Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe
-
Size
454KB
-
MD5
54cfbe2a1c7bd739fd53a7066ba9c02e
-
SHA1
7eb9ea5d7d2df34c520702a33d1f2a8ea908562c
-
SHA256
929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be
-
SHA512
70810c39f33e86dea480580f5aec356edb6c4882e0249581a7b7e4af8ac13d458a09c92b02bd9f03573f8ad2804841a9873f15b2b62337c9b5843ecb9dd91945
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/440-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1408-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2672-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/712-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-837-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-1011-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-1629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3552 btbbbb.exe 1720 pjpjp.exe 2388 7hhbtt.exe 4088 dvvvp.exe 2032 dvvvp.exe 4268 3pvvv.exe 4056 bbhnhn.exe 3564 7pddv.exe 640 xrxxrrx.exe 748 tbbttn.exe 948 vpjjd.exe 5016 7fffxfx.exe 3000 hhhbtb.exe 3388 vdpjv.exe 2008 lxlfxxx.exe 4156 vppjd.exe 1052 tthhbn.exe 4564 ppjjv.exe 4264 pdddv.exe 4544 fxfxrrl.exe 1952 7rxrffx.exe 2084 tthbtn.exe 1408 nhnhbb.exe 3020 fxlfrrl.exe 1596 thhhbb.exe 2916 5rrxrlf.exe 1332 dvjvp.exe 3592 vvvpj.exe 4208 bthbhn.exe 4212 9bhbtt.exe 4336 rrxlllf.exe 2672 nbtntn.exe 2228 ffffxff.exe 1488 7hnnhn.exe 4932 9vvjd.exe 1092 rxrlffx.exe 1724 tbtttb.exe 4004 1djjj.exe 1540 ppppd.exe 644 bthbnn.exe 5064 hnbtnn.exe 4904 7flfrrr.exe 4588 httttt.exe 3012 3hnntt.exe 4580 pjvpp.exe 4784 9ffffff.exe 3004 xlrlffx.exe 4456 bhnhhh.exe 2312 ddjjp.exe 2736 5xxrfff.exe 4584 bttnhh.exe 3104 3pvpj.exe 4488 ppvpp.exe 2256 xfrlfxr.exe 4748 hbhbtt.exe 2216 5jddp.exe 3684 pjjdv.exe 4724 rlxrlrl.exe 4088 thtttt.exe 1728 dvvpd.exe 2488 rrxrllf.exe 4268 bttbtt.exe 4692 btttnn.exe 760 vpppj.exe -
resource yara_rule behavioral2/memory/440-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1408-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2672-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/712-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-575-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 440 wrote to memory of 3552 440 929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe 82 PID 440 wrote to memory of 3552 440 929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe 82 PID 440 wrote to memory of 3552 440 929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe 82 PID 3552 wrote to memory of 1720 3552 btbbbb.exe 83 PID 3552 wrote to memory of 1720 3552 btbbbb.exe 83 PID 3552 wrote to memory of 1720 3552 btbbbb.exe 83 PID 1720 wrote to memory of 2388 1720 pjpjp.exe 84 PID 1720 wrote to memory of 2388 1720 pjpjp.exe 84 PID 1720 wrote to memory of 2388 1720 pjpjp.exe 84 PID 2388 wrote to memory of 4088 2388 7hhbtt.exe 85 PID 2388 wrote to memory of 4088 2388 7hhbtt.exe 85 PID 2388 wrote to memory of 4088 2388 7hhbtt.exe 85 PID 4088 wrote to memory of 2032 4088 dvvvp.exe 86 PID 4088 wrote to memory of 2032 4088 dvvvp.exe 86 PID 4088 wrote to memory of 2032 4088 dvvvp.exe 86 PID 2032 wrote to memory of 4268 2032 dvvvp.exe 87 PID 2032 wrote to memory of 4268 2032 dvvvp.exe 87 PID 2032 wrote to memory of 4268 2032 dvvvp.exe 87 PID 4268 wrote to memory of 4056 4268 3pvvv.exe 88 PID 4268 wrote to memory of 4056 4268 3pvvv.exe 88 PID 4268 wrote to memory of 4056 4268 3pvvv.exe 88 PID 4056 wrote to memory of 3564 4056 bbhnhn.exe 89 PID 4056 wrote to memory of 3564 4056 bbhnhn.exe 89 PID 4056 wrote to memory of 3564 4056 bbhnhn.exe 89 PID 3564 wrote to memory of 640 3564 7pddv.exe 90 PID 3564 wrote to memory of 640 3564 7pddv.exe 90 PID 3564 wrote to memory of 640 3564 7pddv.exe 90 PID 640 wrote to memory of 748 640 xrxxrrx.exe 91 PID 640 wrote to memory of 748 640 xrxxrrx.exe 91 PID 640 wrote to memory of 748 640 xrxxrrx.exe 91 PID 748 wrote to memory of 948 748 tbbttn.exe 92 PID 748 wrote to memory of 948 748 tbbttn.exe 92 PID 748 wrote to memory of 948 748 tbbttn.exe 92 PID 948 wrote to memory of 5016 948 vpjjd.exe 93 PID 948 wrote to memory of 5016 948 vpjjd.exe 93 PID 948 wrote to memory of 5016 948 vpjjd.exe 93 PID 5016 wrote to memory of 3000 5016 7fffxfx.exe 94 PID 5016 wrote to memory of 3000 5016 7fffxfx.exe 94 PID 5016 wrote to memory of 3000 5016 7fffxfx.exe 94 PID 3000 wrote to memory of 3388 3000 hhhbtb.exe 95 PID 3000 wrote to memory of 3388 3000 hhhbtb.exe 95 PID 3000 wrote to memory of 3388 3000 hhhbtb.exe 95 PID 3388 wrote to memory of 2008 3388 vdpjv.exe 96 PID 3388 wrote to memory of 2008 3388 vdpjv.exe 96 PID 3388 wrote to memory of 2008 3388 vdpjv.exe 96 PID 2008 wrote to memory of 4156 2008 lxlfxxx.exe 97 PID 2008 wrote to memory of 4156 2008 lxlfxxx.exe 97 PID 2008 wrote to memory of 4156 2008 lxlfxxx.exe 97 PID 4156 wrote to memory of 1052 4156 vppjd.exe 98 PID 4156 wrote to memory of 1052 4156 vppjd.exe 98 PID 4156 wrote to memory of 1052 4156 vppjd.exe 98 PID 1052 wrote to memory of 4564 1052 tthhbn.exe 99 PID 1052 wrote to memory of 4564 1052 tthhbn.exe 99 PID 1052 wrote to memory of 4564 1052 tthhbn.exe 99 PID 4564 wrote to memory of 4264 4564 ppjjv.exe 100 PID 4564 wrote to memory of 4264 4564 ppjjv.exe 100 PID 4564 wrote to memory of 4264 4564 ppjjv.exe 100 PID 4264 wrote to memory of 4544 4264 pdddv.exe 101 PID 4264 wrote to memory of 4544 4264 pdddv.exe 101 PID 4264 wrote to memory of 4544 4264 pdddv.exe 101 PID 4544 wrote to memory of 1952 4544 fxfxrrl.exe 102 PID 4544 wrote to memory of 1952 4544 fxfxrrl.exe 102 PID 4544 wrote to memory of 1952 4544 fxfxrrl.exe 102 PID 1952 wrote to memory of 2084 1952 7rxrffx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe"C:\Users\Admin\AppData\Local\Temp\929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\btbbbb.exec:\btbbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\pjpjp.exec:\pjpjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\7hhbtt.exec:\7hhbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\dvvvp.exec:\dvvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\dvvvp.exec:\dvvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\3pvvv.exec:\3pvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\bbhnhn.exec:\bbhnhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\7pddv.exec:\7pddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\xrxxrrx.exec:\xrxxrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\tbbttn.exec:\tbbttn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\vpjjd.exec:\vpjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\7fffxfx.exec:\7fffxfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\hhhbtb.exec:\hhhbtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\vdpjv.exec:\vdpjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\vppjd.exec:\vppjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\tthhbn.exec:\tthhbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\ppjjv.exec:\ppjjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\pdddv.exec:\pdddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\7rxrffx.exec:\7rxrffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\tthbtn.exec:\tthbtn.exe23⤵
- Executes dropped EXE
PID:2084 -
\??\c:\nhnhbb.exec:\nhnhbb.exe24⤵
- Executes dropped EXE
PID:1408 -
\??\c:\fxlfrrl.exec:\fxlfrrl.exe25⤵
- Executes dropped EXE
PID:3020 -
\??\c:\thhhbb.exec:\thhhbb.exe26⤵
- Executes dropped EXE
PID:1596 -
\??\c:\5rrxrlf.exec:\5rrxrlf.exe27⤵
- Executes dropped EXE
PID:2916 -
\??\c:\dvjvp.exec:\dvjvp.exe28⤵
- Executes dropped EXE
PID:1332 -
\??\c:\vvvpj.exec:\vvvpj.exe29⤵
- Executes dropped EXE
PID:3592 -
\??\c:\bthbhn.exec:\bthbhn.exe30⤵
- Executes dropped EXE
PID:4208 -
\??\c:\9bhbtt.exec:\9bhbtt.exe31⤵
- Executes dropped EXE
PID:4212 -
\??\c:\rrxlllf.exec:\rrxlllf.exe32⤵
- Executes dropped EXE
PID:4336 -
\??\c:\nbtntn.exec:\nbtntn.exe33⤵
- Executes dropped EXE
PID:2672 -
\??\c:\ffffxff.exec:\ffffxff.exe34⤵
- Executes dropped EXE
PID:2228 -
\??\c:\7hnnhn.exec:\7hnnhn.exe35⤵
- Executes dropped EXE
PID:1488 -
\??\c:\9vvjd.exec:\9vvjd.exe36⤵
- Executes dropped EXE
PID:4932 -
\??\c:\rxrlffx.exec:\rxrlffx.exe37⤵
- Executes dropped EXE
PID:1092 -
\??\c:\tbtttb.exec:\tbtttb.exe38⤵
- Executes dropped EXE
PID:1724 -
\??\c:\1djjj.exec:\1djjj.exe39⤵
- Executes dropped EXE
PID:4004 -
\??\c:\ppppd.exec:\ppppd.exe40⤵
- Executes dropped EXE
PID:1540 -
\??\c:\bthbnn.exec:\bthbnn.exe41⤵
- Executes dropped EXE
PID:644 -
\??\c:\hnbtnn.exec:\hnbtnn.exe42⤵
- Executes dropped EXE
PID:5064 -
\??\c:\7flfrrr.exec:\7flfrrr.exe43⤵
- Executes dropped EXE
PID:4904 -
\??\c:\httttt.exec:\httttt.exe44⤵
- Executes dropped EXE
PID:4588 -
\??\c:\3hnntt.exec:\3hnntt.exe45⤵
- Executes dropped EXE
PID:3012 -
\??\c:\pjvpp.exec:\pjvpp.exe46⤵
- Executes dropped EXE
PID:4580 -
\??\c:\9ffffff.exec:\9ffffff.exe47⤵
- Executes dropped EXE
PID:4784 -
\??\c:\xlrlffx.exec:\xlrlffx.exe48⤵
- Executes dropped EXE
PID:3004 -
\??\c:\bhnhhh.exec:\bhnhhh.exe49⤵
- Executes dropped EXE
PID:4456 -
\??\c:\ddjjp.exec:\ddjjp.exe50⤵
- Executes dropped EXE
PID:2312 -
\??\c:\5xxrfff.exec:\5xxrfff.exe51⤵
- Executes dropped EXE
PID:2736 -
\??\c:\bttnhh.exec:\bttnhh.exe52⤵
- Executes dropped EXE
PID:4584 -
\??\c:\3pvpj.exec:\3pvpj.exe53⤵
- Executes dropped EXE
PID:3104 -
\??\c:\ppvpp.exec:\ppvpp.exe54⤵
- Executes dropped EXE
PID:4488 -
\??\c:\xfrlfxr.exec:\xfrlfxr.exe55⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hbhbtt.exec:\hbhbtt.exe56⤵
- Executes dropped EXE
PID:4748 -
\??\c:\5jddp.exec:\5jddp.exe57⤵
- Executes dropped EXE
PID:2216 -
\??\c:\pjjdv.exec:\pjjdv.exe58⤵
- Executes dropped EXE
PID:3684 -
\??\c:\rlxrlrl.exec:\rlxrlrl.exe59⤵
- Executes dropped EXE
PID:4724 -
\??\c:\thtttt.exec:\thtttt.exe60⤵
- Executes dropped EXE
PID:4088 -
\??\c:\dvvpd.exec:\dvvpd.exe61⤵
- Executes dropped EXE
PID:1728 -
\??\c:\rrxrllf.exec:\rrxrllf.exe62⤵
- Executes dropped EXE
PID:2488 -
\??\c:\bttbtt.exec:\bttbtt.exe63⤵
- Executes dropped EXE
PID:4268 -
\??\c:\btttnn.exec:\btttnn.exe64⤵
- Executes dropped EXE
PID:4692 -
\??\c:\vpppj.exec:\vpppj.exe65⤵
- Executes dropped EXE
PID:760 -
\??\c:\xxlfxxx.exec:\xxlfxxx.exe66⤵PID:428
-
\??\c:\tbhhbb.exec:\tbhhbb.exe67⤵PID:4880
-
\??\c:\ppvpd.exec:\ppvpd.exe68⤵PID:3468
-
\??\c:\7xfxrrx.exec:\7xfxrrx.exe69⤵PID:1804
-
\??\c:\bnnhbb.exec:\bnnhbb.exe70⤵PID:748
-
\??\c:\jvvvp.exec:\jvvvp.exe71⤵PID:3560
-
\??\c:\jdjjd.exec:\jdjjd.exe72⤵PID:2128
-
\??\c:\lffrllf.exec:\lffrllf.exe73⤵PID:2652
-
\??\c:\hnttbb.exec:\hnttbb.exe74⤵PID:3864
-
\??\c:\btbthh.exec:\btbthh.exe75⤵PID:2340
-
\??\c:\dpjdv.exec:\dpjdv.exe76⤵PID:4344
-
\??\c:\frfxrlf.exec:\frfxrlf.exe77⤵PID:4152
-
\??\c:\tnbttt.exec:\tnbttt.exe78⤵PID:3176
-
\??\c:\7pjdp.exec:\7pjdp.exe79⤵PID:4172
-
\??\c:\ppdvv.exec:\ppdvv.exe80⤵PID:1960
-
\??\c:\xfxrrrl.exec:\xfxrrrl.exe81⤵PID:3444
-
\??\c:\hhhbtt.exec:\hhhbtt.exe82⤵PID:1592
-
\??\c:\jvjdd.exec:\jvjdd.exe83⤵PID:1688
-
\??\c:\pjvpp.exec:\pjvpp.exe84⤵PID:4312
-
\??\c:\xrrlxxx.exec:\xrrlxxx.exe85⤵PID:3668
-
\??\c:\7btbhb.exec:\7btbhb.exe86⤵PID:2276
-
\??\c:\vjpjd.exec:\vjpjd.exe87⤵
- System Location Discovery: System Language Discovery
PID:1784 -
\??\c:\xxllllr.exec:\xxllllr.exe88⤵PID:3460
-
\??\c:\flrrflf.exec:\flrrflf.exe89⤵PID:2248
-
\??\c:\bnttnn.exec:\bnttnn.exe90⤵PID:1680
-
\??\c:\jpvpj.exec:\jpvpj.exe91⤵PID:1500
-
\??\c:\xrrfrrl.exec:\xrrfrrl.exe92⤵PID:2088
-
\??\c:\nbbtnh.exec:\nbbtnh.exe93⤵PID:1696
-
\??\c:\dpjvj.exec:\dpjvj.exe94⤵PID:1332
-
\??\c:\5vjvj.exec:\5vjvj.exe95⤵PID:2724
-
\??\c:\rllxrfx.exec:\rllxrfx.exe96⤵PID:4196
-
\??\c:\htnnhb.exec:\htnnhb.exe97⤵PID:1212
-
\??\c:\dppjv.exec:\dppjv.exe98⤵PID:2204
-
\??\c:\lrrfxxl.exec:\lrrfxxl.exe99⤵PID:2704
-
\??\c:\nbtnnh.exec:\nbtnnh.exe100⤵PID:4764
-
\??\c:\pjvjv.exec:\pjvjv.exe101⤵PID:1636
-
\??\c:\vdpjd.exec:\vdpjd.exe102⤵PID:2624
-
\??\c:\rflxrrf.exec:\rflxrrf.exe103⤵PID:556
-
\??\c:\thhhbb.exec:\thhhbb.exe104⤵PID:4548
-
\??\c:\tnbnbh.exec:\tnbnbh.exe105⤵PID:712
-
\??\c:\3vdvj.exec:\3vdvj.exe106⤵PID:3768
-
\??\c:\1frfllx.exec:\1frfllx.exe107⤵PID:2184
-
\??\c:\thbnhh.exec:\thbnhh.exe108⤵PID:1900
-
\??\c:\dpvdp.exec:\dpvdp.exe109⤵PID:1772
-
\??\c:\ddjvp.exec:\ddjvp.exe110⤵PID:1372
-
\??\c:\xxxlfxl.exec:\xxxlfxl.exe111⤵PID:3676
-
\??\c:\hhtbht.exec:\hhtbht.exe112⤵PID:4276
-
\??\c:\dpjvp.exec:\dpjvp.exe113⤵PID:1712
-
\??\c:\xffrfxl.exec:\xffrfxl.exe114⤵PID:3012
-
\??\c:\3bthbn.exec:\3bthbn.exe115⤵PID:4644
-
\??\c:\dpddv.exec:\dpddv.exe116⤵PID:2348
-
\??\c:\lxrfrlf.exec:\lxrfrlf.exe117⤵PID:3212
-
\??\c:\xlxllff.exec:\xlxllff.exe118⤵PID:2372
-
\??\c:\nbnbtn.exec:\nbnbtn.exe119⤵PID:4392
-
\??\c:\vdvdj.exec:\vdvdj.exe120⤵PID:2736
-
\??\c:\rffrlfx.exec:\rffrlfx.exe121⤵PID:4792
-
\??\c:\bttnhb.exec:\bttnhb.exe122⤵PID:4480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-