Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2025, 09:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da2a621f1c5faf9730a3cecc6d429ef8de160b7432c876a9a79b369913f625be.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
da2a621f1c5faf9730a3cecc6d429ef8de160b7432c876a9a79b369913f625be.exe
-
Size
454KB
-
MD5
d4bf73f600dc07d4f1420e5284d06e59
-
SHA1
1087e674d998ed20830e34f770a4a4a6696bcb42
-
SHA256
da2a621f1c5faf9730a3cecc6d429ef8de160b7432c876a9a79b369913f625be
-
SHA512
21e3af985d15f1cf8c524169e5c3d2348130e4809d97f8aaa56b49879f814fb28bd2f89b1ca36ce4e744f98fa5861cbd246eadaeca0212a368dd9dbb02462797
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4188-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/676-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/316-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/244-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/472-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/932-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-843-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-847-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4116-860-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2604 bbhhhh.exe 4956 jjjjj.exe 4188 rrrrlrr.exe 3616 tnhbbb.exe 1808 dvvpj.exe 3812 9frlfff.exe 372 9htnnt.exe 5084 ffffffx.exe 3964 hbhbbb.exe 4512 jdvvv.exe 3976 rlffrxr.exe 3992 tntttt.exe 2388 thnbtt.exe 3024 bntnbb.exe 4696 djjjj.exe 640 bbbbht.exe 2372 ddddj.exe 2352 xxllrxf.exe 544 dpvvv.exe 1756 9xxxxfl.exe 3952 tnnnbb.exe 3112 5dvpj.exe 2736 btttbb.exe 2188 tnnhbb.exe 4824 dvvpp.exe 1976 nhnhnn.exe 4500 hthhnn.exe 444 bhnhbb.exe 2316 vvvjj.exe 1672 rrlfxxr.exe 1376 nnnhnh.exe 4480 3vdjv.exe 3932 vvpjj.exe 3084 bhhhbb.exe 2752 jvpjd.exe 676 frlllll.exe 3624 bhhnnh.exe 3380 llffllx.exe 472 pjpjj.exe 3676 thttbb.exe 3104 ppjdp.exe 1224 ppdjp.exe 2032 1lrlffx.exe 4016 hnbbtt.exe 2708 pjvpj.exe 4684 xrffrrx.exe 316 bttnhh.exe 752 pddvv.exe 4316 xllxllf.exe 244 tnhhbt.exe 4352 jvvpj.exe 5080 5rlrrfl.exe 4120 hbtntt.exe 376 jjvpj.exe 3616 xfrlflf.exe 4564 hntnnn.exe 5008 pppjj.exe 3640 3djjp.exe 2072 xlllxxx.exe 4800 3hnhhh.exe 4012 jdjvj.exe 4784 xfllllf.exe 4172 lxrrllf.exe 2900 hthnhn.exe -
resource yara_rule behavioral2/memory/4188-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2604-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/676-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/316-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/244-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/472-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/932-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-843-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-847-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4344 wrote to memory of 2604 4344 da2a621f1c5faf9730a3cecc6d429ef8de160b7432c876a9a79b369913f625be.exe 83 PID 4344 wrote to memory of 2604 4344 da2a621f1c5faf9730a3cecc6d429ef8de160b7432c876a9a79b369913f625be.exe 83 PID 4344 wrote to memory of 2604 4344 da2a621f1c5faf9730a3cecc6d429ef8de160b7432c876a9a79b369913f625be.exe 83 PID 2604 wrote to memory of 4956 2604 bbhhhh.exe 84 PID 2604 wrote to memory of 4956 2604 bbhhhh.exe 84 PID 2604 wrote to memory of 4956 2604 bbhhhh.exe 84 PID 4956 wrote to memory of 4188 4956 jjjjj.exe 85 PID 4956 wrote to memory of 4188 4956 jjjjj.exe 85 PID 4956 wrote to memory of 4188 4956 jjjjj.exe 85 PID 4188 wrote to memory of 3616 4188 rrrrlrr.exe 86 PID 4188 wrote to memory of 3616 4188 rrrrlrr.exe 86 PID 4188 wrote to memory of 3616 4188 rrrrlrr.exe 86 PID 3616 wrote to memory of 1808 3616 tnhbbb.exe 87 PID 3616 wrote to memory of 1808 3616 tnhbbb.exe 87 PID 3616 wrote to memory of 1808 3616 tnhbbb.exe 87 PID 1808 wrote to memory of 3812 1808 dvvpj.exe 88 PID 1808 wrote to memory of 3812 1808 dvvpj.exe 88 PID 1808 wrote to memory of 3812 1808 dvvpj.exe 88 PID 3812 wrote to memory of 372 3812 9frlfff.exe 89 PID 3812 wrote to memory of 372 3812 9frlfff.exe 89 PID 3812 wrote to memory of 372 3812 9frlfff.exe 89 PID 372 wrote to memory of 5084 372 9htnnt.exe 90 PID 372 wrote to memory of 5084 372 9htnnt.exe 90 PID 372 wrote to memory of 5084 372 9htnnt.exe 90 PID 5084 wrote to memory of 3964 5084 ffffffx.exe 91 PID 5084 wrote to memory of 3964 5084 ffffffx.exe 91 PID 5084 wrote to memory of 3964 5084 ffffffx.exe 91 PID 3964 wrote to memory of 4512 3964 hbhbbb.exe 92 PID 3964 wrote to memory of 4512 3964 hbhbbb.exe 92 PID 3964 wrote to memory of 4512 3964 hbhbbb.exe 92 PID 4512 wrote to memory of 3976 4512 jdvvv.exe 93 PID 4512 wrote to memory of 3976 4512 jdvvv.exe 93 PID 4512 wrote to memory of 3976 4512 jdvvv.exe 93 PID 3976 wrote to memory of 3992 3976 rlffrxr.exe 94 PID 3976 wrote to memory of 3992 3976 rlffrxr.exe 94 PID 3976 wrote to memory of 3992 3976 rlffrxr.exe 94 PID 3992 wrote to memory of 2388 3992 tntttt.exe 95 PID 3992 wrote to memory of 2388 3992 tntttt.exe 95 PID 3992 wrote to memory of 2388 3992 tntttt.exe 95 PID 2388 wrote to memory of 3024 2388 thnbtt.exe 96 PID 2388 wrote to memory of 3024 2388 thnbtt.exe 96 PID 2388 wrote to memory of 3024 2388 thnbtt.exe 96 PID 3024 wrote to memory of 4696 3024 bntnbb.exe 97 PID 3024 wrote to memory of 4696 3024 bntnbb.exe 97 PID 3024 wrote to memory of 4696 3024 bntnbb.exe 97 PID 4696 wrote to memory of 640 4696 djjjj.exe 98 PID 4696 wrote to memory of 640 4696 djjjj.exe 98 PID 4696 wrote to memory of 640 4696 djjjj.exe 98 PID 640 wrote to memory of 2372 640 bbbbht.exe 99 PID 640 wrote to memory of 2372 640 bbbbht.exe 99 PID 640 wrote to memory of 2372 640 bbbbht.exe 99 PID 2372 wrote to memory of 2352 2372 ddddj.exe 100 PID 2372 wrote to memory of 2352 2372 ddddj.exe 100 PID 2372 wrote to memory of 2352 2372 ddddj.exe 100 PID 2352 wrote to memory of 544 2352 xxllrxf.exe 101 PID 2352 wrote to memory of 544 2352 xxllrxf.exe 101 PID 2352 wrote to memory of 544 2352 xxllrxf.exe 101 PID 544 wrote to memory of 1756 544 dpvvv.exe 102 PID 544 wrote to memory of 1756 544 dpvvv.exe 102 PID 544 wrote to memory of 1756 544 dpvvv.exe 102 PID 1756 wrote to memory of 3952 1756 9xxxxfl.exe 103 PID 1756 wrote to memory of 3952 1756 9xxxxfl.exe 103 PID 1756 wrote to memory of 3952 1756 9xxxxfl.exe 103 PID 3952 wrote to memory of 3112 3952 tnnnbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\da2a621f1c5faf9730a3cecc6d429ef8de160b7432c876a9a79b369913f625be.exe"C:\Users\Admin\AppData\Local\Temp\da2a621f1c5faf9730a3cecc6d429ef8de160b7432c876a9a79b369913f625be.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\bbhhhh.exec:\bbhhhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\jjjjj.exec:\jjjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\rrrrlrr.exec:\rrrrlrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\tnhbbb.exec:\tnhbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\dvvpj.exec:\dvvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\9frlfff.exec:\9frlfff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\9htnnt.exec:\9htnnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\ffffffx.exec:\ffffffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\hbhbbb.exec:\hbhbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\jdvvv.exec:\jdvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\rlffrxr.exec:\rlffrxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\tntttt.exec:\tntttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\thnbtt.exec:\thnbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\bntnbb.exec:\bntnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\djjjj.exec:\djjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\bbbbht.exec:\bbbbht.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\ddddj.exec:\ddddj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\xxllrxf.exec:\xxllrxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\dpvvv.exec:\dpvvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\9xxxxfl.exec:\9xxxxfl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\tnnnbb.exec:\tnnnbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\5dvpj.exec:\5dvpj.exe23⤵
- Executes dropped EXE
PID:3112 -
\??\c:\btttbb.exec:\btttbb.exe24⤵
- Executes dropped EXE
PID:2736 -
\??\c:\tnnhbb.exec:\tnnhbb.exe25⤵
- Executes dropped EXE
PID:2188 -
\??\c:\dvvpp.exec:\dvvpp.exe26⤵
- Executes dropped EXE
PID:4824 -
\??\c:\nhnhnn.exec:\nhnhnn.exe27⤵
- Executes dropped EXE
PID:1976 -
\??\c:\hthhnn.exec:\hthhnn.exe28⤵
- Executes dropped EXE
PID:4500 -
\??\c:\bhnhbb.exec:\bhnhbb.exe29⤵
- Executes dropped EXE
PID:444 -
\??\c:\vvvjj.exec:\vvvjj.exe30⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rrlfxxr.exec:\rrlfxxr.exe31⤵
- Executes dropped EXE
PID:1672 -
\??\c:\nnnhnh.exec:\nnnhnh.exe32⤵
- Executes dropped EXE
PID:1376 -
\??\c:\3vdjv.exec:\3vdjv.exe33⤵
- Executes dropped EXE
PID:4480 -
\??\c:\vvpjj.exec:\vvpjj.exe34⤵
- Executes dropped EXE
PID:3932 -
\??\c:\bhhhbb.exec:\bhhhbb.exe35⤵
- Executes dropped EXE
PID:3084 -
\??\c:\jvpjd.exec:\jvpjd.exe36⤵
- Executes dropped EXE
PID:2752 -
\??\c:\frlllll.exec:\frlllll.exe37⤵
- Executes dropped EXE
PID:676 -
\??\c:\bhhnnh.exec:\bhhnnh.exe38⤵
- Executes dropped EXE
PID:3624 -
\??\c:\llffllx.exec:\llffllx.exe39⤵
- Executes dropped EXE
PID:3380 -
\??\c:\pjpjj.exec:\pjpjj.exe40⤵
- Executes dropped EXE
PID:472 -
\??\c:\thttbb.exec:\thttbb.exe41⤵
- Executes dropped EXE
PID:3676 -
\??\c:\ppjdp.exec:\ppjdp.exe42⤵
- Executes dropped EXE
PID:3104 -
\??\c:\ppdjp.exec:\ppdjp.exe43⤵
- Executes dropped EXE
PID:1224 -
\??\c:\1lrlffx.exec:\1lrlffx.exe44⤵
- Executes dropped EXE
PID:2032 -
\??\c:\hnbbtt.exec:\hnbbtt.exe45⤵
- Executes dropped EXE
PID:4016 -
\??\c:\pjvpj.exec:\pjvpj.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2708 -
\??\c:\xrffrrx.exec:\xrffrrx.exe47⤵
- Executes dropped EXE
PID:4684 -
\??\c:\bttnhh.exec:\bttnhh.exe48⤵
- Executes dropped EXE
PID:316 -
\??\c:\pddvv.exec:\pddvv.exe49⤵
- Executes dropped EXE
PID:752 -
\??\c:\xllxllf.exec:\xllxllf.exe50⤵
- Executes dropped EXE
PID:4316 -
\??\c:\tnhhbt.exec:\tnhhbt.exe51⤵
- Executes dropped EXE
PID:244 -
\??\c:\jvvpj.exec:\jvvpj.exe52⤵
- Executes dropped EXE
PID:4352 -
\??\c:\5rlrrfl.exec:\5rlrrfl.exe53⤵
- Executes dropped EXE
PID:5080 -
\??\c:\hbtntt.exec:\hbtntt.exe54⤵
- Executes dropped EXE
PID:4120 -
\??\c:\jjvpj.exec:\jjvpj.exe55⤵
- Executes dropped EXE
PID:376 -
\??\c:\xfrlflf.exec:\xfrlflf.exe56⤵
- Executes dropped EXE
PID:3616 -
\??\c:\hntnnn.exec:\hntnnn.exe57⤵
- Executes dropped EXE
PID:4564 -
\??\c:\pppjj.exec:\pppjj.exe58⤵
- Executes dropped EXE
PID:5008 -
\??\c:\3djjp.exec:\3djjp.exe59⤵
- Executes dropped EXE
PID:3640 -
\??\c:\xlllxxx.exec:\xlllxxx.exe60⤵
- Executes dropped EXE
PID:2072 -
\??\c:\3hnhhh.exec:\3hnhhh.exe61⤵
- Executes dropped EXE
PID:4800 -
\??\c:\jdjvj.exec:\jdjvj.exe62⤵
- Executes dropped EXE
PID:4012 -
\??\c:\xfllllf.exec:\xfllllf.exe63⤵
- Executes dropped EXE
PID:4784 -
\??\c:\lxrrllf.exec:\lxrrllf.exe64⤵
- Executes dropped EXE
PID:4172 -
\??\c:\hthnhn.exec:\hthnhn.exe65⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vppjj.exec:\vppjj.exe66⤵PID:1796
-
\??\c:\7fffxrl.exec:\7fffxrl.exe67⤵PID:1624
-
\??\c:\rrxrlll.exec:\rrxrlll.exe68⤵PID:3956
-
\??\c:\nnbbtt.exec:\nnbbtt.exe69⤵PID:2440
-
\??\c:\vvvvp.exec:\vvvvp.exe70⤵PID:3740
-
\??\c:\rlxxffr.exec:\rlxxffr.exe71⤵PID:3208
-
\??\c:\hbnbbb.exec:\hbnbbb.exe72⤵PID:3924
-
\??\c:\jdvjv.exec:\jdvjv.exe73⤵PID:60
-
\??\c:\xlfrxrl.exec:\xlfrxrl.exe74⤵PID:2372
-
\??\c:\fxxrlll.exec:\fxxrlll.exe75⤵PID:1620
-
\??\c:\hbnhhb.exec:\hbnhhb.exe76⤵PID:1496
-
\??\c:\ppppj.exec:\ppppj.exe77⤵PID:2848
-
\??\c:\rrxrrrr.exec:\rrxrrrr.exe78⤵PID:1608
-
\??\c:\tntntt.exec:\tntntt.exe79⤵PID:3580
-
\??\c:\ddvvp.exec:\ddvvp.exe80⤵PID:3952
-
\??\c:\rlxxxff.exec:\rlxxxff.exe81⤵PID:2016
-
\??\c:\nnhnbh.exec:\nnhnbh.exe82⤵PID:1832
-
\??\c:\bhhbbb.exec:\bhhbbb.exe83⤵PID:3504
-
\??\c:\rxrrlll.exec:\rxrrlll.exe84⤵PID:2188
-
\??\c:\xlrrrxx.exec:\xlrrrxx.exe85⤵PID:1600
-
\??\c:\nnnnnt.exec:\nnnnnt.exe86⤵PID:4556
-
\??\c:\vjvjd.exec:\vjvjd.exe87⤵PID:3408
-
\??\c:\rfrlxxf.exec:\rfrlxxf.exe88⤵PID:1124
-
\??\c:\bhttbh.exec:\bhttbh.exe89⤵PID:2240
-
\??\c:\pppvj.exec:\pppvj.exe90⤵PID:3752
-
\??\c:\xfrfxxx.exec:\xfrfxxx.exe91⤵PID:3372
-
\??\c:\flxxxxl.exec:\flxxxxl.exe92⤵PID:1140
-
\??\c:\bbnntb.exec:\bbnntb.exe93⤵PID:1376
-
\??\c:\ddddd.exec:\ddddd.exe94⤵PID:1636
-
\??\c:\rlrlffx.exec:\rlrlffx.exe95⤵PID:1132
-
\??\c:\5hnntb.exec:\5hnntb.exe96⤵PID:4584
-
\??\c:\jdjjd.exec:\jdjjd.exe97⤵PID:4340
-
\??\c:\xxffxxx.exec:\xxffxxx.exe98⤵PID:2752
-
\??\c:\thtnhh.exec:\thtnhh.exe99⤵PID:2196
-
\??\c:\jdvvp.exec:\jdvvp.exe100⤵PID:3920
-
\??\c:\xffrlrx.exec:\xffrlrx.exe101⤵PID:2932
-
\??\c:\nhhhht.exec:\nhhhht.exe102⤵PID:472
-
\??\c:\jdvpj.exec:\jdvpj.exe103⤵PID:532
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe104⤵PID:4432
-
\??\c:\tttnhh.exec:\tttnhh.exe105⤵PID:3928
-
\??\c:\pjpjd.exec:\pjpjd.exe106⤵PID:4992
-
\??\c:\frxfrlx.exec:\frxfrlx.exe107⤵
- System Location Discovery: System Language Discovery
PID:3612 -
\??\c:\rrrflfl.exec:\rrrflfl.exe108⤵PID:2680
-
\??\c:\thbnhn.exec:\thbnhn.exe109⤵PID:2412
-
\??\c:\9dvpj.exec:\9dvpj.exe110⤵PID:4700
-
\??\c:\xllfxxr.exec:\xllfxxr.exe111⤵PID:4320
-
\??\c:\tnnnnh.exec:\tnnnnh.exe112⤵PID:2424
-
\??\c:\jjjdv.exec:\jjjdv.exe113⤵PID:4960
-
\??\c:\xrfxffl.exec:\xrfxffl.exe114⤵PID:4572
-
\??\c:\flxlffx.exec:\flxlffx.exe115⤵PID:1736
-
\??\c:\thttnt.exec:\thttnt.exe116⤵PID:4140
-
\??\c:\djjpp.exec:\djjpp.exe117⤵PID:4188
-
\??\c:\frrlfxr.exec:\frrlfxr.exe118⤵PID:996
-
\??\c:\ttnnhn.exec:\ttnnhn.exe119⤵PID:4472
-
\??\c:\tttnhb.exec:\tttnhb.exe120⤵PID:3444
-
\??\c:\dpvdv.exec:\dpvdv.exe121⤵PID:1984
-
\??\c:\lllfrrf.exec:\lllfrrf.exe122⤵PID:3428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-