Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 03:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b09e5f655280df0c7e80a87b6546ed5effb4ab5739a1c68444b31857c9b329f7N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b09e5f655280df0c7e80a87b6546ed5effb4ab5739a1c68444b31857c9b329f7N.exe
-
Size
454KB
-
MD5
d80eb677e63c0b0255d3e4f81ea2e370
-
SHA1
79de23938cdda816f87cbab03ce167af2c508497
-
SHA256
b09e5f655280df0c7e80a87b6546ed5effb4ab5739a1c68444b31857c9b329f7
-
SHA512
35b2ade955bedd6e82ccce0162b081308d67ef8a7b672af4332060ec0ba7d7784493d517cdaee7db005f04fe24fdca46d6fec036fcc2e0f90e00854cebfa5282
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetk:q7Tc2NYHUrAwfMp3CDtk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4508-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2680-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3900-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1344-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-723-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-838-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-878-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-1177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-1343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-1404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3512 jvpjd.exe 1928 3hbthn.exe 3244 rxxrlrx.exe 4848 fllfxrl.exe 3676 dvjdv.exe 4976 nnnhhn.exe 2064 5jdvv.exe 2416 nttnnh.exe 3536 tttnhh.exe 4016 bhhhhn.exe 632 vpdpp.exe 4512 9fffxfx.exe 3532 vpdvv.exe 3492 djpjv.exe 3220 xxlfrrx.exe 1388 ntbtnn.exe 4132 thnnnt.exe 1964 jvvvv.exe 4056 tttnnn.exe 1252 5vdvj.exe 3760 bbnntn.exe 2312 5ntnnn.exe 2680 5dpdd.exe 1556 xfxrrrr.exe 4796 vppjd.exe 3372 htttnt.exe 4320 3jpjd.exe 4572 thhhnt.exe 2224 hthhhb.exe 3156 vvvvv.exe 2268 ppppp.exe 3472 xrrllrl.exe 3664 7vvvv.exe 1448 xxllfff.exe 3776 1nnhbb.exe 756 vvjjp.exe 2572 lrlxrrx.exe 400 tbttnt.exe 4032 pppvp.exe 4556 fflfffl.exe 5036 nthbtt.exe 1680 vpjdv.exe 1192 xflrfrl.exe 3956 xrxrllf.exe 3560 9hbbth.exe 1580 pvppj.exe 5052 3frrlxr.exe 4788 xxllrrf.exe 2588 5hhbtt.exe 4388 5vdvv.exe 2536 1rxrrrr.exe 3280 hhtbht.exe 1504 bthbbb.exe 4472 pdvpv.exe 1472 rfxxffr.exe 4784 tthbbb.exe 208 vppvd.exe 5084 flflflr.exe 3676 bbhhbb.exe 2092 vjdvp.exe 1148 ddjjj.exe 3972 rlffxxx.exe 2556 hnhtnh.exe 4456 7pddj.exe -
resource yara_rule behavioral2/memory/4508-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1388-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3900-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2252-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1444-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1344-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-838-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-878-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-1177-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b09e5f655280df0c7e80a87b6546ed5effb4ab5739a1c68444b31857c9b329f7N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4508 wrote to memory of 3512 4508 b09e5f655280df0c7e80a87b6546ed5effb4ab5739a1c68444b31857c9b329f7N.exe 82 PID 4508 wrote to memory of 3512 4508 b09e5f655280df0c7e80a87b6546ed5effb4ab5739a1c68444b31857c9b329f7N.exe 82 PID 4508 wrote to memory of 3512 4508 b09e5f655280df0c7e80a87b6546ed5effb4ab5739a1c68444b31857c9b329f7N.exe 82 PID 3512 wrote to memory of 1928 3512 jvpjd.exe 83 PID 3512 wrote to memory of 1928 3512 jvpjd.exe 83 PID 3512 wrote to memory of 1928 3512 jvpjd.exe 83 PID 1928 wrote to memory of 3244 1928 3hbthn.exe 84 PID 1928 wrote to memory of 3244 1928 3hbthn.exe 84 PID 1928 wrote to memory of 3244 1928 3hbthn.exe 84 PID 3244 wrote to memory of 4848 3244 rxxrlrx.exe 85 PID 3244 wrote to memory of 4848 3244 rxxrlrx.exe 85 PID 3244 wrote to memory of 4848 3244 rxxrlrx.exe 85 PID 4848 wrote to memory of 3676 4848 fllfxrl.exe 86 PID 4848 wrote to memory of 3676 4848 fllfxrl.exe 86 PID 4848 wrote to memory of 3676 4848 fllfxrl.exe 86 PID 3676 wrote to memory of 4976 3676 dvjdv.exe 87 PID 3676 wrote to memory of 4976 3676 dvjdv.exe 87 PID 3676 wrote to memory of 4976 3676 dvjdv.exe 87 PID 4976 wrote to memory of 2064 4976 nnnhhn.exe 88 PID 4976 wrote to memory of 2064 4976 nnnhhn.exe 88 PID 4976 wrote to memory of 2064 4976 nnnhhn.exe 88 PID 2064 wrote to memory of 2416 2064 5jdvv.exe 89 PID 2064 wrote to memory of 2416 2064 5jdvv.exe 89 PID 2064 wrote to memory of 2416 2064 5jdvv.exe 89 PID 2416 wrote to memory of 3536 2416 nttnnh.exe 90 PID 2416 wrote to memory of 3536 2416 nttnnh.exe 90 PID 2416 wrote to memory of 3536 2416 nttnnh.exe 90 PID 3536 wrote to memory of 4016 3536 tttnhh.exe 91 PID 3536 wrote to memory of 4016 3536 tttnhh.exe 91 PID 3536 wrote to memory of 4016 3536 tttnhh.exe 91 PID 4016 wrote to memory of 632 4016 bhhhhn.exe 92 PID 4016 wrote to memory of 632 4016 bhhhhn.exe 92 PID 4016 wrote to memory of 632 4016 bhhhhn.exe 92 PID 632 wrote to memory of 4512 632 vpdpp.exe 93 PID 632 wrote to memory of 4512 632 vpdpp.exe 93 PID 632 wrote to memory of 4512 632 vpdpp.exe 93 PID 4512 wrote to memory of 3532 4512 9fffxfx.exe 94 PID 4512 wrote to memory of 3532 4512 9fffxfx.exe 94 PID 4512 wrote to memory of 3532 4512 9fffxfx.exe 94 PID 3532 wrote to memory of 3492 3532 vpdvv.exe 95 PID 3532 wrote to memory of 3492 3532 vpdvv.exe 95 PID 3532 wrote to memory of 3492 3532 vpdvv.exe 95 PID 3492 wrote to memory of 3220 3492 djpjv.exe 96 PID 3492 wrote to memory of 3220 3492 djpjv.exe 96 PID 3492 wrote to memory of 3220 3492 djpjv.exe 96 PID 3220 wrote to memory of 1388 3220 xxlfrrx.exe 97 PID 3220 wrote to memory of 1388 3220 xxlfrrx.exe 97 PID 3220 wrote to memory of 1388 3220 xxlfrrx.exe 97 PID 1388 wrote to memory of 4132 1388 ntbtnn.exe 99 PID 1388 wrote to memory of 4132 1388 ntbtnn.exe 99 PID 1388 wrote to memory of 4132 1388 ntbtnn.exe 99 PID 4132 wrote to memory of 1964 4132 thnnnt.exe 100 PID 4132 wrote to memory of 1964 4132 thnnnt.exe 100 PID 4132 wrote to memory of 1964 4132 thnnnt.exe 100 PID 1964 wrote to memory of 4056 1964 jvvvv.exe 101 PID 1964 wrote to memory of 4056 1964 jvvvv.exe 101 PID 1964 wrote to memory of 4056 1964 jvvvv.exe 101 PID 4056 wrote to memory of 1252 4056 tttnnn.exe 102 PID 4056 wrote to memory of 1252 4056 tttnnn.exe 102 PID 4056 wrote to memory of 1252 4056 tttnnn.exe 102 PID 1252 wrote to memory of 3760 1252 5vdvj.exe 103 PID 1252 wrote to memory of 3760 1252 5vdvj.exe 103 PID 1252 wrote to memory of 3760 1252 5vdvj.exe 103 PID 3760 wrote to memory of 2312 3760 bbnntn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b09e5f655280df0c7e80a87b6546ed5effb4ab5739a1c68444b31857c9b329f7N.exe"C:\Users\Admin\AppData\Local\Temp\b09e5f655280df0c7e80a87b6546ed5effb4ab5739a1c68444b31857c9b329f7N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\jvpjd.exec:\jvpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\3hbthn.exec:\3hbthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\rxxrlrx.exec:\rxxrlrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\fllfxrl.exec:\fllfxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\dvjdv.exec:\dvjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\nnnhhn.exec:\nnnhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\5jdvv.exec:\5jdvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\nttnnh.exec:\nttnnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\tttnhh.exec:\tttnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\bhhhhn.exec:\bhhhhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\vpdpp.exec:\vpdpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\9fffxfx.exec:\9fffxfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\vpdvv.exec:\vpdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\djpjv.exec:\djpjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\xxlfrrx.exec:\xxlfrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\ntbtnn.exec:\ntbtnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\thnnnt.exec:\thnnnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\jvvvv.exec:\jvvvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\tttnnn.exec:\tttnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\5vdvj.exec:\5vdvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\bbnntn.exec:\bbnntn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\5ntnnn.exec:\5ntnnn.exe23⤵
- Executes dropped EXE
PID:2312 -
\??\c:\5dpdd.exec:\5dpdd.exe24⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xfxrrrr.exec:\xfxrrrr.exe25⤵
- Executes dropped EXE
PID:1556 -
\??\c:\vppjd.exec:\vppjd.exe26⤵
- Executes dropped EXE
PID:4796 -
\??\c:\htttnt.exec:\htttnt.exe27⤵
- Executes dropped EXE
PID:3372 -
\??\c:\3jpjd.exec:\3jpjd.exe28⤵
- Executes dropped EXE
PID:4320 -
\??\c:\thhhnt.exec:\thhhnt.exe29⤵
- Executes dropped EXE
PID:4572 -
\??\c:\hthhhb.exec:\hthhhb.exe30⤵
- Executes dropped EXE
PID:2224 -
\??\c:\vvvvv.exec:\vvvvv.exe31⤵
- Executes dropped EXE
PID:3156 -
\??\c:\ppppp.exec:\ppppp.exe32⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xrrllrl.exec:\xrrllrl.exe33⤵
- Executes dropped EXE
PID:3472 -
\??\c:\7vvvv.exec:\7vvvv.exe34⤵
- Executes dropped EXE
PID:3664 -
\??\c:\xxllfff.exec:\xxllfff.exe35⤵
- Executes dropped EXE
PID:1448 -
\??\c:\1nnhbb.exec:\1nnhbb.exe36⤵
- Executes dropped EXE
PID:3776 -
\??\c:\vvjjp.exec:\vvjjp.exe37⤵
- Executes dropped EXE
PID:756 -
\??\c:\lrlxrrx.exec:\lrlxrrx.exe38⤵
- Executes dropped EXE
PID:2572 -
\??\c:\tbttnt.exec:\tbttnt.exe39⤵
- Executes dropped EXE
PID:400 -
\??\c:\pppvp.exec:\pppvp.exe40⤵
- Executes dropped EXE
PID:4032 -
\??\c:\fflfffl.exec:\fflfffl.exe41⤵
- Executes dropped EXE
PID:4556 -
\??\c:\nthbtt.exec:\nthbtt.exe42⤵
- Executes dropped EXE
PID:5036 -
\??\c:\vpjdv.exec:\vpjdv.exe43⤵
- Executes dropped EXE
PID:1680 -
\??\c:\xflrfrl.exec:\xflrfrl.exe44⤵
- Executes dropped EXE
PID:1192 -
\??\c:\xrxrllf.exec:\xrxrllf.exe45⤵
- Executes dropped EXE
PID:3956 -
\??\c:\9hbbth.exec:\9hbbth.exe46⤵
- Executes dropped EXE
PID:3560 -
\??\c:\pvppj.exec:\pvppj.exe47⤵
- Executes dropped EXE
PID:1580 -
\??\c:\3frrlxr.exec:\3frrlxr.exe48⤵
- Executes dropped EXE
PID:5052 -
\??\c:\xxllrrf.exec:\xxllrrf.exe49⤵
- Executes dropped EXE
PID:4788 -
\??\c:\5hhbtt.exec:\5hhbtt.exe50⤵
- Executes dropped EXE
PID:2588 -
\??\c:\5vdvv.exec:\5vdvv.exe51⤵
- Executes dropped EXE
PID:4388 -
\??\c:\1rxrrrr.exec:\1rxrrrr.exe52⤵
- Executes dropped EXE
PID:2536 -
\??\c:\hhtbht.exec:\hhtbht.exe53⤵
- Executes dropped EXE
PID:3280 -
\??\c:\bthbbb.exec:\bthbbb.exe54⤵
- Executes dropped EXE
PID:1504 -
\??\c:\pdvpv.exec:\pdvpv.exe55⤵
- Executes dropped EXE
PID:4472 -
\??\c:\rfxxffr.exec:\rfxxffr.exe56⤵
- Executes dropped EXE
PID:1472 -
\??\c:\tthbbb.exec:\tthbbb.exe57⤵
- Executes dropped EXE
PID:4784 -
\??\c:\vppvd.exec:\vppvd.exe58⤵
- Executes dropped EXE
PID:208 -
\??\c:\flflflr.exec:\flflflr.exe59⤵
- Executes dropped EXE
PID:5084 -
\??\c:\bbhhbb.exec:\bbhhbb.exe60⤵
- Executes dropped EXE
PID:3676 -
\??\c:\vjdvp.exec:\vjdvp.exe61⤵
- Executes dropped EXE
PID:2092 -
\??\c:\ddjjj.exec:\ddjjj.exe62⤵
- Executes dropped EXE
PID:1148 -
\??\c:\rlffxxx.exec:\rlffxxx.exe63⤵
- Executes dropped EXE
PID:3972 -
\??\c:\hnhtnh.exec:\hnhtnh.exe64⤵
- Executes dropped EXE
PID:2556 -
\??\c:\7pddj.exec:\7pddj.exe65⤵
- Executes dropped EXE
PID:4456 -
\??\c:\rxrrxfx.exec:\rxrrxfx.exe66⤵PID:4948
-
\??\c:\bbhbtb.exec:\bbhbtb.exe67⤵PID:4816
-
\??\c:\tthhnn.exec:\tthhnn.exe68⤵PID:1920
-
\??\c:\jpppj.exec:\jpppj.exe69⤵PID:632
-
\??\c:\xxxrlrl.exec:\xxxrlrl.exe70⤵PID:1464
-
\??\c:\7hhbhb.exec:\7hhbhb.exe71⤵PID:624
-
\??\c:\vvvpd.exec:\vvvpd.exe72⤵PID:3900
-
\??\c:\ffxrfxr.exec:\ffxrfxr.exe73⤵
- System Location Discovery: System Language Discovery
PID:1092 -
\??\c:\nnnnhn.exec:\nnnnhn.exe74⤵PID:1516
-
\??\c:\ppppp.exec:\ppppp.exe75⤵PID:3220
-
\??\c:\3jdvp.exec:\3jdvp.exe76⤵PID:1044
-
\??\c:\3rxxrrl.exec:\3rxxrrl.exe77⤵PID:4588
-
\??\c:\9fxxrff.exec:\9fxxrff.exe78⤵PID:4132
-
\??\c:\1ntttt.exec:\1ntttt.exe79⤵PID:4960
-
\??\c:\pjdpj.exec:\pjdpj.exe80⤵PID:3800
-
\??\c:\1llfxxx.exec:\1llfxxx.exe81⤵PID:1256
-
\??\c:\nttnnn.exec:\nttnnn.exe82⤵PID:3108
-
\??\c:\hhbnbb.exec:\hhbnbb.exe83⤵PID:4480
-
\??\c:\pjjdd.exec:\pjjdd.exe84⤵PID:3832
-
\??\c:\xfxlfxl.exec:\xfxlfxl.exe85⤵PID:2876
-
\??\c:\hhnhhb.exec:\hhnhhb.exe86⤵PID:3168
-
\??\c:\jpvpd.exec:\jpvpd.exe87⤵PID:2396
-
\??\c:\vvvvv.exec:\vvvvv.exe88⤵PID:2400
-
\??\c:\xrxlxxx.exec:\xrxlxxx.exe89⤵PID:3332
-
\??\c:\hbbbbn.exec:\hbbbbn.exe90⤵PID:2252
-
\??\c:\jvddd.exec:\jvddd.exe91⤵PID:1988
-
\??\c:\ddddd.exec:\ddddd.exe92⤵PID:4572
-
\??\c:\rllffxr.exec:\rllffxr.exe93⤵PID:3996
-
\??\c:\nhhnnh.exec:\nhhnnh.exe94⤵PID:2816
-
\??\c:\3dvpp.exec:\3dvpp.exe95⤵PID:4536
-
\??\c:\xxxrflx.exec:\xxxrflx.exe96⤵PID:516
-
\??\c:\hbnnhh.exec:\hbnnhh.exe97⤵PID:4676
-
\??\c:\pppjd.exec:\pppjd.exe98⤵PID:3836
-
\??\c:\rlrllll.exec:\rlrllll.exe99⤵PID:2272
-
\??\c:\fxflrrl.exec:\fxflrrl.exe100⤵PID:1832
-
\??\c:\hntbhn.exec:\hntbhn.exe101⤵PID:2088
-
\??\c:\9jdjd.exec:\9jdjd.exe102⤵PID:756
-
\??\c:\ffrlfxr.exec:\ffrlfxr.exe103⤵PID:2572
-
\??\c:\nhhbnh.exec:\nhhbnh.exe104⤵PID:4060
-
\??\c:\vdddv.exec:\vdddv.exe105⤵PID:4032
-
\??\c:\rxfffxf.exec:\rxfffxf.exe106⤵PID:3656
-
\??\c:\bnhbnb.exec:\bnhbnb.exe107⤵PID:5036
-
\??\c:\vpvpv.exec:\vpvpv.exe108⤵PID:2284
-
\??\c:\5xllfxr.exec:\5xllfxr.exe109⤵PID:1192
-
\??\c:\7lxrxxf.exec:\7lxrxxf.exe110⤵PID:4020
-
\??\c:\bntnbt.exec:\bntnbt.exe111⤵PID:2612
-
\??\c:\jvvpj.exec:\jvvpj.exe112⤵PID:4896
-
\??\c:\xfxlxlf.exec:\xfxlxlf.exe113⤵PID:3368
-
\??\c:\1nbhbh.exec:\1nbhbh.exe114⤵PID:1444
-
\??\c:\ppjvp.exec:\ppjvp.exe115⤵PID:3012
-
\??\c:\1dppv.exec:\1dppv.exe116⤵PID:3884
-
\??\c:\xrxfxlf.exec:\xrxfxlf.exe117⤵PID:980
-
\??\c:\nnhbtt.exec:\nnhbtt.exe118⤵PID:3896
-
\??\c:\9jpdv.exec:\9jpdv.exe119⤵PID:1316
-
\??\c:\1xlxllf.exec:\1xlxllf.exe120⤵PID:4936
-
\??\c:\xffxxxl.exec:\xffxxxl.exe121⤵PID:2668
-
\??\c:\5tbnnn.exec:\5tbnnn.exe122⤵PID:4728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-