Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2025, 09:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8eed249cfb7093b869805dc0e6c6eb1290c16631ae41440cdc1dae123ced76bc.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
8eed249cfb7093b869805dc0e6c6eb1290c16631ae41440cdc1dae123ced76bc.exe
-
Size
455KB
-
MD5
3a6445c088f2d5d87925f640cb99bb12
-
SHA1
a7c56bab2d798e279bc3a8a72c0e62e1cb1de473
-
SHA256
8eed249cfb7093b869805dc0e6c6eb1290c16631ae41440cdc1dae123ced76bc
-
SHA512
a5028434e5b07b6e85bfc6d71135f19a691279b8223b1bce97f6e7b6f6663cab2a43fcdda54d2baa776245cbbcd9ab1afdb7b269389717be82f3a899636b0d3c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeq:q7Tc2NYHUrAwfMp3CDq
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1940-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/980-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4248-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1296-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2836-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/668-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-706-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-761-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/840-957-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1856-1204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-1386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4632 vvvjp.exe 4844 nhhhbh.exe 2268 xrfffff.exe 4232 pjpdp.exe 5076 rrxxffr.exe 3840 tthtbt.exe 2832 3jpvj.exe 980 bthbtn.exe 1860 nnbttt.exe 2168 9jjdv.exe 4644 lxflxrl.exe 2908 ddvpj.exe 2380 dpdvv.exe 2776 rllfxfx.exe 3156 httnhh.exe 3964 thtthh.exe 4148 ddjjv.exe 3556 jjjdv.exe 4396 thttnt.exe 4588 9xrxxxx.exe 1496 jvvvd.exe 4804 dvpdp.exe 3248 bttbtt.exe 4612 pjpjd.exe 4136 vjddv.exe 4792 thnnnn.exe 3744 vpjjd.exe 1460 ddjjp.exe 4952 nthbnh.exe 3860 xllxxll.exe 1620 1jpjd.exe 940 djjdv.exe 3112 jdvpp.exe 4832 dvppv.exe 456 hbnhbn.exe 2012 ppvvv.exe 1712 rllffxx.exe 2304 vdjdp.exe 4248 rlffxxl.exe 1996 bhbthh.exe 1576 jvpvp.exe 2256 lffxrll.exe 5028 nnnhbb.exe 4864 pjjpj.exe 2184 lxlxlrf.exe 2696 hhbnbb.exe 2940 7pvpj.exe 4380 xrrrllf.exe 4824 ppjjv.exe 1828 xrxrlrr.exe 4632 tbhhhn.exe 1664 jvvvd.exe 4844 llfffff.exe 748 nntbhb.exe 4800 vdpvd.exe 1260 ppvvp.exe 3660 rrffxlr.exe 4716 7bhhbb.exe 4744 5pvpp.exe 4144 rrrllrl.exe 1296 1hbbbh.exe 1456 pdjdv.exe 2876 ppvvd.exe 4060 xrlxflx.exe -
resource yara_rule behavioral2/memory/1940-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/980-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1712-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1296-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/668-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/840-957-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1856-1204-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrlrr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1940 wrote to memory of 4632 1940 8eed249cfb7093b869805dc0e6c6eb1290c16631ae41440cdc1dae123ced76bc.exe 83 PID 1940 wrote to memory of 4632 1940 8eed249cfb7093b869805dc0e6c6eb1290c16631ae41440cdc1dae123ced76bc.exe 83 PID 1940 wrote to memory of 4632 1940 8eed249cfb7093b869805dc0e6c6eb1290c16631ae41440cdc1dae123ced76bc.exe 83 PID 4632 wrote to memory of 4844 4632 vvvjp.exe 84 PID 4632 wrote to memory of 4844 4632 vvvjp.exe 84 PID 4632 wrote to memory of 4844 4632 vvvjp.exe 84 PID 4844 wrote to memory of 2268 4844 nhhhbh.exe 85 PID 4844 wrote to memory of 2268 4844 nhhhbh.exe 85 PID 4844 wrote to memory of 2268 4844 nhhhbh.exe 85 PID 2268 wrote to memory of 4232 2268 xrfffff.exe 86 PID 2268 wrote to memory of 4232 2268 xrfffff.exe 86 PID 2268 wrote to memory of 4232 2268 xrfffff.exe 86 PID 4232 wrote to memory of 5076 4232 pjpdp.exe 87 PID 4232 wrote to memory of 5076 4232 pjpdp.exe 87 PID 4232 wrote to memory of 5076 4232 pjpdp.exe 87 PID 5076 wrote to memory of 3840 5076 rrxxffr.exe 88 PID 5076 wrote to memory of 3840 5076 rrxxffr.exe 88 PID 5076 wrote to memory of 3840 5076 rrxxffr.exe 88 PID 3840 wrote to memory of 2832 3840 tthtbt.exe 89 PID 3840 wrote to memory of 2832 3840 tthtbt.exe 89 PID 3840 wrote to memory of 2832 3840 tthtbt.exe 89 PID 2832 wrote to memory of 980 2832 3jpvj.exe 90 PID 2832 wrote to memory of 980 2832 3jpvj.exe 90 PID 2832 wrote to memory of 980 2832 3jpvj.exe 90 PID 980 wrote to memory of 1860 980 bthbtn.exe 91 PID 980 wrote to memory of 1860 980 bthbtn.exe 91 PID 980 wrote to memory of 1860 980 bthbtn.exe 91 PID 1860 wrote to memory of 2168 1860 nnbttt.exe 92 PID 1860 wrote to memory of 2168 1860 nnbttt.exe 92 PID 1860 wrote to memory of 2168 1860 nnbttt.exe 92 PID 2168 wrote to memory of 4644 2168 9jjdv.exe 93 PID 2168 wrote to memory of 4644 2168 9jjdv.exe 93 PID 2168 wrote to memory of 4644 2168 9jjdv.exe 93 PID 4644 wrote to memory of 2908 4644 lxflxrl.exe 94 PID 4644 wrote to memory of 2908 4644 lxflxrl.exe 94 PID 4644 wrote to memory of 2908 4644 lxflxrl.exe 94 PID 2908 wrote to memory of 2380 2908 ddvpj.exe 95 PID 2908 wrote to memory of 2380 2908 ddvpj.exe 95 PID 2908 wrote to memory of 2380 2908 ddvpj.exe 95 PID 2380 wrote to memory of 2776 2380 dpdvv.exe 96 PID 2380 wrote to memory of 2776 2380 dpdvv.exe 96 PID 2380 wrote to memory of 2776 2380 dpdvv.exe 96 PID 2776 wrote to memory of 3156 2776 rllfxfx.exe 97 PID 2776 wrote to memory of 3156 2776 rllfxfx.exe 97 PID 2776 wrote to memory of 3156 2776 rllfxfx.exe 97 PID 3156 wrote to memory of 3964 3156 httnhh.exe 98 PID 3156 wrote to memory of 3964 3156 httnhh.exe 98 PID 3156 wrote to memory of 3964 3156 httnhh.exe 98 PID 3964 wrote to memory of 4148 3964 thtthh.exe 99 PID 3964 wrote to memory of 4148 3964 thtthh.exe 99 PID 3964 wrote to memory of 4148 3964 thtthh.exe 99 PID 4148 wrote to memory of 3556 4148 ddjjv.exe 100 PID 4148 wrote to memory of 3556 4148 ddjjv.exe 100 PID 4148 wrote to memory of 3556 4148 ddjjv.exe 100 PID 3556 wrote to memory of 4396 3556 jjjdv.exe 101 PID 3556 wrote to memory of 4396 3556 jjjdv.exe 101 PID 3556 wrote to memory of 4396 3556 jjjdv.exe 101 PID 4396 wrote to memory of 4588 4396 thttnt.exe 102 PID 4396 wrote to memory of 4588 4396 thttnt.exe 102 PID 4396 wrote to memory of 4588 4396 thttnt.exe 102 PID 4588 wrote to memory of 1496 4588 9xrxxxx.exe 103 PID 4588 wrote to memory of 1496 4588 9xrxxxx.exe 103 PID 4588 wrote to memory of 1496 4588 9xrxxxx.exe 103 PID 1496 wrote to memory of 4804 1496 jvvvd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\8eed249cfb7093b869805dc0e6c6eb1290c16631ae41440cdc1dae123ced76bc.exe"C:\Users\Admin\AppData\Local\Temp\8eed249cfb7093b869805dc0e6c6eb1290c16631ae41440cdc1dae123ced76bc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\vvvjp.exec:\vvvjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\nhhhbh.exec:\nhhhbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\xrfffff.exec:\xrfffff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\pjpdp.exec:\pjpdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\rrxxffr.exec:\rrxxffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\tthtbt.exec:\tthtbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\3jpvj.exec:\3jpvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\bthbtn.exec:\bthbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\nnbttt.exec:\nnbttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\9jjdv.exec:\9jjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\lxflxrl.exec:\lxflxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\ddvpj.exec:\ddvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\dpdvv.exec:\dpdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\rllfxfx.exec:\rllfxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\httnhh.exec:\httnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\thtthh.exec:\thtthh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\ddjjv.exec:\ddjjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\jjjdv.exec:\jjjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\thttnt.exec:\thttnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\9xrxxxx.exec:\9xrxxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\jvvvd.exec:\jvvvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\dvpdp.exec:\dvpdp.exe23⤵
- Executes dropped EXE
PID:4804 -
\??\c:\bttbtt.exec:\bttbtt.exe24⤵
- Executes dropped EXE
PID:3248 -
\??\c:\pjpjd.exec:\pjpjd.exe25⤵
- Executes dropped EXE
PID:4612 -
\??\c:\vjddv.exec:\vjddv.exe26⤵
- Executes dropped EXE
PID:4136 -
\??\c:\thnnnn.exec:\thnnnn.exe27⤵
- Executes dropped EXE
PID:4792 -
\??\c:\vpjjd.exec:\vpjjd.exe28⤵
- Executes dropped EXE
PID:3744 -
\??\c:\ddjjp.exec:\ddjjp.exe29⤵
- Executes dropped EXE
PID:1460 -
\??\c:\nthbnh.exec:\nthbnh.exe30⤵
- Executes dropped EXE
PID:4952 -
\??\c:\xllxxll.exec:\xllxxll.exe31⤵
- Executes dropped EXE
PID:3860 -
\??\c:\1jpjd.exec:\1jpjd.exe32⤵
- Executes dropped EXE
PID:1620 -
\??\c:\djjdv.exec:\djjdv.exe33⤵
- Executes dropped EXE
PID:940 -
\??\c:\jdvpp.exec:\jdvpp.exe34⤵
- Executes dropped EXE
PID:3112 -
\??\c:\dvppv.exec:\dvppv.exe35⤵
- Executes dropped EXE
PID:4832 -
\??\c:\hbnhbn.exec:\hbnhbn.exe36⤵
- Executes dropped EXE
PID:456 -
\??\c:\ppvvv.exec:\ppvvv.exe37⤵
- Executes dropped EXE
PID:2012 -
\??\c:\rllffxx.exec:\rllffxx.exe38⤵
- Executes dropped EXE
PID:1712 -
\??\c:\vdjdp.exec:\vdjdp.exe39⤵
- Executes dropped EXE
PID:2304 -
\??\c:\rlffxxl.exec:\rlffxxl.exe40⤵
- Executes dropped EXE
PID:4248 -
\??\c:\bhbthh.exec:\bhbthh.exe41⤵
- Executes dropped EXE
PID:1996 -
\??\c:\jvpvp.exec:\jvpvp.exe42⤵
- Executes dropped EXE
PID:1576 -
\??\c:\lffxrll.exec:\lffxrll.exe43⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nnnhbb.exec:\nnnhbb.exe44⤵
- Executes dropped EXE
PID:5028 -
\??\c:\pjjpj.exec:\pjjpj.exe45⤵
- Executes dropped EXE
PID:4864 -
\??\c:\lxlxlrf.exec:\lxlxlrf.exe46⤵
- Executes dropped EXE
PID:2184 -
\??\c:\hhbnbb.exec:\hhbnbb.exe47⤵
- Executes dropped EXE
PID:2696 -
\??\c:\7pvpj.exec:\7pvpj.exe48⤵
- Executes dropped EXE
PID:2940 -
\??\c:\xrrrllf.exec:\xrrrllf.exe49⤵
- Executes dropped EXE
PID:4380 -
\??\c:\ppjjv.exec:\ppjjv.exe50⤵
- Executes dropped EXE
PID:4824 -
\??\c:\xrxrlrr.exec:\xrxrlrr.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1828 -
\??\c:\tbhhhn.exec:\tbhhhn.exe52⤵
- Executes dropped EXE
PID:4632 -
\??\c:\jvvvd.exec:\jvvvd.exe53⤵
- Executes dropped EXE
PID:1664 -
\??\c:\llfffff.exec:\llfffff.exe54⤵
- Executes dropped EXE
PID:4844 -
\??\c:\nntbhb.exec:\nntbhb.exe55⤵
- Executes dropped EXE
PID:748 -
\??\c:\vdpvd.exec:\vdpvd.exe56⤵
- Executes dropped EXE
PID:4800 -
\??\c:\ppvvp.exec:\ppvvp.exe57⤵
- Executes dropped EXE
PID:1260 -
\??\c:\rrffxlr.exec:\rrffxlr.exe58⤵
- Executes dropped EXE
PID:3660 -
\??\c:\7bhhbb.exec:\7bhhbb.exe59⤵
- Executes dropped EXE
PID:4716 -
\??\c:\5pvpp.exec:\5pvpp.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4744 -
\??\c:\rrrllrl.exec:\rrrllrl.exe61⤵
- Executes dropped EXE
PID:4144 -
\??\c:\1hbbbh.exec:\1hbbbh.exe62⤵
- Executes dropped EXE
PID:1296 -
\??\c:\pdjdv.exec:\pdjdv.exe63⤵
- Executes dropped EXE
PID:1456 -
\??\c:\ppvvd.exec:\ppvvd.exe64⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xrlxflx.exec:\xrlxflx.exe65⤵
- Executes dropped EXE
PID:4060 -
\??\c:\hbbbtb.exec:\hbbbtb.exe66⤵PID:4296
-
\??\c:\tbhbbb.exec:\tbhbbb.exe67⤵PID:4712
-
\??\c:\pjppp.exec:\pjppp.exe68⤵PID:2420
-
\??\c:\tnnhnh.exec:\tnnhnh.exe69⤵PID:2592
-
\??\c:\7htnbh.exec:\7htnbh.exe70⤵PID:1668
-
\??\c:\vpppp.exec:\vpppp.exe71⤵PID:432
-
\??\c:\3frrlrr.exec:\3frrlrr.exe72⤵PID:732
-
\??\c:\llfffrx.exec:\llfffrx.exe73⤵PID:4788
-
\??\c:\hhhhbh.exec:\hhhhbh.exe74⤵PID:3964
-
\??\c:\3vdvp.exec:\3vdvp.exe75⤵PID:4148
-
\??\c:\rrllrrr.exec:\rrllrrr.exe76⤵PID:3368
-
\??\c:\5hhhbh.exec:\5hhhbh.exe77⤵PID:4140
-
\??\c:\pvppj.exec:\pvppj.exe78⤵PID:3580
-
\??\c:\vpvpv.exec:\vpvpv.exe79⤵PID:2324
-
\??\c:\ffrfrfr.exec:\ffrfrfr.exe80⤵PID:4480
-
\??\c:\hbbbbn.exec:\hbbbbn.exe81⤵PID:5088
-
\??\c:\bbbbbh.exec:\bbbbbh.exe82⤵PID:1552
-
\??\c:\ppjjp.exec:\ppjjp.exe83⤵PID:2852
-
\??\c:\rlxrlll.exec:\rlxrlll.exe84⤵PID:860
-
\??\c:\nbnnhh.exec:\nbnnhh.exe85⤵PID:2936
-
\??\c:\jpvdd.exec:\jpvdd.exe86⤵PID:2288
-
\??\c:\xllllll.exec:\xllllll.exe87⤵PID:400
-
\??\c:\fxxxxxf.exec:\fxxxxxf.exe88⤵PID:2836
-
\??\c:\bbbbbh.exec:\bbbbbh.exe89⤵PID:5072
-
\??\c:\jppjd.exec:\jppjd.exe90⤵PID:5080
-
\??\c:\rxlfffx.exec:\rxlfffx.exe91⤵PID:2548
-
\??\c:\ttbbbh.exec:\ttbbbh.exe92⤵PID:4704
-
\??\c:\vpvdd.exec:\vpvdd.exe93⤵PID:3900
-
\??\c:\xlxxxxx.exec:\xlxxxxx.exe94⤵PID:1480
-
\??\c:\ntbbbb.exec:\ntbbbb.exe95⤵PID:1820
-
\??\c:\jdvpd.exec:\jdvpd.exe96⤵PID:1776
-
\??\c:\7pjjd.exec:\7pjjd.exe97⤵PID:412
-
\??\c:\rlrrrxx.exec:\rlrrrxx.exe98⤵PID:3220
-
\??\c:\hnbbhn.exec:\hnbbhn.exe99⤵PID:456
-
\??\c:\vpppp.exec:\vpppp.exe100⤵PID:2508
-
\??\c:\7jddv.exec:\7jddv.exe101⤵PID:2872
-
\??\c:\lrrrrxx.exec:\lrrrrxx.exe102⤵PID:548
-
\??\c:\5ttthh.exec:\5ttthh.exe103⤵PID:1824
-
\??\c:\nnhhhn.exec:\nnhhhn.exe104⤵PID:2436
-
\??\c:\pjppj.exec:\pjppj.exe105⤵PID:2808
-
\??\c:\rxffflr.exec:\rxffflr.exe106⤵PID:1900
-
\??\c:\tnhbbt.exec:\tnhbbt.exe107⤵PID:1732
-
\??\c:\nnthtn.exec:\nnthtn.exe108⤵PID:1640
-
\??\c:\jjpvp.exec:\jjpvp.exe109⤵PID:2948
-
\??\c:\rlrrfll.exec:\rlrrfll.exe110⤵PID:5016
-
\??\c:\htbbbb.exec:\htbbbb.exe111⤵PID:5000
-
\??\c:\vjjvd.exec:\vjjvd.exe112⤵PID:4372
-
\??\c:\xfllrxl.exec:\xfllrxl.exe113⤵PID:452
-
\??\c:\nbhhhh.exec:\nbhhhh.exe114⤵PID:3288
-
\??\c:\djvvd.exec:\djvvd.exe115⤵PID:1048
-
\??\c:\rflfxfx.exec:\rflfxfx.exe116⤵PID:3508
-
\??\c:\5hhbbb.exec:\5hhbbb.exe117⤵PID:3648
-
\??\c:\jvdvp.exec:\jvdvp.exe118⤵PID:4424
-
\??\c:\flxlflf.exec:\flxlflf.exe119⤵PID:4616
-
\??\c:\hbhbbb.exec:\hbhbbb.exe120⤵PID:100
-
\??\c:\3vpjd.exec:\3vpjd.exe121⤵PID:668
-
\??\c:\ffrxrrf.exec:\ffrxrrf.exe122⤵PID:3896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-