Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 04:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
38e6fde750e22af7f43790d0005f30e25d5fe5c63c99289c1e71ce4c30076a4e.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
38e6fde750e22af7f43790d0005f30e25d5fe5c63c99289c1e71ce4c30076a4e.exe
-
Size
455KB
-
MD5
688f2d84932e870bb5ede32ff831a7c5
-
SHA1
dd3a0233daa51e1bb90f5695af83856cd6eab503
-
SHA256
38e6fde750e22af7f43790d0005f30e25d5fe5c63c99289c1e71ce4c30076a4e
-
SHA512
4100c01a9cb2c4b26efaff6d4dfaba5ec5b85771a44eca4028757b1f124dce72bfc4815841220c2883b3241d9021163eaac7d97739e01fb53c5b3039384db9ef
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRz:q7Tc2NYHUrAwfMp3CDRz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/772-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/652-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/744-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/620-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2772-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/772-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/784-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2116-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/700-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-648-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-878-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3344-985-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/772-1007-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-1803-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3388 jdjjd.exe 652 jdppp.exe 4800 vpvpv.exe 2020 flrrrrr.exe 1452 bbbbbt.exe 2388 hhhbtt.exe 1020 htbttt.exe 744 nnnnhn.exe 2096 vvppj.exe 3244 rllxrlf.exe 1092 llrrrrr.exe 4932 lllxrxr.exe 2296 btbbbb.exe 3392 rflfllf.exe 2876 dpjdd.exe 232 ppppj.exe 1484 btnhhh.exe 1132 5pjvv.exe 1152 rxxrllf.exe 1128 pjdvp.exe 3272 vdddd.exe 4736 flfxrrr.exe 2392 hhtntt.exe 2104 jjvpv.exe 4620 tbbnbb.exe 620 jppjj.exe 2772 vjjjj.exe 1280 xrllfff.exe 1416 ttbbhh.exe 3484 bnntth.exe 1972 dvvpj.exe 2828 rlxrlxx.exe 2804 tntttt.exe 5056 rfxrrrl.exe 2272 bbhbtt.exe 4460 hhnhhh.exe 3724 dpdvp.exe 5076 9rxxxxf.exe 3128 tntttt.exe 4112 1pvdp.exe 924 flxrflf.exe 2716 rfrxrrx.exe 636 dvjjd.exe 4312 jddvp.exe 4328 ffrlfff.exe 772 9nnnhh.exe 740 btbtbt.exe 876 ppjdp.exe 784 rrffllx.exe 2116 3ntthb.exe 1936 ppdjd.exe 1292 fxfrlrr.exe 1452 1rxxflx.exe 2388 3nttnn.exe 4560 ddjdv.exe 1348 xxxrrll.exe 464 xrlrxxl.exe 1284 hbbbbb.exe 2328 jdddd.exe 4452 llxlrfx.exe 2932 fflfffl.exe 3460 ppvdd.exe 4500 3xxrffx.exe 3544 fxxrlrl.exe -
resource yara_rule behavioral2/memory/772-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/652-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/744-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2772-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/620-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2772-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/772-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/784-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2116-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/700-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/32-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-878-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lllfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ththtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 772 wrote to memory of 3388 772 38e6fde750e22af7f43790d0005f30e25d5fe5c63c99289c1e71ce4c30076a4e.exe 82 PID 772 wrote to memory of 3388 772 38e6fde750e22af7f43790d0005f30e25d5fe5c63c99289c1e71ce4c30076a4e.exe 82 PID 772 wrote to memory of 3388 772 38e6fde750e22af7f43790d0005f30e25d5fe5c63c99289c1e71ce4c30076a4e.exe 82 PID 3388 wrote to memory of 652 3388 jdjjd.exe 83 PID 3388 wrote to memory of 652 3388 jdjjd.exe 83 PID 3388 wrote to memory of 652 3388 jdjjd.exe 83 PID 652 wrote to memory of 4800 652 jdppp.exe 84 PID 652 wrote to memory of 4800 652 jdppp.exe 84 PID 652 wrote to memory of 4800 652 jdppp.exe 84 PID 4800 wrote to memory of 2020 4800 vpvpv.exe 85 PID 4800 wrote to memory of 2020 4800 vpvpv.exe 85 PID 4800 wrote to memory of 2020 4800 vpvpv.exe 85 PID 2020 wrote to memory of 1452 2020 flrrrrr.exe 86 PID 2020 wrote to memory of 1452 2020 flrrrrr.exe 86 PID 2020 wrote to memory of 1452 2020 flrrrrr.exe 86 PID 1452 wrote to memory of 2388 1452 bbbbbt.exe 87 PID 1452 wrote to memory of 2388 1452 bbbbbt.exe 87 PID 1452 wrote to memory of 2388 1452 bbbbbt.exe 87 PID 2388 wrote to memory of 1020 2388 hhhbtt.exe 88 PID 2388 wrote to memory of 1020 2388 hhhbtt.exe 88 PID 2388 wrote to memory of 1020 2388 hhhbtt.exe 88 PID 1020 wrote to memory of 744 1020 htbttt.exe 89 PID 1020 wrote to memory of 744 1020 htbttt.exe 89 PID 1020 wrote to memory of 744 1020 htbttt.exe 89 PID 744 wrote to memory of 2096 744 nnnnhn.exe 90 PID 744 wrote to memory of 2096 744 nnnnhn.exe 90 PID 744 wrote to memory of 2096 744 nnnnhn.exe 90 PID 2096 wrote to memory of 3244 2096 vvppj.exe 91 PID 2096 wrote to memory of 3244 2096 vvppj.exe 91 PID 2096 wrote to memory of 3244 2096 vvppj.exe 91 PID 3244 wrote to memory of 1092 3244 rllxrlf.exe 92 PID 3244 wrote to memory of 1092 3244 rllxrlf.exe 92 PID 3244 wrote to memory of 1092 3244 rllxrlf.exe 92 PID 1092 wrote to memory of 4932 1092 llrrrrr.exe 93 PID 1092 wrote to memory of 4932 1092 llrrrrr.exe 93 PID 1092 wrote to memory of 4932 1092 llrrrrr.exe 93 PID 4932 wrote to memory of 2296 4932 lllxrxr.exe 94 PID 4932 wrote to memory of 2296 4932 lllxrxr.exe 94 PID 4932 wrote to memory of 2296 4932 lllxrxr.exe 94 PID 2296 wrote to memory of 3392 2296 btbbbb.exe 95 PID 2296 wrote to memory of 3392 2296 btbbbb.exe 95 PID 2296 wrote to memory of 3392 2296 btbbbb.exe 95 PID 3392 wrote to memory of 2876 3392 rflfllf.exe 96 PID 3392 wrote to memory of 2876 3392 rflfllf.exe 96 PID 3392 wrote to memory of 2876 3392 rflfllf.exe 96 PID 2876 wrote to memory of 232 2876 dpjdd.exe 97 PID 2876 wrote to memory of 232 2876 dpjdd.exe 97 PID 2876 wrote to memory of 232 2876 dpjdd.exe 97 PID 232 wrote to memory of 1484 232 ppppj.exe 98 PID 232 wrote to memory of 1484 232 ppppj.exe 98 PID 232 wrote to memory of 1484 232 ppppj.exe 98 PID 1484 wrote to memory of 1132 1484 btnhhh.exe 99 PID 1484 wrote to memory of 1132 1484 btnhhh.exe 99 PID 1484 wrote to memory of 1132 1484 btnhhh.exe 99 PID 1132 wrote to memory of 1152 1132 5pjvv.exe 100 PID 1132 wrote to memory of 1152 1132 5pjvv.exe 100 PID 1132 wrote to memory of 1152 1132 5pjvv.exe 100 PID 1152 wrote to memory of 1128 1152 rxxrllf.exe 101 PID 1152 wrote to memory of 1128 1152 rxxrllf.exe 101 PID 1152 wrote to memory of 1128 1152 rxxrllf.exe 101 PID 1128 wrote to memory of 3272 1128 pjdvp.exe 102 PID 1128 wrote to memory of 3272 1128 pjdvp.exe 102 PID 1128 wrote to memory of 3272 1128 pjdvp.exe 102 PID 3272 wrote to memory of 4736 3272 vdddd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\38e6fde750e22af7f43790d0005f30e25d5fe5c63c99289c1e71ce4c30076a4e.exe"C:\Users\Admin\AppData\Local\Temp\38e6fde750e22af7f43790d0005f30e25d5fe5c63c99289c1e71ce4c30076a4e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\jdjjd.exec:\jdjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\jdppp.exec:\jdppp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\vpvpv.exec:\vpvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\flrrrrr.exec:\flrrrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\bbbbbt.exec:\bbbbbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\hhhbtt.exec:\hhhbtt.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\htbttt.exec:\htbttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\nnnnhn.exec:\nnnnhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\vvppj.exec:\vvppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\rllxrlf.exec:\rllxrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\llrrrrr.exec:\llrrrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\lllxrxr.exec:\lllxrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\btbbbb.exec:\btbbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\rflfllf.exec:\rflfllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\dpjdd.exec:\dpjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\ppppj.exec:\ppppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\btnhhh.exec:\btnhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\5pjvv.exec:\5pjvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\rxxrllf.exec:\rxxrllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\pjdvp.exec:\pjdvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\vdddd.exec:\vdddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\flfxrrr.exec:\flfxrrr.exe23⤵
- Executes dropped EXE
PID:4736 -
\??\c:\hhtntt.exec:\hhtntt.exe24⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jjvpv.exec:\jjvpv.exe25⤵
- Executes dropped EXE
PID:2104 -
\??\c:\tbbnbb.exec:\tbbnbb.exe26⤵
- Executes dropped EXE
PID:4620 -
\??\c:\jppjj.exec:\jppjj.exe27⤵
- Executes dropped EXE
PID:620 -
\??\c:\vjjjj.exec:\vjjjj.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2772 -
\??\c:\xrllfff.exec:\xrllfff.exe29⤵
- Executes dropped EXE
PID:1280 -
\??\c:\ttbbhh.exec:\ttbbhh.exe30⤵
- Executes dropped EXE
PID:1416 -
\??\c:\bnntth.exec:\bnntth.exe31⤵
- Executes dropped EXE
PID:3484 -
\??\c:\dvvpj.exec:\dvvpj.exe32⤵
- Executes dropped EXE
PID:1972 -
\??\c:\rlxrlxx.exec:\rlxrlxx.exe33⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tntttt.exec:\tntttt.exe34⤵
- Executes dropped EXE
PID:2804 -
\??\c:\rfxrrrl.exec:\rfxrrrl.exe35⤵
- Executes dropped EXE
PID:5056 -
\??\c:\bbhbtt.exec:\bbhbtt.exe36⤵
- Executes dropped EXE
PID:2272 -
\??\c:\hhnhhh.exec:\hhnhhh.exe37⤵
- Executes dropped EXE
PID:4460 -
\??\c:\dpdvp.exec:\dpdvp.exe38⤵
- Executes dropped EXE
PID:3724 -
\??\c:\9rxxxxf.exec:\9rxxxxf.exe39⤵
- Executes dropped EXE
PID:5076 -
\??\c:\tntttt.exec:\tntttt.exe40⤵
- Executes dropped EXE
PID:3128 -
\??\c:\1pvdp.exec:\1pvdp.exe41⤵
- Executes dropped EXE
PID:4112 -
\??\c:\flxrflf.exec:\flxrflf.exe42⤵
- Executes dropped EXE
PID:924 -
\??\c:\rfrxrrx.exec:\rfrxrrx.exe43⤵
- Executes dropped EXE
PID:2716 -
\??\c:\dvjjd.exec:\dvjjd.exe44⤵
- Executes dropped EXE
PID:636 -
\??\c:\jddvp.exec:\jddvp.exe45⤵
- Executes dropped EXE
PID:4312 -
\??\c:\ffrlfff.exec:\ffrlfff.exe46⤵
- Executes dropped EXE
PID:4328 -
\??\c:\9nnnhh.exec:\9nnnhh.exe47⤵
- Executes dropped EXE
PID:772 -
\??\c:\btbtbt.exec:\btbtbt.exe48⤵
- Executes dropped EXE
PID:740 -
\??\c:\ppjdp.exec:\ppjdp.exe49⤵
- Executes dropped EXE
PID:876 -
\??\c:\rrffllx.exec:\rrffllx.exe50⤵
- Executes dropped EXE
PID:784 -
\??\c:\3ntthb.exec:\3ntthb.exe51⤵
- Executes dropped EXE
PID:2116 -
\??\c:\ppdjd.exec:\ppdjd.exe52⤵
- Executes dropped EXE
PID:1936 -
\??\c:\fxfrlrr.exec:\fxfrlrr.exe53⤵
- Executes dropped EXE
PID:1292 -
\??\c:\1rxxflx.exec:\1rxxflx.exe54⤵
- Executes dropped EXE
PID:1452 -
\??\c:\3nttnn.exec:\3nttnn.exe55⤵
- Executes dropped EXE
PID:2388 -
\??\c:\ddjdv.exec:\ddjdv.exe56⤵
- Executes dropped EXE
PID:4560 -
\??\c:\xxxrrll.exec:\xxxrrll.exe57⤵
- Executes dropped EXE
PID:1348 -
\??\c:\xrlrxxl.exec:\xrlrxxl.exe58⤵
- Executes dropped EXE
PID:464 -
\??\c:\hbbbbb.exec:\hbbbbb.exe59⤵
- Executes dropped EXE
PID:1284 -
\??\c:\jdddd.exec:\jdddd.exe60⤵
- Executes dropped EXE
PID:2328 -
\??\c:\llxlrfx.exec:\llxlrfx.exe61⤵
- Executes dropped EXE
PID:4452 -
\??\c:\fflfffl.exec:\fflfffl.exe62⤵
- Executes dropped EXE
PID:2932 -
\??\c:\ppvdd.exec:\ppvdd.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3460 -
\??\c:\3xxrffx.exec:\3xxrffx.exe64⤵
- Executes dropped EXE
PID:4500 -
\??\c:\fxxrlrl.exec:\fxxrlrl.exe65⤵
- Executes dropped EXE
PID:3544 -
\??\c:\btttbb.exec:\btttbb.exe66⤵PID:2296
-
\??\c:\ppvpp.exec:\ppvpp.exe67⤵PID:1468
-
\??\c:\3xflfff.exec:\3xflfff.exe68⤵PID:3924
-
\??\c:\rlfxxrr.exec:\rlfxxrr.exe69⤵PID:4436
-
\??\c:\ththhb.exec:\ththhb.exe70⤵PID:4220
-
\??\c:\jvpvp.exec:\jvpvp.exe71⤵PID:700
-
\??\c:\jvjpj.exec:\jvjpj.exe72⤵PID:1496
-
\??\c:\xlrlfff.exec:\xlrlfff.exe73⤵PID:4756
-
\??\c:\hhnntt.exec:\hhnntt.exe74⤵PID:2440
-
\??\c:\ddvpj.exec:\ddvpj.exe75⤵PID:3240
-
\??\c:\fffffff.exec:\fffffff.exe76⤵PID:2344
-
\??\c:\hnbttt.exec:\hnbttt.exe77⤵PID:4848
-
\??\c:\nthbtt.exec:\nthbtt.exe78⤵PID:4736
-
\??\c:\jjpdd.exec:\jjpdd.exe79⤵PID:4964
-
\??\c:\1rxrrrr.exec:\1rxrrrr.exe80⤵PID:1252
-
\??\c:\lxlfffx.exec:\lxlfffx.exe81⤵PID:2276
-
\??\c:\nbnnnn.exec:\nbnnnn.exe82⤵PID:1532
-
\??\c:\jvddd.exec:\jvddd.exe83⤵PID:3336
-
\??\c:\lfxrfrr.exec:\lfxrfrr.exe84⤵PID:856
-
\??\c:\tnbttt.exec:\tnbttt.exe85⤵PID:2772
-
\??\c:\tnbttt.exec:\tnbttt.exe86⤵PID:888
-
\??\c:\vdvjv.exec:\vdvjv.exe87⤵PID:2016
-
\??\c:\xxllllf.exec:\xxllllf.exe88⤵PID:2324
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe89⤵PID:8
-
\??\c:\jpvvv.exec:\jpvvv.exe90⤵PID:3068
-
\??\c:\vjjdd.exec:\vjjdd.exe91⤵PID:1972
-
\??\c:\7flfrrl.exec:\7flfrrl.exe92⤵PID:4940
-
\??\c:\ntttnt.exec:\ntttnt.exe93⤵PID:1480
-
\??\c:\jddvp.exec:\jddvp.exe94⤵PID:1784
-
\??\c:\ppjpj.exec:\ppjpj.exe95⤵PID:2680
-
\??\c:\rlrlflf.exec:\rlrlflf.exe96⤵PID:3368
-
\??\c:\tnhbbb.exec:\tnhbbb.exe97⤵PID:1948
-
\??\c:\jvjdj.exec:\jvjdj.exe98⤵PID:4124
-
\??\c:\xrrlfff.exec:\xrrlfff.exe99⤵PID:1088
-
\??\c:\xrxxxxr.exec:\xrxxxxr.exe100⤵PID:2776
-
\??\c:\hhhtnb.exec:\hhhtnb.exe101⤵PID:1984
-
\??\c:\9dddv.exec:\9dddv.exe102⤵PID:1808
-
\??\c:\lrxrrxf.exec:\lrxrrxf.exe103⤵PID:4332
-
\??\c:\xxxxxxf.exec:\xxxxxxf.exe104⤵PID:3932
-
\??\c:\nnhhhh.exec:\nnhhhh.exe105⤵PID:5108
-
\??\c:\jdddv.exec:\jdddv.exe106⤵PID:3256
-
\??\c:\ffrrlff.exec:\ffrrlff.exe107⤵PID:64
-
\??\c:\nbnnnn.exec:\nbnnnn.exe108⤵PID:4880
-
\??\c:\hnttbn.exec:\hnttbn.exe109⤵PID:4600
-
\??\c:\9pvpp.exec:\9pvpp.exe110⤵PID:1260
-
\??\c:\rxlffff.exec:\rxlffff.exe111⤵PID:528
-
\??\c:\ffrrrfx.exec:\ffrrrfx.exe112⤵PID:4564
-
\??\c:\htnhhb.exec:\htnhhb.exe113⤵PID:2836
-
\??\c:\pjvvv.exec:\pjvvv.exe114⤵
- System Location Discovery: System Language Discovery
PID:4832 -
\??\c:\5xxxrxx.exec:\5xxxrxx.exe115⤵PID:4852
-
\??\c:\btbhhh.exec:\btbhhh.exe116⤵PID:4292
-
\??\c:\vppdp.exec:\vppdp.exe117⤵PID:744
-
\??\c:\9vpjd.exec:\9vpjd.exe118⤵PID:2968
-
\??\c:\frrlxxr.exec:\frrlxxr.exe119⤵PID:1284
-
\??\c:\thbthb.exec:\thbthb.exe120⤵
- System Location Discovery: System Language Discovery
PID:4516 -
\??\c:\dvjjj.exec:\dvjjj.exe121⤵PID:5112
-
\??\c:\vjvpj.exec:\vjvpj.exe122⤵PID:2684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-