Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9ab181df770c57cf1fb78f78054677352b537320d9c6324e6e133c05e7797a5.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b9ab181df770c57cf1fb78f78054677352b537320d9c6324e6e133c05e7797a5.exe
-
Size
454KB
-
MD5
f0e48d61b80929d263140dda94d9e58f
-
SHA1
e7b89e7e192acff62ec5c00d46f29a6ef7b69dd2
-
SHA256
b9ab181df770c57cf1fb78f78054677352b537320d9c6324e6e133c05e7797a5
-
SHA512
e422713ac4fca89c7a938dbedab77279cbc352a582b106cb26d6166abbe7c2847451efa0cabac54bd3fba9718a3292566d3ba726cc73f4fc01d207bef49d3321
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE8:q7Tc2NYHUrAwfMp3CDE8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3996-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4248-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3752-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1412-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/800-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4248-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/684-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-768-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-784-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-824-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-978-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-1030-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-1177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-1233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4804 jpdjd.exe 1684 lfxxxxx.exe 4248 3lrlrrl.exe 5012 5bbbtt.exe 1548 7hhbbb.exe 4264 lrxrllf.exe 3716 1jpjd.exe 3752 5bhbtb.exe 1960 xfllxlf.exe 3212 nnnhhh.exe 3748 ddvpj.exe 1632 htnttt.exe 940 frrllxr.exe 3488 1nnnhn.exe 2040 7xxlxrl.exe 1372 tthbhb.exe 3112 ppvvv.exe 2172 fffxllr.exe 4316 nnbtth.exe 4516 xxxrffr.exe 1868 hhhbtt.exe 3292 jddvp.exe 2268 nntnbt.exe 4364 ddjjj.exe 4964 xrrrffx.exe 628 lrlrfrf.exe 2968 hhthhh.exe 2056 5rlfffx.exe 1896 ttnttt.exe 1988 djpdd.exe 3092 ffflrrr.exe 1088 vppjd.exe 1996 jdddv.exe 372 nhbtnn.exe 3736 dpvpd.exe 2960 xlfrlfx.exe 4276 3xfxxlx.exe 1412 tnnhtt.exe 3964 7jdvd.exe 1596 1dpdd.exe 2292 fflflfl.exe 3600 jdpdd.exe 4156 ppjdv.exe 3248 rlfxrrr.exe 4720 9bttnn.exe 1332 jjvpj.exe 4736 flxflff.exe 4748 9fxlxlr.exe 4196 bhhtnn.exe 2616 pjjdv.exe 4144 1lxrxxf.exe 4428 hbbtnn.exe 800 bnbnhh.exe 4804 flxxfxr.exe 1812 nhbbbb.exe 1684 5jdvv.exe 4248 5dvpp.exe 3036 xrrlrrl.exe 1052 1hbbhh.exe 1548 vvjpj.exe 5060 1vvvp.exe 684 7xxxrlf.exe 3716 tnbttt.exe 4044 9pvjp.exe -
resource yara_rule behavioral2/memory/3996-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1412-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/800-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/684-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-768-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3996 wrote to memory of 4804 3996 b9ab181df770c57cf1fb78f78054677352b537320d9c6324e6e133c05e7797a5.exe 82 PID 3996 wrote to memory of 4804 3996 b9ab181df770c57cf1fb78f78054677352b537320d9c6324e6e133c05e7797a5.exe 82 PID 3996 wrote to memory of 4804 3996 b9ab181df770c57cf1fb78f78054677352b537320d9c6324e6e133c05e7797a5.exe 82 PID 4804 wrote to memory of 1684 4804 jpdjd.exe 83 PID 4804 wrote to memory of 1684 4804 jpdjd.exe 83 PID 4804 wrote to memory of 1684 4804 jpdjd.exe 83 PID 1684 wrote to memory of 4248 1684 lfxxxxx.exe 84 PID 1684 wrote to memory of 4248 1684 lfxxxxx.exe 84 PID 1684 wrote to memory of 4248 1684 lfxxxxx.exe 84 PID 4248 wrote to memory of 5012 4248 3lrlrrl.exe 85 PID 4248 wrote to memory of 5012 4248 3lrlrrl.exe 85 PID 4248 wrote to memory of 5012 4248 3lrlrrl.exe 85 PID 5012 wrote to memory of 1548 5012 5bbbtt.exe 86 PID 5012 wrote to memory of 1548 5012 5bbbtt.exe 86 PID 5012 wrote to memory of 1548 5012 5bbbtt.exe 86 PID 1548 wrote to memory of 4264 1548 7hhbbb.exe 87 PID 1548 wrote to memory of 4264 1548 7hhbbb.exe 87 PID 1548 wrote to memory of 4264 1548 7hhbbb.exe 87 PID 4264 wrote to memory of 3716 4264 lrxrllf.exe 88 PID 4264 wrote to memory of 3716 4264 lrxrllf.exe 88 PID 4264 wrote to memory of 3716 4264 lrxrllf.exe 88 PID 3716 wrote to memory of 3752 3716 1jpjd.exe 89 PID 3716 wrote to memory of 3752 3716 1jpjd.exe 89 PID 3716 wrote to memory of 3752 3716 1jpjd.exe 89 PID 3752 wrote to memory of 1960 3752 5bhbtb.exe 90 PID 3752 wrote to memory of 1960 3752 5bhbtb.exe 90 PID 3752 wrote to memory of 1960 3752 5bhbtb.exe 90 PID 1960 wrote to memory of 3212 1960 xfllxlf.exe 91 PID 1960 wrote to memory of 3212 1960 xfllxlf.exe 91 PID 1960 wrote to memory of 3212 1960 xfllxlf.exe 91 PID 3212 wrote to memory of 3748 3212 nnnhhh.exe 92 PID 3212 wrote to memory of 3748 3212 nnnhhh.exe 92 PID 3212 wrote to memory of 3748 3212 nnnhhh.exe 92 PID 3748 wrote to memory of 1632 3748 ddvpj.exe 93 PID 3748 wrote to memory of 1632 3748 ddvpj.exe 93 PID 3748 wrote to memory of 1632 3748 ddvpj.exe 93 PID 1632 wrote to memory of 940 1632 htnttt.exe 94 PID 1632 wrote to memory of 940 1632 htnttt.exe 94 PID 1632 wrote to memory of 940 1632 htnttt.exe 94 PID 940 wrote to memory of 3488 940 frrllxr.exe 95 PID 940 wrote to memory of 3488 940 frrllxr.exe 95 PID 940 wrote to memory of 3488 940 frrllxr.exe 95 PID 3488 wrote to memory of 2040 3488 1nnnhn.exe 96 PID 3488 wrote to memory of 2040 3488 1nnnhn.exe 96 PID 3488 wrote to memory of 2040 3488 1nnnhn.exe 96 PID 2040 wrote to memory of 1372 2040 7xxlxrl.exe 97 PID 2040 wrote to memory of 1372 2040 7xxlxrl.exe 97 PID 2040 wrote to memory of 1372 2040 7xxlxrl.exe 97 PID 1372 wrote to memory of 3112 1372 tthbhb.exe 98 PID 1372 wrote to memory of 3112 1372 tthbhb.exe 98 PID 1372 wrote to memory of 3112 1372 tthbhb.exe 98 PID 3112 wrote to memory of 2172 3112 ppvvv.exe 99 PID 3112 wrote to memory of 2172 3112 ppvvv.exe 99 PID 3112 wrote to memory of 2172 3112 ppvvv.exe 99 PID 2172 wrote to memory of 4316 2172 fffxllr.exe 100 PID 2172 wrote to memory of 4316 2172 fffxllr.exe 100 PID 2172 wrote to memory of 4316 2172 fffxllr.exe 100 PID 4316 wrote to memory of 4516 4316 nnbtth.exe 101 PID 4316 wrote to memory of 4516 4316 nnbtth.exe 101 PID 4316 wrote to memory of 4516 4316 nnbtth.exe 101 PID 4516 wrote to memory of 1868 4516 xxxrffr.exe 102 PID 4516 wrote to memory of 1868 4516 xxxrffr.exe 102 PID 4516 wrote to memory of 1868 4516 xxxrffr.exe 102 PID 1868 wrote to memory of 3292 1868 hhhbtt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9ab181df770c57cf1fb78f78054677352b537320d9c6324e6e133c05e7797a5.exe"C:\Users\Admin\AppData\Local\Temp\b9ab181df770c57cf1fb78f78054677352b537320d9c6324e6e133c05e7797a5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\jpdjd.exec:\jpdjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\lfxxxxx.exec:\lfxxxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\3lrlrrl.exec:\3lrlrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\5bbbtt.exec:\5bbbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\7hhbbb.exec:\7hhbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\lrxrllf.exec:\lrxrllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\1jpjd.exec:\1jpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\5bhbtb.exec:\5bhbtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\xfllxlf.exec:\xfllxlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\nnnhhh.exec:\nnnhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\ddvpj.exec:\ddvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\htnttt.exec:\htnttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\frrllxr.exec:\frrllxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\1nnnhn.exec:\1nnnhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\7xxlxrl.exec:\7xxlxrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\tthbhb.exec:\tthbhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\ppvvv.exec:\ppvvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\fffxllr.exec:\fffxllr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\nnbtth.exec:\nnbtth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\xxxrffr.exec:\xxxrffr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\hhhbtt.exec:\hhhbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\jddvp.exec:\jddvp.exe23⤵
- Executes dropped EXE
PID:3292 -
\??\c:\nntnbt.exec:\nntnbt.exe24⤵
- Executes dropped EXE
PID:2268 -
\??\c:\ddjjj.exec:\ddjjj.exe25⤵
- Executes dropped EXE
PID:4364 -
\??\c:\xrrrffx.exec:\xrrrffx.exe26⤵
- Executes dropped EXE
PID:4964 -
\??\c:\lrlrfrf.exec:\lrlrfrf.exe27⤵
- Executes dropped EXE
PID:628 -
\??\c:\hhthhh.exec:\hhthhh.exe28⤵
- Executes dropped EXE
PID:2968 -
\??\c:\5rlfffx.exec:\5rlfffx.exe29⤵
- Executes dropped EXE
PID:2056 -
\??\c:\ttnttt.exec:\ttnttt.exe30⤵
- Executes dropped EXE
PID:1896 -
\??\c:\djpdd.exec:\djpdd.exe31⤵
- Executes dropped EXE
PID:1988 -
\??\c:\ffflrrr.exec:\ffflrrr.exe32⤵
- Executes dropped EXE
PID:3092 -
\??\c:\vppjd.exec:\vppjd.exe33⤵
- Executes dropped EXE
PID:1088 -
\??\c:\jdddv.exec:\jdddv.exe34⤵
- Executes dropped EXE
PID:1996 -
\??\c:\nhbtnn.exec:\nhbtnn.exe35⤵
- Executes dropped EXE
PID:372 -
\??\c:\dpvpd.exec:\dpvpd.exe36⤵
- Executes dropped EXE
PID:3736 -
\??\c:\xlfrlfx.exec:\xlfrlfx.exe37⤵
- Executes dropped EXE
PID:2960 -
\??\c:\3xfxxlx.exec:\3xfxxlx.exe38⤵
- Executes dropped EXE
PID:4276 -
\??\c:\tnnhtt.exec:\tnnhtt.exe39⤵
- Executes dropped EXE
PID:1412 -
\??\c:\7jdvd.exec:\7jdvd.exe40⤵
- Executes dropped EXE
PID:3964 -
\??\c:\1dpdd.exec:\1dpdd.exe41⤵
- Executes dropped EXE
PID:1596 -
\??\c:\fflflfl.exec:\fflflfl.exe42⤵
- Executes dropped EXE
PID:2292 -
\??\c:\jdpdd.exec:\jdpdd.exe43⤵
- Executes dropped EXE
PID:3600 -
\??\c:\ppjdv.exec:\ppjdv.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4156 -
\??\c:\rlfxrrr.exec:\rlfxrrr.exe45⤵
- Executes dropped EXE
PID:3248 -
\??\c:\9bttnn.exec:\9bttnn.exe46⤵
- Executes dropped EXE
PID:4720 -
\??\c:\jjvpj.exec:\jjvpj.exe47⤵
- Executes dropped EXE
PID:1332 -
\??\c:\flxflff.exec:\flxflff.exe48⤵
- Executes dropped EXE
PID:4736 -
\??\c:\9fxlxlr.exec:\9fxlxlr.exe49⤵
- Executes dropped EXE
PID:4748 -
\??\c:\bhhtnn.exec:\bhhtnn.exe50⤵
- Executes dropped EXE
PID:4196 -
\??\c:\pjjdv.exec:\pjjdv.exe51⤵
- Executes dropped EXE
PID:2616 -
\??\c:\1lxrxxf.exec:\1lxrxxf.exe52⤵
- Executes dropped EXE
PID:4144 -
\??\c:\hbbtnn.exec:\hbbtnn.exe53⤵
- Executes dropped EXE
PID:4428 -
\??\c:\bnbnhh.exec:\bnbnhh.exe54⤵
- Executes dropped EXE
PID:800 -
\??\c:\5pjdv.exec:\5pjdv.exe55⤵PID:4084
-
\??\c:\flxxfxr.exec:\flxxfxr.exe56⤵
- Executes dropped EXE
PID:4804 -
\??\c:\nhbbbb.exec:\nhbbbb.exe57⤵
- Executes dropped EXE
PID:1812 -
\??\c:\5jdvv.exec:\5jdvv.exe58⤵
- Executes dropped EXE
PID:1684 -
\??\c:\5dvpp.exec:\5dvpp.exe59⤵
- Executes dropped EXE
PID:4248 -
\??\c:\xrrlrrl.exec:\xrrlrrl.exe60⤵
- Executes dropped EXE
PID:3036 -
\??\c:\1hbbhh.exec:\1hbbhh.exe61⤵
- Executes dropped EXE
PID:1052 -
\??\c:\vvjpj.exec:\vvjpj.exe62⤵
- Executes dropped EXE
PID:1548 -
\??\c:\1vvvp.exec:\1vvvp.exe63⤵
- Executes dropped EXE
PID:5060 -
\??\c:\7xxxrlf.exec:\7xxxrlf.exe64⤵
- Executes dropped EXE
PID:684 -
\??\c:\tnbttt.exec:\tnbttt.exe65⤵
- Executes dropped EXE
PID:3716 -
\??\c:\9pvjp.exec:\9pvjp.exe66⤵
- Executes dropped EXE
PID:4044 -
\??\c:\lflffff.exec:\lflffff.exe67⤵PID:4172
-
\??\c:\lrllffr.exec:\lrllffr.exe68⤵PID:1960
-
\??\c:\htbttt.exec:\htbttt.exe69⤵PID:2364
-
\??\c:\ffrlxxx.exec:\ffrlxxx.exe70⤵PID:4536
-
\??\c:\hnbbbt.exec:\hnbbbt.exe71⤵PID:3748
-
\??\c:\bbnhth.exec:\bbnhth.exe72⤵PID:3724
-
\??\c:\3vvpj.exec:\3vvpj.exe73⤵PID:4360
-
\??\c:\pdjdv.exec:\pdjdv.exe74⤵PID:4616
-
\??\c:\xxrlrxx.exec:\xxrlrxx.exe75⤵PID:2472
-
\??\c:\tttbtt.exec:\tttbtt.exe76⤵PID:1992
-
\??\c:\7tbbhn.exec:\7tbbhn.exe77⤵PID:4548
-
\??\c:\3vdjd.exec:\3vdjd.exe78⤵PID:2212
-
\??\c:\rrrrlfx.exec:\rrrrlfx.exe79⤵PID:3112
-
\??\c:\hntnhh.exec:\hntnhh.exe80⤵
- System Location Discovery: System Language Discovery
PID:4352 -
\??\c:\1nhtnn.exec:\1nhtnn.exe81⤵PID:1284
-
\??\c:\vpddd.exec:\vpddd.exe82⤵PID:4180
-
\??\c:\5rrlfff.exec:\5rrlfff.exe83⤵PID:4528
-
\??\c:\hnnhbn.exec:\hnnhbn.exe84⤵
- System Location Discovery: System Language Discovery
PID:2992 -
\??\c:\vjjdv.exec:\vjjdv.exe85⤵PID:2700
-
\??\c:\rfffxxr.exec:\rfffxxr.exe86⤵PID:3316
-
\??\c:\lflfxxr.exec:\lflfxxr.exe87⤵PID:3660
-
\??\c:\tnnbbt.exec:\tnnbbt.exe88⤵PID:3216
-
\??\c:\ddddv.exec:\ddddv.exe89⤵PID:4844
-
\??\c:\vdvvp.exec:\vdvvp.exe90⤵PID:4964
-
\??\c:\5rlfxxr.exec:\5rlfxxr.exe91⤵PID:2176
-
\??\c:\ttbttn.exec:\ttbttn.exe92⤵PID:1792
-
\??\c:\3vpjv.exec:\3vpjv.exe93⤵PID:3944
-
\??\c:\frxrxrr.exec:\frxrxrr.exe94⤵PID:1644
-
\??\c:\tnhtnn.exec:\tnhtnn.exe95⤵PID:972
-
\??\c:\dvppp.exec:\dvppp.exe96⤵PID:4864
-
\??\c:\lrxlxlx.exec:\lrxlxlx.exe97⤵PID:2880
-
\??\c:\fflrrrr.exec:\fflrrrr.exe98⤵PID:2232
-
\??\c:\nnnnhh.exec:\nnnnhh.exe99⤵PID:2768
-
\??\c:\7dvvv.exec:\7dvvv.exe100⤵PID:1112
-
\??\c:\xrrlffx.exec:\xrrlffx.exe101⤵PID:1700
-
\??\c:\hhnhbb.exec:\hhnhbb.exe102⤵PID:4972
-
\??\c:\5pdpd.exec:\5pdpd.exe103⤵PID:4872
-
\??\c:\jjpjp.exec:\jjpjp.exe104⤵PID:2600
-
\??\c:\rfxrfxr.exec:\rfxrfxr.exe105⤵PID:948
-
\??\c:\bttnhh.exec:\bttnhh.exe106⤵PID:1900
-
\??\c:\dvvpj.exec:\dvvpj.exe107⤵PID:960
-
\??\c:\rrrrrrl.exec:\rrrrrrl.exe108⤵PID:4660
-
\??\c:\thbnnh.exec:\thbnnh.exe109⤵PID:3600
-
\??\c:\vpvvv.exec:\vpvvv.exe110⤵PID:2780
-
\??\c:\jdppp.exec:\jdppp.exe111⤵PID:3416
-
\??\c:\fxrfrlx.exec:\fxrfrlx.exe112⤵PID:2180
-
\??\c:\tththt.exec:\tththt.exe113⤵PID:3268
-
\??\c:\9vddp.exec:\9vddp.exe114⤵PID:4648
-
\??\c:\rlllfff.exec:\rlllfff.exe115⤵PID:3032
-
\??\c:\bntnhh.exec:\bntnhh.exe116⤵PID:4748
-
\??\c:\hthbhh.exec:\hthbhh.exe117⤵PID:3560
-
\??\c:\vdddv.exec:\vdddv.exe118⤵PID:2616
-
\??\c:\fllxxxr.exec:\fllxxxr.exe119⤵PID:1716
-
\??\c:\htbttt.exec:\htbttt.exe120⤵PID:5000
-
\??\c:\vpddd.exec:\vpddd.exe121⤵PID:5004
-
\??\c:\3djvj.exec:\3djvj.exe122⤵PID:2576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-