Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 18:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a0fef7a397030d7e3bad73986411a9ddb7747ebbd997e7f1fd1906dd8615863N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
5a0fef7a397030d7e3bad73986411a9ddb7747ebbd997e7f1fd1906dd8615863N.exe
-
Size
456KB
-
MD5
2f0ee2b2a5b0ca29bb6ae2a724fb9090
-
SHA1
11dddd685d5bc3f6d767d4a5905b35b04223a8e0
-
SHA256
5a0fef7a397030d7e3bad73986411a9ddb7747ebbd997e7f1fd1906dd8615863
-
SHA512
749753d32a7d755ca5a1f32645416fb47c56c100f07528664f2e68c89cb91688c478fce74cf96289daaa2eb0734e69440d1dbfe87cc019492068f27ffe3555c2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRr:q7Tc2NYHUrAwfMp3CDRr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1940-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1104-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3368-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1784-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4140-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3368-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1012-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2092-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1084-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2068-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1516-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-697-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-1475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4576 jjvdj.exe 3060 jdpvp.exe 2612 pdvjv.exe 5032 nhnhhn.exe 4808 lxrfxfx.exe 4828 jjjvj.exe 3180 1lrfffx.exe 3224 pvpdj.exe 2148 jpdpp.exe 5112 bnthtt.exe 3956 1pjvv.exe 1548 thnbtn.exe 1436 vjpdj.exe 3836 5frrfxf.exe 3184 7bhtbb.exe 764 nbbbbh.exe 4848 vpvvp.exe 1104 xrrfrfr.exe 3432 btbtnb.exe 3368 djdvp.exe 1736 7hnhtt.exe 1620 pjdvp.exe 5028 5llfxxx.exe 5072 3tnnhh.exe 2776 jpddv.exe 4068 7nhbtt.exe 4304 3bhbtb.exe 1552 xrrrxrx.exe 4672 1nbttt.exe 3320 jjpjp.exe 1928 1xflfrr.exe 3336 bnhhhh.exe 3220 1lxrxfl.exe 4668 5bnhbt.exe 2192 pvvpp.exe 4960 5frrrxf.exe 4816 tnthbh.exe 4752 fffxlxl.exe 3604 hbhbtt.exe 428 vvjdp.exe 4724 xrfxffl.exe 1044 pdpjv.exe 4920 dpdvv.exe 3308 xlllfxl.exe 3188 5ttnbb.exe 4348 btthtn.exe 4200 djdvj.exe 1240 lfxrrrl.exe 3116 hnnhbt.exe 4584 bbtnbt.exe 836 3pjdp.exe 3224 fxxrllf.exe 1084 nttnnh.exe 4456 9nnhbh.exe 5112 vdpvv.exe 4996 rxlfxxr.exe 2376 htttnh.exe 2036 nnnbtn.exe 4860 jjpdp.exe 3208 1xrrfxx.exe 1784 nnnhtn.exe 3672 jdjdv.exe 3184 rxfrlfx.exe 1864 ntttnh.exe -
resource yara_rule behavioral2/memory/1940-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1104-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4140-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2092-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1516-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-639-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1940 wrote to memory of 4576 1940 5a0fef7a397030d7e3bad73986411a9ddb7747ebbd997e7f1fd1906dd8615863N.exe 83 PID 1940 wrote to memory of 4576 1940 5a0fef7a397030d7e3bad73986411a9ddb7747ebbd997e7f1fd1906dd8615863N.exe 83 PID 1940 wrote to memory of 4576 1940 5a0fef7a397030d7e3bad73986411a9ddb7747ebbd997e7f1fd1906dd8615863N.exe 83 PID 4576 wrote to memory of 3060 4576 jjvdj.exe 84 PID 4576 wrote to memory of 3060 4576 jjvdj.exe 84 PID 4576 wrote to memory of 3060 4576 jjvdj.exe 84 PID 3060 wrote to memory of 2612 3060 jdpvp.exe 85 PID 3060 wrote to memory of 2612 3060 jdpvp.exe 85 PID 3060 wrote to memory of 2612 3060 jdpvp.exe 85 PID 2612 wrote to memory of 5032 2612 pdvjv.exe 86 PID 2612 wrote to memory of 5032 2612 pdvjv.exe 86 PID 2612 wrote to memory of 5032 2612 pdvjv.exe 86 PID 5032 wrote to memory of 4808 5032 nhnhhn.exe 87 PID 5032 wrote to memory of 4808 5032 nhnhhn.exe 87 PID 5032 wrote to memory of 4808 5032 nhnhhn.exe 87 PID 4808 wrote to memory of 4828 4808 lxrfxfx.exe 88 PID 4808 wrote to memory of 4828 4808 lxrfxfx.exe 88 PID 4808 wrote to memory of 4828 4808 lxrfxfx.exe 88 PID 4828 wrote to memory of 3180 4828 jjjvj.exe 89 PID 4828 wrote to memory of 3180 4828 jjjvj.exe 89 PID 4828 wrote to memory of 3180 4828 jjjvj.exe 89 PID 3180 wrote to memory of 3224 3180 1lrfffx.exe 90 PID 3180 wrote to memory of 3224 3180 1lrfffx.exe 90 PID 3180 wrote to memory of 3224 3180 1lrfffx.exe 90 PID 3224 wrote to memory of 2148 3224 pvpdj.exe 91 PID 3224 wrote to memory of 2148 3224 pvpdj.exe 91 PID 3224 wrote to memory of 2148 3224 pvpdj.exe 91 PID 2148 wrote to memory of 5112 2148 jpdpp.exe 92 PID 2148 wrote to memory of 5112 2148 jpdpp.exe 92 PID 2148 wrote to memory of 5112 2148 jpdpp.exe 92 PID 5112 wrote to memory of 3956 5112 bnthtt.exe 93 PID 5112 wrote to memory of 3956 5112 bnthtt.exe 93 PID 5112 wrote to memory of 3956 5112 bnthtt.exe 93 PID 3956 wrote to memory of 1548 3956 1pjvv.exe 94 PID 3956 wrote to memory of 1548 3956 1pjvv.exe 94 PID 3956 wrote to memory of 1548 3956 1pjvv.exe 94 PID 1548 wrote to memory of 1436 1548 thnbtn.exe 95 PID 1548 wrote to memory of 1436 1548 thnbtn.exe 95 PID 1548 wrote to memory of 1436 1548 thnbtn.exe 95 PID 1436 wrote to memory of 3836 1436 vjpdj.exe 96 PID 1436 wrote to memory of 3836 1436 vjpdj.exe 96 PID 1436 wrote to memory of 3836 1436 vjpdj.exe 96 PID 3836 wrote to memory of 3184 3836 5frrfxf.exe 97 PID 3836 wrote to memory of 3184 3836 5frrfxf.exe 97 PID 3836 wrote to memory of 3184 3836 5frrfxf.exe 97 PID 3184 wrote to memory of 764 3184 7bhtbb.exe 98 PID 3184 wrote to memory of 764 3184 7bhtbb.exe 98 PID 3184 wrote to memory of 764 3184 7bhtbb.exe 98 PID 764 wrote to memory of 4848 764 nbbbbh.exe 99 PID 764 wrote to memory of 4848 764 nbbbbh.exe 99 PID 764 wrote to memory of 4848 764 nbbbbh.exe 99 PID 4848 wrote to memory of 1104 4848 vpvvp.exe 100 PID 4848 wrote to memory of 1104 4848 vpvvp.exe 100 PID 4848 wrote to memory of 1104 4848 vpvvp.exe 100 PID 1104 wrote to memory of 3432 1104 xrrfrfr.exe 101 PID 1104 wrote to memory of 3432 1104 xrrfrfr.exe 101 PID 1104 wrote to memory of 3432 1104 xrrfrfr.exe 101 PID 3432 wrote to memory of 3368 3432 btbtnb.exe 102 PID 3432 wrote to memory of 3368 3432 btbtnb.exe 102 PID 3432 wrote to memory of 3368 3432 btbtnb.exe 102 PID 3368 wrote to memory of 1736 3368 djdvp.exe 103 PID 3368 wrote to memory of 1736 3368 djdvp.exe 103 PID 3368 wrote to memory of 1736 3368 djdvp.exe 103 PID 1736 wrote to memory of 1620 1736 7hnhtt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a0fef7a397030d7e3bad73986411a9ddb7747ebbd997e7f1fd1906dd8615863N.exe"C:\Users\Admin\AppData\Local\Temp\5a0fef7a397030d7e3bad73986411a9ddb7747ebbd997e7f1fd1906dd8615863N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\jjvdj.exec:\jjvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\jdpvp.exec:\jdpvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\pdvjv.exec:\pdvjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\nhnhhn.exec:\nhnhhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\lxrfxfx.exec:\lxrfxfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\jjjvj.exec:\jjjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\1lrfffx.exec:\1lrfffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\pvpdj.exec:\pvpdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\jpdpp.exec:\jpdpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\bnthtt.exec:\bnthtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\1pjvv.exec:\1pjvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\thnbtn.exec:\thnbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\vjpdj.exec:\vjpdj.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\5frrfxf.exec:\5frrfxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\7bhtbb.exec:\7bhtbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\nbbbbh.exec:\nbbbbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\vpvvp.exec:\vpvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\xrrfrfr.exec:\xrrfrfr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\btbtnb.exec:\btbtnb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\djdvp.exec:\djdvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\7hnhtt.exec:\7hnhtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\pjdvp.exec:\pjdvp.exe23⤵
- Executes dropped EXE
PID:1620 -
\??\c:\5llfxxx.exec:\5llfxxx.exe24⤵
- Executes dropped EXE
PID:5028 -
\??\c:\3tnnhh.exec:\3tnnhh.exe25⤵
- Executes dropped EXE
PID:5072 -
\??\c:\jpddv.exec:\jpddv.exe26⤵
- Executes dropped EXE
PID:2776 -
\??\c:\7nhbtt.exec:\7nhbtt.exe27⤵
- Executes dropped EXE
PID:4068 -
\??\c:\3bhbtb.exec:\3bhbtb.exe28⤵
- Executes dropped EXE
PID:4304 -
\??\c:\xrrrxrx.exec:\xrrrxrx.exe29⤵
- Executes dropped EXE
PID:1552 -
\??\c:\1nbttt.exec:\1nbttt.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4672 -
\??\c:\jjpjp.exec:\jjpjp.exe31⤵
- Executes dropped EXE
PID:3320 -
\??\c:\1xflfrr.exec:\1xflfrr.exe32⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bnhhhh.exec:\bnhhhh.exe33⤵
- Executes dropped EXE
PID:3336 -
\??\c:\1lxrxfl.exec:\1lxrxfl.exe34⤵
- Executes dropped EXE
PID:3220 -
\??\c:\5bnhbt.exec:\5bnhbt.exe35⤵
- Executes dropped EXE
PID:4668 -
\??\c:\pvvpp.exec:\pvvpp.exe36⤵
- Executes dropped EXE
PID:2192 -
\??\c:\5frrrxf.exec:\5frrrxf.exe37⤵
- Executes dropped EXE
PID:4960 -
\??\c:\tnthbh.exec:\tnthbh.exe38⤵
- Executes dropped EXE
PID:4816 -
\??\c:\fffxlxl.exec:\fffxlxl.exe39⤵
- Executes dropped EXE
PID:4752 -
\??\c:\hbhbtt.exec:\hbhbtt.exe40⤵
- Executes dropped EXE
PID:3604 -
\??\c:\vvjdp.exec:\vvjdp.exe41⤵
- Executes dropped EXE
PID:428 -
\??\c:\xrfxffl.exec:\xrfxffl.exe42⤵
- Executes dropped EXE
PID:4724 -
\??\c:\7nnbnh.exec:\7nnbnh.exe43⤵PID:4344
-
\??\c:\pdpjv.exec:\pdpjv.exe44⤵
- Executes dropped EXE
PID:1044 -
\??\c:\dpdvv.exec:\dpdvv.exe45⤵
- Executes dropped EXE
PID:4920 -
\??\c:\xlllfxl.exec:\xlllfxl.exe46⤵
- Executes dropped EXE
PID:3308 -
\??\c:\5ttnbb.exec:\5ttnbb.exe47⤵
- Executes dropped EXE
PID:3188 -
\??\c:\btthtn.exec:\btthtn.exe48⤵
- Executes dropped EXE
PID:4348 -
\??\c:\djdvj.exec:\djdvj.exe49⤵
- Executes dropped EXE
PID:4200 -
\??\c:\lfxrrrl.exec:\lfxrrrl.exe50⤵
- Executes dropped EXE
PID:1240 -
\??\c:\hnnhbt.exec:\hnnhbt.exe51⤵
- Executes dropped EXE
PID:3116 -
\??\c:\bbtnbt.exec:\bbtnbt.exe52⤵
- Executes dropped EXE
PID:4584 -
\??\c:\3pjdp.exec:\3pjdp.exe53⤵
- Executes dropped EXE
PID:836 -
\??\c:\fxxrllf.exec:\fxxrllf.exe54⤵
- Executes dropped EXE
PID:3224 -
\??\c:\nttnnh.exec:\nttnnh.exe55⤵
- Executes dropped EXE
PID:1084 -
\??\c:\9nnhbh.exec:\9nnhbh.exe56⤵
- Executes dropped EXE
PID:4456 -
\??\c:\vdpvv.exec:\vdpvv.exe57⤵
- Executes dropped EXE
PID:5112 -
\??\c:\rxlfxxr.exec:\rxlfxxr.exe58⤵
- Executes dropped EXE
PID:4996 -
\??\c:\htttnh.exec:\htttnh.exe59⤵
- Executes dropped EXE
PID:2376 -
\??\c:\nnnbtn.exec:\nnnbtn.exe60⤵
- Executes dropped EXE
PID:2036 -
\??\c:\jjpdp.exec:\jjpdp.exe61⤵
- Executes dropped EXE
PID:4860 -
\??\c:\1xrrfxx.exec:\1xrrfxx.exe62⤵
- Executes dropped EXE
PID:3208 -
\??\c:\nnnhtn.exec:\nnnhtn.exe63⤵
- Executes dropped EXE
PID:1784 -
\??\c:\jdjdv.exec:\jdjdv.exe64⤵
- Executes dropped EXE
PID:3672 -
\??\c:\rxfrlfx.exec:\rxfrlfx.exe65⤵
- Executes dropped EXE
PID:3184 -
\??\c:\ntttnh.exec:\ntttnh.exe66⤵
- Executes dropped EXE
PID:1864 -
\??\c:\3nhbtt.exec:\3nhbtt.exe67⤵PID:440
-
\??\c:\vddpj.exec:\vddpj.exe68⤵PID:2260
-
\??\c:\xlxrlrl.exec:\xlxrlrl.exe69⤵PID:4140
-
\??\c:\bttnnn.exec:\bttnnn.exe70⤵PID:3368
-
\??\c:\jdppd.exec:\jdppd.exe71⤵PID:3168
-
\??\c:\fxxlllf.exec:\fxxlllf.exe72⤵PID:1012
-
\??\c:\llxrlfx.exec:\llxrlfx.exe73⤵PID:3864
-
\??\c:\nbnbnh.exec:\nbnbnh.exe74⤵PID:3996
-
\??\c:\dvvpp.exec:\dvvpp.exe75⤵PID:5092
-
\??\c:\rrxrfxf.exec:\rrxrfxf.exe76⤵PID:2776
-
\??\c:\btbtnn.exec:\btbtnn.exe77⤵PID:2548
-
\??\c:\jpvdj.exec:\jpvdj.exe78⤵PID:1192
-
\??\c:\flrlffx.exec:\flrlffx.exe79⤵PID:4708
-
\??\c:\lrfrlfx.exec:\lrfrlfx.exe80⤵PID:2604
-
\??\c:\hbbthh.exec:\hbbthh.exe81⤵PID:4864
-
\??\c:\ppvvp.exec:\ppvvp.exe82⤵PID:388
-
\??\c:\3rlfxxr.exec:\3rlfxxr.exe83⤵PID:2628
-
\??\c:\1bttnt.exec:\1bttnt.exe84⤵PID:2092
-
\??\c:\bttnnn.exec:\bttnnn.exe85⤵PID:4488
-
\??\c:\vvpjj.exec:\vvpjj.exe86⤵PID:1480
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe87⤵PID:544
-
\??\c:\lrffllf.exec:\lrffllf.exe88⤵PID:4668
-
\??\c:\1hnhhh.exec:\1hnhhh.exe89⤵PID:2192
-
\??\c:\jppjd.exec:\jppjd.exe90⤵PID:4160
-
\??\c:\7rxxrrr.exec:\7rxxrrr.exe91⤵PID:1976
-
\??\c:\ffxrlfx.exec:\ffxrlfx.exe92⤵PID:320
-
\??\c:\bhnhbt.exec:\bhnhbt.exe93⤵PID:664
-
\??\c:\vvdvp.exec:\vvdvp.exe94⤵PID:4260
-
\??\c:\rrxrffr.exec:\rrxrffr.exe95⤵PID:1940
-
\??\c:\9rlrllf.exec:\9rlrllf.exe96⤵PID:4000
-
\??\c:\nbbbtn.exec:\nbbbtn.exe97⤵PID:1616
-
\??\c:\7vpjd.exec:\7vpjd.exe98⤵PID:1396
-
\??\c:\pdpdv.exec:\pdpdv.exe99⤵PID:3308
-
\??\c:\fxxfxxf.exec:\fxxfxxf.exe100⤵PID:3692
-
\??\c:\9bbbnn.exec:\9bbbnn.exe101⤵PID:4208
-
\??\c:\dvvpj.exec:\dvvpj.exe102⤵PID:2316
-
\??\c:\rffxfxf.exec:\rffxfxf.exe103⤵PID:4756
-
\??\c:\lfrlllr.exec:\lfrlllr.exe104⤵PID:2808
-
\??\c:\7nnbtt.exec:\7nnbtt.exe105⤵PID:2712
-
\??\c:\5dpdd.exec:\5dpdd.exe106⤵PID:2896
-
\??\c:\xrrfxrl.exec:\xrrfxrl.exe107⤵PID:836
-
\??\c:\9hbthh.exec:\9hbthh.exe108⤵PID:3224
-
\??\c:\nbbtnh.exec:\nbbtnh.exe109⤵PID:1084
-
\??\c:\5vvvj.exec:\5vvvj.exe110⤵PID:4456
-
\??\c:\3fxrxrx.exec:\3fxrxrx.exe111⤵PID:1284
-
\??\c:\fflllfl.exec:\fflllfl.exe112⤵PID:2524
-
\??\c:\7ttnhh.exec:\7ttnhh.exe113⤵PID:4916
-
\??\c:\bttnnn.exec:\bttnnn.exe114⤵PID:1804
-
\??\c:\vdpjv.exec:\vdpjv.exe115⤵PID:2960
-
\??\c:\jppdv.exec:\jppdv.exe116⤵PID:2152
-
\??\c:\lrrrxfl.exec:\lrrrxfl.exe117⤵PID:5068
-
\??\c:\pjjjd.exec:\pjjjd.exe118⤵PID:4768
-
\??\c:\3dvvp.exec:\3dvvp.exe119⤵PID:3740
-
\??\c:\7fffrrf.exec:\7fffrrf.exe120⤵PID:540
-
\??\c:\1htnnn.exec:\1htnnn.exe121⤵PID:1864
-
\??\c:\pdpjd.exec:\pdpjd.exe122⤵PID:440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-