Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 04:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d7a136da2670cd89b0983ddb38196fb5f4c79cdcab36c1aab40552eab7835566.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
d7a136da2670cd89b0983ddb38196fb5f4c79cdcab36c1aab40552eab7835566.exe
-
Size
456KB
-
MD5
24350ba08163567ec63cd309c58e589d
-
SHA1
e9152a58dce4d2c24ee3b28761c8f98063dc0be4
-
SHA256
d7a136da2670cd89b0983ddb38196fb5f4c79cdcab36c1aab40552eab7835566
-
SHA512
e32bcb23d953be145151ffd06c79908aa778af1416d5152605509dfec977af64da2040704d15688e5e9be2975376d02a66133594fb997232a7041a09bce75f8b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeW:q7Tc2NYHUrAwfMp3CDW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1620-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/620-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/832-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1512-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/996-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1080-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/956-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/316-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-772-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-1035-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-1093-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-1271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-1407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2708 ttbtbb.exe 5016 pjjdv.exe 1632 xrxlfxl.exe 620 tbhhbb.exe 1480 thbtnn.exe 2676 jdpjp.exe 5064 dppjv.exe 2140 xflfxxr.exe 3864 frxrlff.exe 2476 hhtnhh.exe 832 jjvpj.exe 3956 hbttbh.exe 2656 rxrfxxl.exe 3624 pddvp.exe 2832 bhtnhh.exe 3672 hhnnhh.exe 944 frrllfx.exe 4512 lrrxrfl.exe 2924 pdjvp.exe 4528 pjdvp.exe 3252 tnhtnn.exe 2244 vpjdv.exe 4368 vpdvd.exe 1512 fflfrrf.exe 1984 7lrrllf.exe 4788 jvdvj.exe 5008 xffxxrl.exe 4896 nntttn.exe 4496 1ttbht.exe 996 jvjdp.exe 1400 nbhbnn.exe 1852 rrrrlll.exe 2876 xlffxlr.exe 2084 ttbtnn.exe 1484 jddvp.exe 208 lxfxrfx.exe 3160 xxfrxfl.exe 2720 nhntnb.exe 3208 vjpvj.exe 2484 frrlxxr.exe 3300 nbbtnn.exe 4892 pdvpj.exe 3744 djvvj.exe 2288 lxfxfxx.exe 5092 dpdvv.exe 4832 llfxrll.exe 1268 hbhbbb.exe 2768 jpdvp.exe 1080 xfxlxrf.exe 1688 nhhhnn.exe 956 jvjjp.exe 4940 xrrxrxx.exe 2004 1hnhbn.exe 1760 dddvv.exe 4200 lxxllxl.exe 100 llrrxfr.exe 1172 pjvpj.exe 2604 ttbbth.exe 2344 jpjdd.exe 3684 fflrrlr.exe 436 bbbbbb.exe 1288 nhnhbh.exe 2568 vdvpj.exe 3196 llrlllr.exe -
resource yara_rule behavioral2/memory/1620-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/620-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/620-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/832-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1512-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/996-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/956-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2604-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/316-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-1035-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxflrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfxff.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1620 wrote to memory of 2708 1620 d7a136da2670cd89b0983ddb38196fb5f4c79cdcab36c1aab40552eab7835566.exe 83 PID 1620 wrote to memory of 2708 1620 d7a136da2670cd89b0983ddb38196fb5f4c79cdcab36c1aab40552eab7835566.exe 83 PID 1620 wrote to memory of 2708 1620 d7a136da2670cd89b0983ddb38196fb5f4c79cdcab36c1aab40552eab7835566.exe 83 PID 2708 wrote to memory of 5016 2708 ttbtbb.exe 84 PID 2708 wrote to memory of 5016 2708 ttbtbb.exe 84 PID 2708 wrote to memory of 5016 2708 ttbtbb.exe 84 PID 5016 wrote to memory of 1632 5016 pjjdv.exe 85 PID 5016 wrote to memory of 1632 5016 pjjdv.exe 85 PID 5016 wrote to memory of 1632 5016 pjjdv.exe 85 PID 1632 wrote to memory of 620 1632 xrxlfxl.exe 86 PID 1632 wrote to memory of 620 1632 xrxlfxl.exe 86 PID 1632 wrote to memory of 620 1632 xrxlfxl.exe 86 PID 620 wrote to memory of 1480 620 tbhhbb.exe 87 PID 620 wrote to memory of 1480 620 tbhhbb.exe 87 PID 620 wrote to memory of 1480 620 tbhhbb.exe 87 PID 1480 wrote to memory of 2676 1480 thbtnn.exe 88 PID 1480 wrote to memory of 2676 1480 thbtnn.exe 88 PID 1480 wrote to memory of 2676 1480 thbtnn.exe 88 PID 2676 wrote to memory of 5064 2676 jdpjp.exe 89 PID 2676 wrote to memory of 5064 2676 jdpjp.exe 89 PID 2676 wrote to memory of 5064 2676 jdpjp.exe 89 PID 5064 wrote to memory of 2140 5064 dppjv.exe 90 PID 5064 wrote to memory of 2140 5064 dppjv.exe 90 PID 5064 wrote to memory of 2140 5064 dppjv.exe 90 PID 2140 wrote to memory of 3864 2140 xflfxxr.exe 91 PID 2140 wrote to memory of 3864 2140 xflfxxr.exe 91 PID 2140 wrote to memory of 3864 2140 xflfxxr.exe 91 PID 3864 wrote to memory of 2476 3864 frxrlff.exe 92 PID 3864 wrote to memory of 2476 3864 frxrlff.exe 92 PID 3864 wrote to memory of 2476 3864 frxrlff.exe 92 PID 2476 wrote to memory of 832 2476 hhtnhh.exe 93 PID 2476 wrote to memory of 832 2476 hhtnhh.exe 93 PID 2476 wrote to memory of 832 2476 hhtnhh.exe 93 PID 832 wrote to memory of 3956 832 jjvpj.exe 94 PID 832 wrote to memory of 3956 832 jjvpj.exe 94 PID 832 wrote to memory of 3956 832 jjvpj.exe 94 PID 3956 wrote to memory of 2656 3956 hbttbh.exe 95 PID 3956 wrote to memory of 2656 3956 hbttbh.exe 95 PID 3956 wrote to memory of 2656 3956 hbttbh.exe 95 PID 2656 wrote to memory of 3624 2656 rxrfxxl.exe 96 PID 2656 wrote to memory of 3624 2656 rxrfxxl.exe 96 PID 2656 wrote to memory of 3624 2656 rxrfxxl.exe 96 PID 3624 wrote to memory of 2832 3624 pddvp.exe 97 PID 3624 wrote to memory of 2832 3624 pddvp.exe 97 PID 3624 wrote to memory of 2832 3624 pddvp.exe 97 PID 2832 wrote to memory of 3672 2832 bhtnhh.exe 98 PID 2832 wrote to memory of 3672 2832 bhtnhh.exe 98 PID 2832 wrote to memory of 3672 2832 bhtnhh.exe 98 PID 3672 wrote to memory of 944 3672 hhnnhh.exe 99 PID 3672 wrote to memory of 944 3672 hhnnhh.exe 99 PID 3672 wrote to memory of 944 3672 hhnnhh.exe 99 PID 944 wrote to memory of 4512 944 frrllfx.exe 100 PID 944 wrote to memory of 4512 944 frrllfx.exe 100 PID 944 wrote to memory of 4512 944 frrllfx.exe 100 PID 4512 wrote to memory of 2924 4512 lrrxrfl.exe 101 PID 4512 wrote to memory of 2924 4512 lrrxrfl.exe 101 PID 4512 wrote to memory of 2924 4512 lrrxrfl.exe 101 PID 2924 wrote to memory of 4528 2924 pdjvp.exe 102 PID 2924 wrote to memory of 4528 2924 pdjvp.exe 102 PID 2924 wrote to memory of 4528 2924 pdjvp.exe 102 PID 4528 wrote to memory of 3252 4528 pjdvp.exe 103 PID 4528 wrote to memory of 3252 4528 pjdvp.exe 103 PID 4528 wrote to memory of 3252 4528 pjdvp.exe 103 PID 3252 wrote to memory of 2244 3252 tnhtnn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7a136da2670cd89b0983ddb38196fb5f4c79cdcab36c1aab40552eab7835566.exe"C:\Users\Admin\AppData\Local\Temp\d7a136da2670cd89b0983ddb38196fb5f4c79cdcab36c1aab40552eab7835566.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\ttbtbb.exec:\ttbtbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\pjjdv.exec:\pjjdv.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\xrxlfxl.exec:\xrxlfxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\tbhhbb.exec:\tbhhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\thbtnn.exec:\thbtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\jdpjp.exec:\jdpjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\dppjv.exec:\dppjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\xflfxxr.exec:\xflfxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\frxrlff.exec:\frxrlff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\hhtnhh.exec:\hhtnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\jjvpj.exec:\jjvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\hbttbh.exec:\hbttbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\rxrfxxl.exec:\rxrfxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\pddvp.exec:\pddvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\bhtnhh.exec:\bhtnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\hhnnhh.exec:\hhnnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\frrllfx.exec:\frrllfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\lrrxrfl.exec:\lrrxrfl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\pdjvp.exec:\pdjvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\pjdvp.exec:\pjdvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\tnhtnn.exec:\tnhtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\vpjdv.exec:\vpjdv.exe23⤵
- Executes dropped EXE
PID:2244 -
\??\c:\vpdvd.exec:\vpdvd.exe24⤵
- Executes dropped EXE
PID:4368 -
\??\c:\fflfrrf.exec:\fflfrrf.exe25⤵
- Executes dropped EXE
PID:1512 -
\??\c:\7lrrllf.exec:\7lrrllf.exe26⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jvdvj.exec:\jvdvj.exe27⤵
- Executes dropped EXE
PID:4788 -
\??\c:\xffxxrl.exec:\xffxxrl.exe28⤵
- Executes dropped EXE
PID:5008 -
\??\c:\nntttn.exec:\nntttn.exe29⤵
- Executes dropped EXE
PID:4896 -
\??\c:\1ttbht.exec:\1ttbht.exe30⤵
- Executes dropped EXE
PID:4496 -
\??\c:\jvjdp.exec:\jvjdp.exe31⤵
- Executes dropped EXE
PID:996 -
\??\c:\nbhbnn.exec:\nbhbnn.exe32⤵
- Executes dropped EXE
PID:1400 -
\??\c:\rrrrlll.exec:\rrrrlll.exe33⤵
- Executes dropped EXE
PID:1852 -
\??\c:\xlffxlr.exec:\xlffxlr.exe34⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ttbtnn.exec:\ttbtnn.exe35⤵
- Executes dropped EXE
PID:2084 -
\??\c:\jddvp.exec:\jddvp.exe36⤵
- Executes dropped EXE
PID:1484 -
\??\c:\lxfxrfx.exec:\lxfxrfx.exe37⤵
- Executes dropped EXE
PID:208 -
\??\c:\xxfrxfl.exec:\xxfrxfl.exe38⤵
- Executes dropped EXE
PID:3160 -
\??\c:\nhntnb.exec:\nhntnb.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\vjpvj.exec:\vjpvj.exe40⤵
- Executes dropped EXE
PID:3208 -
\??\c:\frrlxxr.exec:\frrlxxr.exe41⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nbbtnn.exec:\nbbtnn.exe42⤵
- Executes dropped EXE
PID:3300 -
\??\c:\pdvpj.exec:\pdvpj.exe43⤵
- Executes dropped EXE
PID:4892 -
\??\c:\djvvj.exec:\djvvj.exe44⤵
- Executes dropped EXE
PID:3744 -
\??\c:\lxfxfxx.exec:\lxfxfxx.exe45⤵
- Executes dropped EXE
PID:2288 -
\??\c:\dpdvv.exec:\dpdvv.exe46⤵
- Executes dropped EXE
PID:5092 -
\??\c:\llfxrll.exec:\llfxrll.exe47⤵
- Executes dropped EXE
PID:4832 -
\??\c:\hbhbbb.exec:\hbhbbb.exe48⤵
- Executes dropped EXE
PID:1268 -
\??\c:\jpdvp.exec:\jpdvp.exe49⤵
- Executes dropped EXE
PID:2768 -
\??\c:\xfxlxrf.exec:\xfxlxrf.exe50⤵
- Executes dropped EXE
PID:1080 -
\??\c:\nhhhnn.exec:\nhhhnn.exe51⤵
- Executes dropped EXE
PID:1688 -
\??\c:\jvjjp.exec:\jvjjp.exe52⤵
- Executes dropped EXE
PID:956 -
\??\c:\xrrxrxx.exec:\xrrxrxx.exe53⤵
- Executes dropped EXE
PID:4940 -
\??\c:\1hnhbn.exec:\1hnhbn.exe54⤵
- Executes dropped EXE
PID:2004 -
\??\c:\dddvv.exec:\dddvv.exe55⤵
- Executes dropped EXE
PID:1760 -
\??\c:\lxxllxl.exec:\lxxllxl.exe56⤵
- Executes dropped EXE
PID:4200 -
\??\c:\llrrxfr.exec:\llrrxfr.exe57⤵
- Executes dropped EXE
PID:100 -
\??\c:\pjvpj.exec:\pjvpj.exe58⤵
- Executes dropped EXE
PID:1172 -
\??\c:\ttbbth.exec:\ttbbth.exe59⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jpjdd.exec:\jpjdd.exe60⤵
- Executes dropped EXE
PID:2344 -
\??\c:\fflrrlr.exec:\fflrrlr.exe61⤵
- Executes dropped EXE
PID:3684 -
\??\c:\bbbbbb.exec:\bbbbbb.exe62⤵
- Executes dropped EXE
PID:436 -
\??\c:\nhnhbh.exec:\nhnhbh.exe63⤵
- Executes dropped EXE
PID:1288 -
\??\c:\vdvpj.exec:\vdvpj.exe64⤵
- Executes dropped EXE
PID:2568 -
\??\c:\llrlllr.exec:\llrlllr.exe65⤵
- Executes dropped EXE
PID:3196 -
\??\c:\bbttbt.exec:\bbttbt.exe66⤵PID:832
-
\??\c:\nntnnn.exec:\nntnnn.exe67⤵PID:2260
-
\??\c:\vdddj.exec:\vdddj.exe68⤵PID:2740
-
\??\c:\lrxrxfr.exec:\lrxrxfr.exe69⤵PID:2284
-
\??\c:\bhnhbb.exec:\bhnhbb.exe70⤵PID:3960
-
\??\c:\ppdpp.exec:\ppdpp.exe71⤵PID:2948
-
\??\c:\ddvvv.exec:\ddvvv.exe72⤵PID:316
-
\??\c:\rllffff.exec:\rllffff.exe73⤵PID:4644
-
\??\c:\bnthbn.exec:\bnthbn.exe74⤵PID:4272
-
\??\c:\5ddvv.exec:\5ddvv.exe75⤵PID:4104
-
\??\c:\lxxrllf.exec:\lxxrllf.exe76⤵PID:680
-
\??\c:\tnbbbh.exec:\tnbbbh.exe77⤵PID:1936
-
\??\c:\vjpdd.exec:\vjpdd.exe78⤵PID:3084
-
\??\c:\vpddv.exec:\vpddv.exe79⤵PID:2112
-
\??\c:\xffxxlf.exec:\xffxxlf.exe80⤵PID:4528
-
\??\c:\nnnhnt.exec:\nnnhnt.exe81⤵PID:2340
-
\??\c:\xrrxxxf.exec:\xrrxxxf.exe82⤵PID:532
-
\??\c:\rlrffxr.exec:\rlrffxr.exe83⤵PID:1988
-
\??\c:\3tbnhh.exec:\3tbnhh.exe84⤵PID:5012
-
\??\c:\pjjjp.exec:\pjjjp.exe85⤵
- System Location Discovery: System Language Discovery
PID:940 -
\??\c:\rrxrlff.exec:\rrxrlff.exe86⤵PID:4524
-
\??\c:\1tnhbb.exec:\1tnhbb.exe87⤵PID:3648
-
\??\c:\vvdvj.exec:\vvdvj.exe88⤵PID:2236
-
\??\c:\rllxlrx.exec:\rllxlrx.exe89⤵PID:4460
-
\??\c:\llrlfxx.exec:\llrlfxx.exe90⤵PID:3788
-
\??\c:\nnnhhh.exec:\nnnhhh.exe91⤵PID:2756
-
\??\c:\jdddj.exec:\jdddj.exe92⤵PID:4276
-
\??\c:\rfrxxrl.exec:\rfrxxrl.exe93⤵PID:2688
-
\??\c:\hbhbtb.exec:\hbhbtb.exe94⤵PID:2796
-
\??\c:\jvvvp.exec:\jvvvp.exe95⤵PID:4360
-
\??\c:\9rrlflf.exec:\9rrlflf.exe96⤵PID:1852
-
\??\c:\ntnhhh.exec:\ntnhhh.exe97⤵PID:2876
-
\??\c:\9vvpv.exec:\9vvpv.exe98⤵PID:4380
-
\??\c:\7lrrrrr.exec:\7lrrrrr.exe99⤵PID:4816
-
\??\c:\thbthh.exec:\thbthh.exe100⤵PID:208
-
\??\c:\hhhbbb.exec:\hhhbbb.exe101⤵PID:860
-
\??\c:\vdjvp.exec:\vdjvp.exe102⤵PID:4636
-
\??\c:\flrllll.exec:\flrllll.exe103⤵PID:2492
-
\??\c:\djvvd.exec:\djvvd.exe104⤵PID:2204
-
\??\c:\jpvpp.exec:\jpvpp.exe105⤵PID:4620
-
\??\c:\bhhhbh.exec:\bhhhbh.exe106⤵PID:2224
-
\??\c:\tnttnn.exec:\tnttnn.exe107⤵PID:3916
-
\??\c:\dvvpp.exec:\dvvpp.exe108⤵PID:4388
-
\??\c:\lrlrrrr.exec:\lrlrrrr.exe109⤵PID:3004
-
\??\c:\hhhbbb.exec:\hhhbbb.exe110⤵PID:3240
-
\??\c:\hhtbbb.exec:\hhtbbb.exe111⤵PID:2432
-
\??\c:\vpddj.exec:\vpddj.exe112⤵PID:4492
-
\??\c:\xrrflrl.exec:\xrrflrl.exe113⤵PID:4332
-
\??\c:\bntbtt.exec:\bntbtt.exe114⤵PID:4308
-
\??\c:\1ppvp.exec:\1ppvp.exe115⤵PID:1620
-
\??\c:\7frllrl.exec:\7frllrl.exe116⤵PID:956
-
\??\c:\hbhbbb.exec:\hbhbbb.exe117⤵PID:1148
-
\??\c:\tnnnnn.exec:\tnnnnn.exe118⤵PID:2040
-
\??\c:\pjpjj.exec:\pjpjj.exe119⤵PID:4348
-
\??\c:\5lxxrlr.exec:\5lxxrlr.exe120⤵PID:620
-
\??\c:\hbbbtb.exec:\hbbbtb.exe121⤵PID:2248
-
\??\c:\vdpjj.exec:\vdpjj.exe122⤵PID:1172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-