Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 11:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e658cb75b345b3d2c305584cf1ffcf89d973e1c38dbba453dd4a542fbe3a0658.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e658cb75b345b3d2c305584cf1ffcf89d973e1c38dbba453dd4a542fbe3a0658.exe
-
Size
456KB
-
MD5
e1f5a0b036747158ae6eb5ac7a1c80db
-
SHA1
b46969295a89bb547ec7cb54543f67b5c2aacf05
-
SHA256
e658cb75b345b3d2c305584cf1ffcf89d973e1c38dbba453dd4a542fbe3a0658
-
SHA512
a869d688d19a9fd63563a4df52201aaffda00ebc6c58948af8f263fceb7feeef065b91f88cc66a622c097e9e273cf6d0b3e20c758d74fc5e54c05c5e337c9cb8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRE:q7Tc2NYHUrAwfMp3CDRE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4328-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/752-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/832-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2524-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/608-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2504-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3792-863-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/844-915-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-1018-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-1037-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-1210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4540 tntntt.exe 4008 pppjj.exe 4836 9pppj.exe 1704 lxffrff.exe 4280 9bttnn.exe 872 dvdvv.exe 3588 rrxllfx.exe 4624 bbbtbh.exe 1216 hbtnbn.exe 2676 7xfrrlf.exe 2140 1lfrfxr.exe 3904 5hthbb.exe 3672 djjvv.exe 4652 bbnnth.exe 752 rfxrfrl.exe 4816 nntnhb.exe 4620 dvvjj.exe 3384 xfrxlfr.exe 2456 7lfrlfx.exe 4636 djjvp.exe 4848 xffrfxr.exe 2780 5bbnbt.exe 1268 7pdvj.exe 4772 rxfrlfl.exe 1200 9nthnh.exe 2916 pvvjd.exe 1828 tbbtnh.exe 2332 nhbbhn.exe 1876 1djvj.exe 4916 5ffrlfx.exe 4308 djvpp.exe 5000 frlfrlf.exe 1544 tnnbnh.exe 4428 vjjvp.exe 3928 xllxlfx.exe 3152 nnbhtt.exe 1752 dppdv.exe 2536 xrfrfxl.exe 3128 xlrffxx.exe 1824 tnhhhb.exe 2528 nhthtn.exe 408 xlrfrfx.exe 3916 htbnnh.exe 1656 jjdvp.exe 1040 jvvjv.exe 832 rrxrrrx.exe 1600 hbtbtt.exe 5004 pdvjv.exe 3324 xxrlxrl.exe 3596 5flflfr.exe 4416 ntbntn.exe 4304 7pppj.exe 4436 rflffff.exe 1452 nbthtb.exe 2040 dvvpj.exe 3960 jjdpd.exe 4860 fxfrffr.exe 2256 httnbt.exe 1528 ppvjp.exe 4984 vpddp.exe 4380 xlrffrf.exe 4736 bhthtn.exe 4208 vddvj.exe 3744 rrxrlxl.exe -
resource yara_rule behavioral2/memory/4328-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/752-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/832-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2524-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/608-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2504-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3792-863-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/844-915-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-1018-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhttn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4328 wrote to memory of 4540 4328 e658cb75b345b3d2c305584cf1ffcf89d973e1c38dbba453dd4a542fbe3a0658.exe 82 PID 4328 wrote to memory of 4540 4328 e658cb75b345b3d2c305584cf1ffcf89d973e1c38dbba453dd4a542fbe3a0658.exe 82 PID 4328 wrote to memory of 4540 4328 e658cb75b345b3d2c305584cf1ffcf89d973e1c38dbba453dd4a542fbe3a0658.exe 82 PID 4540 wrote to memory of 4008 4540 tntntt.exe 83 PID 4540 wrote to memory of 4008 4540 tntntt.exe 83 PID 4540 wrote to memory of 4008 4540 tntntt.exe 83 PID 4008 wrote to memory of 4836 4008 pppjj.exe 84 PID 4008 wrote to memory of 4836 4008 pppjj.exe 84 PID 4008 wrote to memory of 4836 4008 pppjj.exe 84 PID 4836 wrote to memory of 1704 4836 9pppj.exe 85 PID 4836 wrote to memory of 1704 4836 9pppj.exe 85 PID 4836 wrote to memory of 1704 4836 9pppj.exe 85 PID 1704 wrote to memory of 4280 1704 lxffrff.exe 86 PID 1704 wrote to memory of 4280 1704 lxffrff.exe 86 PID 1704 wrote to memory of 4280 1704 lxffrff.exe 86 PID 4280 wrote to memory of 872 4280 9bttnn.exe 87 PID 4280 wrote to memory of 872 4280 9bttnn.exe 87 PID 4280 wrote to memory of 872 4280 9bttnn.exe 87 PID 872 wrote to memory of 3588 872 dvdvv.exe 88 PID 872 wrote to memory of 3588 872 dvdvv.exe 88 PID 872 wrote to memory of 3588 872 dvdvv.exe 88 PID 3588 wrote to memory of 4624 3588 rrxllfx.exe 89 PID 3588 wrote to memory of 4624 3588 rrxllfx.exe 89 PID 3588 wrote to memory of 4624 3588 rrxllfx.exe 89 PID 4624 wrote to memory of 1216 4624 bbbtbh.exe 90 PID 4624 wrote to memory of 1216 4624 bbbtbh.exe 90 PID 4624 wrote to memory of 1216 4624 bbbtbh.exe 90 PID 1216 wrote to memory of 2676 1216 hbtnbn.exe 91 PID 1216 wrote to memory of 2676 1216 hbtnbn.exe 91 PID 1216 wrote to memory of 2676 1216 hbtnbn.exe 91 PID 2676 wrote to memory of 2140 2676 7xfrrlf.exe 92 PID 2676 wrote to memory of 2140 2676 7xfrrlf.exe 92 PID 2676 wrote to memory of 2140 2676 7xfrrlf.exe 92 PID 2140 wrote to memory of 3904 2140 1lfrfxr.exe 93 PID 2140 wrote to memory of 3904 2140 1lfrfxr.exe 93 PID 2140 wrote to memory of 3904 2140 1lfrfxr.exe 93 PID 3904 wrote to memory of 3672 3904 5hthbb.exe 94 PID 3904 wrote to memory of 3672 3904 5hthbb.exe 94 PID 3904 wrote to memory of 3672 3904 5hthbb.exe 94 PID 3672 wrote to memory of 4652 3672 djjvv.exe 95 PID 3672 wrote to memory of 4652 3672 djjvv.exe 95 PID 3672 wrote to memory of 4652 3672 djjvv.exe 95 PID 4652 wrote to memory of 752 4652 bbnnth.exe 96 PID 4652 wrote to memory of 752 4652 bbnnth.exe 96 PID 4652 wrote to memory of 752 4652 bbnnth.exe 96 PID 752 wrote to memory of 4816 752 rfxrfrl.exe 97 PID 752 wrote to memory of 4816 752 rfxrfrl.exe 97 PID 752 wrote to memory of 4816 752 rfxrfrl.exe 97 PID 4816 wrote to memory of 4620 4816 nntnhb.exe 98 PID 4816 wrote to memory of 4620 4816 nntnhb.exe 98 PID 4816 wrote to memory of 4620 4816 nntnhb.exe 98 PID 4620 wrote to memory of 3384 4620 dvvjj.exe 99 PID 4620 wrote to memory of 3384 4620 dvvjj.exe 99 PID 4620 wrote to memory of 3384 4620 dvvjj.exe 99 PID 3384 wrote to memory of 2456 3384 xfrxlfr.exe 100 PID 3384 wrote to memory of 2456 3384 xfrxlfr.exe 100 PID 3384 wrote to memory of 2456 3384 xfrxlfr.exe 100 PID 2456 wrote to memory of 4636 2456 7lfrlfx.exe 101 PID 2456 wrote to memory of 4636 2456 7lfrlfx.exe 101 PID 2456 wrote to memory of 4636 2456 7lfrlfx.exe 101 PID 4636 wrote to memory of 4848 4636 djjvp.exe 102 PID 4636 wrote to memory of 4848 4636 djjvp.exe 102 PID 4636 wrote to memory of 4848 4636 djjvp.exe 102 PID 4848 wrote to memory of 2780 4848 xffrfxr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\e658cb75b345b3d2c305584cf1ffcf89d973e1c38dbba453dd4a542fbe3a0658.exe"C:\Users\Admin\AppData\Local\Temp\e658cb75b345b3d2c305584cf1ffcf89d973e1c38dbba453dd4a542fbe3a0658.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\tntntt.exec:\tntntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\pppjj.exec:\pppjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\9pppj.exec:\9pppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\lxffrff.exec:\lxffrff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\9bttnn.exec:\9bttnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\dvdvv.exec:\dvdvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\rrxllfx.exec:\rrxllfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\bbbtbh.exec:\bbbtbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\hbtnbn.exec:\hbtnbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\7xfrrlf.exec:\7xfrrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\1lfrfxr.exec:\1lfrfxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\5hthbb.exec:\5hthbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\djjvv.exec:\djjvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\bbnnth.exec:\bbnnth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\rfxrfrl.exec:\rfxrfrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\nntnhb.exec:\nntnhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\dvvjj.exec:\dvvjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\xfrxlfr.exec:\xfrxlfr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\7lfrlfx.exec:\7lfrlfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\djjvp.exec:\djjvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\xffrfxr.exec:\xffrfxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\5bbnbt.exec:\5bbnbt.exe23⤵
- Executes dropped EXE
PID:2780 -
\??\c:\7pdvj.exec:\7pdvj.exe24⤵
- Executes dropped EXE
PID:1268 -
\??\c:\rxfrlfl.exec:\rxfrlfl.exe25⤵
- Executes dropped EXE
PID:4772 -
\??\c:\9nthnh.exec:\9nthnh.exe26⤵
- Executes dropped EXE
PID:1200 -
\??\c:\pvvjd.exec:\pvvjd.exe27⤵
- Executes dropped EXE
PID:2916 -
\??\c:\tbbtnh.exec:\tbbtnh.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1828 -
\??\c:\nhbbhn.exec:\nhbbhn.exe29⤵
- Executes dropped EXE
PID:2332 -
\??\c:\1djvj.exec:\1djvj.exe30⤵
- Executes dropped EXE
PID:1876 -
\??\c:\5ffrlfx.exec:\5ffrlfx.exe31⤵
- Executes dropped EXE
PID:4916 -
\??\c:\djvpp.exec:\djvpp.exe32⤵
- Executes dropped EXE
PID:4308 -
\??\c:\frlfrlf.exec:\frlfrlf.exe33⤵
- Executes dropped EXE
PID:5000 -
\??\c:\tnnbnh.exec:\tnnbnh.exe34⤵
- Executes dropped EXE
PID:1544 -
\??\c:\vjjvp.exec:\vjjvp.exe35⤵
- Executes dropped EXE
PID:4428 -
\??\c:\xllxlfx.exec:\xllxlfx.exe36⤵
- Executes dropped EXE
PID:3928 -
\??\c:\nnbhtt.exec:\nnbhtt.exe37⤵
- Executes dropped EXE
PID:3152 -
\??\c:\dppdv.exec:\dppdv.exe38⤵
- Executes dropped EXE
PID:1752 -
\??\c:\xrfrfxl.exec:\xrfrfxl.exe39⤵
- Executes dropped EXE
PID:2536 -
\??\c:\xlrffxx.exec:\xlrffxx.exe40⤵
- Executes dropped EXE
PID:3128 -
\??\c:\tnhhhb.exec:\tnhhhb.exe41⤵
- Executes dropped EXE
PID:1824 -
\??\c:\nhthtn.exec:\nhthtn.exe42⤵
- Executes dropped EXE
PID:2528 -
\??\c:\xlrfrfx.exec:\xlrfrfx.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:408 -
\??\c:\htbnnh.exec:\htbnnh.exe44⤵
- Executes dropped EXE
PID:3916 -
\??\c:\jjdvp.exec:\jjdvp.exe45⤵
- Executes dropped EXE
PID:1656 -
\??\c:\jvvjv.exec:\jvvjv.exe46⤵
- Executes dropped EXE
PID:1040 -
\??\c:\rrxrrrx.exec:\rrxrrrx.exe47⤵
- Executes dropped EXE
PID:832 -
\??\c:\hbtbtt.exec:\hbtbtt.exe48⤵
- Executes dropped EXE
PID:1600 -
\??\c:\pdvjv.exec:\pdvjv.exe49⤵
- Executes dropped EXE
PID:5004 -
\??\c:\xxrlxrl.exec:\xxrlxrl.exe50⤵
- Executes dropped EXE
PID:3324 -
\??\c:\5flflfr.exec:\5flflfr.exe51⤵
- Executes dropped EXE
PID:3596 -
\??\c:\ntbntn.exec:\ntbntn.exe52⤵
- Executes dropped EXE
PID:4416 -
\??\c:\7pppj.exec:\7pppj.exe53⤵
- Executes dropped EXE
PID:4304 -
\??\c:\rflffff.exec:\rflffff.exe54⤵
- Executes dropped EXE
PID:4436 -
\??\c:\nbthtb.exec:\nbthtb.exe55⤵
- Executes dropped EXE
PID:1452 -
\??\c:\dvvpj.exec:\dvvpj.exe56⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jjdpd.exec:\jjdpd.exe57⤵
- Executes dropped EXE
PID:3960 -
\??\c:\fxfrffr.exec:\fxfrffr.exe58⤵
- Executes dropped EXE
PID:4860 -
\??\c:\httnbt.exec:\httnbt.exe59⤵
- Executes dropped EXE
PID:2256 -
\??\c:\ppvjp.exec:\ppvjp.exe60⤵
- Executes dropped EXE
PID:1528 -
\??\c:\vpddp.exec:\vpddp.exe61⤵
- Executes dropped EXE
PID:4984 -
\??\c:\xlrffrf.exec:\xlrffrf.exe62⤵
- Executes dropped EXE
PID:4380 -
\??\c:\bhthtn.exec:\bhthtn.exe63⤵
- Executes dropped EXE
PID:4736 -
\??\c:\vddvj.exec:\vddvj.exe64⤵
- Executes dropped EXE
PID:4208 -
\??\c:\rrxrlxl.exec:\rrxrlxl.exe65⤵
- Executes dropped EXE
PID:3744 -
\??\c:\frrfrrf.exec:\frrfrrf.exe66⤵PID:4624
-
\??\c:\ppjjv.exec:\ppjjv.exe67⤵PID:2820
-
\??\c:\3ppdv.exec:\3ppdv.exe68⤵PID:1104
-
\??\c:\9llfrlf.exec:\9llfrlf.exe69⤵PID:1784
-
\??\c:\thhtbt.exec:\thhtbt.exe70⤵PID:3016
-
\??\c:\7vpdp.exec:\7vpdp.exe71⤵PID:2140
-
\??\c:\jvppv.exec:\jvppv.exe72⤵PID:1548
-
\??\c:\lflfxxr.exec:\lflfxxr.exe73⤵PID:2600
-
\??\c:\hthttn.exec:\hthttn.exe74⤵PID:1028
-
\??\c:\jdvpd.exec:\jdvpd.exe75⤵PID:2056
-
\??\c:\ddjvj.exec:\ddjvj.exe76⤵PID:3568
-
\??\c:\1lfrfxl.exec:\1lfrfxl.exe77⤵PID:1624
-
\??\c:\hhnbhb.exec:\hhnbhb.exe78⤵PID:5044
-
\??\c:\bthnht.exec:\bthnht.exe79⤵PID:4196
-
\??\c:\jddpd.exec:\jddpd.exe80⤵PID:4176
-
\??\c:\lffxrll.exec:\lffxrll.exe81⤵PID:3384
-
\??\c:\thbnhb.exec:\thbnhb.exe82⤵PID:2456
-
\??\c:\pdvpj.exec:\pdvpj.exe83⤵PID:400
-
\??\c:\xffrxxl.exec:\xffrxxl.exe84⤵
- System Location Discovery: System Language Discovery
PID:3860 -
\??\c:\1ttnbt.exec:\1ttnbt.exe85⤵PID:2780
-
\??\c:\pvddj.exec:\pvddj.exe86⤵PID:1072
-
\??\c:\rxxlxrl.exec:\rxxlxrl.exe87⤵PID:2420
-
\??\c:\tnhnbn.exec:\tnhnbn.exe88⤵PID:3632
-
\??\c:\1btnnb.exec:\1btnnb.exe89⤵PID:3008
-
\??\c:\dddvj.exec:\dddvj.exe90⤵PID:1848
-
\??\c:\rrxlxrr.exec:\rrxlxrr.exe91⤵PID:5104
-
\??\c:\5nhbnh.exec:\5nhbnh.exe92⤵PID:64
-
\??\c:\pdppj.exec:\pdppj.exe93⤵PID:4496
-
\??\c:\5ddpd.exec:\5ddpd.exe94⤵PID:2524
-
\??\c:\7lfrfxl.exec:\7lfrfxl.exe95⤵PID:2552
-
\??\c:\3htbnt.exec:\3htbnt.exe96⤵PID:1484
-
\??\c:\vjdjd.exec:\vjdjd.exe97⤵PID:264
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe98⤵PID:5000
-
\??\c:\bnhbbb.exec:\bnhbbb.exe99⤵
- System Location Discovery: System Language Discovery
PID:5108 -
\??\c:\htbbnh.exec:\htbbnh.exe100⤵PID:5088
-
\??\c:\jddpv.exec:\jddpv.exe101⤵PID:1208
-
\??\c:\xfrfxlx.exec:\xfrfxlx.exe102⤵PID:2948
-
\??\c:\hbhthh.exec:\hbhthh.exe103⤵PID:3332
-
\??\c:\nbbnbt.exec:\nbbnbt.exe104⤵PID:4944
-
\??\c:\jjjvj.exec:\jjjvj.exe105⤵PID:5096
-
\??\c:\rxfrfxl.exec:\rxfrfxl.exe106⤵PID:232
-
\??\c:\bnnbnh.exec:\bnnbnh.exe107⤵PID:3108
-
\??\c:\jvdpd.exec:\jvdpd.exe108⤵PID:2900
-
\??\c:\dpjvj.exec:\dpjvj.exe109⤵PID:3088
-
\??\c:\nnhhtn.exec:\nnhhtn.exe110⤵PID:1468
-
\??\c:\bbhnht.exec:\bbhnht.exe111⤵PID:4512
-
\??\c:\pjpvp.exec:\pjpvp.exe112⤵PID:4220
-
\??\c:\9flfxrr.exec:\9flfxrr.exe113⤵PID:3876
-
\??\c:\bntnbh.exec:\bntnbh.exe114⤵PID:1600
-
\??\c:\jvvpd.exec:\jvvpd.exe115⤵PID:5004
-
\??\c:\lxxlxrl.exec:\lxxlxrl.exe116⤵PID:444
-
\??\c:\tbhbtb.exec:\tbhbtb.exe117⤵PID:3596
-
\??\c:\3ttntn.exec:\3ttntn.exe118⤵PID:1856
-
\??\c:\vjdvp.exec:\vjdvp.exe119⤵PID:1176
-
\??\c:\xffrlfr.exec:\xffrlfr.exe120⤵PID:4260
-
\??\c:\tbnntt.exec:\tbnntt.exe121⤵PID:3924
-
\??\c:\5jjvj.exec:\5jjvj.exe122⤵PID:3600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-