Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 19:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e3e67322e09150befe40516ac35c5a1c42869816f1c1ba4d5a11a87e712c85fe.exe
Resource
win7-20240729-en
7 signatures
120 seconds
General
-
Target
e3e67322e09150befe40516ac35c5a1c42869816f1c1ba4d5a11a87e712c85fe.exe
-
Size
454KB
-
MD5
54cb98c4e0fa8937758db911dcb873bc
-
SHA1
0955f16650e83ab4f712d2112c59b7cd3555afb1
-
SHA256
e3e67322e09150befe40516ac35c5a1c42869816f1c1ba4d5a11a87e712c85fe
-
SHA512
98c9e4ac1941d7821898e98f7ebd1d9c0b12aee33bb0a53e00d3930d88edfc9fea42b6f1322204801af321b74eda0e70565566469ff9e140e33b6d7042bc063f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbec:q7Tc2NYHUrAwfMp3CDc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2940-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3408-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/936-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/772-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/712-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-666-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-716-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-778-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-878-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1328-975-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/988-988-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-995-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-1032-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1428-1102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5004 tbthbt.exe 3408 pjjdv.exe 2380 xllxfrl.exe 4424 7lllfxr.exe 4012 ththbn.exe 548 ffxlrxr.exe 2888 5hbnhb.exe 3684 bnnbtn.exe 4064 vjdpd.exe 244 xrflfrl.exe 3620 hbhnbh.exe 412 vpjvp.exe 3464 fflxrlx.exe 1896 jdpjd.exe 2396 7xrlrlr.exe 3216 thhthh.exe 5000 htbttn.exe 2384 3ppjj.exe 3920 btnbbn.exe 4224 vvvjd.exe 3772 rflrrff.exe 3624 tnnnhn.exe 4652 xxrlxrl.exe 1844 btthbn.exe 2636 jjddd.exe 220 pjvjd.exe 2960 1ntnbt.exe 1392 xxfrlfr.exe 636 hbhthb.exe 4976 rflxxlx.exe 2168 djjdp.exe 5016 9flxllf.exe 1168 9tbntt.exe 1316 jjvdv.exe 1356 9rfxllx.exe 1592 lfxrlff.exe 1176 thnnnn.exe 1672 5ddpj.exe 3936 lxxrfxr.exe 3100 htbthn.exe 5004 jpvdj.exe 1708 vdvpj.exe 992 xlrxlxr.exe 936 tnnhbt.exe 436 7vjdp.exe 2344 ffxrfxx.exe 4788 hbbtnh.exe 1484 dpddv.exe 3700 ddpjj.exe 4624 xxxrrrx.exe 1588 1bbbtb.exe 1696 dvvdd.exe 468 fxfxxfx.exe 4408 7hhttn.exe 1832 jpvpj.exe 3004 frxxrlx.exe 2236 1nhbbh.exe 4884 3hnbbt.exe 4836 pjjdp.exe 324 frfrfrx.exe 2156 bttnbb.exe 3564 htnhtn.exe 2304 5vpdj.exe 4720 lrrfrlx.exe -
resource yara_rule behavioral2/memory/2940-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3408-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/936-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/772-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1712-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/712-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-878-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxflxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllxfrl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2940 wrote to memory of 5004 2940 e3e67322e09150befe40516ac35c5a1c42869816f1c1ba4d5a11a87e712c85fe.exe 84 PID 2940 wrote to memory of 5004 2940 e3e67322e09150befe40516ac35c5a1c42869816f1c1ba4d5a11a87e712c85fe.exe 84 PID 2940 wrote to memory of 5004 2940 e3e67322e09150befe40516ac35c5a1c42869816f1c1ba4d5a11a87e712c85fe.exe 84 PID 5004 wrote to memory of 3408 5004 tbthbt.exe 85 PID 5004 wrote to memory of 3408 5004 tbthbt.exe 85 PID 5004 wrote to memory of 3408 5004 tbthbt.exe 85 PID 3408 wrote to memory of 2380 3408 pjjdv.exe 86 PID 3408 wrote to memory of 2380 3408 pjjdv.exe 86 PID 3408 wrote to memory of 2380 3408 pjjdv.exe 86 PID 2380 wrote to memory of 4424 2380 xllxfrl.exe 87 PID 2380 wrote to memory of 4424 2380 xllxfrl.exe 87 PID 2380 wrote to memory of 4424 2380 xllxfrl.exe 87 PID 4424 wrote to memory of 4012 4424 7lllfxr.exe 88 PID 4424 wrote to memory of 4012 4424 7lllfxr.exe 88 PID 4424 wrote to memory of 4012 4424 7lllfxr.exe 88 PID 4012 wrote to memory of 548 4012 ththbn.exe 89 PID 4012 wrote to memory of 548 4012 ththbn.exe 89 PID 4012 wrote to memory of 548 4012 ththbn.exe 89 PID 548 wrote to memory of 2888 548 ffxlrxr.exe 90 PID 548 wrote to memory of 2888 548 ffxlrxr.exe 90 PID 548 wrote to memory of 2888 548 ffxlrxr.exe 90 PID 2888 wrote to memory of 3684 2888 5hbnhb.exe 91 PID 2888 wrote to memory of 3684 2888 5hbnhb.exe 91 PID 2888 wrote to memory of 3684 2888 5hbnhb.exe 91 PID 3684 wrote to memory of 4064 3684 bnnbtn.exe 92 PID 3684 wrote to memory of 4064 3684 bnnbtn.exe 92 PID 3684 wrote to memory of 4064 3684 bnnbtn.exe 92 PID 4064 wrote to memory of 244 4064 vjdpd.exe 93 PID 4064 wrote to memory of 244 4064 vjdpd.exe 93 PID 4064 wrote to memory of 244 4064 vjdpd.exe 93 PID 244 wrote to memory of 3620 244 xrflfrl.exe 94 PID 244 wrote to memory of 3620 244 xrflfrl.exe 94 PID 244 wrote to memory of 3620 244 xrflfrl.exe 94 PID 3620 wrote to memory of 412 3620 hbhnbh.exe 95 PID 3620 wrote to memory of 412 3620 hbhnbh.exe 95 PID 3620 wrote to memory of 412 3620 hbhnbh.exe 95 PID 412 wrote to memory of 3464 412 vpjvp.exe 96 PID 412 wrote to memory of 3464 412 vpjvp.exe 96 PID 412 wrote to memory of 3464 412 vpjvp.exe 96 PID 3464 wrote to memory of 1896 3464 fflxrlx.exe 97 PID 3464 wrote to memory of 1896 3464 fflxrlx.exe 97 PID 3464 wrote to memory of 1896 3464 fflxrlx.exe 97 PID 1896 wrote to memory of 2396 1896 jdpjd.exe 98 PID 1896 wrote to memory of 2396 1896 jdpjd.exe 98 PID 1896 wrote to memory of 2396 1896 jdpjd.exe 98 PID 2396 wrote to memory of 3216 2396 7xrlrlr.exe 99 PID 2396 wrote to memory of 3216 2396 7xrlrlr.exe 99 PID 2396 wrote to memory of 3216 2396 7xrlrlr.exe 99 PID 3216 wrote to memory of 5000 3216 thhthh.exe 100 PID 3216 wrote to memory of 5000 3216 thhthh.exe 100 PID 3216 wrote to memory of 5000 3216 thhthh.exe 100 PID 5000 wrote to memory of 2384 5000 htbttn.exe 101 PID 5000 wrote to memory of 2384 5000 htbttn.exe 101 PID 5000 wrote to memory of 2384 5000 htbttn.exe 101 PID 2384 wrote to memory of 3920 2384 3ppjj.exe 102 PID 2384 wrote to memory of 3920 2384 3ppjj.exe 102 PID 2384 wrote to memory of 3920 2384 3ppjj.exe 102 PID 3920 wrote to memory of 4224 3920 btnbbn.exe 103 PID 3920 wrote to memory of 4224 3920 btnbbn.exe 103 PID 3920 wrote to memory of 4224 3920 btnbbn.exe 103 PID 4224 wrote to memory of 3772 4224 vvvjd.exe 104 PID 4224 wrote to memory of 3772 4224 vvvjd.exe 104 PID 4224 wrote to memory of 3772 4224 vvvjd.exe 104 PID 3772 wrote to memory of 3624 3772 rflrrff.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3e67322e09150befe40516ac35c5a1c42869816f1c1ba4d5a11a87e712c85fe.exe"C:\Users\Admin\AppData\Local\Temp\e3e67322e09150befe40516ac35c5a1c42869816f1c1ba4d5a11a87e712c85fe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\tbthbt.exec:\tbthbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\pjjdv.exec:\pjjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\xllxfrl.exec:\xllxfrl.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\7lllfxr.exec:\7lllfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\ththbn.exec:\ththbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\ffxlrxr.exec:\ffxlrxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\5hbnhb.exec:\5hbnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\bnnbtn.exec:\bnnbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\vjdpd.exec:\vjdpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\xrflfrl.exec:\xrflfrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
\??\c:\hbhnbh.exec:\hbhnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\vpjvp.exec:\vpjvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\fflxrlx.exec:\fflxrlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\jdpjd.exec:\jdpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\7xrlrlr.exec:\7xrlrlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\thhthh.exec:\thhthh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\htbttn.exec:\htbttn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\3ppjj.exec:\3ppjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\btnbbn.exec:\btnbbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\vvvjd.exec:\vvvjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\rflrrff.exec:\rflrrff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\tnnnhn.exec:\tnnnhn.exe23⤵
- Executes dropped EXE
PID:3624 -
\??\c:\xxrlxrl.exec:\xxrlxrl.exe24⤵
- Executes dropped EXE
PID:4652 -
\??\c:\btthbn.exec:\btthbn.exe25⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jjddd.exec:\jjddd.exe26⤵
- Executes dropped EXE
PID:2636 -
\??\c:\pjvjd.exec:\pjvjd.exe27⤵
- Executes dropped EXE
PID:220 -
\??\c:\1ntnbt.exec:\1ntnbt.exe28⤵
- Executes dropped EXE
PID:2960 -
\??\c:\xxfrlfr.exec:\xxfrlfr.exe29⤵
- Executes dropped EXE
PID:1392 -
\??\c:\hbhthb.exec:\hbhthb.exe30⤵
- Executes dropped EXE
PID:636 -
\??\c:\rflxxlx.exec:\rflxxlx.exe31⤵
- Executes dropped EXE
PID:4976 -
\??\c:\djjdp.exec:\djjdp.exe32⤵
- Executes dropped EXE
PID:2168 -
\??\c:\9flxllf.exec:\9flxllf.exe33⤵
- Executes dropped EXE
PID:5016 -
\??\c:\9tbntt.exec:\9tbntt.exe34⤵
- Executes dropped EXE
PID:1168 -
\??\c:\jjvdv.exec:\jjvdv.exe35⤵
- Executes dropped EXE
PID:1316 -
\??\c:\9rfxllx.exec:\9rfxllx.exe36⤵
- Executes dropped EXE
PID:1356 -
\??\c:\lfxrlff.exec:\lfxrlff.exe37⤵
- Executes dropped EXE
PID:1592 -
\??\c:\thnnnn.exec:\thnnnn.exe38⤵
- Executes dropped EXE
PID:1176 -
\??\c:\5ddpj.exec:\5ddpj.exe39⤵
- Executes dropped EXE
PID:1672 -
\??\c:\ffllfll.exec:\ffllfll.exe40⤵PID:388
-
\??\c:\lxxrfxr.exec:\lxxrfxr.exe41⤵
- Executes dropped EXE
PID:3936 -
\??\c:\htbthn.exec:\htbthn.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3100 -
\??\c:\jpvdj.exec:\jpvdj.exe43⤵
- Executes dropped EXE
PID:5004 -
\??\c:\vdvpj.exec:\vdvpj.exe44⤵
- Executes dropped EXE
PID:1708 -
\??\c:\xlrxlxr.exec:\xlrxlxr.exe45⤵
- Executes dropped EXE
PID:992 -
\??\c:\tnnhbt.exec:\tnnhbt.exe46⤵
- Executes dropped EXE
PID:936 -
\??\c:\7vjdp.exec:\7vjdp.exe47⤵
- Executes dropped EXE
PID:436 -
\??\c:\ffxrfxx.exec:\ffxrfxx.exe48⤵
- Executes dropped EXE
PID:2344 -
\??\c:\hbbtnh.exec:\hbbtnh.exe49⤵
- Executes dropped EXE
PID:4788 -
\??\c:\dpddv.exec:\dpddv.exe50⤵
- Executes dropped EXE
PID:1484 -
\??\c:\ddpjj.exec:\ddpjj.exe51⤵
- Executes dropped EXE
PID:3700 -
\??\c:\xxxrrrx.exec:\xxxrrrx.exe52⤵
- Executes dropped EXE
PID:4624 -
\??\c:\1bbbtb.exec:\1bbbtb.exe53⤵
- Executes dropped EXE
PID:1588 -
\??\c:\dvvdd.exec:\dvvdd.exe54⤵
- Executes dropped EXE
PID:1696 -
\??\c:\fxfxxfx.exec:\fxfxxfx.exe55⤵
- Executes dropped EXE
PID:468 -
\??\c:\7hhttn.exec:\7hhttn.exe56⤵
- Executes dropped EXE
PID:4408 -
\??\c:\jpvpj.exec:\jpvpj.exe57⤵
- Executes dropped EXE
PID:1832 -
\??\c:\frxxrlx.exec:\frxxrlx.exe58⤵
- Executes dropped EXE
PID:3004 -
\??\c:\1nhbbh.exec:\1nhbbh.exe59⤵
- Executes dropped EXE
PID:2236 -
\??\c:\3hnbbt.exec:\3hnbbt.exe60⤵
- Executes dropped EXE
PID:4884 -
\??\c:\pjjdp.exec:\pjjdp.exe61⤵
- Executes dropped EXE
PID:4836 -
\??\c:\frfrfrx.exec:\frfrfrx.exe62⤵
- Executes dropped EXE
PID:324 -
\??\c:\bttnbb.exec:\bttnbb.exe63⤵
- Executes dropped EXE
PID:2156 -
\??\c:\htnhtn.exec:\htnhtn.exe64⤵
- Executes dropped EXE
PID:3564 -
\??\c:\5vpdj.exec:\5vpdj.exe65⤵
- Executes dropped EXE
PID:2304 -
\??\c:\lrrfrlx.exec:\lrrfrlx.exe66⤵
- Executes dropped EXE
PID:4720 -
\??\c:\3hbthb.exec:\3hbthb.exe67⤵PID:3536
-
\??\c:\thhbhb.exec:\thhbhb.exe68⤵PID:64
-
\??\c:\dvvdd.exec:\dvvdd.exe69⤵PID:1688
-
\??\c:\rlrfffr.exec:\rlrfffr.exe70⤵PID:3540
-
\??\c:\1hbbnn.exec:\1hbbnn.exe71⤵PID:3208
-
\??\c:\jvpjj.exec:\jvpjj.exe72⤵PID:2812
-
\??\c:\xllfrxf.exec:\xllfrxf.exe73⤵PID:4908
-
\??\c:\tnnhbt.exec:\tnnhbt.exe74⤵PID:3844
-
\??\c:\nhbbtt.exec:\nhbbtt.exe75⤵PID:1360
-
\??\c:\jdjvv.exec:\jdjvv.exe76⤵PID:4616
-
\??\c:\1fxrlfx.exec:\1fxrlfx.exe77⤵PID:1932
-
\??\c:\bbhbhh.exec:\bbhbhh.exe78⤵PID:820
-
\??\c:\vvjvp.exec:\vvjvp.exe79⤵PID:4652
-
\??\c:\fxxlfxr.exec:\fxxlfxr.exe80⤵PID:3516
-
\??\c:\hhbtnh.exec:\hhbtnh.exe81⤵PID:3548
-
\??\c:\djpdp.exec:\djpdp.exe82⤵PID:772
-
\??\c:\9rrlfxr.exec:\9rrlfxr.exe83⤵PID:2676
-
\??\c:\nbbhbh.exec:\nbbhbh.exe84⤵PID:4184
-
\??\c:\9nbbhh.exec:\9nbbhh.exe85⤵PID:384
-
\??\c:\vvvvv.exec:\vvvvv.exe86⤵PID:1192
-
\??\c:\7xxxrrr.exec:\7xxxrrr.exe87⤵
- System Location Discovery: System Language Discovery
PID:380 -
\??\c:\btbbhh.exec:\btbbhh.exe88⤵PID:2108
-
\??\c:\dpjpp.exec:\dpjpp.exe89⤵PID:2488
-
\??\c:\lflfrrr.exec:\lflfrrr.exe90⤵PID:4712
-
\??\c:\htbnnt.exec:\htbnnt.exe91⤵PID:3496
-
\??\c:\vpvjv.exec:\vpvjv.exe92⤵PID:4128
-
\??\c:\3fxlxxl.exec:\3fxlxxl.exe93⤵PID:1812
-
\??\c:\1rfxlfx.exec:\1rfxlfx.exe94⤵PID:1168
-
\??\c:\1httnt.exec:\1httnt.exe95⤵PID:4236
-
\??\c:\pvpdp.exec:\pvpdp.exe96⤵PID:2052
-
\??\c:\9rxlxrl.exec:\9rxlxrl.exe97⤵PID:2664
-
\??\c:\fllfxrl.exec:\fllfxrl.exe98⤵PID:3792
-
\??\c:\ttthbt.exec:\ttthbt.exe99⤵PID:2608
-
\??\c:\3jdpv.exec:\3jdpv.exe100⤵PID:4368
-
\??\c:\jpdvj.exec:\jpdvj.exe101⤵PID:2640
-
\??\c:\7xlfrrl.exec:\7xlfrrl.exe102⤵PID:2940
-
\??\c:\nthhhh.exec:\nthhhh.exe103⤵PID:3444
-
\??\c:\pjpjp.exec:\pjpjp.exe104⤵PID:3576
-
\??\c:\7flrffr.exec:\7flrffr.exe105⤵PID:3376
-
\??\c:\tnhtth.exec:\tnhtth.exe106⤵PID:2504
-
\??\c:\thnhtn.exec:\thnhtn.exe107⤵PID:1720
-
\??\c:\frfxffr.exec:\frfxffr.exe108⤵PID:2688
-
\??\c:\5xrlfxx.exec:\5xrlfxx.exe109⤵PID:1132
-
\??\c:\thtnbt.exec:\thtnbt.exe110⤵PID:436
-
\??\c:\vjdpj.exec:\vjdpj.exe111⤵PID:2344
-
\??\c:\ffrlrfl.exec:\ffrlrfl.exe112⤵PID:4544
-
\??\c:\rffxrxr.exec:\rffxrxr.exe113⤵PID:3500
-
\??\c:\hhnhtn.exec:\hhnhtn.exe114⤵PID:1200
-
\??\c:\vvvvp.exec:\vvvvp.exe115⤵PID:4512
-
\??\c:\5ffxlfx.exec:\5ffxlfx.exe116⤵PID:3560
-
\??\c:\nntnnn.exec:\nntnnn.exe117⤵PID:1492
-
\??\c:\tnnbtb.exec:\tnnbtb.exe118⤵PID:2424
-
\??\c:\jddvj.exec:\jddvj.exe119⤵PID:4856
-
\??\c:\rlrlrfx.exec:\rlrlrfx.exe120⤵PID:4064
-
\??\c:\nhtbnb.exec:\nhtbnb.exe121⤵PID:1036
-
\??\c:\9vjjv.exec:\9vjjv.exe122⤵PID:2160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-