Analysis
-
max time kernel
120s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 10:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad1eecf5183243e9db6fcd5e8a07fd7c919f1834719129949c847f47b1339244.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
ad1eecf5183243e9db6fcd5e8a07fd7c919f1834719129949c847f47b1339244.exe
-
Size
454KB
-
MD5
af41d2810e4461d38765855431903103
-
SHA1
0a84f87ec2226669582c7256f5d93f7ac3c1ce56
-
SHA256
ad1eecf5183243e9db6fcd5e8a07fd7c919f1834719129949c847f47b1339244
-
SHA512
5072fc7b6d56073b18ce084c2e582c37025abd65f7b2b4fd9c2b0e26b55dc752db4f3ae450f68b4dd9da9dda129877b59ef06c0464a52548efb39ba138ad5e0a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4308-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/944-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1508-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1852-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-697-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-713-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-780-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-1007-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-1083-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-1619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-1666-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3872 9pjvj.exe 3480 vpjdp.exe 1612 7tnbtt.exe 3356 jdpjd.exe 4252 hnhtht.exe 1932 fxrxlxf.exe 1020 tbbnht.exe 1476 rllrfrl.exe 3772 pjjvd.exe 1748 5nhthb.exe 1548 ppvjd.exe 3152 lflxxrr.exe 2596 rlfxlfx.exe 5060 ddvpd.exe 4976 ttbbth.exe 4564 jvvjd.exe 944 ffxlxxl.exe 4012 jdpjj.exe 3616 rrrfrxr.exe 2420 nhnnbt.exe 3424 rfxrfrl.exe 2296 3bnnbt.exe 4712 jpdpd.exe 1508 tnnbbb.exe 4968 pdjdv.exe 5008 5nnbnn.exe 4680 vddpj.exe 3420 lrxrlfx.exe 1772 djjdv.exe 3348 frlfrlf.exe 3084 ntbtbt.exe 992 djpjv.exe 4516 xxffllr.exe 380 bntnhb.exe 4912 3hnbbt.exe 5024 pjppd.exe 2308 xlfxrlf.exe 2240 bthbnh.exe 1736 nhbtnh.exe 5016 3djvp.exe 1480 lrrfxlf.exe 532 lflrlrl.exe 4044 9bthhb.exe 644 pjdvj.exe 1216 fxxrfrl.exe 1888 fffxllx.exe 2228 bttttt.exe 2736 jdvpj.exe 3356 fflfrxr.exe 1104 hbbnbn.exe 4684 dvvvp.exe 2324 1ffxlxr.exe 3168 llrlffx.exe 468 3htttt.exe 3300 pjppj.exe 1476 7flfxrr.exe 2636 nhhbbb.exe 1744 ppvvd.exe 1548 lxxrlfx.exe 1608 7jdpp.exe 3156 xrfffrr.exe 2596 tnhbnh.exe 1796 bnnhtt.exe 3028 pjjdp.exe -
resource yara_rule behavioral2/memory/4308-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/944-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1508-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1508-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3300-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1852-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-780-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-937-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1llllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4308 wrote to memory of 3872 4308 ad1eecf5183243e9db6fcd5e8a07fd7c919f1834719129949c847f47b1339244.exe 83 PID 4308 wrote to memory of 3872 4308 ad1eecf5183243e9db6fcd5e8a07fd7c919f1834719129949c847f47b1339244.exe 83 PID 4308 wrote to memory of 3872 4308 ad1eecf5183243e9db6fcd5e8a07fd7c919f1834719129949c847f47b1339244.exe 83 PID 3872 wrote to memory of 3480 3872 9pjvj.exe 84 PID 3872 wrote to memory of 3480 3872 9pjvj.exe 84 PID 3872 wrote to memory of 3480 3872 9pjvj.exe 84 PID 3480 wrote to memory of 1612 3480 vpjdp.exe 85 PID 3480 wrote to memory of 1612 3480 vpjdp.exe 85 PID 3480 wrote to memory of 1612 3480 vpjdp.exe 85 PID 1612 wrote to memory of 3356 1612 7tnbtt.exe 86 PID 1612 wrote to memory of 3356 1612 7tnbtt.exe 86 PID 1612 wrote to memory of 3356 1612 7tnbtt.exe 86 PID 3356 wrote to memory of 4252 3356 jdpjd.exe 87 PID 3356 wrote to memory of 4252 3356 jdpjd.exe 87 PID 3356 wrote to memory of 4252 3356 jdpjd.exe 87 PID 4252 wrote to memory of 1932 4252 hnhtht.exe 88 PID 4252 wrote to memory of 1932 4252 hnhtht.exe 88 PID 4252 wrote to memory of 1932 4252 hnhtht.exe 88 PID 1932 wrote to memory of 1020 1932 fxrxlxf.exe 89 PID 1932 wrote to memory of 1020 1932 fxrxlxf.exe 89 PID 1932 wrote to memory of 1020 1932 fxrxlxf.exe 89 PID 1020 wrote to memory of 1476 1020 tbbnht.exe 90 PID 1020 wrote to memory of 1476 1020 tbbnht.exe 90 PID 1020 wrote to memory of 1476 1020 tbbnht.exe 90 PID 1476 wrote to memory of 3772 1476 rllrfrl.exe 91 PID 1476 wrote to memory of 3772 1476 rllrfrl.exe 91 PID 1476 wrote to memory of 3772 1476 rllrfrl.exe 91 PID 3772 wrote to memory of 1748 3772 pjjvd.exe 92 PID 3772 wrote to memory of 1748 3772 pjjvd.exe 92 PID 3772 wrote to memory of 1748 3772 pjjvd.exe 92 PID 1748 wrote to memory of 1548 1748 5nhthb.exe 93 PID 1748 wrote to memory of 1548 1748 5nhthb.exe 93 PID 1748 wrote to memory of 1548 1748 5nhthb.exe 93 PID 1548 wrote to memory of 3152 1548 ppvjd.exe 94 PID 1548 wrote to memory of 3152 1548 ppvjd.exe 94 PID 1548 wrote to memory of 3152 1548 ppvjd.exe 94 PID 3152 wrote to memory of 2596 3152 lflxxrr.exe 95 PID 3152 wrote to memory of 2596 3152 lflxxrr.exe 95 PID 3152 wrote to memory of 2596 3152 lflxxrr.exe 95 PID 2596 wrote to memory of 5060 2596 rlfxlfx.exe 96 PID 2596 wrote to memory of 5060 2596 rlfxlfx.exe 96 PID 2596 wrote to memory of 5060 2596 rlfxlfx.exe 96 PID 5060 wrote to memory of 4976 5060 ddvpd.exe 97 PID 5060 wrote to memory of 4976 5060 ddvpd.exe 97 PID 5060 wrote to memory of 4976 5060 ddvpd.exe 97 PID 4976 wrote to memory of 4564 4976 ttbbth.exe 98 PID 4976 wrote to memory of 4564 4976 ttbbth.exe 98 PID 4976 wrote to memory of 4564 4976 ttbbth.exe 98 PID 4564 wrote to memory of 944 4564 jvvjd.exe 99 PID 4564 wrote to memory of 944 4564 jvvjd.exe 99 PID 4564 wrote to memory of 944 4564 jvvjd.exe 99 PID 944 wrote to memory of 4012 944 ffxlxxl.exe 100 PID 944 wrote to memory of 4012 944 ffxlxxl.exe 100 PID 944 wrote to memory of 4012 944 ffxlxxl.exe 100 PID 4012 wrote to memory of 3616 4012 jdpjj.exe 101 PID 4012 wrote to memory of 3616 4012 jdpjj.exe 101 PID 4012 wrote to memory of 3616 4012 jdpjj.exe 101 PID 3616 wrote to memory of 2420 3616 rrrfrxr.exe 102 PID 3616 wrote to memory of 2420 3616 rrrfrxr.exe 102 PID 3616 wrote to memory of 2420 3616 rrrfrxr.exe 102 PID 2420 wrote to memory of 3424 2420 nhnnbt.exe 103 PID 2420 wrote to memory of 3424 2420 nhnnbt.exe 103 PID 2420 wrote to memory of 3424 2420 nhnnbt.exe 103 PID 3424 wrote to memory of 2296 3424 rfxrfrl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad1eecf5183243e9db6fcd5e8a07fd7c919f1834719129949c847f47b1339244.exe"C:\Users\Admin\AppData\Local\Temp\ad1eecf5183243e9db6fcd5e8a07fd7c919f1834719129949c847f47b1339244.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\9pjvj.exec:\9pjvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\vpjdp.exec:\vpjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\7tnbtt.exec:\7tnbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\jdpjd.exec:\jdpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\hnhtht.exec:\hnhtht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\fxrxlxf.exec:\fxrxlxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\tbbnht.exec:\tbbnht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\rllrfrl.exec:\rllrfrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\pjjvd.exec:\pjjvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\5nhthb.exec:\5nhthb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\ppvjd.exec:\ppvjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\lflxxrr.exec:\lflxxrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\rlfxlfx.exec:\rlfxlfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\ddvpd.exec:\ddvpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\ttbbth.exec:\ttbbth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\jvvjd.exec:\jvvjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\ffxlxxl.exec:\ffxlxxl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\jdpjj.exec:\jdpjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\rrrfrxr.exec:\rrrfrxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\nhnnbt.exec:\nhnnbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\rfxrfrl.exec:\rfxrfrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\3bnnbt.exec:\3bnnbt.exe23⤵
- Executes dropped EXE
PID:2296 -
\??\c:\jpdpd.exec:\jpdpd.exe24⤵
- Executes dropped EXE
PID:4712 -
\??\c:\tnnbbb.exec:\tnnbbb.exe25⤵
- Executes dropped EXE
PID:1508 -
\??\c:\pdjdv.exec:\pdjdv.exe26⤵
- Executes dropped EXE
PID:4968 -
\??\c:\5nnbnn.exec:\5nnbnn.exe27⤵
- Executes dropped EXE
PID:5008 -
\??\c:\vddpj.exec:\vddpj.exe28⤵
- Executes dropped EXE
PID:4680 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe29⤵
- Executes dropped EXE
PID:3420 -
\??\c:\djjdv.exec:\djjdv.exe30⤵
- Executes dropped EXE
PID:1772 -
\??\c:\frlfrlf.exec:\frlfrlf.exe31⤵
- Executes dropped EXE
PID:3348 -
\??\c:\ntbtbt.exec:\ntbtbt.exe32⤵
- Executes dropped EXE
PID:3084 -
\??\c:\djpjv.exec:\djpjv.exe33⤵
- Executes dropped EXE
PID:992 -
\??\c:\xxffllr.exec:\xxffllr.exe34⤵
- Executes dropped EXE
PID:4516 -
\??\c:\bntnhb.exec:\bntnhb.exe35⤵
- Executes dropped EXE
PID:380 -
\??\c:\3hnbbt.exec:\3hnbbt.exe36⤵
- Executes dropped EXE
PID:4912 -
\??\c:\pjppd.exec:\pjppd.exe37⤵
- Executes dropped EXE
PID:5024 -
\??\c:\xlfxrlf.exec:\xlfxrlf.exe38⤵
- Executes dropped EXE
PID:2308 -
\??\c:\bthbnh.exec:\bthbnh.exe39⤵
- Executes dropped EXE
PID:2240 -
\??\c:\nhbtnh.exec:\nhbtnh.exe40⤵
- Executes dropped EXE
PID:1736 -
\??\c:\3djvp.exec:\3djvp.exe41⤵
- Executes dropped EXE
PID:5016 -
\??\c:\lrrfxlf.exec:\lrrfxlf.exe42⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lflrlrl.exec:\lflrlrl.exe43⤵
- Executes dropped EXE
PID:532 -
\??\c:\9bthhb.exec:\9bthhb.exe44⤵
- Executes dropped EXE
PID:4044 -
\??\c:\pjdvj.exec:\pjdvj.exe45⤵
- Executes dropped EXE
PID:644 -
\??\c:\fxxrfrl.exec:\fxxrfrl.exe46⤵
- Executes dropped EXE
PID:1216 -
\??\c:\fffxllx.exec:\fffxllx.exe47⤵
- Executes dropped EXE
PID:1888 -
\??\c:\bttttt.exec:\bttttt.exe48⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jdvpj.exec:\jdvpj.exe49⤵
- Executes dropped EXE
PID:2736 -
\??\c:\fflfrxr.exec:\fflfrxr.exe50⤵
- Executes dropped EXE
PID:3356 -
\??\c:\hbbnbn.exec:\hbbnbn.exe51⤵
- Executes dropped EXE
PID:1104 -
\??\c:\dvvvp.exec:\dvvvp.exe52⤵
- Executes dropped EXE
PID:4684 -
\??\c:\1ffxlxr.exec:\1ffxlxr.exe53⤵
- Executes dropped EXE
PID:2324 -
\??\c:\llrlffx.exec:\llrlffx.exe54⤵
- Executes dropped EXE
PID:3168 -
\??\c:\3htttt.exec:\3htttt.exe55⤵
- Executes dropped EXE
PID:468 -
\??\c:\pjppj.exec:\pjppj.exe56⤵
- Executes dropped EXE
PID:3300 -
\??\c:\7flfxrr.exec:\7flfxrr.exe57⤵
- Executes dropped EXE
PID:1476 -
\??\c:\nhhbbb.exec:\nhhbbb.exe58⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ppvvd.exec:\ppvvd.exe59⤵
- Executes dropped EXE
PID:1744 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe60⤵
- Executes dropped EXE
PID:1548 -
\??\c:\7jdpp.exec:\7jdpp.exe61⤵
- Executes dropped EXE
PID:1608 -
\??\c:\xrfffrr.exec:\xrfffrr.exe62⤵
- Executes dropped EXE
PID:3156 -
\??\c:\tnhbnh.exec:\tnhbnh.exe63⤵
- Executes dropped EXE
PID:2596 -
\??\c:\bnnhtt.exec:\bnnhtt.exe64⤵
- Executes dropped EXE
PID:1796 -
\??\c:\pjjdp.exec:\pjjdp.exe65⤵
- Executes dropped EXE
PID:3028 -
\??\c:\fxxrffx.exec:\fxxrffx.exe66⤵PID:4124
-
\??\c:\nntnnn.exec:\nntnnn.exe67⤵PID:3976
-
\??\c:\dddvp.exec:\dddvp.exe68⤵PID:2568
-
\??\c:\pppjd.exec:\pppjd.exe69⤵PID:1852
-
\??\c:\llxrrrx.exec:\llxrrrx.exe70⤵PID:3252
-
\??\c:\thttnn.exec:\thttnn.exe71⤵PID:4612
-
\??\c:\dpdvv.exec:\dpdvv.exe72⤵PID:5104
-
\??\c:\flrrrrf.exec:\flrrrrf.exe73⤵PID:3652
-
\??\c:\tnnhbh.exec:\tnnhbh.exe74⤵PID:2000
-
\??\c:\jvjpd.exec:\jvjpd.exe75⤵PID:2172
-
\??\c:\vdpjd.exec:\vdpjd.exe76⤵PID:4764
-
\??\c:\rflfxxr.exec:\rflfxxr.exe77⤵PID:3660
-
\??\c:\thhbbt.exec:\thhbbt.exe78⤵PID:696
-
\??\c:\pdjdp.exec:\pdjdp.exe79⤵PID:3032
-
\??\c:\fllfrrl.exec:\fllfrrl.exe80⤵PID:376
-
\??\c:\3ffxrxr.exec:\3ffxrxr.exe81⤵PID:700
-
\??\c:\tnnhbh.exec:\tnnhbh.exe82⤵PID:868
-
\??\c:\dvdpj.exec:\dvdpj.exe83⤵PID:1588
-
\??\c:\9xxxllf.exec:\9xxxllf.exe84⤵PID:1328
-
\??\c:\nhnhbt.exec:\nhnhbt.exe85⤵PID:4244
-
\??\c:\jddvj.exec:\jddvj.exe86⤵PID:2368
-
\??\c:\lfxrlfr.exec:\lfxrlfr.exe87⤵PID:1408
-
\??\c:\nbhnhh.exec:\nbhnhh.exe88⤵PID:3420
-
\??\c:\pjppd.exec:\pjppd.exe89⤵PID:5000
-
\??\c:\vppjv.exec:\vppjv.exe90⤵PID:1336
-
\??\c:\lrflfff.exec:\lrflfff.exe91⤵PID:1368
-
\??\c:\tnttbb.exec:\tnttbb.exe92⤵PID:4580
-
\??\c:\vppjp.exec:\vppjp.exe93⤵PID:4280
-
\??\c:\rxfxlll.exec:\rxfxlll.exe94⤵PID:1732
-
\??\c:\1fxxrrl.exec:\1fxxrrl.exe95⤵PID:4516
-
\??\c:\ttbtnh.exec:\ttbtnh.exe96⤵PID:5068
-
\??\c:\3dddp.exec:\3dddp.exe97⤵PID:1784
-
\??\c:\fffxfff.exec:\fffxfff.exe98⤵PID:4636
-
\??\c:\tntnnn.exec:\tntnnn.exe99⤵PID:2308
-
\??\c:\jpdjp.exec:\jpdjp.exe100⤵PID:4920
-
\??\c:\xrrffxr.exec:\xrrffxr.exe101⤵PID:2912
-
\??\c:\htbthn.exec:\htbthn.exe102⤵PID:5016
-
\??\c:\vvjpv.exec:\vvjpv.exe103⤵PID:4416
-
\??\c:\xffxfxf.exec:\xffxfxf.exe104⤵PID:3668
-
\??\c:\hhhhht.exec:\hhhhht.exe105⤵PID:4032
-
\??\c:\7vvpd.exec:\7vvpd.exe106⤵PID:3632
-
\??\c:\lxrlfxr.exec:\lxrlfxr.exe107⤵PID:644
-
\??\c:\rrlfxxf.exec:\rrlfxxf.exe108⤵PID:1216
-
\??\c:\ppvpv.exec:\ppvpv.exe109⤵PID:1888
-
\??\c:\jdjdp.exec:\jdjdp.exe110⤵PID:2228
-
\??\c:\lflfrlx.exec:\lflfrlx.exe111⤵PID:2736
-
\??\c:\pppdv.exec:\pppdv.exe112⤵PID:4904
-
\??\c:\1llrlxf.exec:\1llrlxf.exe113⤵PID:3112
-
\??\c:\xllfxrf.exec:\xllfxrf.exe114⤵PID:4688
-
\??\c:\bhnnht.exec:\bhnnht.exe115⤵PID:4828
-
\??\c:\jpddp.exec:\jpddp.exe116⤵PID:2152
-
\??\c:\rflxllf.exec:\rflxllf.exe117⤵PID:5096
-
\??\c:\frxllrf.exec:\frxllrf.exe118⤵PID:4352
-
\??\c:\5nthhn.exec:\5nthhn.exe119⤵PID:3612
-
\??\c:\dppdp.exec:\dppdp.exe120⤵PID:3696
-
\??\c:\lfrfrlf.exec:\lfrfrlf.exe121⤵PID:1476
-
\??\c:\thhbtn.exec:\thhbtn.exe122⤵PID:4500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-