Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/12/2024, 23:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe
-
Size
453KB
-
MD5
609243d0265cb44a1f60cd626c2e9a2a
-
SHA1
83540096107387538742e106c70cedfd56628020
-
SHA256
771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b
-
SHA512
aad8916dff5c098dc8dbaf6fcf3941289356e98bee407e77656091b3ec9c0230d78def59e049acd912d6564529bf6f812c4f196425345a3e7ff94d7b64d20671
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeGM3:q7Tc2NYHUrAwfMp3CDGM3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4872-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3380-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/112-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/720-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3352-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3880-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1212-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/604-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-658-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-771-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-889-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-1137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-1378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2352 vvpdv.exe 456 djpjd.exe 2036 tntnhh.exe 468 djdpj.exe 4804 fffxrrl.exe 3676 7hthtn.exe 1068 7llxrrl.exe 3380 nhthtt.exe 4280 nhtnbt.exe 8 jjdjp.exe 3796 9htnbb.exe 4688 xxxxffx.exe 4240 nhnnhb.exe 4608 jjpjd.exe 112 xrxrxxf.exe 3404 ffrlfxr.exe 3332 pjvvp.exe 4224 tbnnnb.exe 4828 dvddv.exe 1952 fllllll.exe 3892 btnhbb.exe 3620 pddvv.exe 1384 jpjdv.exe 3568 djpdj.exe 1924 ttbthb.exe 3480 jvdvv.exe 1204 htbtnn.exe 3732 vvpvd.exe 1352 xxrlfff.exe 720 tttnhh.exe 3472 rfxrllf.exe 3856 pppdp.exe 2880 5lfxrrl.exe 2336 hbhbtt.exe 2588 vvvpp.exe 4856 fxfrlfx.exe 4084 1nbttn.exe 2180 bbbtnn.exe 4928 xrrfxrl.exe 5028 bbbtbb.exe 2792 5vvpj.exe 1648 ffrlffx.exe 548 1djdv.exe 4304 rxrrrrr.exe 3876 hhbbbb.exe 3352 pjpjd.exe 4848 xrrlfxr.exe 2348 htttnh.exe 3880 jjvvj.exe 1436 frrlxrl.exe 1932 btnbth.exe 3012 nntnhh.exe 2060 jpdvj.exe 208 fxlxxrr.exe 3356 bbnbtn.exe 2892 vpjdp.exe 836 vpjdv.exe 212 rfrlllr.exe 5020 1nnhnb.exe 1452 dpppp.exe 1900 fffrllf.exe 2940 xrllrlx.exe 4276 hbhbtb.exe 1424 pvvpj.exe -
resource yara_rule behavioral2/memory/4872-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3380-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/112-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/112-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/720-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3352-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1212-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/604-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2252-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-771-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-816-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ffflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4872 wrote to memory of 2352 4872 771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe 83 PID 4872 wrote to memory of 2352 4872 771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe 83 PID 4872 wrote to memory of 2352 4872 771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe 83 PID 2352 wrote to memory of 456 2352 vvpdv.exe 84 PID 2352 wrote to memory of 456 2352 vvpdv.exe 84 PID 2352 wrote to memory of 456 2352 vvpdv.exe 84 PID 456 wrote to memory of 2036 456 djpjd.exe 85 PID 456 wrote to memory of 2036 456 djpjd.exe 85 PID 456 wrote to memory of 2036 456 djpjd.exe 85 PID 2036 wrote to memory of 468 2036 tntnhh.exe 86 PID 2036 wrote to memory of 468 2036 tntnhh.exe 86 PID 2036 wrote to memory of 468 2036 tntnhh.exe 86 PID 468 wrote to memory of 4804 468 djdpj.exe 87 PID 468 wrote to memory of 4804 468 djdpj.exe 87 PID 468 wrote to memory of 4804 468 djdpj.exe 87 PID 4804 wrote to memory of 3676 4804 fffxrrl.exe 88 PID 4804 wrote to memory of 3676 4804 fffxrrl.exe 88 PID 4804 wrote to memory of 3676 4804 fffxrrl.exe 88 PID 3676 wrote to memory of 1068 3676 7hthtn.exe 89 PID 3676 wrote to memory of 1068 3676 7hthtn.exe 89 PID 3676 wrote to memory of 1068 3676 7hthtn.exe 89 PID 1068 wrote to memory of 3380 1068 7llxrrl.exe 90 PID 1068 wrote to memory of 3380 1068 7llxrrl.exe 90 PID 1068 wrote to memory of 3380 1068 7llxrrl.exe 90 PID 3380 wrote to memory of 4280 3380 nhthtt.exe 91 PID 3380 wrote to memory of 4280 3380 nhthtt.exe 91 PID 3380 wrote to memory of 4280 3380 nhthtt.exe 91 PID 4280 wrote to memory of 8 4280 nhtnbt.exe 92 PID 4280 wrote to memory of 8 4280 nhtnbt.exe 92 PID 4280 wrote to memory of 8 4280 nhtnbt.exe 92 PID 8 wrote to memory of 3796 8 jjdjp.exe 93 PID 8 wrote to memory of 3796 8 jjdjp.exe 93 PID 8 wrote to memory of 3796 8 jjdjp.exe 93 PID 3796 wrote to memory of 4688 3796 9htnbb.exe 94 PID 3796 wrote to memory of 4688 3796 9htnbb.exe 94 PID 3796 wrote to memory of 4688 3796 9htnbb.exe 94 PID 4688 wrote to memory of 4240 4688 xxxxffx.exe 95 PID 4688 wrote to memory of 4240 4688 xxxxffx.exe 95 PID 4688 wrote to memory of 4240 4688 xxxxffx.exe 95 PID 4240 wrote to memory of 4608 4240 nhnnhb.exe 96 PID 4240 wrote to memory of 4608 4240 nhnnhb.exe 96 PID 4240 wrote to memory of 4608 4240 nhnnhb.exe 96 PID 4608 wrote to memory of 112 4608 jjpjd.exe 97 PID 4608 wrote to memory of 112 4608 jjpjd.exe 97 PID 4608 wrote to memory of 112 4608 jjpjd.exe 97 PID 112 wrote to memory of 3404 112 xrxrxxf.exe 98 PID 112 wrote to memory of 3404 112 xrxrxxf.exe 98 PID 112 wrote to memory of 3404 112 xrxrxxf.exe 98 PID 3404 wrote to memory of 3332 3404 ffrlfxr.exe 99 PID 3404 wrote to memory of 3332 3404 ffrlfxr.exe 99 PID 3404 wrote to memory of 3332 3404 ffrlfxr.exe 99 PID 3332 wrote to memory of 4224 3332 pjvvp.exe 100 PID 3332 wrote to memory of 4224 3332 pjvvp.exe 100 PID 3332 wrote to memory of 4224 3332 pjvvp.exe 100 PID 4224 wrote to memory of 4828 4224 tbnnnb.exe 101 PID 4224 wrote to memory of 4828 4224 tbnnnb.exe 101 PID 4224 wrote to memory of 4828 4224 tbnnnb.exe 101 PID 4828 wrote to memory of 1952 4828 dvddv.exe 102 PID 4828 wrote to memory of 1952 4828 dvddv.exe 102 PID 4828 wrote to memory of 1952 4828 dvddv.exe 102 PID 1952 wrote to memory of 3892 1952 fllllll.exe 103 PID 1952 wrote to memory of 3892 1952 fllllll.exe 103 PID 1952 wrote to memory of 3892 1952 fllllll.exe 103 PID 3892 wrote to memory of 3620 3892 btnhbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe"C:\Users\Admin\AppData\Local\Temp\771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\vvpdv.exec:\vvpdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\djpjd.exec:\djpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\tntnhh.exec:\tntnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\djdpj.exec:\djdpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\fffxrrl.exec:\fffxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\7hthtn.exec:\7hthtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\7llxrrl.exec:\7llxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\nhthtt.exec:\nhthtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\nhtnbt.exec:\nhtnbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\jjdjp.exec:\jjdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\9htnbb.exec:\9htnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\xxxxffx.exec:\xxxxffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\nhnnhb.exec:\nhnnhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\jjpjd.exec:\jjpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\xrxrxxf.exec:\xrxrxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\ffrlfxr.exec:\ffrlfxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\pjvvp.exec:\pjvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\tbnnnb.exec:\tbnnnb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\dvddv.exec:\dvddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\fllllll.exec:\fllllll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\btnhbb.exec:\btnhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\pddvv.exec:\pddvv.exe23⤵
- Executes dropped EXE
PID:3620 -
\??\c:\jpjdv.exec:\jpjdv.exe24⤵
- Executes dropped EXE
PID:1384 -
\??\c:\djpdj.exec:\djpdj.exe25⤵
- Executes dropped EXE
PID:3568 -
\??\c:\ttbthb.exec:\ttbthb.exe26⤵
- Executes dropped EXE
PID:1924 -
\??\c:\jvdvv.exec:\jvdvv.exe27⤵
- Executes dropped EXE
PID:3480 -
\??\c:\htbtnn.exec:\htbtnn.exe28⤵
- Executes dropped EXE
PID:1204 -
\??\c:\vvpvd.exec:\vvpvd.exe29⤵
- Executes dropped EXE
PID:3732 -
\??\c:\xxrlfff.exec:\xxrlfff.exe30⤵
- Executes dropped EXE
PID:1352 -
\??\c:\tttnhh.exec:\tttnhh.exe31⤵
- Executes dropped EXE
PID:720 -
\??\c:\rfxrllf.exec:\rfxrllf.exe32⤵
- Executes dropped EXE
PID:3472 -
\??\c:\pppdp.exec:\pppdp.exe33⤵
- Executes dropped EXE
PID:3856 -
\??\c:\5lfxrrl.exec:\5lfxrrl.exe34⤵
- Executes dropped EXE
PID:2880 -
\??\c:\hbhbtt.exec:\hbhbtt.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2336 -
\??\c:\vvvpp.exec:\vvvpp.exe36⤵
- Executes dropped EXE
PID:2588 -
\??\c:\fxfrlfx.exec:\fxfrlfx.exe37⤵
- Executes dropped EXE
PID:4856 -
\??\c:\1nbttn.exec:\1nbttn.exe38⤵
- Executes dropped EXE
PID:4084 -
\??\c:\bbbtnn.exec:\bbbtnn.exe39⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xrrfxrl.exec:\xrrfxrl.exe40⤵
- Executes dropped EXE
PID:4928 -
\??\c:\bbbtbb.exec:\bbbtbb.exe41⤵
- Executes dropped EXE
PID:5028 -
\??\c:\5vvpj.exec:\5vvpj.exe42⤵
- Executes dropped EXE
PID:2792 -
\??\c:\ffrlffx.exec:\ffrlffx.exe43⤵
- Executes dropped EXE
PID:1648 -
\??\c:\1djdv.exec:\1djdv.exe44⤵
- Executes dropped EXE
PID:548 -
\??\c:\rxrrrrr.exec:\rxrrrrr.exe45⤵
- Executes dropped EXE
PID:4304 -
\??\c:\hhbbbb.exec:\hhbbbb.exe46⤵
- Executes dropped EXE
PID:3876 -
\??\c:\pjpjd.exec:\pjpjd.exe47⤵
- Executes dropped EXE
PID:3352 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe48⤵
- Executes dropped EXE
PID:4848 -
\??\c:\htttnh.exec:\htttnh.exe49⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jjvvj.exec:\jjvvj.exe50⤵
- Executes dropped EXE
PID:3880 -
\??\c:\frrlxrl.exec:\frrlxrl.exe51⤵
- Executes dropped EXE
PID:1436 -
\??\c:\btnbth.exec:\btnbth.exe52⤵
- Executes dropped EXE
PID:1932 -
\??\c:\nntnhh.exec:\nntnhh.exe53⤵
- Executes dropped EXE
PID:3012 -
\??\c:\jpdvj.exec:\jpdvj.exe54⤵
- Executes dropped EXE
PID:2060 -
\??\c:\fxlxxrr.exec:\fxlxxrr.exe55⤵
- Executes dropped EXE
PID:208 -
\??\c:\bbnbtn.exec:\bbnbtn.exe56⤵
- Executes dropped EXE
PID:3356 -
\??\c:\vpjdp.exec:\vpjdp.exe57⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vpjdv.exec:\vpjdv.exe58⤵
- Executes dropped EXE
PID:836 -
\??\c:\rfrlllr.exec:\rfrlllr.exe59⤵
- Executes dropped EXE
PID:212 -
\??\c:\1nnhnb.exec:\1nnhnb.exe60⤵
- Executes dropped EXE
PID:5020 -
\??\c:\dpppp.exec:\dpppp.exe61⤵
- Executes dropped EXE
PID:1452 -
\??\c:\fffrllf.exec:\fffrllf.exe62⤵
- Executes dropped EXE
PID:1900 -
\??\c:\xrllrlx.exec:\xrllrlx.exe63⤵
- Executes dropped EXE
PID:2940 -
\??\c:\hbhbtb.exec:\hbhbtb.exe64⤵
- Executes dropped EXE
PID:4276 -
\??\c:\pvvpj.exec:\pvvpj.exe65⤵
- Executes dropped EXE
PID:1424 -
\??\c:\lrllrxr.exec:\lrllrxr.exe66⤵PID:4240
-
\??\c:\hhhbtt.exec:\hhhbtt.exe67⤵PID:4608
-
\??\c:\jppjd.exec:\jppjd.exe68⤵PID:904
-
\??\c:\pjvjp.exec:\pjvjp.exe69⤵PID:3536
-
\??\c:\rrrrrrf.exec:\rrrrrrf.exe70⤵PID:2684
-
\??\c:\3hnhbb.exec:\3hnhbb.exe71⤵PID:3636
-
\??\c:\dpvjv.exec:\dpvjv.exe72⤵PID:4372
-
\??\c:\1vvvp.exec:\1vvvp.exe73⤵PID:760
-
\??\c:\3lfxrxx.exec:\3lfxrxx.exe74⤵PID:1212
-
\??\c:\7nbtbh.exec:\7nbtbh.exe75⤵PID:4568
-
\??\c:\7ddpp.exec:\7ddpp.exe76⤵PID:1940
-
\??\c:\lrfffrx.exec:\lrfffrx.exe77⤵PID:1268
-
\??\c:\bhhbtt.exec:\bhhbtt.exe78⤵PID:2944
-
\??\c:\ddjjj.exec:\ddjjj.exe79⤵PID:2228
-
\??\c:\vjjjd.exec:\vjjjd.exe80⤵PID:1516
-
\??\c:\7flflrx.exec:\7flflrx.exe81⤵PID:604
-
\??\c:\tththb.exec:\tththb.exe82⤵PID:2968
-
\??\c:\vdjjd.exec:\vdjjd.exe83⤵PID:3912
-
\??\c:\pjddj.exec:\pjddj.exe84⤵PID:4436
-
\??\c:\rxxfxrl.exec:\rxxfxrl.exe85⤵PID:4976
-
\??\c:\nbbbth.exec:\nbbbth.exe86⤵PID:4932
-
\??\c:\djdvv.exec:\djdvv.exe87⤵PID:2860
-
\??\c:\3rflllx.exec:\3rflllx.exe88⤵PID:4996
-
\??\c:\ntttnt.exec:\ntttnt.exe89⤵PID:1352
-
\??\c:\hhnhbb.exec:\hhnhbb.exe90⤵PID:1456
-
\??\c:\jjpjj.exec:\jjpjj.exe91⤵PID:4416
-
\??\c:\3rllxxr.exec:\3rllxxr.exe92⤵PID:1132
-
\??\c:\3btntt.exec:\3btntt.exe93⤵PID:2308
-
\??\c:\9pppj.exec:\9pppj.exe94⤵PID:3128
-
\??\c:\jdvvp.exec:\jdvvp.exe95⤵PID:2444
-
\??\c:\lxlfxrl.exec:\lxlfxrl.exe96⤵PID:1584
-
\??\c:\nnntnn.exec:\nnntnn.exe97⤵PID:2364
-
\??\c:\vjppj.exec:\vjppj.exe98⤵PID:4880
-
\??\c:\rrlfffx.exec:\rrlfffx.exe99⤵PID:2252
-
\??\c:\ntbthb.exec:\ntbthb.exe100⤵PID:3372
-
\??\c:\dpvvp.exec:\dpvvp.exe101⤵PID:4008
-
\??\c:\1rxxxfl.exec:\1rxxxfl.exe102⤵PID:4820
-
\??\c:\rfxrrll.exec:\rfxrrll.exe103⤵PID:4616
-
\??\c:\nbnbtt.exec:\nbnbtt.exe104⤵PID:4496
-
\??\c:\dvjpd.exec:\dvjpd.exe105⤵PID:4740
-
\??\c:\ddddp.exec:\ddddp.exe106⤵PID:4352
-
\??\c:\rrfrlfx.exec:\rrfrlfx.exe107⤵PID:388
-
\??\c:\hbhtbt.exec:\hbhtbt.exe108⤵PID:4840
-
\??\c:\vjjjd.exec:\vjjjd.exe109⤵PID:4848
-
\??\c:\5djdd.exec:\5djdd.exe110⤵PID:2028
-
\??\c:\bnttbb.exec:\bnttbb.exe111⤵PID:3316
-
\??\c:\nnhhbh.exec:\nnhhbh.exe112⤵PID:2972
-
\??\c:\dvppj.exec:\dvppj.exe113⤵PID:4380
-
\??\c:\xxfrxrx.exec:\xxfrxrx.exe114⤵PID:2268
-
\??\c:\nbttnh.exec:\nbttnh.exe115⤵PID:1692
-
\??\c:\vvpjd.exec:\vvpjd.exe116⤵PID:5100
-
\??\c:\vjdpj.exec:\vjdpj.exe117⤵PID:4188
-
\??\c:\llfxxxr.exec:\llfxxxr.exe118⤵PID:2828
-
\??\c:\bnnhbt.exec:\bnnhbt.exe119⤵PID:1616
-
\??\c:\1ppjj.exec:\1ppjj.exe120⤵PID:3428
-
\??\c:\rlffffx.exec:\rlffffx.exe121⤵PID:2272
-
\??\c:\btnnnn.exec:\btnnnn.exe122⤵PID:3612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-