Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 02:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
972e75bb4fff6ba8e120df57289ef8df93b34e7a303726f016281398caea4aa9.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
972e75bb4fff6ba8e120df57289ef8df93b34e7a303726f016281398caea4aa9.exe
-
Size
456KB
-
MD5
a7f9ade8b35a7ab920f0611e01a25578
-
SHA1
81bb778fdb969dbeae54c7fcfe0937afd84ccfc8
-
SHA256
972e75bb4fff6ba8e120df57289ef8df93b34e7a303726f016281398caea4aa9
-
SHA512
0b39e4d98dff04c06a5a22c65017e2ac6e3b833e54ad261e78ca114f0478aeb2df06787ea60a55632c78f0a75ecfd1cc477e9a39d0cf6d68cb3dcfa62d7d3878
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRwr:q7Tc2NYHUrAwfMp3CDRwr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2004-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/956-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1768-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1184-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3908-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3140-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4208-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/932-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-728-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-1141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 956 xxlfllr.exe 1160 jjpjd.exe 3084 tnthbh.exe 1768 pjpjd.exe 1748 ppppj.exe 2284 bbbhnb.exe 1184 5xlfrlx.exe 2272 pvvpd.exe 4016 bnhhtb.exe 4100 ppjdd.exe 3908 5xlfxxr.exe 3520 nthbhh.exe 536 fxlfffx.exe 2280 hhnhhn.exe 4344 jvppj.exe 3140 lffxrfx.exe 5028 jdpjp.exe 4776 jvdvd.exe 3068 xffxllx.exe 3372 nnhhhh.exe 1948 jdvpj.exe 4504 pjjpj.exe 216 lrrllfx.exe 2536 fflffxl.exe 1620 nhhbtn.exe 1452 djvpj.exe 1076 jvjdv.exe 4208 pdjdd.exe 2516 lllfxxr.exe 3000 5dpdv.exe 3484 ttbttt.exe 2792 xfrlllf.exe 2360 jpvpd.exe 2556 frlflfl.exe 4560 hntnnn.exe 2800 7dvpv.exe 3900 flrlfxr.exe 3412 nhnbtt.exe 4548 vdpdv.exe 1976 lxfxrxx.exe 2224 5djdd.exe 3600 lfxrfxr.exe 4532 htbttn.exe 3740 3vdvd.exe 3148 rflfxrl.exe 5036 3thbtt.exe 2412 1vppd.exe 1652 xflfxrr.exe 5096 htnbtn.exe 5088 7vvpp.exe 2288 lffxrrr.exe 408 bnhtnb.exe 2052 pjdpv.exe 1928 xxlxrlr.exe 4176 rxllfrx.exe 3308 nnhhbb.exe 1644 jdjjj.exe 2036 lrrlfff.exe 2676 ffxfxrr.exe 4956 httbbt.exe 2524 7djvp.exe 2808 fflxrlf.exe 932 btnhbb.exe 2392 tnbtnn.exe -
resource yara_rule behavioral2/memory/2004-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/956-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1184-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2272-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3908-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3140-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4208-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4208-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/932-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-597-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2004 wrote to memory of 956 2004 972e75bb4fff6ba8e120df57289ef8df93b34e7a303726f016281398caea4aa9.exe 83 PID 2004 wrote to memory of 956 2004 972e75bb4fff6ba8e120df57289ef8df93b34e7a303726f016281398caea4aa9.exe 83 PID 2004 wrote to memory of 956 2004 972e75bb4fff6ba8e120df57289ef8df93b34e7a303726f016281398caea4aa9.exe 83 PID 956 wrote to memory of 1160 956 xxlfllr.exe 84 PID 956 wrote to memory of 1160 956 xxlfllr.exe 84 PID 956 wrote to memory of 1160 956 xxlfllr.exe 84 PID 1160 wrote to memory of 3084 1160 jjpjd.exe 85 PID 1160 wrote to memory of 3084 1160 jjpjd.exe 85 PID 1160 wrote to memory of 3084 1160 jjpjd.exe 85 PID 3084 wrote to memory of 1768 3084 tnthbh.exe 86 PID 3084 wrote to memory of 1768 3084 tnthbh.exe 86 PID 3084 wrote to memory of 1768 3084 tnthbh.exe 86 PID 1768 wrote to memory of 1748 1768 pjpjd.exe 87 PID 1768 wrote to memory of 1748 1768 pjpjd.exe 87 PID 1768 wrote to memory of 1748 1768 pjpjd.exe 87 PID 1748 wrote to memory of 2284 1748 ppppj.exe 88 PID 1748 wrote to memory of 2284 1748 ppppj.exe 88 PID 1748 wrote to memory of 2284 1748 ppppj.exe 88 PID 2284 wrote to memory of 1184 2284 bbbhnb.exe 89 PID 2284 wrote to memory of 1184 2284 bbbhnb.exe 89 PID 2284 wrote to memory of 1184 2284 bbbhnb.exe 89 PID 1184 wrote to memory of 2272 1184 5xlfrlx.exe 90 PID 1184 wrote to memory of 2272 1184 5xlfrlx.exe 90 PID 1184 wrote to memory of 2272 1184 5xlfrlx.exe 90 PID 2272 wrote to memory of 4016 2272 pvvpd.exe 91 PID 2272 wrote to memory of 4016 2272 pvvpd.exe 91 PID 2272 wrote to memory of 4016 2272 pvvpd.exe 91 PID 4016 wrote to memory of 4100 4016 bnhhtb.exe 92 PID 4016 wrote to memory of 4100 4016 bnhhtb.exe 92 PID 4016 wrote to memory of 4100 4016 bnhhtb.exe 92 PID 4100 wrote to memory of 3908 4100 ppjdd.exe 93 PID 4100 wrote to memory of 3908 4100 ppjdd.exe 93 PID 4100 wrote to memory of 3908 4100 ppjdd.exe 93 PID 3908 wrote to memory of 3520 3908 5xlfxxr.exe 94 PID 3908 wrote to memory of 3520 3908 5xlfxxr.exe 94 PID 3908 wrote to memory of 3520 3908 5xlfxxr.exe 94 PID 3520 wrote to memory of 536 3520 nthbhh.exe 95 PID 3520 wrote to memory of 536 3520 nthbhh.exe 95 PID 3520 wrote to memory of 536 3520 nthbhh.exe 95 PID 536 wrote to memory of 2280 536 fxlfffx.exe 96 PID 536 wrote to memory of 2280 536 fxlfffx.exe 96 PID 536 wrote to memory of 2280 536 fxlfffx.exe 96 PID 2280 wrote to memory of 4344 2280 hhnhhn.exe 97 PID 2280 wrote to memory of 4344 2280 hhnhhn.exe 97 PID 2280 wrote to memory of 4344 2280 hhnhhn.exe 97 PID 4344 wrote to memory of 3140 4344 jvppj.exe 98 PID 4344 wrote to memory of 3140 4344 jvppj.exe 98 PID 4344 wrote to memory of 3140 4344 jvppj.exe 98 PID 3140 wrote to memory of 5028 3140 lffxrfx.exe 99 PID 3140 wrote to memory of 5028 3140 lffxrfx.exe 99 PID 3140 wrote to memory of 5028 3140 lffxrfx.exe 99 PID 5028 wrote to memory of 4776 5028 jdpjp.exe 100 PID 5028 wrote to memory of 4776 5028 jdpjp.exe 100 PID 5028 wrote to memory of 4776 5028 jdpjp.exe 100 PID 4776 wrote to memory of 3068 4776 jvdvd.exe 101 PID 4776 wrote to memory of 3068 4776 jvdvd.exe 101 PID 4776 wrote to memory of 3068 4776 jvdvd.exe 101 PID 3068 wrote to memory of 3372 3068 xffxllx.exe 102 PID 3068 wrote to memory of 3372 3068 xffxllx.exe 102 PID 3068 wrote to memory of 3372 3068 xffxllx.exe 102 PID 3372 wrote to memory of 1948 3372 nnhhhh.exe 103 PID 3372 wrote to memory of 1948 3372 nnhhhh.exe 103 PID 3372 wrote to memory of 1948 3372 nnhhhh.exe 103 PID 1948 wrote to memory of 4504 1948 jdvpj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\972e75bb4fff6ba8e120df57289ef8df93b34e7a303726f016281398caea4aa9.exe"C:\Users\Admin\AppData\Local\Temp\972e75bb4fff6ba8e120df57289ef8df93b34e7a303726f016281398caea4aa9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\xxlfllr.exec:\xxlfllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\jjpjd.exec:\jjpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\tnthbh.exec:\tnthbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\pjpjd.exec:\pjpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\ppppj.exec:\ppppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\bbbhnb.exec:\bbbhnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\5xlfrlx.exec:\5xlfrlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\pvvpd.exec:\pvvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\bnhhtb.exec:\bnhhtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\ppjdd.exec:\ppjdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\5xlfxxr.exec:\5xlfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\nthbhh.exec:\nthbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\fxlfffx.exec:\fxlfffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\hhnhhn.exec:\hhnhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\jvppj.exec:\jvppj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\lffxrfx.exec:\lffxrfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\jdpjp.exec:\jdpjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\jvdvd.exec:\jvdvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\xffxllx.exec:\xffxllx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\nnhhhh.exec:\nnhhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\jdvpj.exec:\jdvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\pjjpj.exec:\pjjpj.exe23⤵
- Executes dropped EXE
PID:4504 -
\??\c:\lrrllfx.exec:\lrrllfx.exe24⤵
- Executes dropped EXE
PID:216 -
\??\c:\fflffxl.exec:\fflffxl.exe25⤵
- Executes dropped EXE
PID:2536 -
\??\c:\nhhbtn.exec:\nhhbtn.exe26⤵
- Executes dropped EXE
PID:1620 -
\??\c:\djvpj.exec:\djvpj.exe27⤵
- Executes dropped EXE
PID:1452 -
\??\c:\jvjdv.exec:\jvjdv.exe28⤵
- Executes dropped EXE
PID:1076 -
\??\c:\pdjdd.exec:\pdjdd.exe29⤵
- Executes dropped EXE
PID:4208 -
\??\c:\lllfxxr.exec:\lllfxxr.exe30⤵
- Executes dropped EXE
PID:2516 -
\??\c:\5dpdv.exec:\5dpdv.exe31⤵
- Executes dropped EXE
PID:3000 -
\??\c:\ttbttt.exec:\ttbttt.exe32⤵
- Executes dropped EXE
PID:3484 -
\??\c:\xfrlllf.exec:\xfrlllf.exe33⤵
- Executes dropped EXE
PID:2792 -
\??\c:\jpvpd.exec:\jpvpd.exe34⤵
- Executes dropped EXE
PID:2360 -
\??\c:\frlflfl.exec:\frlflfl.exe35⤵
- Executes dropped EXE
PID:2556 -
\??\c:\hntnnn.exec:\hntnnn.exe36⤵
- Executes dropped EXE
PID:4560 -
\??\c:\7dvpv.exec:\7dvpv.exe37⤵
- Executes dropped EXE
PID:2800 -
\??\c:\flrlfxr.exec:\flrlfxr.exe38⤵
- Executes dropped EXE
PID:3900 -
\??\c:\nhnbtt.exec:\nhnbtt.exe39⤵
- Executes dropped EXE
PID:3412 -
\??\c:\vdpdv.exec:\vdpdv.exe40⤵
- Executes dropped EXE
PID:4548 -
\??\c:\lxfxrxx.exec:\lxfxrxx.exe41⤵
- Executes dropped EXE
PID:1976 -
\??\c:\5djdd.exec:\5djdd.exe42⤵
- Executes dropped EXE
PID:2224 -
\??\c:\lfxrfxr.exec:\lfxrfxr.exe43⤵
- Executes dropped EXE
PID:3600 -
\??\c:\htbttn.exec:\htbttn.exe44⤵
- Executes dropped EXE
PID:4532 -
\??\c:\3vdvd.exec:\3vdvd.exe45⤵
- Executes dropped EXE
PID:3740 -
\??\c:\rflfxrl.exec:\rflfxrl.exe46⤵
- Executes dropped EXE
PID:3148 -
\??\c:\3thbtt.exec:\3thbtt.exe47⤵
- Executes dropped EXE
PID:5036 -
\??\c:\1vppd.exec:\1vppd.exe48⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xflfxrr.exec:\xflfxrr.exe49⤵
- Executes dropped EXE
PID:1652 -
\??\c:\htnbtn.exec:\htnbtn.exe50⤵
- Executes dropped EXE
PID:5096 -
\??\c:\7vvpp.exec:\7vvpp.exe51⤵
- Executes dropped EXE
PID:5088 -
\??\c:\lffxrrr.exec:\lffxrrr.exe52⤵
- Executes dropped EXE
PID:2288 -
\??\c:\bnhtnb.exec:\bnhtnb.exe53⤵
- Executes dropped EXE
PID:408 -
\??\c:\pjdpv.exec:\pjdpv.exe54⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xxlxrlr.exec:\xxlxrlr.exe55⤵
- Executes dropped EXE
PID:1928 -
\??\c:\rxllfrx.exec:\rxllfrx.exe56⤵
- Executes dropped EXE
PID:4176 -
\??\c:\nnhhbb.exec:\nnhhbb.exe57⤵
- Executes dropped EXE
PID:3308 -
\??\c:\jdjjj.exec:\jdjjj.exe58⤵
- Executes dropped EXE
PID:1644 -
\??\c:\lrrlfff.exec:\lrrlfff.exe59⤵
- Executes dropped EXE
PID:2036 -
\??\c:\ffxfxrr.exec:\ffxfxrr.exe60⤵
- Executes dropped EXE
PID:2676 -
\??\c:\httbbt.exec:\httbbt.exe61⤵
- Executes dropped EXE
PID:4956 -
\??\c:\7djvp.exec:\7djvp.exe62⤵
- Executes dropped EXE
PID:2524 -
\??\c:\fflxrlf.exec:\fflxrlf.exe63⤵
- Executes dropped EXE
PID:2808 -
\??\c:\btnhbb.exec:\btnhbb.exe64⤵
- Executes dropped EXE
PID:932 -
\??\c:\tnbtnn.exec:\tnbtnn.exe65⤵
- Executes dropped EXE
PID:2392 -
\??\c:\dvddv.exec:\dvddv.exe66⤵PID:4812
-
\??\c:\lxfxfxr.exec:\lxfxfxr.exe67⤵PID:2080
-
\??\c:\lffxlfx.exec:\lffxlfx.exe68⤵PID:4984
-
\??\c:\hthbtn.exec:\hthbtn.exe69⤵PID:4464
-
\??\c:\vjpjd.exec:\vjpjd.exe70⤵PID:2512
-
\??\c:\fffxxxr.exec:\fffxxxr.exe71⤵PID:2188
-
\??\c:\rxfxlfx.exec:\rxfxlfx.exe72⤵PID:3572
-
\??\c:\1bbnhb.exec:\1bbnhb.exe73⤵PID:4344
-
\??\c:\dpvpj.exec:\dpvpj.exe74⤵PID:644
-
\??\c:\jvjpd.exec:\jvjpd.exe75⤵PID:2332
-
\??\c:\5lxrrll.exec:\5lxrrll.exe76⤵PID:3244
-
\??\c:\btbthb.exec:\btbthb.exe77⤵PID:2404
-
\??\c:\vppjv.exec:\vppjv.exe78⤵PID:876
-
\??\c:\frxrflx.exec:\frxrflx.exe79⤵PID:3100
-
\??\c:\rffxrlx.exec:\rffxrlx.exe80⤵PID:1796
-
\??\c:\tttnbt.exec:\tttnbt.exe81⤵PID:2256
-
\??\c:\pjpdv.exec:\pjpdv.exe82⤵PID:588
-
\??\c:\ffrlfxr.exec:\ffrlfxr.exe83⤵PID:760
-
\??\c:\ththnh.exec:\ththnh.exe84⤵PID:2992
-
\??\c:\dddvv.exec:\dddvv.exe85⤵PID:3328
-
\??\c:\dppdd.exec:\dppdd.exe86⤵PID:756
-
\??\c:\xffxfff.exec:\xffxfff.exe87⤵PID:3736
-
\??\c:\nbbntn.exec:\nbbntn.exe88⤵PID:2148
-
\??\c:\jdpdd.exec:\jdpdd.exe89⤵PID:4112
-
\??\c:\5xrlfxf.exec:\5xrlfxf.exe90⤵PID:4204
-
\??\c:\7bbtbb.exec:\7bbtbb.exe91⤵PID:3384
-
\??\c:\vppjj.exec:\vppjj.exe92⤵PID:1336
-
\??\c:\jdjpj.exec:\jdjpj.exe93⤵PID:4820
-
\??\c:\7flfllr.exec:\7flfllr.exe94⤵PID:264
-
\??\c:\bhnhtn.exec:\bhnhtn.exe95⤵PID:2756
-
\??\c:\jdjjv.exec:\jdjjv.exe96⤵PID:4272
-
\??\c:\3ffrlrr.exec:\3ffrlrr.exe97⤵PID:1848
-
\??\c:\5hhnbh.exec:\5hhnbh.exe98⤵PID:4492
-
\??\c:\nbtnnn.exec:\nbtnnn.exe99⤵PID:1872
-
\??\c:\dvjdd.exec:\dvjdd.exe100⤵PID:4560
-
\??\c:\lfrlxxr.exec:\lfrlxxr.exe101⤵PID:1068
-
\??\c:\frxrflf.exec:\frxrflf.exe102⤵PID:3900
-
\??\c:\bttnhh.exec:\bttnhh.exe103⤵
- System Location Discovery: System Language Discovery
PID:2652 -
\??\c:\vdjdp.exec:\vdjdp.exe104⤵PID:4132
-
\??\c:\3dddd.exec:\3dddd.exe105⤵PID:2108
-
\??\c:\bthbtt.exec:\bthbtt.exe106⤵PID:3924
-
\??\c:\nbhtnh.exec:\nbhtnh.exe107⤵PID:5064
-
\??\c:\5dvvp.exec:\5dvvp.exe108⤵PID:4996
-
\??\c:\frfxrrl.exec:\frfxrrl.exe109⤵PID:4960
-
\??\c:\tbbttt.exec:\tbbttt.exe110⤵PID:1596
-
\??\c:\htbtnn.exec:\htbtnn.exe111⤵PID:4536
-
\??\c:\jvjdd.exec:\jvjdd.exe112⤵PID:1984
-
\??\c:\fxxrffr.exec:\fxxrffr.exe113⤵PID:4312
-
\??\c:\bbbtnn.exec:\bbbtnn.exe114⤵PID:4084
-
\??\c:\vdpjj.exec:\vdpjj.exe115⤵PID:1448
-
\??\c:\ddvpj.exec:\ddvpj.exe116⤵PID:4740
-
\??\c:\rxrlrrr.exec:\rxrlrrr.exe117⤵PID:1160
-
\??\c:\tthbbb.exec:\tthbbb.exe118⤵PID:1300
-
\??\c:\3pvpd.exec:\3pvpd.exe119⤵PID:3084
-
\??\c:\3xrlllf.exec:\3xrlllf.exe120⤵PID:1376
-
\??\c:\tttttt.exec:\tttttt.exe121⤵PID:4964
-
\??\c:\1djdv.exec:\1djdv.exe122⤵PID:2912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-