Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 12:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d01aac0405276ba991db94415dfba2ee0604d1d3be6ac1c1710e6396198c3c70N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
d01aac0405276ba991db94415dfba2ee0604d1d3be6ac1c1710e6396198c3c70N.exe
-
Size
453KB
-
MD5
87cdd088b81c43874698e72678abca70
-
SHA1
b7ed021a998fc07f3bf94ab077fa889cbc9cbb33
-
SHA256
d01aac0405276ba991db94415dfba2ee0604d1d3be6ac1c1710e6396198c3c70
-
SHA512
bfc9461d425e66d870114cdb991b5fbe5b0033c945d7bd65b92283d2a8514d38d5f08eace8a6885de423dada05cf17fcad140e015e5390f8acbd92165cd56650
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetp:q7Tc2NYHUrAwfMp3CDtp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2256-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/520-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/772-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/476-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4120-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1856-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3368-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/772-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1408-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1264-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-661-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-714-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-739-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-746-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-777-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-1159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3980 llfrxrr.exe 3452 pjpjp.exe 4736 hhnbnh.exe 520 bhhbnh.exe 772 vjpjp.exe 972 htbnnh.exe 476 7xfxlrl.exe 2428 jpvjv.exe 3968 9hthbn.exe 3440 lxlxfrx.exe 2348 5ttntt.exe 2780 7nbtnn.exe 2572 ffxflxl.exe 3936 vjjdv.exe 1548 lxffrfr.exe 2268 7ddpd.exe 2012 btnhbh.exe 444 nthtnh.exe 2308 ttbthh.exe 4596 3djdv.exe 4588 llfrfxl.exe 3648 tnnbtn.exe 628 jvpdp.exe 1680 5bhhbt.exe 3216 pvdpj.exe 3436 tnttnh.exe 4412 jdjjd.exe 404 hbbtnb.exe 3340 dppdv.exe 1696 xlrfrrf.exe 2808 frxrlfx.exe 296 bbbbtn.exe 4128 xrlfrrx.exe 456 tntnnn.exe 3320 dpvjv.exe 4120 3flfrrl.exe 1112 bbbtnh.exe 3328 bhbthh.exe 2008 dvvjd.exe 2344 lxxxrlf.exe 4152 rffrfxl.exe 1856 dppvv.exe 960 dvdjv.exe 3412 flrlrrf.exe 4496 nhbbtn.exe 4252 jdvpj.exe 1092 flrlfxr.exe 2956 9xfrfxl.exe 3060 hhtnbb.exe 3368 pjjdp.exe 1752 lrxlxrl.exe 3568 nhhhbb.exe 2288 vddvp.exe 4344 jvdjd.exe 772 rxfrlfl.exe 4144 7hnhbt.exe 3484 pdjdp.exe 3132 rrlrllf.exe 1408 bnbthb.exe 2428 3bbttn.exe 1264 jdvjp.exe 880 1lrfffl.exe 2980 nhnnhh.exe 932 jddvp.exe -
resource yara_rule behavioral2/memory/2256-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/520-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/772-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/476-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1856-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4252-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/772-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1408-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1264-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-777-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2256 wrote to memory of 3980 2256 d01aac0405276ba991db94415dfba2ee0604d1d3be6ac1c1710e6396198c3c70N.exe 82 PID 2256 wrote to memory of 3980 2256 d01aac0405276ba991db94415dfba2ee0604d1d3be6ac1c1710e6396198c3c70N.exe 82 PID 2256 wrote to memory of 3980 2256 d01aac0405276ba991db94415dfba2ee0604d1d3be6ac1c1710e6396198c3c70N.exe 82 PID 3980 wrote to memory of 3452 3980 llfrxrr.exe 83 PID 3980 wrote to memory of 3452 3980 llfrxrr.exe 83 PID 3980 wrote to memory of 3452 3980 llfrxrr.exe 83 PID 3452 wrote to memory of 4736 3452 pjpjp.exe 84 PID 3452 wrote to memory of 4736 3452 pjpjp.exe 84 PID 3452 wrote to memory of 4736 3452 pjpjp.exe 84 PID 4736 wrote to memory of 520 4736 hhnbnh.exe 85 PID 4736 wrote to memory of 520 4736 hhnbnh.exe 85 PID 4736 wrote to memory of 520 4736 hhnbnh.exe 85 PID 520 wrote to memory of 772 520 bhhbnh.exe 86 PID 520 wrote to memory of 772 520 bhhbnh.exe 86 PID 520 wrote to memory of 772 520 bhhbnh.exe 86 PID 772 wrote to memory of 972 772 vjpjp.exe 87 PID 772 wrote to memory of 972 772 vjpjp.exe 87 PID 772 wrote to memory of 972 772 vjpjp.exe 87 PID 972 wrote to memory of 476 972 htbnnh.exe 88 PID 972 wrote to memory of 476 972 htbnnh.exe 88 PID 972 wrote to memory of 476 972 htbnnh.exe 88 PID 476 wrote to memory of 2428 476 7xfxlrl.exe 89 PID 476 wrote to memory of 2428 476 7xfxlrl.exe 89 PID 476 wrote to memory of 2428 476 7xfxlrl.exe 89 PID 2428 wrote to memory of 3968 2428 jpvjv.exe 90 PID 2428 wrote to memory of 3968 2428 jpvjv.exe 90 PID 2428 wrote to memory of 3968 2428 jpvjv.exe 90 PID 3968 wrote to memory of 3440 3968 9hthbn.exe 91 PID 3968 wrote to memory of 3440 3968 9hthbn.exe 91 PID 3968 wrote to memory of 3440 3968 9hthbn.exe 91 PID 3440 wrote to memory of 2348 3440 lxlxfrx.exe 92 PID 3440 wrote to memory of 2348 3440 lxlxfrx.exe 92 PID 3440 wrote to memory of 2348 3440 lxlxfrx.exe 92 PID 2348 wrote to memory of 2780 2348 5ttntt.exe 93 PID 2348 wrote to memory of 2780 2348 5ttntt.exe 93 PID 2348 wrote to memory of 2780 2348 5ttntt.exe 93 PID 2780 wrote to memory of 2572 2780 7nbtnn.exe 94 PID 2780 wrote to memory of 2572 2780 7nbtnn.exe 94 PID 2780 wrote to memory of 2572 2780 7nbtnn.exe 94 PID 2572 wrote to memory of 3936 2572 ffxflxl.exe 95 PID 2572 wrote to memory of 3936 2572 ffxflxl.exe 95 PID 2572 wrote to memory of 3936 2572 ffxflxl.exe 95 PID 3936 wrote to memory of 1548 3936 vjjdv.exe 96 PID 3936 wrote to memory of 1548 3936 vjjdv.exe 96 PID 3936 wrote to memory of 1548 3936 vjjdv.exe 96 PID 1548 wrote to memory of 2268 1548 lxffrfr.exe 97 PID 1548 wrote to memory of 2268 1548 lxffrfr.exe 97 PID 1548 wrote to memory of 2268 1548 lxffrfr.exe 97 PID 2268 wrote to memory of 2012 2268 7ddpd.exe 98 PID 2268 wrote to memory of 2012 2268 7ddpd.exe 98 PID 2268 wrote to memory of 2012 2268 7ddpd.exe 98 PID 2012 wrote to memory of 444 2012 btnhbh.exe 99 PID 2012 wrote to memory of 444 2012 btnhbh.exe 99 PID 2012 wrote to memory of 444 2012 btnhbh.exe 99 PID 444 wrote to memory of 2308 444 nthtnh.exe 100 PID 444 wrote to memory of 2308 444 nthtnh.exe 100 PID 444 wrote to memory of 2308 444 nthtnh.exe 100 PID 2308 wrote to memory of 4596 2308 ttbthh.exe 101 PID 2308 wrote to memory of 4596 2308 ttbthh.exe 101 PID 2308 wrote to memory of 4596 2308 ttbthh.exe 101 PID 4596 wrote to memory of 4588 4596 3djdv.exe 102 PID 4596 wrote to memory of 4588 4596 3djdv.exe 102 PID 4596 wrote to memory of 4588 4596 3djdv.exe 102 PID 4588 wrote to memory of 3648 4588 llfrfxl.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\d01aac0405276ba991db94415dfba2ee0604d1d3be6ac1c1710e6396198c3c70N.exe"C:\Users\Admin\AppData\Local\Temp\d01aac0405276ba991db94415dfba2ee0604d1d3be6ac1c1710e6396198c3c70N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\llfrxrr.exec:\llfrxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\pjpjp.exec:\pjpjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\hhnbnh.exec:\hhnbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\bhhbnh.exec:\bhhbnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
\??\c:\vjpjp.exec:\vjpjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\htbnnh.exec:\htbnnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\7xfxlrl.exec:\7xfxlrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:476 -
\??\c:\jpvjv.exec:\jpvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\9hthbn.exec:\9hthbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\lxlxfrx.exec:\lxlxfrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\5ttntt.exec:\5ttntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\7nbtnn.exec:\7nbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\ffxflxl.exec:\ffxflxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\vjjdv.exec:\vjjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\lxffrfr.exec:\lxffrfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\7ddpd.exec:\7ddpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\btnhbh.exec:\btnhbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\nthtnh.exec:\nthtnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\ttbthh.exec:\ttbthh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\3djdv.exec:\3djdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\llfrfxl.exec:\llfrfxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\tnnbtn.exec:\tnnbtn.exe23⤵
- Executes dropped EXE
PID:3648 -
\??\c:\jvpdp.exec:\jvpdp.exe24⤵
- Executes dropped EXE
PID:628 -
\??\c:\5bhhbt.exec:\5bhhbt.exe25⤵
- Executes dropped EXE
PID:1680 -
\??\c:\pvdpj.exec:\pvdpj.exe26⤵
- Executes dropped EXE
PID:3216 -
\??\c:\tnttnh.exec:\tnttnh.exe27⤵
- Executes dropped EXE
PID:3436 -
\??\c:\jdjjd.exec:\jdjjd.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4412 -
\??\c:\hbbtnb.exec:\hbbtnb.exe29⤵
- Executes dropped EXE
PID:404 -
\??\c:\dppdv.exec:\dppdv.exe30⤵
- Executes dropped EXE
PID:3340 -
\??\c:\xlrfrrf.exec:\xlrfrrf.exe31⤵
- Executes dropped EXE
PID:1696 -
\??\c:\frxrlfx.exec:\frxrlfx.exe32⤵
- Executes dropped EXE
PID:2808 -
\??\c:\bbbbtn.exec:\bbbbtn.exe33⤵
- Executes dropped EXE
PID:296 -
\??\c:\xrlfrrx.exec:\xrlfrrx.exe34⤵
- Executes dropped EXE
PID:4128 -
\??\c:\tntnnn.exec:\tntnnn.exe35⤵
- Executes dropped EXE
PID:456 -
\??\c:\dpvjv.exec:\dpvjv.exe36⤵
- Executes dropped EXE
PID:3320 -
\??\c:\3flfrrl.exec:\3flfrrl.exe37⤵
- Executes dropped EXE
PID:4120 -
\??\c:\bbbtnh.exec:\bbbtnh.exe38⤵
- Executes dropped EXE
PID:1112 -
\??\c:\bhbthh.exec:\bhbthh.exe39⤵
- Executes dropped EXE
PID:3328 -
\??\c:\dvvjd.exec:\dvvjd.exe40⤵
- Executes dropped EXE
PID:2008 -
\??\c:\lxxxrlf.exec:\lxxxrlf.exe41⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rffrfxl.exec:\rffrfxl.exe42⤵
- Executes dropped EXE
PID:4152 -
\??\c:\dppvv.exec:\dppvv.exe43⤵
- Executes dropped EXE
PID:1856 -
\??\c:\dvdjv.exec:\dvdjv.exe44⤵
- Executes dropped EXE
PID:960 -
\??\c:\flrlrrf.exec:\flrlrrf.exe45⤵
- Executes dropped EXE
PID:3412 -
\??\c:\nhbbtn.exec:\nhbbtn.exe46⤵
- Executes dropped EXE
PID:4496 -
\??\c:\jdvpj.exec:\jdvpj.exe47⤵
- Executes dropped EXE
PID:4252 -
\??\c:\flrlfxr.exec:\flrlfxr.exe48⤵
- Executes dropped EXE
PID:1092 -
\??\c:\9xfrfxl.exec:\9xfrfxl.exe49⤵
- Executes dropped EXE
PID:2956 -
\??\c:\hhtnbb.exec:\hhtnbb.exe50⤵
- Executes dropped EXE
PID:3060 -
\??\c:\pjjdp.exec:\pjjdp.exe51⤵
- Executes dropped EXE
PID:3368 -
\??\c:\lrxlxrl.exec:\lrxlxrl.exe52⤵
- Executes dropped EXE
PID:1752 -
\??\c:\nhhhbb.exec:\nhhhbb.exe53⤵
- Executes dropped EXE
PID:3568 -
\??\c:\vddvp.exec:\vddvp.exe54⤵
- Executes dropped EXE
PID:2288 -
\??\c:\jvdjd.exec:\jvdjd.exe55⤵
- Executes dropped EXE
PID:4344 -
\??\c:\rxfrlfl.exec:\rxfrlfl.exe56⤵
- Executes dropped EXE
PID:772 -
\??\c:\7hnhbt.exec:\7hnhbt.exe57⤵
- Executes dropped EXE
PID:4144 -
\??\c:\pdjdp.exec:\pdjdp.exe58⤵
- Executes dropped EXE
PID:3484 -
\??\c:\rrlrllf.exec:\rrlrllf.exe59⤵
- Executes dropped EXE
PID:3132 -
\??\c:\bnbthb.exec:\bnbthb.exe60⤵
- Executes dropped EXE
PID:1408 -
\??\c:\3bbttn.exec:\3bbttn.exe61⤵
- Executes dropped EXE
PID:2428 -
\??\c:\jdvjp.exec:\jdvjp.exe62⤵
- Executes dropped EXE
PID:1264 -
\??\c:\1lrfffl.exec:\1lrfffl.exe63⤵
- Executes dropped EXE
PID:880 -
\??\c:\nhnnhh.exec:\nhnnhh.exe64⤵
- Executes dropped EXE
PID:2980 -
\??\c:\jddvp.exec:\jddvp.exe65⤵
- Executes dropped EXE
PID:932 -
\??\c:\nbnhhh.exec:\nbnhhh.exe66⤵PID:1992
-
\??\c:\nttnht.exec:\nttnht.exe67⤵PID:2468
-
\??\c:\djvpd.exec:\djvpd.exe68⤵PID:4004
-
\??\c:\xrlxxrx.exec:\xrlxxrx.exe69⤵PID:596
-
\??\c:\nbbthh.exec:\nbbthh.exe70⤵PID:2396
-
\??\c:\1vpjv.exec:\1vpjv.exe71⤵PID:3872
-
\??\c:\pdjvp.exec:\pdjvp.exe72⤵PID:3500
-
\??\c:\fllxlfx.exec:\fllxlfx.exe73⤵PID:4020
-
\??\c:\3hbtnh.exec:\3hbtnh.exe74⤵PID:2312
-
\??\c:\dppdv.exec:\dppdv.exe75⤵PID:2012
-
\??\c:\pjvpj.exec:\pjvpj.exe76⤵PID:2840
-
\??\c:\lxfrlfx.exec:\lxfrlfx.exe77⤵
- System Location Discovery: System Language Discovery
PID:3112 -
\??\c:\btnhnb.exec:\btnhnb.exe78⤵PID:4232
-
\??\c:\jvvdv.exec:\jvvdv.exe79⤵PID:4508
-
\??\c:\xffrlfx.exec:\xffrlfx.exe80⤵PID:1304
-
\??\c:\fxrlfrl.exec:\fxrlfrl.exe81⤵PID:1448
-
\??\c:\hhnbnh.exec:\hhnbnh.exe82⤵PID:3888
-
\??\c:\pjjpj.exec:\pjjpj.exe83⤵PID:1132
-
\??\c:\pdvpd.exec:\pdvpd.exe84⤵PID:2584
-
\??\c:\flrfxlx.exec:\flrfxlx.exe85⤵PID:3436
-
\??\c:\5tnnbt.exec:\5tnnbt.exe86⤵PID:3668
-
\??\c:\vpjdp.exec:\vpjdp.exe87⤵PID:3596
-
\??\c:\dvvjp.exec:\dvvjp.exe88⤵PID:4420
-
\??\c:\rfflfxr.exec:\rfflfxr.exe89⤵PID:4056
-
\??\c:\bthbbb.exec:\bthbbb.exe90⤵PID:3524
-
\??\c:\jjjjd.exec:\jjjjd.exe91⤵PID:4116
-
\??\c:\dvdvv.exec:\dvdvv.exe92⤵PID:1180
-
\??\c:\5xrfrlf.exec:\5xrfrlf.exe93⤵PID:2744
-
\??\c:\htbhtn.exec:\htbhtn.exe94⤵PID:1808
-
\??\c:\pjjdd.exec:\pjjdd.exe95⤵PID:3320
-
\??\c:\9frfrlf.exec:\9frfrlf.exe96⤵PID:4120
-
\??\c:\htbthh.exec:\htbthh.exe97⤵PID:2832
-
\??\c:\pjpjd.exec:\pjpjd.exe98⤵PID:4880
-
\??\c:\pdpjv.exec:\pdpjv.exe99⤵PID:2008
-
\??\c:\lxfrllf.exec:\lxfrllf.exe100⤵PID:1080
-
\??\c:\btbttn.exec:\btbttn.exe101⤵PID:2208
-
\??\c:\vdpjd.exec:\vdpjd.exe102⤵PID:2432
-
\??\c:\lfrlxxr.exec:\lfrlxxr.exe103⤵PID:3472
-
\??\c:\3thttb.exec:\3thttb.exe104⤵PID:3984
-
\??\c:\hnbbbb.exec:\hnbbbb.exe105⤵PID:4572
-
\??\c:\pdjvv.exec:\pdjvv.exe106⤵
- System Location Discovery: System Language Discovery
PID:4496 -
\??\c:\3flrfff.exec:\3flrfff.exe107⤵PID:2216
-
\??\c:\nhhbbt.exec:\nhhbbt.exe108⤵PID:1092
-
\??\c:\7ddvp.exec:\7ddvp.exe109⤵PID:2180
-
\??\c:\9vdvj.exec:\9vdvj.exe110⤵PID:3060
-
\??\c:\rffrlfr.exec:\rffrlfr.exe111⤵PID:4736
-
\??\c:\bnbbtt.exec:\bnbbtt.exe112⤵PID:1632
-
\??\c:\hhhhbb.exec:\hhhhbb.exe113⤵PID:1288
-
\??\c:\lxxrrlf.exec:\lxxrrlf.exe114⤵PID:1040
-
\??\c:\lffrxxx.exec:\lffrxxx.exe115⤵PID:4556
-
\??\c:\hbtnhb.exec:\hbtnhb.exe116⤵PID:4288
-
\??\c:\dvdvp.exec:\dvdvp.exe117⤵PID:3208
-
\??\c:\dpvjd.exec:\dpvjd.exe118⤵PID:4040
-
\??\c:\lxlrlfr.exec:\lxlrlfr.exe119⤵PID:5092
-
\??\c:\9nttnh.exec:\9nttnh.exe120⤵PID:4892
-
\??\c:\vjppd.exec:\vjppd.exe121⤵PID:3732
-
\??\c:\5ddpj.exec:\5ddpj.exe122⤵PID:3244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-