Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 03:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3d353bb177b2d5b32a1ce93222eb127f691f7d9afb133093c98422b04f4dd568.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
3d353bb177b2d5b32a1ce93222eb127f691f7d9afb133093c98422b04f4dd568.exe
-
Size
453KB
-
MD5
b70d25eed3d9ed33864f62e5090b2583
-
SHA1
a31aa27f72b9f48c7e80ea5dac32f99653c35063
-
SHA256
3d353bb177b2d5b32a1ce93222eb127f691f7d9afb133093c98422b04f4dd568
-
SHA512
65b962fa8f481d7867f1a7cc9e46f170b1a68b87c1ba7ab482360dc190041c8e997d8cd807b3e092ad8395dc1762226512737c7799691ffd60bec999b5b8cd69
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4692-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1028-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/996-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4284-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/784-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/712-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-726-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-866-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-915-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-1680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-1840-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4216 pdjdp.exe 4968 rllrlfx.exe 3728 1vvvv.exe 1028 jddvv.exe 5092 xlrllfx.exe 2420 pppjd.exe 4884 lxxxrlf.exe 3480 tbhbtt.exe 1356 hbthhn.exe 3028 dvvpv.exe 2240 ntthbt.exe 996 dpvvp.exe 4284 ddjdp.exe 2364 rfxrfxr.exe 1372 7ttnbt.exe 1816 ddjdj.exe 3088 xfrlrrl.exe 1844 htttnh.exe 784 vjjvp.exe 2960 lxrlfxr.exe 1832 thnhhn.exe 2580 pjjjd.exe 1016 7jpjj.exe 1056 xrlfxxr.exe 760 ntbthh.exe 1304 ntbtnh.exe 2488 dvdjj.exe 3960 nhnnhb.exe 1648 llxrxrx.exe 3440 5thbtt.exe 4848 pddpj.exe 4448 dvdvp.exe 2024 vpvjd.exe 4032 nbnbhb.exe 4432 jvvvp.exe 712 jvvpd.exe 1756 xllxlrl.exe 4956 9tthnh.exe 2404 pjpjp.exe 4380 rxfrfxl.exe 1000 tbnbtt.exe 4272 1vpjv.exe 4804 xlfxlfx.exe 4424 btbtbt.exe 4216 bbhbnn.exe 3084 pjjdv.exe 1464 fxrlxrl.exe 2788 tnnhbt.exe 876 pddvv.exe 5116 5xrfrlr.exe 4068 xflfxrr.exe 4304 nbnhhb.exe 1164 pvvjd.exe 4816 fxrlxrl.exe 3480 lflfflf.exe 2964 tnnbtn.exe 4844 ppjdv.exe 3028 frfxxrr.exe 1968 httnhb.exe 2520 dpvjj.exe 1004 vpjdp.exe 1736 xrrlxrf.exe 1604 thhnbt.exe 872 jpvpj.exe -
resource yara_rule behavioral2/memory/4692-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1028-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/996-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4284-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/784-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/712-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-733-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-866-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-915-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fffrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4692 wrote to memory of 4216 4692 3d353bb177b2d5b32a1ce93222eb127f691f7d9afb133093c98422b04f4dd568.exe 82 PID 4692 wrote to memory of 4216 4692 3d353bb177b2d5b32a1ce93222eb127f691f7d9afb133093c98422b04f4dd568.exe 82 PID 4692 wrote to memory of 4216 4692 3d353bb177b2d5b32a1ce93222eb127f691f7d9afb133093c98422b04f4dd568.exe 82 PID 4216 wrote to memory of 4968 4216 pdjdp.exe 83 PID 4216 wrote to memory of 4968 4216 pdjdp.exe 83 PID 4216 wrote to memory of 4968 4216 pdjdp.exe 83 PID 4968 wrote to memory of 3728 4968 rllrlfx.exe 84 PID 4968 wrote to memory of 3728 4968 rllrlfx.exe 84 PID 4968 wrote to memory of 3728 4968 rllrlfx.exe 84 PID 3728 wrote to memory of 1028 3728 1vvvv.exe 85 PID 3728 wrote to memory of 1028 3728 1vvvv.exe 85 PID 3728 wrote to memory of 1028 3728 1vvvv.exe 85 PID 1028 wrote to memory of 5092 1028 jddvv.exe 86 PID 1028 wrote to memory of 5092 1028 jddvv.exe 86 PID 1028 wrote to memory of 5092 1028 jddvv.exe 86 PID 5092 wrote to memory of 2420 5092 xlrllfx.exe 87 PID 5092 wrote to memory of 2420 5092 xlrllfx.exe 87 PID 5092 wrote to memory of 2420 5092 xlrllfx.exe 87 PID 2420 wrote to memory of 4884 2420 pppjd.exe 88 PID 2420 wrote to memory of 4884 2420 pppjd.exe 88 PID 2420 wrote to memory of 4884 2420 pppjd.exe 88 PID 4884 wrote to memory of 3480 4884 lxxxrlf.exe 89 PID 4884 wrote to memory of 3480 4884 lxxxrlf.exe 89 PID 4884 wrote to memory of 3480 4884 lxxxrlf.exe 89 PID 3480 wrote to memory of 1356 3480 tbhbtt.exe 90 PID 3480 wrote to memory of 1356 3480 tbhbtt.exe 90 PID 3480 wrote to memory of 1356 3480 tbhbtt.exe 90 PID 1356 wrote to memory of 3028 1356 hbthhn.exe 91 PID 1356 wrote to memory of 3028 1356 hbthhn.exe 91 PID 1356 wrote to memory of 3028 1356 hbthhn.exe 91 PID 3028 wrote to memory of 2240 3028 dvvpv.exe 92 PID 3028 wrote to memory of 2240 3028 dvvpv.exe 92 PID 3028 wrote to memory of 2240 3028 dvvpv.exe 92 PID 2240 wrote to memory of 996 2240 ntthbt.exe 93 PID 2240 wrote to memory of 996 2240 ntthbt.exe 93 PID 2240 wrote to memory of 996 2240 ntthbt.exe 93 PID 996 wrote to memory of 4284 996 dpvvp.exe 94 PID 996 wrote to memory of 4284 996 dpvvp.exe 94 PID 996 wrote to memory of 4284 996 dpvvp.exe 94 PID 4284 wrote to memory of 2364 4284 ddjdp.exe 95 PID 4284 wrote to memory of 2364 4284 ddjdp.exe 95 PID 4284 wrote to memory of 2364 4284 ddjdp.exe 95 PID 2364 wrote to memory of 1372 2364 rfxrfxr.exe 96 PID 2364 wrote to memory of 1372 2364 rfxrfxr.exe 96 PID 2364 wrote to memory of 1372 2364 rfxrfxr.exe 96 PID 1372 wrote to memory of 1816 1372 7ttnbt.exe 97 PID 1372 wrote to memory of 1816 1372 7ttnbt.exe 97 PID 1372 wrote to memory of 1816 1372 7ttnbt.exe 97 PID 1816 wrote to memory of 3088 1816 ddjdj.exe 98 PID 1816 wrote to memory of 3088 1816 ddjdj.exe 98 PID 1816 wrote to memory of 3088 1816 ddjdj.exe 98 PID 3088 wrote to memory of 1844 3088 xfrlrrl.exe 99 PID 3088 wrote to memory of 1844 3088 xfrlrrl.exe 99 PID 3088 wrote to memory of 1844 3088 xfrlrrl.exe 99 PID 1844 wrote to memory of 784 1844 htttnh.exe 100 PID 1844 wrote to memory of 784 1844 htttnh.exe 100 PID 1844 wrote to memory of 784 1844 htttnh.exe 100 PID 784 wrote to memory of 2960 784 vjjvp.exe 101 PID 784 wrote to memory of 2960 784 vjjvp.exe 101 PID 784 wrote to memory of 2960 784 vjjvp.exe 101 PID 2960 wrote to memory of 1832 2960 lxrlfxr.exe 102 PID 2960 wrote to memory of 1832 2960 lxrlfxr.exe 102 PID 2960 wrote to memory of 1832 2960 lxrlfxr.exe 102 PID 1832 wrote to memory of 2580 1832 thnhhn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d353bb177b2d5b32a1ce93222eb127f691f7d9afb133093c98422b04f4dd568.exe"C:\Users\Admin\AppData\Local\Temp\3d353bb177b2d5b32a1ce93222eb127f691f7d9afb133093c98422b04f4dd568.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\pdjdp.exec:\pdjdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\rllrlfx.exec:\rllrlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\1vvvv.exec:\1vvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\jddvv.exec:\jddvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\xlrllfx.exec:\xlrllfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\pppjd.exec:\pppjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\lxxxrlf.exec:\lxxxrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\tbhbtt.exec:\tbhbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\hbthhn.exec:\hbthhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\dvvpv.exec:\dvvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\ntthbt.exec:\ntthbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\dpvvp.exec:\dpvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\ddjdp.exec:\ddjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\rfxrfxr.exec:\rfxrfxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\7ttnbt.exec:\7ttnbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\ddjdj.exec:\ddjdj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\xfrlrrl.exec:\xfrlrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\htttnh.exec:\htttnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\vjjvp.exec:\vjjvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\thnhhn.exec:\thnhhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\pjjjd.exec:\pjjjd.exe23⤵
- Executes dropped EXE
PID:2580 -
\??\c:\7jpjj.exec:\7jpjj.exe24⤵
- Executes dropped EXE
PID:1016 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe25⤵
- Executes dropped EXE
PID:1056 -
\??\c:\ntbthh.exec:\ntbthh.exe26⤵
- Executes dropped EXE
PID:760 -
\??\c:\ntbtnh.exec:\ntbtnh.exe27⤵
- Executes dropped EXE
PID:1304 -
\??\c:\dvdjj.exec:\dvdjj.exe28⤵
- Executes dropped EXE
PID:2488 -
\??\c:\nhnnhb.exec:\nhnnhb.exe29⤵
- Executes dropped EXE
PID:3960 -
\??\c:\llxrxrx.exec:\llxrxrx.exe30⤵
- Executes dropped EXE
PID:1648 -
\??\c:\5thbtt.exec:\5thbtt.exe31⤵
- Executes dropped EXE
PID:3440 -
\??\c:\pddpj.exec:\pddpj.exe32⤵
- Executes dropped EXE
PID:4848 -
\??\c:\dvdvp.exec:\dvdvp.exe33⤵
- Executes dropped EXE
PID:4448 -
\??\c:\vpvjd.exec:\vpvjd.exe34⤵
- Executes dropped EXE
PID:2024 -
\??\c:\nbnbhb.exec:\nbnbhb.exe35⤵
- Executes dropped EXE
PID:4032 -
\??\c:\jvvvp.exec:\jvvvp.exe36⤵
- Executes dropped EXE
PID:4432 -
\??\c:\jvvpd.exec:\jvvpd.exe37⤵
- Executes dropped EXE
PID:712 -
\??\c:\xllxlrl.exec:\xllxlrl.exe38⤵
- Executes dropped EXE
PID:1756 -
\??\c:\9tthnh.exec:\9tthnh.exe39⤵
- Executes dropped EXE
PID:4956 -
\??\c:\pjpjp.exec:\pjpjp.exe40⤵
- Executes dropped EXE
PID:2404 -
\??\c:\rxfrfxl.exec:\rxfrfxl.exe41⤵
- Executes dropped EXE
PID:4380 -
\??\c:\tbnbtt.exec:\tbnbtt.exe42⤵
- Executes dropped EXE
PID:1000 -
\??\c:\1vpjv.exec:\1vpjv.exe43⤵
- Executes dropped EXE
PID:4272 -
\??\c:\xlfxlfx.exec:\xlfxlfx.exe44⤵
- Executes dropped EXE
PID:4804 -
\??\c:\btbtbt.exec:\btbtbt.exe45⤵
- Executes dropped EXE
PID:4424 -
\??\c:\bbhbnn.exec:\bbhbnn.exe46⤵
- Executes dropped EXE
PID:4216 -
\??\c:\pjjdv.exec:\pjjdv.exe47⤵
- Executes dropped EXE
PID:3084 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe48⤵
- Executes dropped EXE
PID:1464 -
\??\c:\tnnhbt.exec:\tnnhbt.exe49⤵
- Executes dropped EXE
PID:2788 -
\??\c:\pddvv.exec:\pddvv.exe50⤵
- Executes dropped EXE
PID:876 -
\??\c:\5xrfrlr.exec:\5xrfrlr.exe51⤵
- Executes dropped EXE
PID:5116 -
\??\c:\xflfxrr.exec:\xflfxrr.exe52⤵
- Executes dropped EXE
PID:4068 -
\??\c:\nbnhhb.exec:\nbnhhb.exe53⤵
- Executes dropped EXE
PID:4304 -
\??\c:\pvvjd.exec:\pvvjd.exe54⤵
- Executes dropped EXE
PID:1164 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe55⤵
- Executes dropped EXE
PID:4816 -
\??\c:\lflfflf.exec:\lflfflf.exe56⤵
- Executes dropped EXE
PID:3480 -
\??\c:\tnnbtn.exec:\tnnbtn.exe57⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ppjdv.exec:\ppjdv.exe58⤵
- Executes dropped EXE
PID:4844 -
\??\c:\frfxxrr.exec:\frfxxrr.exe59⤵
- Executes dropped EXE
PID:3028 -
\??\c:\httnhb.exec:\httnhb.exe60⤵
- Executes dropped EXE
PID:1968 -
\??\c:\dpvjj.exec:\dpvjj.exe61⤵
- Executes dropped EXE
PID:2520 -
\??\c:\vpjdp.exec:\vpjdp.exe62⤵
- Executes dropped EXE
PID:1004 -
\??\c:\xrrlxrf.exec:\xrrlxrf.exe63⤵
- Executes dropped EXE
PID:1736 -
\??\c:\thhnbt.exec:\thhnbt.exe64⤵
- Executes dropped EXE
PID:1604 -
\??\c:\jpvpj.exec:\jpvpj.exe65⤵
- Executes dropped EXE
PID:872 -
\??\c:\1rlxlff.exec:\1rlxlff.exe66⤵PID:3656
-
\??\c:\3hhbnn.exec:\3hhbnn.exe67⤵PID:3504
-
\??\c:\5djvv.exec:\5djvv.exe68⤵
- System Location Discovery: System Language Discovery
PID:2244 -
\??\c:\xflxlxr.exec:\xflxlxr.exe69⤵PID:1668
-
\??\c:\hbthtb.exec:\hbthtb.exe70⤵PID:2756
-
\??\c:\jpvpj.exec:\jpvpj.exe71⤵PID:3544
-
\??\c:\pjpdv.exec:\pjpdv.exe72⤵PID:2096
-
\??\c:\lfffxfr.exec:\lfffxfr.exe73⤵PID:3540
-
\??\c:\htnhtn.exec:\htnhtn.exe74⤵PID:5004
-
\??\c:\dpvjv.exec:\dpvjv.exe75⤵PID:532
-
\??\c:\5lfxrlf.exec:\5lfxrlf.exe76⤵PID:2016
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe77⤵PID:3732
-
\??\c:\bntbnn.exec:\bntbnn.exe78⤵
- System Location Discovery: System Language Discovery
PID:644 -
\??\c:\3ppjd.exec:\3ppjd.exe79⤵PID:2396
-
\??\c:\xflfxxr.exec:\xflfxxr.exe80⤵PID:2896
-
\??\c:\lxfrlfx.exec:\lxfrlfx.exe81⤵PID:920
-
\??\c:\bttnbt.exec:\bttnbt.exe82⤵PID:1504
-
\??\c:\nnthtt.exec:\nnthtt.exe83⤵PID:468
-
\??\c:\dvvjd.exec:\dvvjd.exe84⤵PID:4224
-
\??\c:\fxllxfr.exec:\fxllxfr.exe85⤵PID:3960
-
\??\c:\tbbthb.exec:\tbbthb.exe86⤵PID:4468
-
\??\c:\jvvpj.exec:\jvvpj.exe87⤵PID:2260
-
\??\c:\ppdvp.exec:\ppdvp.exe88⤵PID:4880
-
\??\c:\lrrrlrl.exec:\lrrrlrl.exe89⤵PID:3664
-
\??\c:\flrlffx.exec:\flrlffx.exe90⤵PID:3372
-
\??\c:\1nnnhh.exec:\1nnnhh.exe91⤵PID:2716
-
\??\c:\vvdvp.exec:\vvdvp.exe92⤵PID:4368
-
\??\c:\vdvpj.exec:\vdvpj.exe93⤵PID:2024
-
\??\c:\fflxrlx.exec:\fflxrlx.exe94⤵PID:4032
-
\??\c:\nbhbbt.exec:\nbhbbt.exe95⤵PID:2852
-
\??\c:\vdjjd.exec:\vdjjd.exe96⤵PID:3448
-
\??\c:\pjjpj.exec:\pjjpj.exe97⤵PID:4484
-
\??\c:\fxxrlll.exec:\fxxrlll.exe98⤵PID:3156
-
\??\c:\rrxxrrx.exec:\rrxxrrx.exe99⤵PID:4704
-
\??\c:\nttnbt.exec:\nttnbt.exe100⤵PID:4408
-
\??\c:\pdddd.exec:\pdddd.exe101⤵PID:4864
-
\??\c:\dppdv.exec:\dppdv.exe102⤵PID:4424
-
\??\c:\lfxrrrl.exec:\lfxrrrl.exe103⤵PID:4968
-
\??\c:\9nnnhh.exec:\9nnnhh.exe104⤵PID:2320
-
\??\c:\jpdvp.exec:\jpdvp.exe105⤵PID:2968
-
\??\c:\hbbhbt.exec:\hbbhbt.exe106⤵PID:4416
-
\??\c:\jvjvd.exec:\jvjvd.exe107⤵PID:3056
-
\??\c:\9djdp.exec:\9djdp.exe108⤵PID:5092
-
\??\c:\lfflfll.exec:\lfflfll.exe109⤵PID:4068
-
\??\c:\hhhhbb.exec:\hhhhbb.exe110⤵PID:1960
-
\??\c:\1djdd.exec:\1djdd.exe111⤵PID:5084
-
\??\c:\7rrlrlf.exec:\7rrlrlf.exe112⤵PID:3452
-
\??\c:\nhntnh.exec:\nhntnh.exe113⤵PID:1940
-
\??\c:\tbtnhb.exec:\tbtnhb.exe114⤵PID:3112
-
\??\c:\pdpjd.exec:\pdpjd.exe115⤵PID:4584
-
\??\c:\rlfxlfx.exec:\rlfxlfx.exe116⤵PID:2508
-
\??\c:\hnhnnt.exec:\hnhnnt.exe117⤵PID:2240
-
\??\c:\9vvjv.exec:\9vvjv.exe118⤵PID:4064
-
\??\c:\jpvpv.exec:\jpvpv.exe119⤵PID:2520
-
\??\c:\5lrffxf.exec:\5lrffxf.exe120⤵PID:1004
-
\??\c:\hbnhbh.exec:\hbnhbh.exe121⤵PID:2464
-
\??\c:\dpvpp.exec:\dpvpp.exe122⤵PID:1604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-