Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 02:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a23d879ed902866533be1e47e2b72e3526acde7a76ff3a248b05abecca79f3b2.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
a23d879ed902866533be1e47e2b72e3526acde7a76ff3a248b05abecca79f3b2.exe
-
Size
455KB
-
MD5
b0f8f7774ebe0f4f8b41e61ba2e38545
-
SHA1
d05a09339dfd15298a067a1efa5269a93c1494fa
-
SHA256
a23d879ed902866533be1e47e2b72e3526acde7a76ff3a248b05abecca79f3b2
-
SHA512
d634e2066222e7eeb61080757273beb1d3278e08a5b42319e497181775e490de0b5110a2504df0209caf274445ed7a14ce0ab416c4db329a59934708eee352e4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTq:q7Tc2NYHUrAwfMp3CDW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3868-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2044-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3352-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1300-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1516-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1784-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2332-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-648-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/696-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-714-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-727-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-1057-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-1085-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-1621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1068 jdjjj.exe 4216 xxxrrrl.exe 4804 nbbhht.exe 2044 llrfllr.exe 3220 9bhhhh.exe 3260 nnttnt.exe 1660 vdddv.exe 3216 hnnntb.exe 2968 ppjdp.exe 1204 dpjjj.exe 2564 lxxxxxx.exe 3284 lxfffff.exe 4880 jjvdp.exe 3800 rflffrr.exe 2320 jjpjv.exe 3352 flrlrxl.exe 3600 vvvvp.exe 4944 fllxfff.exe 4012 hhnhhh.exe 2404 tbhhtb.exe 636 vjjjd.exe 3372 hnbhth.exe 3512 lllfffx.exe 3412 jdddp.exe 4300 bbhbtt.exe 1912 dddvv.exe 2316 9hnnnt.exe 1300 rlxrrfx.exe 3148 xfffrrx.exe 3464 jpjjp.exe 4528 bbhbtt.exe 924 thnhnh.exe 1360 3hbbtt.exe 2444 djjvp.exe 4000 xrlllll.exe 1664 1hnntn.exe 1536 djddv.exe 4780 pjpjd.exe 4128 rxxrllf.exe 1788 ttnhhb.exe 1860 ppdvd.exe 2760 ffxrfxf.exe 1108 7rllffx.exe 2128 tttnhn.exe 1088 jvddp.exe 1516 llffxxx.exe 1436 thnnhn.exe 4404 bntnbh.exe 3040 7jjjd.exe 740 ffffffl.exe 2308 xxrfxxx.exe 4344 5dpjp.exe 2304 fxlfrfx.exe 3868 lrxrrrr.exe 4764 tbnhbb.exe 60 pjjdv.exe 3232 ffrlrfr.exe 2416 hhhbnh.exe 2860 tbtnhh.exe 2912 jvdpj.exe 2108 fllllfx.exe 3796 xrlfrxr.exe 1660 hhttnn.exe 4732 jpjvp.exe -
resource yara_rule behavioral2/memory/3868-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2044-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3352-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1300-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1536-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1516-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2332-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1388-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/696-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-811-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-1057-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3868 wrote to memory of 1068 3868 a23d879ed902866533be1e47e2b72e3526acde7a76ff3a248b05abecca79f3b2.exe 83 PID 3868 wrote to memory of 1068 3868 a23d879ed902866533be1e47e2b72e3526acde7a76ff3a248b05abecca79f3b2.exe 83 PID 3868 wrote to memory of 1068 3868 a23d879ed902866533be1e47e2b72e3526acde7a76ff3a248b05abecca79f3b2.exe 83 PID 1068 wrote to memory of 4216 1068 jdjjj.exe 84 PID 1068 wrote to memory of 4216 1068 jdjjj.exe 84 PID 1068 wrote to memory of 4216 1068 jdjjj.exe 84 PID 4216 wrote to memory of 4804 4216 xxxrrrl.exe 85 PID 4216 wrote to memory of 4804 4216 xxxrrrl.exe 85 PID 4216 wrote to memory of 4804 4216 xxxrrrl.exe 85 PID 4804 wrote to memory of 2044 4804 nbbhht.exe 86 PID 4804 wrote to memory of 2044 4804 nbbhht.exe 86 PID 4804 wrote to memory of 2044 4804 nbbhht.exe 86 PID 2044 wrote to memory of 3220 2044 llrfllr.exe 87 PID 2044 wrote to memory of 3220 2044 llrfllr.exe 87 PID 2044 wrote to memory of 3220 2044 llrfllr.exe 87 PID 3220 wrote to memory of 3260 3220 9bhhhh.exe 88 PID 3220 wrote to memory of 3260 3220 9bhhhh.exe 88 PID 3220 wrote to memory of 3260 3220 9bhhhh.exe 88 PID 3260 wrote to memory of 1660 3260 nnttnt.exe 89 PID 3260 wrote to memory of 1660 3260 nnttnt.exe 89 PID 3260 wrote to memory of 1660 3260 nnttnt.exe 89 PID 1660 wrote to memory of 3216 1660 vdddv.exe 90 PID 1660 wrote to memory of 3216 1660 vdddv.exe 90 PID 1660 wrote to memory of 3216 1660 vdddv.exe 90 PID 3216 wrote to memory of 2968 3216 hnnntb.exe 91 PID 3216 wrote to memory of 2968 3216 hnnntb.exe 91 PID 3216 wrote to memory of 2968 3216 hnnntb.exe 91 PID 2968 wrote to memory of 1204 2968 ppjdp.exe 92 PID 2968 wrote to memory of 1204 2968 ppjdp.exe 92 PID 2968 wrote to memory of 1204 2968 ppjdp.exe 92 PID 1204 wrote to memory of 2564 1204 dpjjj.exe 93 PID 1204 wrote to memory of 2564 1204 dpjjj.exe 93 PID 1204 wrote to memory of 2564 1204 dpjjj.exe 93 PID 2564 wrote to memory of 3284 2564 lxxxxxx.exe 94 PID 2564 wrote to memory of 3284 2564 lxxxxxx.exe 94 PID 2564 wrote to memory of 3284 2564 lxxxxxx.exe 94 PID 3284 wrote to memory of 4880 3284 lxfffff.exe 95 PID 3284 wrote to memory of 4880 3284 lxfffff.exe 95 PID 3284 wrote to memory of 4880 3284 lxfffff.exe 95 PID 4880 wrote to memory of 3800 4880 jjvdp.exe 96 PID 4880 wrote to memory of 3800 4880 jjvdp.exe 96 PID 4880 wrote to memory of 3800 4880 jjvdp.exe 96 PID 3800 wrote to memory of 2320 3800 rflffrr.exe 97 PID 3800 wrote to memory of 2320 3800 rflffrr.exe 97 PID 3800 wrote to memory of 2320 3800 rflffrr.exe 97 PID 2320 wrote to memory of 3352 2320 jjpjv.exe 98 PID 2320 wrote to memory of 3352 2320 jjpjv.exe 98 PID 2320 wrote to memory of 3352 2320 jjpjv.exe 98 PID 3352 wrote to memory of 3600 3352 flrlrxl.exe 99 PID 3352 wrote to memory of 3600 3352 flrlrxl.exe 99 PID 3352 wrote to memory of 3600 3352 flrlrxl.exe 99 PID 3600 wrote to memory of 4944 3600 vvvvp.exe 100 PID 3600 wrote to memory of 4944 3600 vvvvp.exe 100 PID 3600 wrote to memory of 4944 3600 vvvvp.exe 100 PID 4944 wrote to memory of 4012 4944 fllxfff.exe 101 PID 4944 wrote to memory of 4012 4944 fllxfff.exe 101 PID 4944 wrote to memory of 4012 4944 fllxfff.exe 101 PID 4012 wrote to memory of 2404 4012 hhnhhh.exe 102 PID 4012 wrote to memory of 2404 4012 hhnhhh.exe 102 PID 4012 wrote to memory of 2404 4012 hhnhhh.exe 102 PID 2404 wrote to memory of 636 2404 tbhhtb.exe 103 PID 2404 wrote to memory of 636 2404 tbhhtb.exe 103 PID 2404 wrote to memory of 636 2404 tbhhtb.exe 103 PID 636 wrote to memory of 3372 636 vjjjd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\a23d879ed902866533be1e47e2b72e3526acde7a76ff3a248b05abecca79f3b2.exe"C:\Users\Admin\AppData\Local\Temp\a23d879ed902866533be1e47e2b72e3526acde7a76ff3a248b05abecca79f3b2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\jdjjj.exec:\jdjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\xxxrrrl.exec:\xxxrrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\nbbhht.exec:\nbbhht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\llrfllr.exec:\llrfllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\9bhhhh.exec:\9bhhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\nnttnt.exec:\nnttnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\vdddv.exec:\vdddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\hnnntb.exec:\hnnntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\ppjdp.exec:\ppjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\dpjjj.exec:\dpjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\lxxxxxx.exec:\lxxxxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\lxfffff.exec:\lxfffff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\jjvdp.exec:\jjvdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\rflffrr.exec:\rflffrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\jjpjv.exec:\jjpjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\flrlrxl.exec:\flrlrxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\vvvvp.exec:\vvvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\fllxfff.exec:\fllxfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\hhnhhh.exec:\hhnhhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\tbhhtb.exec:\tbhhtb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\vjjjd.exec:\vjjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\hnbhth.exec:\hnbhth.exe23⤵
- Executes dropped EXE
PID:3372 -
\??\c:\lllfffx.exec:\lllfffx.exe24⤵
- Executes dropped EXE
PID:3512 -
\??\c:\jdddp.exec:\jdddp.exe25⤵
- Executes dropped EXE
PID:3412 -
\??\c:\bbhbtt.exec:\bbhbtt.exe26⤵
- Executes dropped EXE
PID:4300 -
\??\c:\dddvv.exec:\dddvv.exe27⤵
- Executes dropped EXE
PID:1912 -
\??\c:\9hnnnt.exec:\9hnnnt.exe28⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rlxrrfx.exec:\rlxrrfx.exe29⤵
- Executes dropped EXE
PID:1300 -
\??\c:\xfffrrx.exec:\xfffrrx.exe30⤵
- Executes dropped EXE
PID:3148 -
\??\c:\jpjjp.exec:\jpjjp.exe31⤵
- Executes dropped EXE
PID:3464 -
\??\c:\bbhbtt.exec:\bbhbtt.exe32⤵
- Executes dropped EXE
PID:4528 -
\??\c:\thnhnh.exec:\thnhnh.exe33⤵
- Executes dropped EXE
PID:924 -
\??\c:\3hbbtt.exec:\3hbbtt.exe34⤵
- Executes dropped EXE
PID:1360 -
\??\c:\djjvp.exec:\djjvp.exe35⤵
- Executes dropped EXE
PID:2444 -
\??\c:\xrlllll.exec:\xrlllll.exe36⤵
- Executes dropped EXE
PID:4000 -
\??\c:\1hnntn.exec:\1hnntn.exe37⤵
- Executes dropped EXE
PID:1664 -
\??\c:\djddv.exec:\djddv.exe38⤵
- Executes dropped EXE
PID:1536 -
\??\c:\pjpjd.exec:\pjpjd.exe39⤵
- Executes dropped EXE
PID:4780 -
\??\c:\rxxrllf.exec:\rxxrllf.exe40⤵
- Executes dropped EXE
PID:4128 -
\??\c:\ttnhhb.exec:\ttnhhb.exe41⤵
- Executes dropped EXE
PID:1788 -
\??\c:\ppdvd.exec:\ppdvd.exe42⤵
- Executes dropped EXE
PID:1860 -
\??\c:\ffxrfxf.exec:\ffxrfxf.exe43⤵
- Executes dropped EXE
PID:2760 -
\??\c:\7rllffx.exec:\7rllffx.exe44⤵
- Executes dropped EXE
PID:1108 -
\??\c:\tttnhn.exec:\tttnhn.exe45⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jvddp.exec:\jvddp.exe46⤵
- Executes dropped EXE
PID:1088 -
\??\c:\llffxxx.exec:\llffxxx.exe47⤵
- Executes dropped EXE
PID:1516 -
\??\c:\thnnhn.exec:\thnnhn.exe48⤵
- Executes dropped EXE
PID:1436 -
\??\c:\bntnbh.exec:\bntnbh.exe49⤵
- Executes dropped EXE
PID:4404 -
\??\c:\7jjjd.exec:\7jjjd.exe50⤵
- Executes dropped EXE
PID:3040 -
\??\c:\ffffffl.exec:\ffffffl.exe51⤵
- Executes dropped EXE
PID:740 -
\??\c:\xxrfxxx.exec:\xxrfxxx.exe52⤵
- Executes dropped EXE
PID:2308 -
\??\c:\5dpjp.exec:\5dpjp.exe53⤵
- Executes dropped EXE
PID:4344 -
\??\c:\fxlfrfx.exec:\fxlfrfx.exe54⤵
- Executes dropped EXE
PID:2304 -
\??\c:\lrxrrrr.exec:\lrxrrrr.exe55⤵
- Executes dropped EXE
PID:3868 -
\??\c:\tbnhbb.exec:\tbnhbb.exe56⤵
- Executes dropped EXE
PID:4764 -
\??\c:\pjjdv.exec:\pjjdv.exe57⤵
- Executes dropped EXE
PID:60 -
\??\c:\ffrlrfr.exec:\ffrlrfr.exe58⤵
- Executes dropped EXE
PID:3232 -
\??\c:\hhhbnh.exec:\hhhbnh.exe59⤵
- Executes dropped EXE
PID:2416 -
\??\c:\tbtnhh.exec:\tbtnhh.exe60⤵
- Executes dropped EXE
PID:2860 -
\??\c:\jvdpj.exec:\jvdpj.exe61⤵
- Executes dropped EXE
PID:2912 -
\??\c:\fllllfx.exec:\fllllfx.exe62⤵
- Executes dropped EXE
PID:2108 -
\??\c:\xrlfrxr.exec:\xrlfrxr.exe63⤵
- Executes dropped EXE
PID:3796 -
\??\c:\hhttnn.exec:\hhttnn.exe64⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jpjvp.exec:\jpjvp.exe65⤵
- Executes dropped EXE
PID:4732 -
\??\c:\xffrxxx.exec:\xffrxxx.exe66⤵PID:5004
-
\??\c:\thhhbb.exec:\thhhbb.exe67⤵PID:2260
-
\??\c:\hhnhtt.exec:\hhnhtt.exe68⤵PID:2636
-
\??\c:\1pvvd.exec:\1pvvd.exe69⤵PID:3032
-
\??\c:\rlfrffx.exec:\rlfrffx.exe70⤵PID:2284
-
\??\c:\htbnhb.exec:\htbnhb.exe71⤵PID:3748
-
\??\c:\vvjdp.exec:\vvjdp.exe72⤵PID:3284
-
\??\c:\jjdvp.exec:\jjdvp.exe73⤵PID:3044
-
\??\c:\1llfrrl.exec:\1llfrrl.exe74⤵PID:3224
-
\??\c:\1nnhbt.exec:\1nnhbt.exe75⤵PID:1476
-
\??\c:\jdjjv.exec:\jdjjv.exe76⤵PID:5084
-
\??\c:\llxrfxl.exec:\llxrfxl.exe77⤵PID:3332
-
\??\c:\ttnttn.exec:\ttnttn.exe78⤵PID:2216
-
\??\c:\hhbnbh.exec:\hhbnbh.exe79⤵PID:1872
-
\??\c:\jvjdj.exec:\jvjdj.exe80⤵PID:4548
-
\??\c:\frlfxrl.exec:\frlfxrl.exe81⤵PID:3912
-
\??\c:\nthbhh.exec:\nthbhh.exe82⤵PID:212
-
\??\c:\9vjjd.exec:\9vjjd.exe83⤵PID:1784
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe84⤵PID:636
-
\??\c:\bhhbtn.exec:\bhhbtn.exe85⤵
- System Location Discovery: System Language Discovery
PID:4692 -
\??\c:\vjvdp.exec:\vjvdp.exe86⤵PID:1380
-
\??\c:\xxrrrxx.exec:\xxrrrxx.exe87⤵PID:376
-
\??\c:\xrffxxx.exec:\xrffxxx.exe88⤵PID:3412
-
\??\c:\thhtnn.exec:\thhtnn.exe89⤵PID:436
-
\??\c:\jjjdv.exec:\jjjdv.exe90⤵PID:4680
-
\??\c:\3xxxrrr.exec:\3xxxrrr.exe91⤵PID:3584
-
\??\c:\ntbhtb.exec:\ntbhtb.exe92⤵PID:3736
-
\??\c:\vpvvv.exec:\vpvvv.exe93⤵PID:2332
-
\??\c:\5fxxrxr.exec:\5fxxrxr.exe94⤵PID:5072
-
\??\c:\tnhbtn.exec:\tnhbtn.exe95⤵PID:2456
-
\??\c:\vvdjd.exec:\vvdjd.exe96⤵PID:4588
-
\??\c:\5jjdd.exec:\5jjdd.exe97⤵PID:2256
-
\??\c:\fxffxxx.exec:\fxffxxx.exe98⤵PID:2016
-
\??\c:\tthbbt.exec:\tthbbt.exe99⤵
- System Location Discovery: System Language Discovery
PID:1548 -
\??\c:\pddvv.exec:\pddvv.exe100⤵PID:2928
-
\??\c:\xxffxxx.exec:\xxffxxx.exe101⤵PID:5008
-
\??\c:\nbbnhh.exec:\nbbnhh.exe102⤵PID:1664
-
\??\c:\ddddv.exec:\ddddv.exe103⤵PID:3264
-
\??\c:\ffllfff.exec:\ffllfff.exe104⤵PID:1524
-
\??\c:\9fxxxll.exec:\9fxxxll.exe105⤵PID:4128
-
\??\c:\vdjjd.exec:\vdjjd.exe106⤵PID:4192
-
\??\c:\djdvp.exec:\djdvp.exe107⤵PID:1992
-
\??\c:\xfrrxff.exec:\xfrrxff.exe108⤵PID:3776
-
\??\c:\hbhhnn.exec:\hbhhnn.exe109⤵PID:1376
-
\??\c:\djvvd.exec:\djvvd.exe110⤵PID:208
-
\??\c:\lxxrffr.exec:\lxxrffr.exe111⤵PID:4688
-
\??\c:\bnbthh.exec:\bnbthh.exe112⤵PID:3188
-
\??\c:\9jpjd.exec:\9jpjd.exe113⤵PID:3012
-
\??\c:\ffxffrr.exec:\ffxffrr.exe114⤵PID:2148
-
\??\c:\hhtbtt.exec:\hhtbtt.exe115⤵PID:100
-
\??\c:\pvddd.exec:\pvddd.exe116⤵PID:1100
-
\??\c:\lllffxx.exec:\lllffxx.exe117⤵PID:2348
-
\??\c:\bnbntt.exec:\bnbntt.exe118⤵PID:4596
-
\??\c:\hbtthn.exec:\hbtthn.exe119⤵PID:3732
-
\??\c:\9jdjj.exec:\9jdjj.exe120⤵PID:4136
-
\??\c:\xflxfxr.exec:\xflxfxr.exe121⤵PID:1672
-
\??\c:\hnhhtn.exec:\hnhhtn.exe122⤵PID:696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-