntn.exec:\nnnntn.exe82⤵PID:4840
-
\??\c:\vpvpp.exec:\vpvpp.exe83⤵PID:1852
-
\??\c:\rrxflrx.exec:\rrxflrx.exe84⤵
- System Location Discovery: System Language Discovery
PID:3744 -
\??\c:\rllfxrr.exec:\rllfxrr.exe85⤵PID:2228
-
\??\c:\tnhtnh.exec:\tnhtnh.exe86⤵PID:4032
-
\??\c:\1dvpj.exec:\1dvpj.exe87⤵PID:3144
-
\??\c:\rfffxrf.exec:\rfffxrf.exe88⤵PID:3624
-
\??\c:\bntnhh.exec:\bntnhh.exe89⤵PID:4548
-
\??\c:\jppjv.exec:\jppjv.exe90⤵PID:948
-
\??\c:\rfffxrl.exec:\rfffxrl.exe91⤵PID:2276
-
\??\c:\nhtbtn.exec:\nhtbtn.exe92⤵PID:1340
-
\??\c:\jdddj.exec:\jdddj.exe93⤵PID:1648
-
\??\c:\dvjdj.exec:\dvjdj.exe94⤵PID:5088
-
\??\c:\lxfxffl.exec:\lxfxffl.exe95⤵PID:3808
-
\??\c:\5hbtbt.exec:\5hbtbt.exe96⤵PID:2976
-
\??\c:\jvddv.exec:\jvddv.exe97⤵PID:4856
-
\??\c:\3xrlffx.exec:\3xrlffx.exe98⤵PID:1456
-
\??\c:\3xrfxfx.exec:\3xrfxfx.exe99⤵PID:2764
-
\??\c:\hbhtnn.exec:\hbhtnn.exe100⤵PID:3948
-
\??\c:\pvjvj.exec:\pvjvj.exe101⤵PID:2024
-
\??\c:\dvvjp.exec:\dvvjp.exe102⤵PID:3724
-
\??\c:\9xrfrlx.exec:\9xrfrlx.exe103⤵PID:836
-
\??\c:\bnnbtn.exec:\bnnbtn.exe104⤵PID:3628
-
\??\c:\1ppdv.exec:\1ppdv.exe105⤵PID:1148
-
\??\c:\vppdv.exec:\vppdv.exe106⤵PID:3068
-
\??\c:\lrfrffx.exec:\lrfrffx.exe107⤵PID:3528
-
\??\c:\fxfflff.exec:\fxfflff.exe108⤵PID:1676
-
\??\c:\btbttn.exec:\btbttn.exe109⤵PID:2616
-
\??\c:\djjdj.exec:\djjdj.exe110⤵PID:4328
-
\??\c:\5ddvj.exec:\5ddvj.exe111⤵PID:2192
-
\??\c:\rffrfxr.exec:\rffrfxr.exe112⤵PID:2736
-
\??\c:\3hhbtn.exec:\3hhbtn.exe113⤵PID:3400
-
\??\c:\5bbnhb.exec:\5bbnhb.exe114⤵PID:1640
-
\??\c:\vdjdv.exec:\vdjdv.exe115⤵PID:2020
-
\??\c:\7lfrlfl.exec:\7lfrlfl.exe116⤵
- System Location Discovery: System Language Discovery
PID:3444 -
\??\c:\1hhbtt.exec:\1hhbtt.exe117⤵PID:2216
-
\??\c:\nhthnh.exec:\nhthnh.exe118⤵PID:1568
-
\??\c:\vjpjj.exec:\vjpjj.exe119⤵PID:1168
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe120⤵PID:968
-
\??\c:\frxrffx.exec:\frxrffx.exe121⤵PID:1496
-
\??\c:\bntthb.exec:\bntthb.exe122⤵PID:1564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-