Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 05:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe
-
Size
453KB
-
MD5
4fdd10b459c02e3e888e9a53edb64d72
-
SHA1
691f618d57a8f9e4b037d95b6e902ae19b1a46c1
-
SHA256
5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244
-
SHA512
86f3d01e99750799753c8240fb9f635f70447d13609766eaedb192cc203dcd730517d7beef2b6d849d3d4e8e88a54e7e2a9b8bbceb86d67ac6dbfa9e79073825
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet1:q7Tc2NYHUrAwfMp3CDt1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2160-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1320-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/936-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/844-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1508-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4120-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3288-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/676-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-568-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2624-951-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 464 jjpjp.exe 1320 fxxlxrf.exe 1868 tnhnbt.exe 2900 bnbnhb.exe 3864 5vdvd.exe 4856 7tnbnb.exe 4936 9dpjd.exe 3820 pjpdd.exe 1968 9hbthh.exe 552 jdvjd.exe 5064 rlxxxxx.exe 1156 3hnhtn.exe 232 dvvpp.exe 2148 tntnhb.exe 100 vvvpv.exe 2660 lxrxfrx.exe 3156 7dvpd.exe 4984 thnbtt.exe 4816 jddvp.exe 5044 nntnnh.exe 4028 vjvpj.exe 4836 pppdv.exe 4964 lrrlrlx.exe 1424 jvdvv.exe 2152 lxxlxxl.exe 916 htnhtn.exe 936 jvdvj.exe 2980 xfllffr.exe 4060 nbbtnn.exe 1168 pddvp.exe 1044 hbhhnn.exe 1484 llrlfxl.exe 2436 jpvjv.exe 4336 vdvpd.exe 116 xlxrrlx.exe 844 bhbtnb.exe 3400 pddpj.exe 1784 rrxlxrx.exe 4516 lxxlfxr.exe 4276 bnnhhb.exe 4288 jvdpj.exe 4640 lffxffx.exe 4020 bhbnhb.exe 4960 pjvvp.exe 760 frfrrll.exe 2220 lrxrxxr.exe 2656 btnbnb.exe 1508 jvvjd.exe 4824 jvpdp.exe 4992 3rrflfr.exe 1712 bthbnh.exe 1568 dppjj.exe 4400 rlfrlxr.exe 2684 nhhtht.exe 4468 bhnnbt.exe 2176 vpdpd.exe 1048 xxxxrll.exe 3176 5nbhtt.exe 5056 pdpdv.exe 4660 xlxlxrl.exe 3948 nhthnh.exe 3912 tnnbtn.exe 5060 1ddvd.exe 2104 flfxrrl.exe -
resource yara_rule behavioral2/memory/2160-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1320-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1320-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/936-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/844-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1508-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1712-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3288-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3288-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/676-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-499-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfflxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2160 wrote to memory of 464 2160 5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe 83 PID 2160 wrote to memory of 464 2160 5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe 83 PID 2160 wrote to memory of 464 2160 5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe 83 PID 464 wrote to memory of 1320 464 jjpjp.exe 84 PID 464 wrote to memory of 1320 464 jjpjp.exe 84 PID 464 wrote to memory of 1320 464 jjpjp.exe 84 PID 1320 wrote to memory of 1868 1320 fxxlxrf.exe 85 PID 1320 wrote to memory of 1868 1320 fxxlxrf.exe 85 PID 1320 wrote to memory of 1868 1320 fxxlxrf.exe 85 PID 1868 wrote to memory of 2900 1868 tnhnbt.exe 86 PID 1868 wrote to memory of 2900 1868 tnhnbt.exe 86 PID 1868 wrote to memory of 2900 1868 tnhnbt.exe 86 PID 2900 wrote to memory of 3864 2900 bnbnhb.exe 87 PID 2900 wrote to memory of 3864 2900 bnbnhb.exe 87 PID 2900 wrote to memory of 3864 2900 bnbnhb.exe 87 PID 3864 wrote to memory of 4856 3864 5vdvd.exe 88 PID 3864 wrote to memory of 4856 3864 5vdvd.exe 88 PID 3864 wrote to memory of 4856 3864 5vdvd.exe 88 PID 4856 wrote to memory of 4936 4856 7tnbnb.exe 89 PID 4856 wrote to memory of 4936 4856 7tnbnb.exe 89 PID 4856 wrote to memory of 4936 4856 7tnbnb.exe 89 PID 4936 wrote to memory of 3820 4936 9dpjd.exe 90 PID 4936 wrote to memory of 3820 4936 9dpjd.exe 90 PID 4936 wrote to memory of 3820 4936 9dpjd.exe 90 PID 3820 wrote to memory of 1968 3820 pjpdd.exe 91 PID 3820 wrote to memory of 1968 3820 pjpdd.exe 91 PID 3820 wrote to memory of 1968 3820 pjpdd.exe 91 PID 1968 wrote to memory of 552 1968 9hbthh.exe 92 PID 1968 wrote to memory of 552 1968 9hbthh.exe 92 PID 1968 wrote to memory of 552 1968 9hbthh.exe 92 PID 552 wrote to memory of 5064 552 jdvjd.exe 93 PID 552 wrote to memory of 5064 552 jdvjd.exe 93 PID 552 wrote to memory of 5064 552 jdvjd.exe 93 PID 5064 wrote to memory of 1156 5064 rlxxxxx.exe 94 PID 5064 wrote to memory of 1156 5064 rlxxxxx.exe 94 PID 5064 wrote to memory of 1156 5064 rlxxxxx.exe 94 PID 1156 wrote to memory of 232 1156 3hnhtn.exe 95 PID 1156 wrote to memory of 232 1156 3hnhtn.exe 95 PID 1156 wrote to memory of 232 1156 3hnhtn.exe 95 PID 232 wrote to memory of 2148 232 dvvpp.exe 96 PID 232 wrote to memory of 2148 232 dvvpp.exe 96 PID 232 wrote to memory of 2148 232 dvvpp.exe 96 PID 2148 wrote to memory of 100 2148 tntnhb.exe 97 PID 2148 wrote to memory of 100 2148 tntnhb.exe 97 PID 2148 wrote to memory of 100 2148 tntnhb.exe 97 PID 100 wrote to memory of 2660 100 vvvpv.exe 98 PID 100 wrote to memory of 2660 100 vvvpv.exe 98 PID 100 wrote to memory of 2660 100 vvvpv.exe 98 PID 2660 wrote to memory of 3156 2660 lxrxfrx.exe 99 PID 2660 wrote to memory of 3156 2660 lxrxfrx.exe 99 PID 2660 wrote to memory of 3156 2660 lxrxfrx.exe 99 PID 3156 wrote to memory of 4984 3156 7dvpd.exe 100 PID 3156 wrote to memory of 4984 3156 7dvpd.exe 100 PID 3156 wrote to memory of 4984 3156 7dvpd.exe 100 PID 4984 wrote to memory of 4816 4984 thnbtt.exe 101 PID 4984 wrote to memory of 4816 4984 thnbtt.exe 101 PID 4984 wrote to memory of 4816 4984 thnbtt.exe 101 PID 4816 wrote to memory of 5044 4816 jddvp.exe 102 PID 4816 wrote to memory of 5044 4816 jddvp.exe 102 PID 4816 wrote to memory of 5044 4816 jddvp.exe 102 PID 5044 wrote to memory of 4028 5044 nntnnh.exe 103 PID 5044 wrote to memory of 4028 5044 nntnnh.exe 103 PID 5044 wrote to memory of 4028 5044 nntnnh.exe 103 PID 4028 wrote to memory of 4836 4028 vjvpj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe"C:\Users\Admin\AppData\Local\Temp\5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\jjpjp.exec:\jjpjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\fxxlxrf.exec:\fxxlxrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\tnhnbt.exec:\tnhnbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\bnbnhb.exec:\bnbnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\5vdvd.exec:\5vdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\7tnbnb.exec:\7tnbnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\9dpjd.exec:\9dpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\pjpdd.exec:\pjpdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\9hbthh.exec:\9hbthh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\jdvjd.exec:\jdvjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\3hnhtn.exec:\3hnhtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\dvvpp.exec:\dvvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\tntnhb.exec:\tntnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\vvvpv.exec:\vvvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\lxrxfrx.exec:\lxrxfrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\7dvpd.exec:\7dvpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\thnbtt.exec:\thnbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\jddvp.exec:\jddvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\nntnnh.exec:\nntnnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\vjvpj.exec:\vjvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\pppdv.exec:\pppdv.exe23⤵
- Executes dropped EXE
PID:4836 -
\??\c:\lrrlrlx.exec:\lrrlrlx.exe24⤵
- Executes dropped EXE
PID:4964 -
\??\c:\jvdvv.exec:\jvdvv.exe25⤵
- Executes dropped EXE
PID:1424 -
\??\c:\lxxlxxl.exec:\lxxlxxl.exe26⤵
- Executes dropped EXE
PID:2152 -
\??\c:\htnhtn.exec:\htnhtn.exe27⤵
- Executes dropped EXE
PID:916 -
\??\c:\jvdvj.exec:\jvdvj.exe28⤵
- Executes dropped EXE
PID:936 -
\??\c:\xfllffr.exec:\xfllffr.exe29⤵
- Executes dropped EXE
PID:2980 -
\??\c:\nbbtnn.exec:\nbbtnn.exe30⤵
- Executes dropped EXE
PID:4060 -
\??\c:\pddvp.exec:\pddvp.exe31⤵
- Executes dropped EXE
PID:1168 -
\??\c:\hbhhnn.exec:\hbhhnn.exe32⤵
- Executes dropped EXE
PID:1044 -
\??\c:\llrlfxl.exec:\llrlfxl.exe33⤵
- Executes dropped EXE
PID:1484 -
\??\c:\jpvjv.exec:\jpvjv.exe34⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vdvpd.exec:\vdvpd.exe35⤵
- Executes dropped EXE
PID:4336 -
\??\c:\xlxrrlx.exec:\xlxrrlx.exe36⤵
- Executes dropped EXE
PID:116 -
\??\c:\bhbtnb.exec:\bhbtnb.exe37⤵
- Executes dropped EXE
PID:844 -
\??\c:\pddpj.exec:\pddpj.exe38⤵
- Executes dropped EXE
PID:3400 -
\??\c:\rrxlxrx.exec:\rrxlxrx.exe39⤵
- Executes dropped EXE
PID:1784 -
\??\c:\lxxlfxr.exec:\lxxlfxr.exe40⤵
- Executes dropped EXE
PID:4516 -
\??\c:\bnnhhb.exec:\bnnhhb.exe41⤵
- Executes dropped EXE
PID:4276 -
\??\c:\jvdpj.exec:\jvdpj.exe42⤵
- Executes dropped EXE
PID:4288 -
\??\c:\lffxffx.exec:\lffxffx.exe43⤵
- Executes dropped EXE
PID:4640 -
\??\c:\bhbnhb.exec:\bhbnhb.exe44⤵
- Executes dropped EXE
PID:4020 -
\??\c:\pjvvp.exec:\pjvvp.exe45⤵
- Executes dropped EXE
PID:4960 -
\??\c:\frfrrll.exec:\frfrrll.exe46⤵
- Executes dropped EXE
PID:760 -
\??\c:\lrxrxxr.exec:\lrxrxxr.exe47⤵
- Executes dropped EXE
PID:2220 -
\??\c:\btnbnb.exec:\btnbnb.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2656 -
\??\c:\jvvjd.exec:\jvvjd.exe49⤵
- Executes dropped EXE
PID:1508 -
\??\c:\jvpdp.exec:\jvpdp.exe50⤵
- Executes dropped EXE
PID:4824 -
\??\c:\3rrflfr.exec:\3rrflfr.exe51⤵
- Executes dropped EXE
PID:4992 -
\??\c:\bthbnh.exec:\bthbnh.exe52⤵
- Executes dropped EXE
PID:1712 -
\??\c:\dppjj.exec:\dppjj.exe53⤵
- Executes dropped EXE
PID:1568 -
\??\c:\rlfrlxr.exec:\rlfrlxr.exe54⤵
- Executes dropped EXE
PID:4400 -
\??\c:\nhhtht.exec:\nhhtht.exe55⤵
- Executes dropped EXE
PID:2684 -
\??\c:\bhnnbt.exec:\bhnnbt.exe56⤵
- Executes dropped EXE
PID:4468 -
\??\c:\vpdpd.exec:\vpdpd.exe57⤵
- Executes dropped EXE
PID:2176 -
\??\c:\xxxxrll.exec:\xxxxrll.exe58⤵
- Executes dropped EXE
PID:1048 -
\??\c:\5nbhtt.exec:\5nbhtt.exe59⤵
- Executes dropped EXE
PID:3176 -
\??\c:\pdpdv.exec:\pdpdv.exe60⤵
- Executes dropped EXE
PID:5056 -
\??\c:\xlxlxrl.exec:\xlxlxrl.exe61⤵
- Executes dropped EXE
PID:4660 -
\??\c:\nhthnh.exec:\nhthnh.exe62⤵
- Executes dropped EXE
PID:3948 -
\??\c:\tnnbtn.exec:\tnnbtn.exe63⤵
- Executes dropped EXE
PID:3912 -
\??\c:\1ddvd.exec:\1ddvd.exe64⤵
- Executes dropped EXE
PID:5060 -
\??\c:\flfxrrl.exec:\flfxrrl.exe65⤵
- Executes dropped EXE
PID:2104 -
\??\c:\7tnhnt.exec:\7tnhnt.exe66⤵PID:4120
-
\??\c:\bnbtnh.exec:\bnbtnh.exe67⤵PID:3888
-
\??\c:\xllfxrl.exec:\xllfxrl.exe68⤵PID:3036
-
\??\c:\xlxlfrl.exec:\xlxlfrl.exe69⤵PID:1296
-
\??\c:\tnbbbn.exec:\tnbbbn.exe70⤵PID:3288
-
\??\c:\jvvjv.exec:\jvvjv.exe71⤵PID:676
-
\??\c:\fxlrflf.exec:\fxlrflf.exe72⤵PID:2960
-
\??\c:\fxrfrll.exec:\fxrfrll.exe73⤵PID:4772
-
\??\c:\3hnhnn.exec:\3hnhnn.exe74⤵PID:1304
-
\??\c:\9jjvd.exec:\9jjvd.exe75⤵PID:3748
-
\??\c:\xffxllx.exec:\xffxllx.exe76⤵PID:4144
-
\??\c:\1nbnbt.exec:\1nbnbt.exe77⤵PID:4028
-
\??\c:\ntbhbb.exec:\ntbhbb.exe78⤵PID:3512
-
\??\c:\pddpd.exec:\pddpd.exe79⤵PID:5112
-
\??\c:\xllxfxr.exec:\xllxfxr.exe80⤵PID:3788
-
\??\c:\thhthb.exec:\thhthb.exe81⤵PID:5036
-
\??\c:\pdvjv.exec:\pdvjv.exe82⤵PID:4524
-
\??\c:\1jvjp.exec:\1jvjp.exe83⤵PID:3116
-
\??\c:\5xxlxrf.exec:\5xxlxrf.exe84⤵PID:916
-
\??\c:\bnthnb.exec:\bnthnb.exe85⤵PID:4204
-
\??\c:\pdppv.exec:\pdppv.exe86⤵PID:4968
-
\??\c:\vdpdp.exec:\vdpdp.exe87⤵PID:3428
-
\??\c:\rrxlrlr.exec:\rrxlrlr.exe88⤵PID:3496
-
\??\c:\7hbbnh.exec:\7hbbnh.exe89⤵PID:2788
-
\??\c:\htthtn.exec:\htthtn.exe90⤵PID:3796
-
\??\c:\pjvpv.exec:\pjvpv.exe91⤵PID:1128
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe92⤵PID:1044
-
\??\c:\frfxfxx.exec:\frfxfxx.exe93⤵PID:2716
-
\??\c:\btthbt.exec:\btthbt.exe94⤵PID:2688
-
\??\c:\vvdpd.exec:\vvdpd.exe95⤵PID:1256
-
\??\c:\lllrrrl.exec:\lllrrrl.exe96⤵PID:4712
-
\??\c:\7lfrlrf.exec:\7lfrlrf.exe97⤵PID:1812
-
\??\c:\nbbnbt.exec:\nbbnbt.exe98⤵PID:2384
-
\??\c:\jppvj.exec:\jppvj.exe99⤵PID:1268
-
\??\c:\pvdpv.exec:\pvdpv.exe100⤵PID:3624
-
\??\c:\lfxfrfr.exec:\lfxfrfr.exe101⤵PID:4304
-
\??\c:\bbhtnh.exec:\bbhtnh.exe102⤵PID:2160
-
\??\c:\3dvjv.exec:\3dvjv.exe103⤵PID:4924
-
\??\c:\ppvjv.exec:\ppvjv.exe104⤵PID:5084
-
\??\c:\lrrlrlx.exec:\lrrlrlx.exe105⤵PID:4020
-
\??\c:\tbbntn.exec:\tbbntn.exe106⤵PID:4960
-
\??\c:\1ppdp.exec:\1ppdp.exe107⤵PID:760
-
\??\c:\3dvjp.exec:\3dvjp.exe108⤵PID:3984
-
\??\c:\flxrlll.exec:\flxrlll.exe109⤵PID:2704
-
\??\c:\hbhhbb.exec:\hbhhbb.exe110⤵PID:1916
-
\??\c:\tbhbhn.exec:\tbhbhn.exe111⤵PID:1764
-
\??\c:\jjjdp.exec:\jjjdp.exe112⤵PID:1608
-
\??\c:\1rfxxxx.exec:\1rfxxxx.exe113⤵PID:4912
-
\??\c:\tbbttt.exec:\tbbttt.exe114⤵PID:3020
-
\??\c:\3pdpj.exec:\3pdpj.exe115⤵PID:412
-
\??\c:\dpdvv.exec:\dpdvv.exe116⤵PID:2004
-
\??\c:\flrlllf.exec:\flrlllf.exe117⤵PID:4680
-
\??\c:\tnntbt.exec:\tnntbt.exe118⤵PID:4988
-
\??\c:\vpvdd.exec:\vpvdd.exe119⤵PID:4740
-
\??\c:\xllxlfr.exec:\xllxlfr.exe120⤵PID:2912
-
\??\c:\bnhntn.exec:\bnhntn.exe121⤵PID:556
-
\??\c:\pvpjd.exec:\pvpjd.exe122⤵PID:4592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-