Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 19:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7ddcce8ef8fbef05fb9dd77d3362528ab9554c8a04b7eb0b064a6e868ad0da9fN.exe
Resource
win7-20241023-en
7 signatures
120 seconds
General
-
Target
7ddcce8ef8fbef05fb9dd77d3362528ab9554c8a04b7eb0b064a6e868ad0da9fN.exe
-
Size
454KB
-
MD5
b3584e2fb38bdb558faa50d951f66f50
-
SHA1
f5f9f1da23c1e2fe7e7d45488b9e0b1ee99eb4b7
-
SHA256
7ddcce8ef8fbef05fb9dd77d3362528ab9554c8a04b7eb0b064a6e868ad0da9f
-
SHA512
abda1e2f2b3d27bec86a347069f84490ec44560a06ee02c96603d672c13d470fa98383f823b964a2e88b14025f85203ab90e261b9945480917b2d2c1b1917e43
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4392-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1300-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/956-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1264-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2784-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2480-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/736-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/952-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-818-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-900-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-1019-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-1201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/528-1232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-1245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-1718-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4796 pjpjj.exe 548 hbttth.exe 2288 vvvdv.exe 4920 xrlrxxf.exe 1268 pjpdj.exe 1300 lxfflrx.exe 956 htbnhn.exe 4856 9vddp.exe 2108 thnhhh.exe 212 pjjjj.exe 4032 1vvvv.exe 1964 xrrlxxr.exe 3708 5bbbhn.exe 4028 dpvjj.exe 3452 xlxxxff.exe 1372 nnbttt.exe 3852 bbbthh.exe 4828 5jdpd.exe 3800 1ppdv.exe 2436 xrrllll.exe 4228 xrfxlrl.exe 3356 1djdd.exe 3048 htbntt.exe 1264 jjppv.exe 4576 jjpvj.exe 1192 lxxrrlf.exe 2256 bttttb.exe 2784 fllxlrr.exe 2820 btnthh.exe 3908 rlxxxff.exe 4536 llfflrx.exe 512 vddvj.exe 4624 xxffxxl.exe 4324 bhnnbh.exe 3744 pjvvv.exe 2128 rllllrr.exe 4964 tbnbtn.exe 2904 djjpv.exe 1136 htbbhh.exe 2816 3jpjd.exe 4400 xrrlfff.exe 384 hbbhbh.exe 1544 vvvpp.exe 64 9djdj.exe 2248 lrrxlrx.exe 4592 bnttnt.exe 3720 ddvjj.exe 3732 nhbhtb.exe 4860 lxfrlll.exe 2548 nnbtnh.exe 1268 vpppj.exe 3416 lrfllfr.exe 3508 vjddp.exe 1300 xxrlxlf.exe 60 nthbbb.exe 3340 jdpjj.exe 2208 pjdvp.exe 4544 rfffxxx.exe 392 hnnnnt.exe 4628 dvvpj.exe 2324 dpdvp.exe 1164 llllllr.exe 3896 5bhhtb.exe 1524 vpjvd.exe -
resource yara_rule behavioral2/memory/4392-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1300-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/956-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/956-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1264-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2784-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/736-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/744-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1444-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/952-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-817-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-818-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-900-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5httth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4392 wrote to memory of 4796 4392 7ddcce8ef8fbef05fb9dd77d3362528ab9554c8a04b7eb0b064a6e868ad0da9fN.exe 83 PID 4392 wrote to memory of 4796 4392 7ddcce8ef8fbef05fb9dd77d3362528ab9554c8a04b7eb0b064a6e868ad0da9fN.exe 83 PID 4392 wrote to memory of 4796 4392 7ddcce8ef8fbef05fb9dd77d3362528ab9554c8a04b7eb0b064a6e868ad0da9fN.exe 83 PID 4796 wrote to memory of 548 4796 pjpjj.exe 84 PID 4796 wrote to memory of 548 4796 pjpjj.exe 84 PID 4796 wrote to memory of 548 4796 pjpjj.exe 84 PID 548 wrote to memory of 2288 548 hbttth.exe 85 PID 548 wrote to memory of 2288 548 hbttth.exe 85 PID 548 wrote to memory of 2288 548 hbttth.exe 85 PID 2288 wrote to memory of 4920 2288 vvvdv.exe 86 PID 2288 wrote to memory of 4920 2288 vvvdv.exe 86 PID 2288 wrote to memory of 4920 2288 vvvdv.exe 86 PID 4920 wrote to memory of 1268 4920 xrlrxxf.exe 87 PID 4920 wrote to memory of 1268 4920 xrlrxxf.exe 87 PID 4920 wrote to memory of 1268 4920 xrlrxxf.exe 87 PID 1268 wrote to memory of 1300 1268 pjpdj.exe 88 PID 1268 wrote to memory of 1300 1268 pjpdj.exe 88 PID 1268 wrote to memory of 1300 1268 pjpdj.exe 88 PID 1300 wrote to memory of 956 1300 lxfflrx.exe 89 PID 1300 wrote to memory of 956 1300 lxfflrx.exe 89 PID 1300 wrote to memory of 956 1300 lxfflrx.exe 89 PID 956 wrote to memory of 4856 956 htbnhn.exe 90 PID 956 wrote to memory of 4856 956 htbnhn.exe 90 PID 956 wrote to memory of 4856 956 htbnhn.exe 90 PID 4856 wrote to memory of 2108 4856 9vddp.exe 91 PID 4856 wrote to memory of 2108 4856 9vddp.exe 91 PID 4856 wrote to memory of 2108 4856 9vddp.exe 91 PID 2108 wrote to memory of 212 2108 thnhhh.exe 92 PID 2108 wrote to memory of 212 2108 thnhhh.exe 92 PID 2108 wrote to memory of 212 2108 thnhhh.exe 92 PID 212 wrote to memory of 4032 212 pjjjj.exe 93 PID 212 wrote to memory of 4032 212 pjjjj.exe 93 PID 212 wrote to memory of 4032 212 pjjjj.exe 93 PID 4032 wrote to memory of 1964 4032 1vvvv.exe 94 PID 4032 wrote to memory of 1964 4032 1vvvv.exe 94 PID 4032 wrote to memory of 1964 4032 1vvvv.exe 94 PID 1964 wrote to memory of 3708 1964 xrrlxxr.exe 95 PID 1964 wrote to memory of 3708 1964 xrrlxxr.exe 95 PID 1964 wrote to memory of 3708 1964 xrrlxxr.exe 95 PID 3708 wrote to memory of 4028 3708 5bbbhn.exe 96 PID 3708 wrote to memory of 4028 3708 5bbbhn.exe 96 PID 3708 wrote to memory of 4028 3708 5bbbhn.exe 96 PID 4028 wrote to memory of 3452 4028 dpvjj.exe 97 PID 4028 wrote to memory of 3452 4028 dpvjj.exe 97 PID 4028 wrote to memory of 3452 4028 dpvjj.exe 97 PID 3452 wrote to memory of 1372 3452 xlxxxff.exe 98 PID 3452 wrote to memory of 1372 3452 xlxxxff.exe 98 PID 3452 wrote to memory of 1372 3452 xlxxxff.exe 98 PID 1372 wrote to memory of 3852 1372 nnbttt.exe 99 PID 1372 wrote to memory of 3852 1372 nnbttt.exe 99 PID 1372 wrote to memory of 3852 1372 nnbttt.exe 99 PID 3852 wrote to memory of 4828 3852 bbbthh.exe 100 PID 3852 wrote to memory of 4828 3852 bbbthh.exe 100 PID 3852 wrote to memory of 4828 3852 bbbthh.exe 100 PID 4828 wrote to memory of 3800 4828 5jdpd.exe 101 PID 4828 wrote to memory of 3800 4828 5jdpd.exe 101 PID 4828 wrote to memory of 3800 4828 5jdpd.exe 101 PID 3800 wrote to memory of 2436 3800 1ppdv.exe 102 PID 3800 wrote to memory of 2436 3800 1ppdv.exe 102 PID 3800 wrote to memory of 2436 3800 1ppdv.exe 102 PID 2436 wrote to memory of 4228 2436 xrrllll.exe 103 PID 2436 wrote to memory of 4228 2436 xrrllll.exe 103 PID 2436 wrote to memory of 4228 2436 xrrllll.exe 103 PID 4228 wrote to memory of 3356 4228 xrfxlrl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ddcce8ef8fbef05fb9dd77d3362528ab9554c8a04b7eb0b064a6e868ad0da9fN.exe"C:\Users\Admin\AppData\Local\Temp\7ddcce8ef8fbef05fb9dd77d3362528ab9554c8a04b7eb0b064a6e868ad0da9fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\pjpjj.exec:\pjpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\hbttth.exec:\hbttth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\vvvdv.exec:\vvvdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\xrlrxxf.exec:\xrlrxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\pjpdj.exec:\pjpdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\lxfflrx.exec:\lxfflrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\htbnhn.exec:\htbnhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\9vddp.exec:\9vddp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\thnhhh.exec:\thnhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\pjjjj.exec:\pjjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\1vvvv.exec:\1vvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\5bbbhn.exec:\5bbbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\dpvjj.exec:\dpvjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\xlxxxff.exec:\xlxxxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\nnbttt.exec:\nnbttt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\bbbthh.exec:\bbbthh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\5jdpd.exec:\5jdpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\1ppdv.exec:\1ppdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\xrrllll.exec:\xrrllll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\xrfxlrl.exec:\xrfxlrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\1djdd.exec:\1djdd.exe23⤵
- Executes dropped EXE
PID:3356 -
\??\c:\htbntt.exec:\htbntt.exe24⤵
- Executes dropped EXE
PID:3048 -
\??\c:\jjppv.exec:\jjppv.exe25⤵
- Executes dropped EXE
PID:1264 -
\??\c:\jjpvj.exec:\jjpvj.exe26⤵
- Executes dropped EXE
PID:4576 -
\??\c:\lxxrrlf.exec:\lxxrrlf.exe27⤵
- Executes dropped EXE
PID:1192 -
\??\c:\bttttb.exec:\bttttb.exe28⤵
- Executes dropped EXE
PID:2256 -
\??\c:\fllxlrr.exec:\fllxlrr.exe29⤵
- Executes dropped EXE
PID:2784 -
\??\c:\btnthh.exec:\btnthh.exe30⤵
- Executes dropped EXE
PID:2820 -
\??\c:\rlxxxff.exec:\rlxxxff.exe31⤵
- Executes dropped EXE
PID:3908 -
\??\c:\llfflrx.exec:\llfflrx.exe32⤵
- Executes dropped EXE
PID:4536 -
\??\c:\vddvj.exec:\vddvj.exe33⤵
- Executes dropped EXE
PID:512 -
\??\c:\xxffxxl.exec:\xxffxxl.exe34⤵
- Executes dropped EXE
PID:4624 -
\??\c:\bhnnbh.exec:\bhnnbh.exe35⤵
- Executes dropped EXE
PID:4324 -
\??\c:\pjvvv.exec:\pjvvv.exe36⤵
- Executes dropped EXE
PID:3744 -
\??\c:\rllllrr.exec:\rllllrr.exe37⤵
- Executes dropped EXE
PID:2128 -
\??\c:\tbnbtn.exec:\tbnbtn.exe38⤵
- Executes dropped EXE
PID:4964 -
\??\c:\djjpv.exec:\djjpv.exe39⤵
- Executes dropped EXE
PID:2904 -
\??\c:\htbbhh.exec:\htbbhh.exe40⤵
- Executes dropped EXE
PID:1136 -
\??\c:\3jpjd.exec:\3jpjd.exe41⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xrrlfff.exec:\xrrlfff.exe42⤵
- Executes dropped EXE
PID:4400 -
\??\c:\hbbhbh.exec:\hbbhbh.exe43⤵
- Executes dropped EXE
PID:384 -
\??\c:\vvvpp.exec:\vvvpp.exe44⤵
- Executes dropped EXE
PID:1544 -
\??\c:\9djdj.exec:\9djdj.exe45⤵
- Executes dropped EXE
PID:64 -
\??\c:\lrrxlrx.exec:\lrrxlrx.exe46⤵
- Executes dropped EXE
PID:2248 -
\??\c:\bnttnt.exec:\bnttnt.exe47⤵
- Executes dropped EXE
PID:4592 -
\??\c:\ddvjj.exec:\ddvjj.exe48⤵
- Executes dropped EXE
PID:3720 -
\??\c:\nhbhtb.exec:\nhbhtb.exe49⤵
- Executes dropped EXE
PID:3732 -
\??\c:\lxfrlll.exec:\lxfrlll.exe50⤵
- Executes dropped EXE
PID:4860 -
\??\c:\nnbtnh.exec:\nnbtnh.exe51⤵
- Executes dropped EXE
PID:2548 -
\??\c:\vpppj.exec:\vpppj.exe52⤵
- Executes dropped EXE
PID:1268 -
\??\c:\lrfllfr.exec:\lrfllfr.exe53⤵
- Executes dropped EXE
PID:3416 -
\??\c:\vjddp.exec:\vjddp.exe54⤵
- Executes dropped EXE
PID:3508 -
\??\c:\xxrlxlf.exec:\xxrlxlf.exe55⤵
- Executes dropped EXE
PID:1300 -
\??\c:\nthbbb.exec:\nthbbb.exe56⤵
- Executes dropped EXE
PID:60 -
\??\c:\jdpjj.exec:\jdpjj.exe57⤵
- Executes dropped EXE
PID:3340 -
\??\c:\pjdvp.exec:\pjdvp.exe58⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rfffxxx.exec:\rfffxxx.exe59⤵
- Executes dropped EXE
PID:4544 -
\??\c:\hnnnnt.exec:\hnnnnt.exe60⤵
- Executes dropped EXE
PID:392 -
\??\c:\dvvpj.exec:\dvvpj.exe61⤵
- Executes dropped EXE
PID:4628 -
\??\c:\dpdvp.exec:\dpdvp.exe62⤵
- Executes dropped EXE
PID:2324 -
\??\c:\llllllr.exec:\llllllr.exe63⤵
- Executes dropped EXE
PID:1164 -
\??\c:\5bhhtb.exec:\5bhhtb.exe64⤵
- Executes dropped EXE
PID:3896 -
\??\c:\vpjvd.exec:\vpjvd.exe65⤵
- Executes dropped EXE
PID:1524 -
\??\c:\3ffxxxr.exec:\3ffxxxr.exe66⤵PID:2448
-
\??\c:\nnnhnn.exec:\nnnhnn.exe67⤵PID:2692
-
\??\c:\vddpd.exec:\vddpd.exe68⤵PID:3840
-
\??\c:\xflffrr.exec:\xflffrr.exe69⤵PID:2132
-
\??\c:\lrfflll.exec:\lrfflll.exe70⤵PID:3852
-
\??\c:\vvjdj.exec:\vvjdj.exe71⤵PID:4512
-
\??\c:\jddvp.exec:\jddvp.exe72⤵PID:4828
-
\??\c:\lrffxxx.exec:\lrffxxx.exe73⤵PID:4936
-
\??\c:\tnthbb.exec:\tnthbb.exe74⤵PID:4072
-
\??\c:\vjppp.exec:\vjppp.exe75⤵PID:3596
-
\??\c:\jjvvv.exec:\jjvvv.exe76⤵PID:3664
-
\??\c:\1lxlfrr.exec:\1lxlfrr.exe77⤵PID:2480
-
\??\c:\7nnnhn.exec:\7nnnhn.exe78⤵PID:736
-
\??\c:\5xfllrr.exec:\5xfllrr.exe79⤵PID:3124
-
\??\c:\llllffx.exec:\llllffx.exe80⤵PID:4268
-
\??\c:\ntbbbb.exec:\ntbbbb.exe81⤵PID:2124
-
\??\c:\5jjjj.exec:\5jjjj.exe82⤵PID:3244
-
\??\c:\lfxrxxr.exec:\lfxrxxr.exe83⤵PID:4184
-
\??\c:\tttttt.exec:\tttttt.exe84⤵PID:744
-
\??\c:\pvppj.exec:\pvppj.exe85⤵PID:412
-
\??\c:\ffrrlfx.exec:\ffrrlfx.exe86⤵PID:3504
-
\??\c:\hbnhnn.exec:\hbnhnn.exe87⤵PID:2256
-
\??\c:\dvddv.exec:\dvddv.exe88⤵PID:3464
-
\??\c:\fxfflll.exec:\fxfflll.exe89⤵PID:3952
-
\??\c:\9nnnnt.exec:\9nnnnt.exe90⤵PID:2820
-
\??\c:\jpvjv.exec:\jpvjv.exe91⤵PID:4404
-
\??\c:\frrlxfr.exec:\frrlxfr.exe92⤵PID:516
-
\??\c:\thnhhh.exec:\thnhhh.exe93⤵PID:3700
-
\??\c:\hhhbtt.exec:\hhhbtt.exe94⤵PID:3992
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe95⤵PID:2408
-
\??\c:\rllrfrl.exec:\rllrfrl.exe96⤵PID:4588
-
\??\c:\nnhbnn.exec:\nnhbnn.exe97⤵PID:5076
-
\??\c:\jpjjj.exec:\jpjjj.exe98⤵PID:1736
-
\??\c:\rrlfxxx.exec:\rrlfxxx.exe99⤵PID:2216
-
\??\c:\bnbbbb.exec:\bnbbbb.exe100⤵PID:4088
-
\??\c:\7djpj.exec:\7djpj.exe101⤵PID:940
-
\??\c:\ppddd.exec:\ppddd.exe102⤵PID:684
-
\??\c:\fllllff.exec:\fllllff.exe103⤵PID:4556
-
\??\c:\tttnnn.exec:\tttnnn.exe104⤵PID:3408
-
\??\c:\jppdj.exec:\jppdj.exe105⤵PID:1444
-
\??\c:\llrrlll.exec:\llrrlll.exe106⤵PID:3396
-
\??\c:\nbhbtn.exec:\nbhbtn.exe107⤵
- System Location Discovery: System Language Discovery
PID:1328 -
\??\c:\djvdj.exec:\djvdj.exe108⤵PID:2020
-
\??\c:\ppvpj.exec:\ppvpj.exe109⤵PID:3796
-
\??\c:\7rrrxxf.exec:\7rrrxxf.exe110⤵PID:4124
-
\??\c:\ntnntb.exec:\ntnntb.exe111⤵PID:2288
-
\??\c:\ppvjj.exec:\ppvjj.exe112⤵PID:1632
-
\??\c:\1flllll.exec:\1flllll.exe113⤵PID:4920
-
\??\c:\nhnbhh.exec:\nhnbhh.exe114⤵PID:1020
-
\??\c:\pvjdv.exec:\pvjdv.exe115⤵PID:3676
-
\??\c:\rflfrrf.exec:\rflfrrf.exe116⤵PID:4612
-
\??\c:\nhhnnb.exec:\nhhnnb.exe117⤵PID:408
-
\??\c:\hhbbhh.exec:\hhbbhh.exe118⤵PID:1740
-
\??\c:\vvppj.exec:\vvppj.exe119⤵
- System Location Discovery: System Language Discovery
PID:1300 -
\??\c:\jppjp.exec:\jppjp.exe120⤵PID:528
-
\??\c:\xlfrrxl.exec:\xlfrrxl.exe121⤵PID:3340
-
\??\c:\tttbth.exec:\tttbth.exe122⤵PID:4820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-