Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 05:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e8308558432c25fa37aeafcf90e573bfc358f6ba62a1f8204e064e5780ef31c1.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
e8308558432c25fa37aeafcf90e573bfc358f6ba62a1f8204e064e5780ef31c1.exe
-
Size
454KB
-
MD5
bcfe4c46c86c2b7c56b4bdb12d3631cf
-
SHA1
8624cdec18a12c3a287b2f27a76756caad07c00e
-
SHA256
e8308558432c25fa37aeafcf90e573bfc358f6ba62a1f8204e064e5780ef31c1
-
SHA512
41f7820bbc7ed992da26d0c932a74ccd4129eb83bb9b4293d0e34e2938615f64c0dd22268ed9a325602cae6608153e89d461a438b86fe4f0a443d9f12cb661d4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1L:q7Tc2NYHUrAwfMp3CD1L
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4816-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/428-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/364-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/804-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4140-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/528-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-811-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-864-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-1062-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-1096-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1684 5jpvp.exe 1424 pjjdv.exe 4860 5vppj.exe 4924 fxlxrrl.exe 404 vjjjd.exe 4396 7lrlrrf.exe 4432 nthbth.exe 1528 hnhbtt.exe 3480 djpjp.exe 3060 htbhhh.exe 3496 jdppp.exe 2428 vvvvp.exe 1932 xxlffff.exe 3916 nnbbnn.exe 4016 bbtntt.exe 4988 5hhbtb.exe 3572 jdddv.exe 4480 rflfxlr.exe 3700 vpvvp.exe 2932 rxfffll.exe 1708 vjjdv.exe 3824 lfrrllf.exe 4056 xfxxxxx.exe 5108 pjdpp.exe 3852 nbbttt.exe 4552 ffffxxr.exe 1608 dvpdv.exe 2364 frffxxf.exe 4636 nbbtnn.exe 3028 rlxrffl.exe 2224 pjpjp.exe 4824 xrrfxrf.exe 428 vjpjd.exe 364 nhhnnn.exe 4592 5frlxxr.exe 3444 nbhhbh.exe 2388 dpvjd.exe 4620 3fllfxr.exe 1072 xrrxlll.exe 4872 3tthbb.exe 4896 1djvj.exe 4500 xffxrrl.exe 3400 htnbtn.exe 2096 1jppj.exe 4124 frfffrr.exe 3424 3tnhbb.exe 1008 5ttnhh.exe 1660 ddvpp.exe 2828 jpddj.exe 1684 9rrfrrl.exe 668 1nthhb.exe 804 ppjdv.exe 1556 1flxlxx.exe 1144 5hbtnn.exe 2832 dvdvp.exe 4732 vpdvv.exe 2688 llrrxfr.exe 4432 3tbntt.exe 2296 jdpjd.exe 4952 vdddv.exe 4868 xlfffff.exe 5020 hbnnnh.exe 2056 flrfxlf.exe 1380 hbhbtt.exe -
resource yara_rule behavioral2/memory/4816-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/428-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/364-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/804-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4140-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/528-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-623-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4816 wrote to memory of 1684 4816 e8308558432c25fa37aeafcf90e573bfc358f6ba62a1f8204e064e5780ef31c1.exe 83 PID 4816 wrote to memory of 1684 4816 e8308558432c25fa37aeafcf90e573bfc358f6ba62a1f8204e064e5780ef31c1.exe 83 PID 4816 wrote to memory of 1684 4816 e8308558432c25fa37aeafcf90e573bfc358f6ba62a1f8204e064e5780ef31c1.exe 83 PID 1684 wrote to memory of 1424 1684 5jpvp.exe 84 PID 1684 wrote to memory of 1424 1684 5jpvp.exe 84 PID 1684 wrote to memory of 1424 1684 5jpvp.exe 84 PID 1424 wrote to memory of 4860 1424 pjjdv.exe 85 PID 1424 wrote to memory of 4860 1424 pjjdv.exe 85 PID 1424 wrote to memory of 4860 1424 pjjdv.exe 85 PID 4860 wrote to memory of 4924 4860 5vppj.exe 86 PID 4860 wrote to memory of 4924 4860 5vppj.exe 86 PID 4860 wrote to memory of 4924 4860 5vppj.exe 86 PID 4924 wrote to memory of 404 4924 fxlxrrl.exe 87 PID 4924 wrote to memory of 404 4924 fxlxrrl.exe 87 PID 4924 wrote to memory of 404 4924 fxlxrrl.exe 87 PID 404 wrote to memory of 4396 404 vjjjd.exe 88 PID 404 wrote to memory of 4396 404 vjjjd.exe 88 PID 404 wrote to memory of 4396 404 vjjjd.exe 88 PID 4396 wrote to memory of 4432 4396 7lrlrrf.exe 89 PID 4396 wrote to memory of 4432 4396 7lrlrrf.exe 89 PID 4396 wrote to memory of 4432 4396 7lrlrrf.exe 89 PID 4432 wrote to memory of 1528 4432 nthbth.exe 90 PID 4432 wrote to memory of 1528 4432 nthbth.exe 90 PID 4432 wrote to memory of 1528 4432 nthbth.exe 90 PID 1528 wrote to memory of 3480 1528 hnhbtt.exe 91 PID 1528 wrote to memory of 3480 1528 hnhbtt.exe 91 PID 1528 wrote to memory of 3480 1528 hnhbtt.exe 91 PID 3480 wrote to memory of 3060 3480 djpjp.exe 92 PID 3480 wrote to memory of 3060 3480 djpjp.exe 92 PID 3480 wrote to memory of 3060 3480 djpjp.exe 92 PID 3060 wrote to memory of 3496 3060 htbhhh.exe 93 PID 3060 wrote to memory of 3496 3060 htbhhh.exe 93 PID 3060 wrote to memory of 3496 3060 htbhhh.exe 93 PID 3496 wrote to memory of 2428 3496 jdppp.exe 94 PID 3496 wrote to memory of 2428 3496 jdppp.exe 94 PID 3496 wrote to memory of 2428 3496 jdppp.exe 94 PID 2428 wrote to memory of 1932 2428 vvvvp.exe 95 PID 2428 wrote to memory of 1932 2428 vvvvp.exe 95 PID 2428 wrote to memory of 1932 2428 vvvvp.exe 95 PID 1932 wrote to memory of 3916 1932 xxlffff.exe 96 PID 1932 wrote to memory of 3916 1932 xxlffff.exe 96 PID 1932 wrote to memory of 3916 1932 xxlffff.exe 96 PID 3916 wrote to memory of 4016 3916 nnbbnn.exe 97 PID 3916 wrote to memory of 4016 3916 nnbbnn.exe 97 PID 3916 wrote to memory of 4016 3916 nnbbnn.exe 97 PID 4016 wrote to memory of 4988 4016 bbtntt.exe 98 PID 4016 wrote to memory of 4988 4016 bbtntt.exe 98 PID 4016 wrote to memory of 4988 4016 bbtntt.exe 98 PID 4988 wrote to memory of 3572 4988 5hhbtb.exe 99 PID 4988 wrote to memory of 3572 4988 5hhbtb.exe 99 PID 4988 wrote to memory of 3572 4988 5hhbtb.exe 99 PID 3572 wrote to memory of 4480 3572 jdddv.exe 100 PID 3572 wrote to memory of 4480 3572 jdddv.exe 100 PID 3572 wrote to memory of 4480 3572 jdddv.exe 100 PID 4480 wrote to memory of 3700 4480 rflfxlr.exe 101 PID 4480 wrote to memory of 3700 4480 rflfxlr.exe 101 PID 4480 wrote to memory of 3700 4480 rflfxlr.exe 101 PID 3700 wrote to memory of 2932 3700 vpvvp.exe 102 PID 3700 wrote to memory of 2932 3700 vpvvp.exe 102 PID 3700 wrote to memory of 2932 3700 vpvvp.exe 102 PID 2932 wrote to memory of 1708 2932 rxfffll.exe 103 PID 2932 wrote to memory of 1708 2932 rxfffll.exe 103 PID 2932 wrote to memory of 1708 2932 rxfffll.exe 103 PID 1708 wrote to memory of 3824 1708 vjjdv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8308558432c25fa37aeafcf90e573bfc358f6ba62a1f8204e064e5780ef31c1.exe"C:\Users\Admin\AppData\Local\Temp\e8308558432c25fa37aeafcf90e573bfc358f6ba62a1f8204e064e5780ef31c1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\5jpvp.exec:\5jpvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\pjjdv.exec:\pjjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\5vppj.exec:\5vppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\fxlxrrl.exec:\fxlxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\vjjjd.exec:\vjjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\7lrlrrf.exec:\7lrlrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\nthbth.exec:\nthbth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\hnhbtt.exec:\hnhbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\djpjp.exec:\djpjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\htbhhh.exec:\htbhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\jdppp.exec:\jdppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\vvvvp.exec:\vvvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\xxlffff.exec:\xxlffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\nnbbnn.exec:\nnbbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\bbtntt.exec:\bbtntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\5hhbtb.exec:\5hhbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\jdddv.exec:\jdddv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\rflfxlr.exec:\rflfxlr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\vpvvp.exec:\vpvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\rxfffll.exec:\rxfffll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\vjjdv.exec:\vjjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\lfrrllf.exec:\lfrrllf.exe23⤵
- Executes dropped EXE
PID:3824 -
\??\c:\xfxxxxx.exec:\xfxxxxx.exe24⤵
- Executes dropped EXE
PID:4056 -
\??\c:\pjdpp.exec:\pjdpp.exe25⤵
- Executes dropped EXE
PID:5108 -
\??\c:\nbbttt.exec:\nbbttt.exe26⤵
- Executes dropped EXE
PID:3852 -
\??\c:\ffffxxr.exec:\ffffxxr.exe27⤵
- Executes dropped EXE
PID:4552 -
\??\c:\dvpdv.exec:\dvpdv.exe28⤵
- Executes dropped EXE
PID:1608 -
\??\c:\frffxxf.exec:\frffxxf.exe29⤵
- Executes dropped EXE
PID:2364 -
\??\c:\nbbtnn.exec:\nbbtnn.exe30⤵
- Executes dropped EXE
PID:4636 -
\??\c:\rlxrffl.exec:\rlxrffl.exe31⤵
- Executes dropped EXE
PID:3028 -
\??\c:\pjpjp.exec:\pjpjp.exe32⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xrrfxrf.exec:\xrrfxrf.exe33⤵
- Executes dropped EXE
PID:4824 -
\??\c:\vjpjd.exec:\vjpjd.exe34⤵
- Executes dropped EXE
PID:428 -
\??\c:\nhhnnn.exec:\nhhnnn.exe35⤵
- Executes dropped EXE
PID:364 -
\??\c:\5frlxxr.exec:\5frlxxr.exe36⤵
- Executes dropped EXE
PID:4592 -
\??\c:\nbhhbh.exec:\nbhhbh.exe37⤵
- Executes dropped EXE
PID:3444 -
\??\c:\dpvjd.exec:\dpvjd.exe38⤵
- Executes dropped EXE
PID:2388 -
\??\c:\3fllfxr.exec:\3fllfxr.exe39⤵
- Executes dropped EXE
PID:4620 -
\??\c:\xrrxlll.exec:\xrrxlll.exe40⤵
- Executes dropped EXE
PID:1072 -
\??\c:\3tthbb.exec:\3tthbb.exe41⤵
- Executes dropped EXE
PID:4872 -
\??\c:\1djvj.exec:\1djvj.exe42⤵
- Executes dropped EXE
PID:4896 -
\??\c:\xffxrrl.exec:\xffxrrl.exe43⤵
- Executes dropped EXE
PID:4500 -
\??\c:\htnbtn.exec:\htnbtn.exe44⤵
- Executes dropped EXE
PID:3400 -
\??\c:\1jppj.exec:\1jppj.exe45⤵
- Executes dropped EXE
PID:2096 -
\??\c:\frfffrr.exec:\frfffrr.exe46⤵
- Executes dropped EXE
PID:4124 -
\??\c:\3tnhbb.exec:\3tnhbb.exe47⤵
- Executes dropped EXE
PID:3424 -
\??\c:\5ttnhh.exec:\5ttnhh.exe48⤵
- Executes dropped EXE
PID:1008 -
\??\c:\ddvpp.exec:\ddvpp.exe49⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jpddj.exec:\jpddj.exe50⤵
- Executes dropped EXE
PID:2828 -
\??\c:\9rrfrrl.exec:\9rrfrrl.exe51⤵
- Executes dropped EXE
PID:1684 -
\??\c:\1nthhb.exec:\1nthhb.exe52⤵
- Executes dropped EXE
PID:668 -
\??\c:\ppjdv.exec:\ppjdv.exe53⤵
- Executes dropped EXE
PID:804 -
\??\c:\1flxlxx.exec:\1flxlxx.exe54⤵
- Executes dropped EXE
PID:1556 -
\??\c:\5hbtnn.exec:\5hbtnn.exe55⤵
- Executes dropped EXE
PID:1144 -
\??\c:\dvdvp.exec:\dvdvp.exe56⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vpdvv.exec:\vpdvv.exe57⤵
- Executes dropped EXE
PID:4732 -
\??\c:\llrrxfr.exec:\llrrxfr.exe58⤵
- Executes dropped EXE
PID:2688 -
\??\c:\3tbntt.exec:\3tbntt.exe59⤵
- Executes dropped EXE
PID:4432 -
\??\c:\jdpjd.exec:\jdpjd.exe60⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vdddv.exec:\vdddv.exe61⤵
- Executes dropped EXE
PID:4952 -
\??\c:\xlfffff.exec:\xlfffff.exe62⤵
- Executes dropped EXE
PID:4868 -
\??\c:\hbnnnh.exec:\hbnnnh.exe63⤵
- Executes dropped EXE
PID:5020 -
\??\c:\flrfxlf.exec:\flrfxlf.exe64⤵
- Executes dropped EXE
PID:2056 -
\??\c:\hbhbtt.exec:\hbhbtt.exe65⤵
- Executes dropped EXE
PID:1380 -
\??\c:\pdjjj.exec:\pdjjj.exe66⤵PID:2608
-
\??\c:\fxfffrl.exec:\fxfffrl.exe67⤵PID:1456
-
\??\c:\7tttnn.exec:\7tttnn.exe68⤵PID:4012
-
\??\c:\ntbnbb.exec:\ntbnbb.exe69⤵PID:4016
-
\??\c:\9jdvv.exec:\9jdvv.exe70⤵PID:3588
-
\??\c:\rrrlrlr.exec:\rrrlrlr.exe71⤵PID:2276
-
\??\c:\nbhbhh.exec:\nbhbhh.exe72⤵PID:2500
-
\??\c:\jjpjj.exec:\jjpjj.exe73⤵PID:4140
-
\??\c:\jvdpp.exec:\jvdpp.exe74⤵PID:1560
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe75⤵PID:4572
-
\??\c:\htthnh.exec:\htthnh.exe76⤵PID:2152
-
\??\c:\3jjdd.exec:\3jjdd.exe77⤵PID:3124
-
\??\c:\rffrrrr.exec:\rffrrrr.exe78⤵PID:4340
-
\??\c:\tnbbtt.exec:\tnbbtt.exe79⤵PID:508
-
\??\c:\nnbtnn.exec:\nnbtnn.exe80⤵PID:1584
-
\??\c:\jpvpj.exec:\jpvpj.exe81⤵PID:4056
-
\??\c:\llxxrrx.exec:\llxxrrx.exe82⤵PID:5048
-
\??\c:\3bbbtb.exec:\3bbbtb.exe83⤵PID:756
-
\??\c:\3vddj.exec:\3vddj.exe84⤵PID:3384
-
\??\c:\djpvv.exec:\djpvv.exe85⤵PID:4200
-
\??\c:\rfflflf.exec:\rfflflf.exe86⤵PID:1808
-
\??\c:\bnbbtt.exec:\bnbbtt.exe87⤵PID:528
-
\??\c:\jppjj.exec:\jppjj.exe88⤵PID:3336
-
\??\c:\lrrxfff.exec:\lrrxfff.exe89⤵PID:5008
-
\??\c:\bbhbbb.exec:\bbhbbb.exe90⤵PID:3048
-
\??\c:\tnnhbb.exec:\tnnhbb.exe91⤵PID:752
-
\??\c:\pvdvp.exec:\pvdvp.exe92⤵PID:3428
-
\??\c:\llfffrf.exec:\llfffrf.exe93⤵PID:4824
-
\??\c:\hhhhbb.exec:\hhhhbb.exe94⤵PID:4320
-
\??\c:\dvdvv.exec:\dvdvv.exe95⤵PID:4232
-
\??\c:\rlrlxlf.exec:\rlrlxlf.exe96⤵PID:1748
-
\??\c:\hbtnnh.exec:\hbtnnh.exe97⤵PID:3236
-
\??\c:\nhhhbh.exec:\nhhhbh.exe98⤵PID:4704
-
\??\c:\dvpvd.exec:\dvpvd.exe99⤵PID:4228
-
\??\c:\llrrflf.exec:\llrrflf.exe100⤵PID:2316
-
\??\c:\9thbbh.exec:\9thbbh.exe101⤵PID:5072
-
\??\c:\jjvvv.exec:\jjvvv.exe102⤵PID:3696
-
\??\c:\vvpjd.exec:\vvpjd.exe103⤵PID:4896
-
\??\c:\1xlfllr.exec:\1xlfllr.exe104⤵PID:4500
-
\??\c:\hbtnbt.exec:\hbtnbt.exe105⤵PID:3400
-
\??\c:\djddp.exec:\djddp.exe106⤵PID:2096
-
\??\c:\1rxrxxx.exec:\1rxrxxx.exe107⤵PID:4124
-
\??\c:\7nthbb.exec:\7nthbb.exe108⤵PID:380
-
\??\c:\jpvjp.exec:\jpvjp.exe109⤵PID:1008
-
\??\c:\fxrllrl.exec:\fxrllrl.exe110⤵PID:1660
-
\??\c:\hbbttt.exec:\hbbttt.exe111⤵PID:1836
-
\??\c:\jvddv.exec:\jvddv.exe112⤵PID:1684
-
\??\c:\xrrlxfr.exec:\xrrlxfr.exe113⤵PID:372
-
\??\c:\btbtnn.exec:\btbtnn.exe114⤵PID:4860
-
\??\c:\vddvp.exec:\vddvp.exe115⤵PID:4276
-
\??\c:\jdjjd.exec:\jdjjd.exe116⤵PID:2720
-
\??\c:\xrlfxrx.exec:\xrlfxrx.exe117⤵PID:3640
-
\??\c:\pvvpp.exec:\pvvpp.exe118⤵PID:3096
-
\??\c:\lxxfxff.exec:\lxxfxff.exe119⤵PID:2144
-
\??\c:\nnbttb.exec:\nnbttb.exe120⤵PID:4420
-
\??\c:\3nnnhh.exec:\3nnnhh.exe121⤵PID:1736
-
\??\c:\1dvvp.exec:\1dvvp.exe122⤵PID:3896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-