Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 15:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9a0cbe33a798795d5ebcf29b2cc62ffe954139d500743d489a27ac4707d2dec2.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
9a0cbe33a798795d5ebcf29b2cc62ffe954139d500743d489a27ac4707d2dec2.exe
-
Size
454KB
-
MD5
d7958561ed405c77bdfa3c89432062dd
-
SHA1
60e8d6f319290bc6a2d65ad29c6e88b73ada9f18
-
SHA256
9a0cbe33a798795d5ebcf29b2cc62ffe954139d500743d489a27ac4707d2dec2
-
SHA512
70b4016c52cb7ce2c714fac56d1784ba8e902bb95bea6a814cccd1d9d56faba5d094acb9ac89a14a58c80688fee90497c5638da74ecef8d728ff485aac35b9e6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeA:q7Tc2NYHUrAwfMp3CDA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4060-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2568-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/900-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/796-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2804-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3368-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/324-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-768-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-781-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-839-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-901-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4964 ppdvd.exe 1604 jvdpj.exe 3764 ttbbbh.exe 4400 nhnhtn.exe 5108 lllllll.exe 2540 tthhhn.exe 2568 rlrlrxr.exe 900 tntthh.exe 4080 ddppj.exe 1092 tntnhh.exe 2436 frxrffx.exe 4136 hnttnn.exe 416 ppddp.exe 3812 bbbttt.exe 876 1vpjd.exe 4564 hntnnn.exe 4848 pdpjj.exe 2996 thbhbb.exe 4340 jvjdv.exe 2320 9hnhbb.exe 4676 pdpjj.exe 796 ffrllfr.exe 3668 ttttbt.exe 4956 vjvpp.exe 4840 lxlllrx.exe 4504 lflffxx.exe 1392 nhnnbb.exe 1824 pvjdv.exe 3208 bthnnn.exe 4992 5htntt.exe 4920 9tbbbh.exe 4484 djdpj.exe 5004 tbnhbt.exe 3228 jpvpp.exe 2576 rfxxxxf.exe 408 1nbtnn.exe 3120 9jppp.exe 2484 xlxrfff.exe 2872 btbttb.exe 4912 9bbtnn.exe 1368 pjdvv.exe 2172 1rxrflr.exe 3064 bhtnhh.exe 4184 vvdjv.exe 3192 xfxrrll.exe 4804 tbhbbb.exe 3608 jvjpd.exe 2028 dpppp.exe 1972 fflflrr.exe 4460 nbntnt.exe 4260 bhtnbb.exe 4416 1pvpp.exe 2664 xrrlffr.exe 896 tntnhh.exe 4016 1tnnnh.exe 3764 pjvvv.exe 1256 9ffxrll.exe 1716 thnhtt.exe 4556 vjpjd.exe 3712 lxlrlll.exe 1932 bbnnht.exe 3888 vpvpj.exe 2376 xfxlfxx.exe 3224 rlffrrl.exe -
resource yara_rule behavioral2/memory/4060-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2568-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/900-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/796-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2804-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/324-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-768-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-839-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4060 wrote to memory of 4964 4060 9a0cbe33a798795d5ebcf29b2cc62ffe954139d500743d489a27ac4707d2dec2.exe 82 PID 4060 wrote to memory of 4964 4060 9a0cbe33a798795d5ebcf29b2cc62ffe954139d500743d489a27ac4707d2dec2.exe 82 PID 4060 wrote to memory of 4964 4060 9a0cbe33a798795d5ebcf29b2cc62ffe954139d500743d489a27ac4707d2dec2.exe 82 PID 4964 wrote to memory of 1604 4964 ppdvd.exe 83 PID 4964 wrote to memory of 1604 4964 ppdvd.exe 83 PID 4964 wrote to memory of 1604 4964 ppdvd.exe 83 PID 1604 wrote to memory of 3764 1604 jvdpj.exe 84 PID 1604 wrote to memory of 3764 1604 jvdpj.exe 84 PID 1604 wrote to memory of 3764 1604 jvdpj.exe 84 PID 3764 wrote to memory of 4400 3764 ttbbbh.exe 85 PID 3764 wrote to memory of 4400 3764 ttbbbh.exe 85 PID 3764 wrote to memory of 4400 3764 ttbbbh.exe 85 PID 4400 wrote to memory of 5108 4400 nhnhtn.exe 86 PID 4400 wrote to memory of 5108 4400 nhnhtn.exe 86 PID 4400 wrote to memory of 5108 4400 nhnhtn.exe 86 PID 5108 wrote to memory of 2540 5108 lllllll.exe 87 PID 5108 wrote to memory of 2540 5108 lllllll.exe 87 PID 5108 wrote to memory of 2540 5108 lllllll.exe 87 PID 2540 wrote to memory of 2568 2540 tthhhn.exe 88 PID 2540 wrote to memory of 2568 2540 tthhhn.exe 88 PID 2540 wrote to memory of 2568 2540 tthhhn.exe 88 PID 2568 wrote to memory of 900 2568 rlrlrxr.exe 89 PID 2568 wrote to memory of 900 2568 rlrlrxr.exe 89 PID 2568 wrote to memory of 900 2568 rlrlrxr.exe 89 PID 900 wrote to memory of 4080 900 tntthh.exe 90 PID 900 wrote to memory of 4080 900 tntthh.exe 90 PID 900 wrote to memory of 4080 900 tntthh.exe 90 PID 4080 wrote to memory of 1092 4080 ddppj.exe 91 PID 4080 wrote to memory of 1092 4080 ddppj.exe 91 PID 4080 wrote to memory of 1092 4080 ddppj.exe 91 PID 1092 wrote to memory of 2436 1092 tntnhh.exe 92 PID 1092 wrote to memory of 2436 1092 tntnhh.exe 92 PID 1092 wrote to memory of 2436 1092 tntnhh.exe 92 PID 2436 wrote to memory of 4136 2436 frxrffx.exe 93 PID 2436 wrote to memory of 4136 2436 frxrffx.exe 93 PID 2436 wrote to memory of 4136 2436 frxrffx.exe 93 PID 4136 wrote to memory of 416 4136 hnttnn.exe 94 PID 4136 wrote to memory of 416 4136 hnttnn.exe 94 PID 4136 wrote to memory of 416 4136 hnttnn.exe 94 PID 416 wrote to memory of 3812 416 ppddp.exe 95 PID 416 wrote to memory of 3812 416 ppddp.exe 95 PID 416 wrote to memory of 3812 416 ppddp.exe 95 PID 3812 wrote to memory of 876 3812 bbbttt.exe 96 PID 3812 wrote to memory of 876 3812 bbbttt.exe 96 PID 3812 wrote to memory of 876 3812 bbbttt.exe 96 PID 876 wrote to memory of 4564 876 1vpjd.exe 97 PID 876 wrote to memory of 4564 876 1vpjd.exe 97 PID 876 wrote to memory of 4564 876 1vpjd.exe 97 PID 4564 wrote to memory of 4848 4564 hntnnn.exe 98 PID 4564 wrote to memory of 4848 4564 hntnnn.exe 98 PID 4564 wrote to memory of 4848 4564 hntnnn.exe 98 PID 4848 wrote to memory of 2996 4848 pdpjj.exe 99 PID 4848 wrote to memory of 2996 4848 pdpjj.exe 99 PID 4848 wrote to memory of 2996 4848 pdpjj.exe 99 PID 2996 wrote to memory of 4340 2996 thbhbb.exe 100 PID 2996 wrote to memory of 4340 2996 thbhbb.exe 100 PID 2996 wrote to memory of 4340 2996 thbhbb.exe 100 PID 4340 wrote to memory of 2320 4340 jvjdv.exe 101 PID 4340 wrote to memory of 2320 4340 jvjdv.exe 101 PID 4340 wrote to memory of 2320 4340 jvjdv.exe 101 PID 2320 wrote to memory of 4676 2320 9hnhbb.exe 102 PID 2320 wrote to memory of 4676 2320 9hnhbb.exe 102 PID 2320 wrote to memory of 4676 2320 9hnhbb.exe 102 PID 4676 wrote to memory of 796 4676 pdpjj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a0cbe33a798795d5ebcf29b2cc62ffe954139d500743d489a27ac4707d2dec2.exe"C:\Users\Admin\AppData\Local\Temp\9a0cbe33a798795d5ebcf29b2cc62ffe954139d500743d489a27ac4707d2dec2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\ppdvd.exec:\ppdvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\jvdpj.exec:\jvdpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\ttbbbh.exec:\ttbbbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\nhnhtn.exec:\nhnhtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\lllllll.exec:\lllllll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\tthhhn.exec:\tthhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\rlrlrxr.exec:\rlrlrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\tntthh.exec:\tntthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\ddppj.exec:\ddppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\tntnhh.exec:\tntnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\frxrffx.exec:\frxrffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\hnttnn.exec:\hnttnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\ppddp.exec:\ppddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
\??\c:\bbbttt.exec:\bbbttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\1vpjd.exec:\1vpjd.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\hntnnn.exec:\hntnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\pdpjj.exec:\pdpjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\thbhbb.exec:\thbhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\jvjdv.exec:\jvjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\9hnhbb.exec:\9hnhbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\pdpjj.exec:\pdpjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\ffrllfr.exec:\ffrllfr.exe23⤵
- Executes dropped EXE
PID:796 -
\??\c:\ttttbt.exec:\ttttbt.exe24⤵
- Executes dropped EXE
PID:3668 -
\??\c:\vjvpp.exec:\vjvpp.exe25⤵
- Executes dropped EXE
PID:4956 -
\??\c:\lxlllrx.exec:\lxlllrx.exe26⤵
- Executes dropped EXE
PID:4840 -
\??\c:\lflffxx.exec:\lflffxx.exe27⤵
- Executes dropped EXE
PID:4504 -
\??\c:\nhnnbb.exec:\nhnnbb.exe28⤵
- Executes dropped EXE
PID:1392 -
\??\c:\pvjdv.exec:\pvjdv.exe29⤵
- Executes dropped EXE
PID:1824 -
\??\c:\bthnnn.exec:\bthnnn.exe30⤵
- Executes dropped EXE
PID:3208 -
\??\c:\5htntt.exec:\5htntt.exe31⤵
- Executes dropped EXE
PID:4992 -
\??\c:\9tbbbh.exec:\9tbbbh.exe32⤵
- Executes dropped EXE
PID:4920 -
\??\c:\djdpj.exec:\djdpj.exe33⤵
- Executes dropped EXE
PID:4484 -
\??\c:\tbnhbt.exec:\tbnhbt.exe34⤵
- Executes dropped EXE
PID:5004 -
\??\c:\jpvpp.exec:\jpvpp.exe35⤵
- Executes dropped EXE
PID:3228 -
\??\c:\rfxxxxf.exec:\rfxxxxf.exe36⤵
- Executes dropped EXE
PID:2576 -
\??\c:\1nbtnn.exec:\1nbtnn.exe37⤵
- Executes dropped EXE
PID:408 -
\??\c:\9jppp.exec:\9jppp.exe38⤵
- Executes dropped EXE
PID:3120 -
\??\c:\xlxrfff.exec:\xlxrfff.exe39⤵
- Executes dropped EXE
PID:2484 -
\??\c:\btbttb.exec:\btbttb.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\9bbtnn.exec:\9bbtnn.exe41⤵
- Executes dropped EXE
PID:4912 -
\??\c:\pjdvv.exec:\pjdvv.exe42⤵
- Executes dropped EXE
PID:1368 -
\??\c:\1rxrflr.exec:\1rxrflr.exe43⤵
- Executes dropped EXE
PID:2172 -
\??\c:\bhtnhh.exec:\bhtnhh.exe44⤵
- Executes dropped EXE
PID:3064 -
\??\c:\vvdjv.exec:\vvdjv.exe45⤵
- Executes dropped EXE
PID:4184 -
\??\c:\xfxrrll.exec:\xfxrrll.exe46⤵
- Executes dropped EXE
PID:3192 -
\??\c:\tbhbbb.exec:\tbhbbb.exe47⤵
- Executes dropped EXE
PID:4804 -
\??\c:\jvjpd.exec:\jvjpd.exe48⤵
- Executes dropped EXE
PID:3608 -
\??\c:\dpppp.exec:\dpppp.exe49⤵
- Executes dropped EXE
PID:2028 -
\??\c:\fflflrr.exec:\fflflrr.exe50⤵
- Executes dropped EXE
PID:1972 -
\??\c:\nbntnt.exec:\nbntnt.exe51⤵
- Executes dropped EXE
PID:4460 -
\??\c:\bhtnbb.exec:\bhtnbb.exe52⤵
- Executes dropped EXE
PID:4260 -
\??\c:\1pvpp.exec:\1pvpp.exe53⤵
- Executes dropped EXE
PID:4416 -
\??\c:\xrrlffr.exec:\xrrlffr.exe54⤵
- Executes dropped EXE
PID:2664 -
\??\c:\tntnhh.exec:\tntnhh.exe55⤵
- Executes dropped EXE
PID:896 -
\??\c:\1tnnnh.exec:\1tnnnh.exe56⤵
- Executes dropped EXE
PID:4016 -
\??\c:\pjvvv.exec:\pjvvv.exe57⤵
- Executes dropped EXE
PID:3764 -
\??\c:\9ffxrll.exec:\9ffxrll.exe58⤵
- Executes dropped EXE
PID:1256 -
\??\c:\thnhtt.exec:\thnhtt.exe59⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vjpjd.exec:\vjpjd.exe60⤵
- Executes dropped EXE
PID:4556 -
\??\c:\lxlrlll.exec:\lxlrlll.exe61⤵
- Executes dropped EXE
PID:3712 -
\??\c:\bbnnht.exec:\bbnnht.exe62⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vpvpj.exec:\vpvpj.exe63⤵
- Executes dropped EXE
PID:3888 -
\??\c:\xfxlfxx.exec:\xfxlfxx.exe64⤵
- Executes dropped EXE
PID:2376 -
\??\c:\rlffrrl.exec:\rlffrrl.exe65⤵
- Executes dropped EXE
PID:3224 -
\??\c:\bbntbb.exec:\bbntbb.exe66⤵PID:5052
-
\??\c:\5pjdv.exec:\5pjdv.exe67⤵PID:4024
-
\??\c:\rrrlfxf.exec:\rrrlfxf.exe68⤵PID:972
-
\??\c:\3bhbth.exec:\3bhbth.exe69⤵PID:2280
-
\??\c:\tnbtbt.exec:\tnbtbt.exe70⤵PID:2404
-
\??\c:\vvjpj.exec:\vvjpj.exe71⤵PID:412
-
\??\c:\vjjvd.exec:\vjjvd.exe72⤵PID:2228
-
\??\c:\hhnnhn.exec:\hhnnhn.exe73⤵PID:4288
-
\??\c:\nnbnhb.exec:\nnbnhb.exe74⤵PID:1612
-
\??\c:\jdppp.exec:\jdppp.exe75⤵PID:3012
-
\??\c:\frfxrlx.exec:\frfxrlx.exe76⤵PID:2428
-
\??\c:\xxxxxll.exec:\xxxxxll.exe77⤵PID:2804
-
\??\c:\htnnnt.exec:\htnnnt.exe78⤵PID:4876
-
\??\c:\jddvp.exec:\jddvp.exe79⤵PID:680
-
\??\c:\xrxxxll.exec:\xrxxxll.exe80⤵PID:4048
-
\??\c:\tnbbtb.exec:\tnbbtb.exe81⤵PID:1416
-
\??\c:\3vddp.exec:\3vddp.exe82⤵PID:3368
-
\??\c:\dvjjp.exec:\dvjjp.exe83⤵PID:4676
-
\??\c:\lfllllr.exec:\lfllllr.exe84⤵PID:796
-
\??\c:\hthhhh.exec:\hthhhh.exe85⤵PID:2940
-
\??\c:\dvvpj.exec:\dvvpj.exe86⤵PID:3364
-
\??\c:\rxfllrx.exec:\rxfllrx.exe87⤵PID:528
-
\??\c:\lxffxxx.exec:\lxffxxx.exe88⤵PID:2216
-
\??\c:\nhbhhh.exec:\nhbhhh.exe89⤵PID:4324
-
\??\c:\ddjdv.exec:\ddjdv.exe90⤵PID:1552
-
\??\c:\llxxrxx.exec:\llxxrxx.exe91⤵PID:1780
-
\??\c:\bnnnbt.exec:\bnnnbt.exe92⤵PID:2180
-
\??\c:\tttttn.exec:\tttttn.exe93⤵PID:4108
-
\??\c:\dvjjd.exec:\dvjjd.exe94⤵PID:4444
-
\??\c:\9rxxlrr.exec:\9rxxlrr.exe95⤵PID:3868
-
\??\c:\hbhhbt.exec:\hbhhbt.exe96⤵PID:2412
-
\??\c:\dvpjj.exec:\dvpjj.exe97⤵PID:4920
-
\??\c:\xrrrfxl.exec:\xrrrfxl.exe98⤵PID:1988
-
\??\c:\5hhbtn.exec:\5hhbtn.exe99⤵PID:5004
-
\??\c:\vjpvj.exec:\vjpvj.exe100⤵PID:4788
-
\??\c:\fflllll.exec:\fflllll.exe101⤵PID:1964
-
\??\c:\nntttb.exec:\nntttb.exe102⤵PID:408
-
\??\c:\vpdvp.exec:\vpdvp.exe103⤵PID:2876
-
\??\c:\vpddv.exec:\vpddv.exe104⤵PID:636
-
\??\c:\ffllrxx.exec:\ffllrxx.exe105⤵PID:832
-
\??\c:\bhnnhn.exec:\bhnnhn.exe106⤵PID:4704
-
\??\c:\dvdvj.exec:\dvdvj.exe107⤵PID:2992
-
\??\c:\vvpvj.exec:\vvpvj.exe108⤵PID:3624
-
\??\c:\xxffxxr.exec:\xxffxxr.exe109⤵PID:4592
-
\??\c:\tnbbbb.exec:\tnbbbb.exe110⤵PID:4684
-
\??\c:\tnntnt.exec:\tnntnt.exe111⤵PID:3440
-
\??\c:\vdvdj.exec:\vdvdj.exe112⤵PID:1888
-
\??\c:\rlffxrr.exec:\rlffxrr.exe113⤵PID:1600
-
\??\c:\hbhbbb.exec:\hbhbbb.exe114⤵PID:1056
-
\??\c:\thnnhb.exec:\thnnhb.exe115⤵PID:4404
-
\??\c:\7ddpp.exec:\7ddpp.exe116⤵PID:4664
-
\??\c:\xxffflr.exec:\xxffflr.exe117⤵PID:3572
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe118⤵PID:4892
-
\??\c:\bnhbnn.exec:\bnhbnn.exe119⤵PID:3520
-
\??\c:\djjjj.exec:\djjjj.exe120⤵PID:4528
-
\??\c:\rlfxflr.exec:\rlfxflr.exe121⤵PID:1844
-
\??\c:\bbtnbb.exec:\bbtnbb.exe122⤵PID:4400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-