Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 21:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b557de7bc26d2713d3c2dab7d07bc629a4a3277c91e567c019d98d19e800151dN.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
b557de7bc26d2713d3c2dab7d07bc629a4a3277c91e567c019d98d19e800151dN.exe
-
Size
454KB
-
MD5
626d595968aa948bcd7f6a20f16ad970
-
SHA1
00c1014d57d3d32966796fd2baa04abc99bb2c97
-
SHA256
b557de7bc26d2713d3c2dab7d07bc629a4a3277c91e567c019d98d19e800151d
-
SHA512
21046a7b0f5ef16412f146e469050a4b3289100b90e2a36c667607400df2979cbdb47767dd144291460aca55d1efca22148eb8696a0a0d10485ee3f52bb5fdc2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1660-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/520-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/744-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1344-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/980-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1080-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-744-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-751-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/844-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-834-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-913-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-968-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-1551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 520 jdpdv.exe 3976 dvjjj.exe 3232 jpvpj.exe 744 rllfxrl.exe 4624 nnnbtt.exe 4156 3vvvp.exe 2972 vvvpj.exe 3008 rfxxxxx.exe 1344 lxffxxr.exe 1124 vpjjd.exe 3192 bnnhnn.exe 5076 vpvpj.exe 2392 fffxxxr.exe 2132 nnnhbb.exe 1988 vvpjd.exe 5032 fxxrrrf.exe 4744 rlxrxrl.exe 2040 7ntttb.exe 980 rllxfxr.exe 1156 7hhbbh.exe 228 jdjpj.exe 2904 hnhhbt.exe 1080 vpjpv.exe 536 vdjdv.exe 1748 lffrlfx.exe 3996 jvjdv.exe 3100 hnbthb.exe 784 lxfxrrl.exe 3172 jjpjv.exe 4236 pddvv.exe 3884 dpddj.exe 3600 rlllffx.exe 3732 nhhbtn.exe 3716 jdvpj.exe 3044 tbbnhh.exe 3320 httnhh.exe 3708 jvdpd.exe 2632 rfrlllf.exe 4540 nhhbtt.exe 956 ppdpj.exe 3532 xxxxfxf.exe 2452 nhhbtt.exe 660 hhhbbt.exe 1712 dvdvv.exe 1788 rrfllrl.exe 4968 nhbtnn.exe 1304 hbbhbb.exe 4568 vdvdv.exe 4336 dvjpj.exe 4748 xllfxlf.exe 2664 hhhbtn.exe 4444 pvvpd.exe 2096 rllxrff.exe 1660 tnhbbt.exe 636 bbnhtb.exe 3976 vppjv.exe 1456 frxrrrr.exe 744 btnhtt.exe 1372 nbhbth.exe 4776 dddjd.exe 2928 3llfxxx.exe 2688 bnntnt.exe 2972 vvdvp.exe 2740 7pvdv.exe -
resource yara_rule behavioral2/memory/1660-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/520-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/744-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1344-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/980-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2664-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-744-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/844-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-834-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-913-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-968-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xfxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1660 wrote to memory of 520 1660 b557de7bc26d2713d3c2dab7d07bc629a4a3277c91e567c019d98d19e800151dN.exe 82 PID 1660 wrote to memory of 520 1660 b557de7bc26d2713d3c2dab7d07bc629a4a3277c91e567c019d98d19e800151dN.exe 82 PID 1660 wrote to memory of 520 1660 b557de7bc26d2713d3c2dab7d07bc629a4a3277c91e567c019d98d19e800151dN.exe 82 PID 520 wrote to memory of 3976 520 jdpdv.exe 83 PID 520 wrote to memory of 3976 520 jdpdv.exe 83 PID 520 wrote to memory of 3976 520 jdpdv.exe 83 PID 3976 wrote to memory of 3232 3976 dvjjj.exe 84 PID 3976 wrote to memory of 3232 3976 dvjjj.exe 84 PID 3976 wrote to memory of 3232 3976 dvjjj.exe 84 PID 3232 wrote to memory of 744 3232 jpvpj.exe 85 PID 3232 wrote to memory of 744 3232 jpvpj.exe 85 PID 3232 wrote to memory of 744 3232 jpvpj.exe 85 PID 744 wrote to memory of 4624 744 rllfxrl.exe 86 PID 744 wrote to memory of 4624 744 rllfxrl.exe 86 PID 744 wrote to memory of 4624 744 rllfxrl.exe 86 PID 4624 wrote to memory of 4156 4624 nnnbtt.exe 87 PID 4624 wrote to memory of 4156 4624 nnnbtt.exe 87 PID 4624 wrote to memory of 4156 4624 nnnbtt.exe 87 PID 4156 wrote to memory of 2972 4156 3vvvp.exe 88 PID 4156 wrote to memory of 2972 4156 3vvvp.exe 88 PID 4156 wrote to memory of 2972 4156 3vvvp.exe 88 PID 2972 wrote to memory of 3008 2972 vvvpj.exe 89 PID 2972 wrote to memory of 3008 2972 vvvpj.exe 89 PID 2972 wrote to memory of 3008 2972 vvvpj.exe 89 PID 3008 wrote to memory of 1344 3008 rfxxxxx.exe 90 PID 3008 wrote to memory of 1344 3008 rfxxxxx.exe 90 PID 3008 wrote to memory of 1344 3008 rfxxxxx.exe 90 PID 1344 wrote to memory of 1124 1344 lxffxxr.exe 91 PID 1344 wrote to memory of 1124 1344 lxffxxr.exe 91 PID 1344 wrote to memory of 1124 1344 lxffxxr.exe 91 PID 1124 wrote to memory of 3192 1124 vpjjd.exe 92 PID 1124 wrote to memory of 3192 1124 vpjjd.exe 92 PID 1124 wrote to memory of 3192 1124 vpjjd.exe 92 PID 3192 wrote to memory of 5076 3192 bnnhnn.exe 93 PID 3192 wrote to memory of 5076 3192 bnnhnn.exe 93 PID 3192 wrote to memory of 5076 3192 bnnhnn.exe 93 PID 5076 wrote to memory of 2392 5076 vpvpj.exe 94 PID 5076 wrote to memory of 2392 5076 vpvpj.exe 94 PID 5076 wrote to memory of 2392 5076 vpvpj.exe 94 PID 2392 wrote to memory of 2132 2392 fffxxxr.exe 95 PID 2392 wrote to memory of 2132 2392 fffxxxr.exe 95 PID 2392 wrote to memory of 2132 2392 fffxxxr.exe 95 PID 2132 wrote to memory of 1988 2132 nnnhbb.exe 96 PID 2132 wrote to memory of 1988 2132 nnnhbb.exe 96 PID 2132 wrote to memory of 1988 2132 nnnhbb.exe 96 PID 1988 wrote to memory of 5032 1988 vvpjd.exe 97 PID 1988 wrote to memory of 5032 1988 vvpjd.exe 97 PID 1988 wrote to memory of 5032 1988 vvpjd.exe 97 PID 5032 wrote to memory of 4744 5032 fxxrrrf.exe 98 PID 5032 wrote to memory of 4744 5032 fxxrrrf.exe 98 PID 5032 wrote to memory of 4744 5032 fxxrrrf.exe 98 PID 4744 wrote to memory of 2040 4744 rlxrxrl.exe 99 PID 4744 wrote to memory of 2040 4744 rlxrxrl.exe 99 PID 4744 wrote to memory of 2040 4744 rlxrxrl.exe 99 PID 2040 wrote to memory of 980 2040 7ntttb.exe 100 PID 2040 wrote to memory of 980 2040 7ntttb.exe 100 PID 2040 wrote to memory of 980 2040 7ntttb.exe 100 PID 980 wrote to memory of 1156 980 rllxfxr.exe 101 PID 980 wrote to memory of 1156 980 rllxfxr.exe 101 PID 980 wrote to memory of 1156 980 rllxfxr.exe 101 PID 1156 wrote to memory of 228 1156 7hhbbh.exe 102 PID 1156 wrote to memory of 228 1156 7hhbbh.exe 102 PID 1156 wrote to memory of 228 1156 7hhbbh.exe 102 PID 228 wrote to memory of 2904 228 jdjpj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\b557de7bc26d2713d3c2dab7d07bc629a4a3277c91e567c019d98d19e800151dN.exe"C:\Users\Admin\AppData\Local\Temp\b557de7bc26d2713d3c2dab7d07bc629a4a3277c91e567c019d98d19e800151dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\jdpdv.exec:\jdpdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
\??\c:\dvjjj.exec:\dvjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\jpvpj.exec:\jpvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\rllfxrl.exec:\rllfxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\nnnbtt.exec:\nnnbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\3vvvp.exec:\3vvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\vvvpj.exec:\vvvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\rfxxxxx.exec:\rfxxxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\lxffxxr.exec:\lxffxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\vpjjd.exec:\vpjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\bnnhnn.exec:\bnnhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\vpvpj.exec:\vpvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\fffxxxr.exec:\fffxxxr.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\nnnhbb.exec:\nnnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\vvpjd.exec:\vvpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\fxxrrrf.exec:\fxxrrrf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\rlxrxrl.exec:\rlxrxrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\7ntttb.exec:\7ntttb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\rllxfxr.exec:\rllxfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\7hhbbh.exec:\7hhbbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\jdjpj.exec:\jdjpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\hnhhbt.exec:\hnhhbt.exe23⤵
- Executes dropped EXE
PID:2904 -
\??\c:\vpjpv.exec:\vpjpv.exe24⤵
- Executes dropped EXE
PID:1080 -
\??\c:\vdjdv.exec:\vdjdv.exe25⤵
- Executes dropped EXE
PID:536 -
\??\c:\lffrlfx.exec:\lffrlfx.exe26⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jvjdv.exec:\jvjdv.exe27⤵
- Executes dropped EXE
PID:3996 -
\??\c:\hnbthb.exec:\hnbthb.exe28⤵
- Executes dropped EXE
PID:3100 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe29⤵
- Executes dropped EXE
PID:784 -
\??\c:\jjpjv.exec:\jjpjv.exe30⤵
- Executes dropped EXE
PID:3172 -
\??\c:\pddvv.exec:\pddvv.exe31⤵
- Executes dropped EXE
PID:4236 -
\??\c:\dpddj.exec:\dpddj.exe32⤵
- Executes dropped EXE
PID:3884 -
\??\c:\rlllffx.exec:\rlllffx.exe33⤵
- Executes dropped EXE
PID:3600 -
\??\c:\nhhbtn.exec:\nhhbtn.exe34⤵
- Executes dropped EXE
PID:3732 -
\??\c:\jdvpj.exec:\jdvpj.exe35⤵
- Executes dropped EXE
PID:3716 -
\??\c:\tbbnhh.exec:\tbbnhh.exe36⤵
- Executes dropped EXE
PID:3044 -
\??\c:\httnhh.exec:\httnhh.exe37⤵
- Executes dropped EXE
PID:3320 -
\??\c:\jvdpd.exec:\jvdpd.exe38⤵
- Executes dropped EXE
PID:3708 -
\??\c:\rfrlllf.exec:\rfrlllf.exe39⤵
- Executes dropped EXE
PID:2632 -
\??\c:\nhhbtt.exec:\nhhbtt.exe40⤵
- Executes dropped EXE
PID:4540 -
\??\c:\ppdpj.exec:\ppdpj.exe41⤵
- Executes dropped EXE
PID:956 -
\??\c:\xxxxfxf.exec:\xxxxfxf.exe42⤵
- Executes dropped EXE
PID:3532 -
\??\c:\nhhbtt.exec:\nhhbtt.exe43⤵
- Executes dropped EXE
PID:2452 -
\??\c:\hhhbbt.exec:\hhhbbt.exe44⤵
- Executes dropped EXE
PID:660 -
\??\c:\dvdvv.exec:\dvdvv.exe45⤵
- Executes dropped EXE
PID:1712 -
\??\c:\rrfllrl.exec:\rrfllrl.exe46⤵
- Executes dropped EXE
PID:1788 -
\??\c:\nhbtnn.exec:\nhbtnn.exe47⤵
- Executes dropped EXE
PID:4968 -
\??\c:\hbbhbb.exec:\hbbhbb.exe48⤵
- Executes dropped EXE
PID:1304 -
\??\c:\vdvdv.exec:\vdvdv.exe49⤵
- Executes dropped EXE
PID:4568 -
\??\c:\dvjpj.exec:\dvjpj.exe50⤵
- Executes dropped EXE
PID:4336 -
\??\c:\xllfxlf.exec:\xllfxlf.exe51⤵
- Executes dropped EXE
PID:4748 -
\??\c:\hhhbtn.exec:\hhhbtn.exe52⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pvvpd.exec:\pvvpd.exe53⤵
- Executes dropped EXE
PID:4444 -
\??\c:\rllxrff.exec:\rllxrff.exe54⤵
- Executes dropped EXE
PID:2096 -
\??\c:\tnhbbt.exec:\tnhbbt.exe55⤵
- Executes dropped EXE
PID:1660 -
\??\c:\bbnhtb.exec:\bbnhtb.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:636 -
\??\c:\vppjv.exec:\vppjv.exe57⤵
- Executes dropped EXE
PID:3976 -
\??\c:\frxrrrr.exec:\frxrrrr.exe58⤵
- Executes dropped EXE
PID:1456 -
\??\c:\btnhtt.exec:\btnhtt.exe59⤵
- Executes dropped EXE
PID:744 -
\??\c:\nbhbth.exec:\nbhbth.exe60⤵
- Executes dropped EXE
PID:1372 -
\??\c:\dddjd.exec:\dddjd.exe61⤵
- Executes dropped EXE
PID:4776 -
\??\c:\3llfxxx.exec:\3llfxxx.exe62⤵
- Executes dropped EXE
PID:2928 -
\??\c:\bnntnt.exec:\bnntnt.exe63⤵
- Executes dropped EXE
PID:2688 -
\??\c:\vvdvp.exec:\vvdvp.exe64⤵
- Executes dropped EXE
PID:2972 -
\??\c:\7pvdv.exec:\7pvdv.exe65⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1flfxlf.exec:\1flfxlf.exe66⤵PID:1704
-
\??\c:\tnnhtn.exec:\tnnhtn.exe67⤵PID:2284
-
\??\c:\pjpjv.exec:\pjpjv.exe68⤵PID:1180
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe69⤵PID:1924
-
\??\c:\tnttnn.exec:\tnttnn.exe70⤵PID:1124
-
\??\c:\nbnhtn.exec:\nbnhtn.exe71⤵PID:2620
-
\??\c:\ddpjd.exec:\ddpjd.exe72⤵PID:3932
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe73⤵PID:3496
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe74⤵PID:2044
-
\??\c:\tnbbhn.exec:\tnbbhn.exe75⤵PID:3060
-
\??\c:\pjdvp.exec:\pjdvp.exe76⤵PID:3028
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe77⤵PID:4560
-
\??\c:\5hnnhn.exec:\5hnnhn.exe78⤵PID:4964
-
\??\c:\7nnnnn.exec:\7nnnnn.exe79⤵PID:3056
-
\??\c:\rllfxrr.exec:\rllfxrr.exe80⤵PID:4744
-
\??\c:\fxfffff.exec:\fxfffff.exe81⤵PID:1984
-
\??\c:\htnnnt.exec:\htnnnt.exe82⤵PID:3484
-
\??\c:\jdpdv.exec:\jdpdv.exe83⤵PID:844
-
\??\c:\fxrlllf.exec:\fxrlllf.exe84⤵PID:1844
-
\??\c:\nntttb.exec:\nntttb.exe85⤵PID:4932
-
\??\c:\tntnhn.exec:\tntnhn.exe86⤵PID:3444
-
\??\c:\pdjdp.exec:\pdjdp.exe87⤵PID:3808
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe88⤵PID:2184
-
\??\c:\fffllfr.exec:\fffllfr.exe89⤵PID:4148
-
\??\c:\thttnt.exec:\thttnt.exe90⤵PID:2708
-
\??\c:\vpvpd.exec:\vpvpd.exe91⤵PID:1592
-
\??\c:\rlxlfrl.exec:\rlxlfrl.exe92⤵PID:2844
-
\??\c:\ntbtnn.exec:\ntbtnn.exe93⤵PID:576
-
\??\c:\jpvpj.exec:\jpvpj.exe94⤵PID:3892
-
\??\c:\rrfxffx.exec:\rrfxffx.exe95⤵PID:1196
-
\??\c:\fxfffff.exec:\fxfffff.exe96⤵PID:3716
-
\??\c:\5bnhbb.exec:\5bnhbb.exe97⤵PID:3044
-
\??\c:\djpvv.exec:\djpvv.exe98⤵PID:2112
-
\??\c:\xffxxxr.exec:\xffxxxr.exe99⤵PID:3116
-
\??\c:\hhthnt.exec:\hhthnt.exe100⤵PID:4052
-
\??\c:\vvdvp.exec:\vvdvp.exe101⤵PID:464
-
\??\c:\vpvvv.exec:\vpvvv.exe102⤵PID:4840
-
\??\c:\flrrxff.exec:\flrrxff.exe103⤵PID:1464
-
\??\c:\tnhnbt.exec:\tnhnbt.exe104⤵PID:2432
-
\??\c:\7vvpv.exec:\7vvpv.exe105⤵PID:4728
-
\??\c:\fxllfff.exec:\fxllfff.exe106⤵PID:4056
-
\??\c:\hbhbtt.exec:\hbhbtt.exe107⤵PID:544
-
\??\c:\pvvpd.exec:\pvvpd.exe108⤵PID:1128
-
\??\c:\3rrlxxr.exec:\3rrlxxr.exe109⤵PID:620
-
\??\c:\lrxffxl.exec:\lrxffxl.exe110⤵PID:4004
-
\??\c:\thnbnh.exec:\thnbnh.exe111⤵PID:1544
-
\??\c:\ddppp.exec:\ddppp.exe112⤵PID:4432
-
\??\c:\xxrlfff.exec:\xxrlfff.exe113⤵PID:2660
-
\??\c:\ntbnnt.exec:\ntbnnt.exe114⤵PID:4644
-
\??\c:\jpvdd.exec:\jpvdd.exe115⤵PID:1572
-
\??\c:\pdppj.exec:\pdppj.exe116⤵PID:4008
-
\??\c:\fflllrr.exec:\fflllrr.exe117⤵PID:4512
-
\??\c:\tbnnbh.exec:\tbnnbh.exe118⤵PID:4468
-
\??\c:\5pvdd.exec:\5pvdd.exe119⤵PID:3052
-
\??\c:\xrllfff.exec:\xrllfff.exe120⤵PID:1332
-
\??\c:\tbtttt.exec:\tbtttt.exe121⤵PID:1160
-
\??\c:\thnnnn.exec:\thnnnn.exe122⤵PID:436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-