Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 07:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
36ecc2e1a6b568bc7827be553772e05ba97c98ecd152daac3792703df4412070.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
36ecc2e1a6b568bc7827be553772e05ba97c98ecd152daac3792703df4412070.exe
-
Size
456KB
-
MD5
66f1d18cd128bc781cb8bde229c49a21
-
SHA1
cd576678b6b6519f3cde161b13ea09696b464b61
-
SHA256
36ecc2e1a6b568bc7827be553772e05ba97c98ecd152daac3792703df4412070
-
SHA512
5f667dc56ce9722866a7fecbb7b8d80728d62a63cd8de721045468e6d60f33c487b728eabceaf321873013c423fc39041e9ab8200f8e843cf72abc8016f6d7d7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRz:q7Tc2NYHUrAwfMp3CDRz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1596-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2772-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/336-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1516-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/664-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/528-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1276-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/892-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1852-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-843-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-987-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-1220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/528-1322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-1508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1756-1557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1456 3bnhbt.exe 2956 jjdvj.exe 3304 frfllfx.exe 1152 rrxrfxr.exe 3460 5xrlxlf.exe 1440 tbthht.exe 2216 5dvjv.exe 4912 vjdvj.exe 2212 3flfrrl.exe 2772 bnnhbt.exe 2600 dvjdj.exe 1488 nttnhh.exe 2612 pddvp.exe 3656 9ppdd.exe 1600 xrxrflf.exe 1276 1ppdd.exe 528 lxlfrlf.exe 4804 llxxllf.exe 3780 htbtnh.exe 432 pdvpd.exe 2996 fflxxrf.exe 664 lflfrrf.exe 1516 3nttnt.exe 3512 dpjjv.exe 5048 lffxxxr.exe 4000 nbhtnn.exe 3128 pddpd.exe 336 7bbttt.exe 4136 xrlxxxr.exe 4584 nbhtnn.exe 548 vjdjv.exe 1996 xxrxrxx.exe 4836 9tbtnn.exe 3292 jjjjj.exe 4660 1vvpd.exe 4164 lrrfxrr.exe 2328 thnhhh.exe 2896 3vjjd.exe 3576 pjpjp.exe 3276 lfrlrrl.exe 2132 bthbhh.exe 4620 9jjdv.exe 4796 lllrlxr.exe 1156 rflxxrl.exe 2760 nbbbtn.exe 3952 nnnbtn.exe 5020 djppj.exe 4944 lxlxfff.exe 4848 rxxrffx.exe 3064 hnbbhn.exe 2440 hbtnhh.exe 3400 3vppj.exe 2388 lffrffx.exe 4484 5xlflfl.exe 3844 ntbbtn.exe 1596 nhnbtt.exe 1456 vpdvp.exe 2176 dppjv.exe 3304 xlrlffx.exe 1604 3nhhbb.exe 4552 3bnhhn.exe 1332 vpjdv.exe 3044 ddpjv.exe 2216 flxfxfx.exe -
resource yara_rule behavioral2/memory/1596-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2772-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/528-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/336-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1516-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/664-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/528-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1276-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/892-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1852-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-843-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1596 wrote to memory of 1456 1596 36ecc2e1a6b568bc7827be553772e05ba97c98ecd152daac3792703df4412070.exe 82 PID 1596 wrote to memory of 1456 1596 36ecc2e1a6b568bc7827be553772e05ba97c98ecd152daac3792703df4412070.exe 82 PID 1596 wrote to memory of 1456 1596 36ecc2e1a6b568bc7827be553772e05ba97c98ecd152daac3792703df4412070.exe 82 PID 1456 wrote to memory of 2956 1456 3bnhbt.exe 83 PID 1456 wrote to memory of 2956 1456 3bnhbt.exe 83 PID 1456 wrote to memory of 2956 1456 3bnhbt.exe 83 PID 2956 wrote to memory of 3304 2956 jjdvj.exe 84 PID 2956 wrote to memory of 3304 2956 jjdvj.exe 84 PID 2956 wrote to memory of 3304 2956 jjdvj.exe 84 PID 3304 wrote to memory of 1152 3304 frfllfx.exe 85 PID 3304 wrote to memory of 1152 3304 frfllfx.exe 85 PID 3304 wrote to memory of 1152 3304 frfllfx.exe 85 PID 1152 wrote to memory of 3460 1152 rrxrfxr.exe 86 PID 1152 wrote to memory of 3460 1152 rrxrfxr.exe 86 PID 1152 wrote to memory of 3460 1152 rrxrfxr.exe 86 PID 3460 wrote to memory of 1440 3460 5xrlxlf.exe 87 PID 3460 wrote to memory of 1440 3460 5xrlxlf.exe 87 PID 3460 wrote to memory of 1440 3460 5xrlxlf.exe 87 PID 1440 wrote to memory of 2216 1440 tbthht.exe 88 PID 1440 wrote to memory of 2216 1440 tbthht.exe 88 PID 1440 wrote to memory of 2216 1440 tbthht.exe 88 PID 2216 wrote to memory of 4912 2216 5dvjv.exe 89 PID 2216 wrote to memory of 4912 2216 5dvjv.exe 89 PID 2216 wrote to memory of 4912 2216 5dvjv.exe 89 PID 4912 wrote to memory of 2212 4912 vjdvj.exe 90 PID 4912 wrote to memory of 2212 4912 vjdvj.exe 90 PID 4912 wrote to memory of 2212 4912 vjdvj.exe 90 PID 2212 wrote to memory of 2772 2212 3flfrrl.exe 91 PID 2212 wrote to memory of 2772 2212 3flfrrl.exe 91 PID 2212 wrote to memory of 2772 2212 3flfrrl.exe 91 PID 2772 wrote to memory of 2600 2772 bnnhbt.exe 92 PID 2772 wrote to memory of 2600 2772 bnnhbt.exe 92 PID 2772 wrote to memory of 2600 2772 bnnhbt.exe 92 PID 2600 wrote to memory of 1488 2600 dvjdj.exe 93 PID 2600 wrote to memory of 1488 2600 dvjdj.exe 93 PID 2600 wrote to memory of 1488 2600 dvjdj.exe 93 PID 1488 wrote to memory of 2612 1488 nttnhh.exe 94 PID 1488 wrote to memory of 2612 1488 nttnhh.exe 94 PID 1488 wrote to memory of 2612 1488 nttnhh.exe 94 PID 2612 wrote to memory of 3656 2612 pddvp.exe 95 PID 2612 wrote to memory of 3656 2612 pddvp.exe 95 PID 2612 wrote to memory of 3656 2612 pddvp.exe 95 PID 3656 wrote to memory of 1600 3656 9ppdd.exe 96 PID 3656 wrote to memory of 1600 3656 9ppdd.exe 96 PID 3656 wrote to memory of 1600 3656 9ppdd.exe 96 PID 1600 wrote to memory of 1276 1600 xrxrflf.exe 97 PID 1600 wrote to memory of 1276 1600 xrxrflf.exe 97 PID 1600 wrote to memory of 1276 1600 xrxrflf.exe 97 PID 1276 wrote to memory of 528 1276 1ppdd.exe 98 PID 1276 wrote to memory of 528 1276 1ppdd.exe 98 PID 1276 wrote to memory of 528 1276 1ppdd.exe 98 PID 528 wrote to memory of 4804 528 lxlfrlf.exe 99 PID 528 wrote to memory of 4804 528 lxlfrlf.exe 99 PID 528 wrote to memory of 4804 528 lxlfrlf.exe 99 PID 4804 wrote to memory of 3780 4804 llxxllf.exe 100 PID 4804 wrote to memory of 3780 4804 llxxllf.exe 100 PID 4804 wrote to memory of 3780 4804 llxxllf.exe 100 PID 3780 wrote to memory of 432 3780 htbtnh.exe 101 PID 3780 wrote to memory of 432 3780 htbtnh.exe 101 PID 3780 wrote to memory of 432 3780 htbtnh.exe 101 PID 432 wrote to memory of 2996 432 pdvpd.exe 102 PID 432 wrote to memory of 2996 432 pdvpd.exe 102 PID 432 wrote to memory of 2996 432 pdvpd.exe 102 PID 2996 wrote to memory of 664 2996 fflxxrf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\36ecc2e1a6b568bc7827be553772e05ba97c98ecd152daac3792703df4412070.exe"C:\Users\Admin\AppData\Local\Temp\36ecc2e1a6b568bc7827be553772e05ba97c98ecd152daac3792703df4412070.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\3bnhbt.exec:\3bnhbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\jjdvj.exec:\jjdvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\frfllfx.exec:\frfllfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\rrxrfxr.exec:\rrxrfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\5xrlxlf.exec:\5xrlxlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\tbthht.exec:\tbthht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\5dvjv.exec:\5dvjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\vjdvj.exec:\vjdvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\3flfrrl.exec:\3flfrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\bnnhbt.exec:\bnnhbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\dvjdj.exec:\dvjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\nttnhh.exec:\nttnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\pddvp.exec:\pddvp.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\9ppdd.exec:\9ppdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\xrxrflf.exec:\xrxrflf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\1ppdd.exec:\1ppdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\lxlfrlf.exec:\lxlfrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\llxxllf.exec:\llxxllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\htbtnh.exec:\htbtnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\pdvpd.exec:\pdvpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\fflxxrf.exec:\fflxxrf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\lflfrrf.exec:\lflfrrf.exe23⤵
- Executes dropped EXE
PID:664 -
\??\c:\3nttnt.exec:\3nttnt.exe24⤵
- Executes dropped EXE
PID:1516 -
\??\c:\dpjjv.exec:\dpjjv.exe25⤵
- Executes dropped EXE
PID:3512 -
\??\c:\lffxxxr.exec:\lffxxxr.exe26⤵
- Executes dropped EXE
PID:5048 -
\??\c:\nbhtnn.exec:\nbhtnn.exe27⤵
- Executes dropped EXE
PID:4000 -
\??\c:\pddpd.exec:\pddpd.exe28⤵
- Executes dropped EXE
PID:3128 -
\??\c:\7bbttt.exec:\7bbttt.exe29⤵
- Executes dropped EXE
PID:336 -
\??\c:\xrlxxxr.exec:\xrlxxxr.exe30⤵
- Executes dropped EXE
PID:4136 -
\??\c:\nbhtnn.exec:\nbhtnn.exe31⤵
- Executes dropped EXE
PID:4584 -
\??\c:\vjdjv.exec:\vjdjv.exe32⤵
- Executes dropped EXE
PID:548 -
\??\c:\xxrxrxx.exec:\xxrxrxx.exe33⤵
- Executes dropped EXE
PID:1996 -
\??\c:\9tbtnn.exec:\9tbtnn.exe34⤵
- Executes dropped EXE
PID:4836 -
\??\c:\jjjjj.exec:\jjjjj.exe35⤵
- Executes dropped EXE
PID:3292 -
\??\c:\1vvpd.exec:\1vvpd.exe36⤵
- Executes dropped EXE
PID:4660 -
\??\c:\lrrfxrr.exec:\lrrfxrr.exe37⤵
- Executes dropped EXE
PID:4164 -
\??\c:\thnhhh.exec:\thnhhh.exe38⤵
- Executes dropped EXE
PID:2328 -
\??\c:\3vjjd.exec:\3vjjd.exe39⤵
- Executes dropped EXE
PID:2896 -
\??\c:\pjpjp.exec:\pjpjp.exe40⤵
- Executes dropped EXE
PID:3576 -
\??\c:\lfrlrrl.exec:\lfrlrrl.exe41⤵
- Executes dropped EXE
PID:3276 -
\??\c:\bthbhh.exec:\bthbhh.exe42⤵
- Executes dropped EXE
PID:2132 -
\??\c:\9jjdv.exec:\9jjdv.exe43⤵
- Executes dropped EXE
PID:4620 -
\??\c:\lllrlxr.exec:\lllrlxr.exe44⤵
- Executes dropped EXE
PID:4796 -
\??\c:\rflxxrl.exec:\rflxxrl.exe45⤵
- Executes dropped EXE
PID:1156 -
\??\c:\nbbbtn.exec:\nbbbtn.exe46⤵
- Executes dropped EXE
PID:2760 -
\??\c:\nnnbtn.exec:\nnnbtn.exe47⤵
- Executes dropped EXE
PID:3952 -
\??\c:\djppj.exec:\djppj.exe48⤵
- Executes dropped EXE
PID:5020 -
\??\c:\lxlxfff.exec:\lxlxfff.exe49⤵
- Executes dropped EXE
PID:4944 -
\??\c:\rxxrffx.exec:\rxxrffx.exe50⤵
- Executes dropped EXE
PID:4848 -
\??\c:\hnbbhn.exec:\hnbbhn.exe51⤵
- Executes dropped EXE
PID:3064 -
\??\c:\hbtnhh.exec:\hbtnhh.exe52⤵
- Executes dropped EXE
PID:2440 -
\??\c:\3vppj.exec:\3vppj.exe53⤵
- Executes dropped EXE
PID:3400 -
\??\c:\lffrffx.exec:\lffrffx.exe54⤵
- Executes dropped EXE
PID:2388 -
\??\c:\5xlflfl.exec:\5xlflfl.exe55⤵
- Executes dropped EXE
PID:4484 -
\??\c:\ntbbtn.exec:\ntbbtn.exe56⤵
- Executes dropped EXE
PID:3844 -
\??\c:\nhnbtt.exec:\nhnbtt.exe57⤵
- Executes dropped EXE
PID:1596 -
\??\c:\vpdvp.exec:\vpdvp.exe58⤵
- Executes dropped EXE
PID:1456 -
\??\c:\dppjv.exec:\dppjv.exe59⤵
- Executes dropped EXE
PID:2176 -
\??\c:\xlrlffx.exec:\xlrlffx.exe60⤵
- Executes dropped EXE
PID:3304 -
\??\c:\3nhhbb.exec:\3nhhbb.exe61⤵
- Executes dropped EXE
PID:1604 -
\??\c:\3bnhhn.exec:\3bnhhn.exe62⤵
- Executes dropped EXE
PID:4552 -
\??\c:\vpjdv.exec:\vpjdv.exe63⤵
- Executes dropped EXE
PID:1332 -
\??\c:\ddpjv.exec:\ddpjv.exe64⤵
- Executes dropped EXE
PID:3044 -
\??\c:\flxfxfx.exec:\flxfxfx.exe65⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nthbbb.exec:\nthbbb.exe66⤵
- System Location Discovery: System Language Discovery
PID:2544 -
\??\c:\7vjdp.exec:\7vjdp.exe67⤵PID:4524
-
\??\c:\pdvjd.exec:\pdvjd.exe68⤵PID:4716
-
\??\c:\llrrlxx.exec:\llrrlxx.exe69⤵PID:2256
-
\??\c:\frrlrrf.exec:\frrlrrf.exe70⤵PID:4224
-
\??\c:\7hhhbh.exec:\7hhhbh.exe71⤵PID:1904
-
\??\c:\pvdpv.exec:\pvdpv.exe72⤵PID:3764
-
\??\c:\9jpvp.exec:\9jpvp.exe73⤵PID:1124
-
\??\c:\7llfxff.exec:\7llfxff.exe74⤵PID:4372
-
\??\c:\lfxrlxl.exec:\lfxrlxl.exe75⤵PID:4172
-
\??\c:\hbhntt.exec:\hbhntt.exe76⤵PID:2088
-
\??\c:\9jjjd.exec:\9jjjd.exe77⤵PID:4140
-
\??\c:\dpvvp.exec:\dpvvp.exe78⤵PID:3888
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe79⤵PID:2276
-
\??\c:\hhthbb.exec:\hhthbb.exe80⤵PID:3700
-
\??\c:\jvdjd.exec:\jvdjd.exe81⤵PID:1148
-
\??\c:\flxrxxr.exec:\flxrxxr.exe82⤵PID:4276
-
\??\c:\3hbnnt.exec:\3hbnnt.exe83⤵PID:3892
-
\??\c:\dvvvj.exec:\dvvvj.exe84⤵PID:4364
-
\??\c:\lfrrrrl.exec:\lfrrrrl.exe85⤵PID:5052
-
\??\c:\bhbtnh.exec:\bhbtnh.exe86⤵PID:892
-
\??\c:\lxxrllr.exec:\lxxrllr.exe87⤵PID:4188
-
\??\c:\bhttbb.exec:\bhttbb.exe88⤵PID:696
-
\??\c:\rxlfxxf.exec:\rxlfxxf.exe89⤵PID:3588
-
\??\c:\hthhbh.exec:\hthhbh.exe90⤵PID:4084
-
\??\c:\vvjjv.exec:\vvjjv.exe91⤵
- System Location Discovery: System Language Discovery
PID:3128 -
\??\c:\pppjd.exec:\pppjd.exe92⤵PID:4700
-
\??\c:\ppvpp.exec:\ppvpp.exe93⤵PID:2528
-
\??\c:\fxrxfff.exec:\fxrxfff.exe94⤵PID:2732
-
\??\c:\vvpjd.exec:\vvpjd.exe95⤵PID:400
-
\??\c:\9lllffx.exec:\9lllffx.exe96⤵PID:4368
-
\??\c:\5vpvv.exec:\5vpvv.exe97⤵PID:1748
-
\??\c:\vjvvp.exec:\vjvvp.exe98⤵PID:4112
-
\??\c:\thnnnn.exec:\thnnnn.exe99⤵PID:3256
-
\??\c:\pvvvv.exec:\pvvvv.exe100⤵PID:3292
-
\??\c:\lflxfxf.exec:\lflxfxf.exe101⤵PID:1012
-
\??\c:\thtnhh.exec:\thtnhh.exe102⤵PID:3600
-
\??\c:\1nnttt.exec:\1nnttt.exe103⤵PID:2000
-
\??\c:\jjjdp.exec:\jjjdp.exe104⤵PID:3544
-
\??\c:\rxxrllf.exec:\rxxrllf.exe105⤵PID:3472
-
\??\c:\hbnhbb.exec:\hbnhbb.exe106⤵PID:3388
-
\??\c:\hhnhtt.exec:\hhnhtt.exe107⤵PID:4388
-
\??\c:\vpdvv.exec:\vpdvv.exe108⤵PID:1852
-
\??\c:\frxrllf.exec:\frxrllf.exe109⤵PID:1228
-
\??\c:\nhtbnt.exec:\nhtbnt.exe110⤵PID:3988
-
\??\c:\5hhbbb.exec:\5hhbbb.exe111⤵PID:3036
-
\??\c:\vjvvp.exec:\vjvvp.exe112⤵PID:1036
-
\??\c:\jdjdp.exec:\jdjdp.exe113⤵PID:4352
-
\??\c:\1lfrllf.exec:\1lfrllf.exe114⤵PID:1900
-
\??\c:\bnbttt.exec:\bnbttt.exe115⤵PID:1640
-
\??\c:\7ppjd.exec:\7ppjd.exe116⤵PID:1504
-
\??\c:\djpjv.exec:\djpjv.exe117⤵PID:4848
-
\??\c:\ffrrrrx.exec:\ffrrrrx.exe118⤵PID:4632
-
\??\c:\bnbttt.exec:\bnbttt.exe119⤵PID:4056
-
\??\c:\1vvdv.exec:\1vvdv.exe120⤵PID:3400
-
\??\c:\jdvpp.exec:\jdvpp.exe121⤵
- System Location Discovery: System Language Discovery
PID:2388 -
\??\c:\rrfxxrx.exec:\rrfxxrx.exe122⤵PID:2304
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-