Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01efc569cc5999e89491ac44735545a2cc63e69eec61c838da721cac1307c10c.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
01efc569cc5999e89491ac44735545a2cc63e69eec61c838da721cac1307c10c.exe
-
Size
455KB
-
MD5
a32a6266eb542f252805902f75778a0e
-
SHA1
4b673bc9699b60cee66c611e1718590a1328c537
-
SHA256
01efc569cc5999e89491ac44735545a2cc63e69eec61c838da721cac1307c10c
-
SHA512
8b251340f918b6aff0a6e8000f94942befc302b190627e6ed9777173a358fdc3dba2a9ade46527d297162d05ddfd960ff556a3dadc73ffde0fcc345fa21ffba4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeA:q7Tc2NYHUrAwfMp3CDA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2464-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3420-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2988-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2784-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1744-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3544-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2100-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-781-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3140-845-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-891-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1840-1045-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2472-1109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-1466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1200 pjppp.exe 3516 djpjj.exe 3420 jjjjd.exe 2284 lflfllr.exe 4848 bbbttt.exe 1560 ddvpj.exe 2908 7djdd.exe 4556 tnbttn.exe 2988 dvdpj.exe 2784 ppvpp.exe 5104 htbtnn.exe 2072 5lrrrxr.exe 3784 hnnnhh.exe 4864 dvjjv.exe 1680 xrxxxff.exe 2932 lfxflll.exe 3616 tbhbtn.exe 556 xxffxxx.exe 1288 9xxlffx.exe 4516 vvjdd.exe 2980 frxrrrl.exe 2236 9lrrfff.exe 4508 lfxrlfl.exe 3936 nhbtnh.exe 4640 dvdvp.exe 768 xrxfllr.exe 2744 ffrlrrr.exe 1792 jdjdv.exe 3560 htbthb.exe 2064 ppdpv.exe 4572 tnbtbb.exe 3412 3htnbt.exe 1584 dpjdp.exe 4624 rlrllll.exe 2220 7ttttt.exe 4772 frrlfll.exe 2592 1ntnbb.exe 3632 vvddd.exe 4448 hntbbb.exe 216 pvddv.exe 4248 fllfxrr.exe 3200 bnttnt.exe 2040 ppjpd.exe 4144 rrrlfff.exe 2436 tbnhhh.exe 3452 3vddp.exe 1888 xxffxrl.exe 2540 tbbbtt.exe 1744 ntnhhh.exe 2660 7jpjd.exe 3204 xxffxxf.exe 4336 9nnhhh.exe 3952 5pjjd.exe 2464 rfrlrlf.exe 4088 tbhbbb.exe 3516 tnbbbt.exe 3544 vvvpj.exe 2848 9rrlrrl.exe 4940 lflffxx.exe 1400 ttbbtb.exe 3596 ddjdp.exe 2100 xlrlfxx.exe 232 9bhbtt.exe 4592 hhnhhh.exe -
resource yara_rule behavioral2/memory/2464-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2988-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2988-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2784-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3544-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3140-845-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dddd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2464 wrote to memory of 1200 2464 01efc569cc5999e89491ac44735545a2cc63e69eec61c838da721cac1307c10c.exe 83 PID 2464 wrote to memory of 1200 2464 01efc569cc5999e89491ac44735545a2cc63e69eec61c838da721cac1307c10c.exe 83 PID 2464 wrote to memory of 1200 2464 01efc569cc5999e89491ac44735545a2cc63e69eec61c838da721cac1307c10c.exe 83 PID 1200 wrote to memory of 3516 1200 pjppp.exe 84 PID 1200 wrote to memory of 3516 1200 pjppp.exe 84 PID 1200 wrote to memory of 3516 1200 pjppp.exe 84 PID 3516 wrote to memory of 3420 3516 djpjj.exe 85 PID 3516 wrote to memory of 3420 3516 djpjj.exe 85 PID 3516 wrote to memory of 3420 3516 djpjj.exe 85 PID 3420 wrote to memory of 2284 3420 jjjjd.exe 86 PID 3420 wrote to memory of 2284 3420 jjjjd.exe 86 PID 3420 wrote to memory of 2284 3420 jjjjd.exe 86 PID 2284 wrote to memory of 4848 2284 lflfllr.exe 87 PID 2284 wrote to memory of 4848 2284 lflfllr.exe 87 PID 2284 wrote to memory of 4848 2284 lflfllr.exe 87 PID 4848 wrote to memory of 1560 4848 bbbttt.exe 88 PID 4848 wrote to memory of 1560 4848 bbbttt.exe 88 PID 4848 wrote to memory of 1560 4848 bbbttt.exe 88 PID 1560 wrote to memory of 2908 1560 ddvpj.exe 89 PID 1560 wrote to memory of 2908 1560 ddvpj.exe 89 PID 1560 wrote to memory of 2908 1560 ddvpj.exe 89 PID 2908 wrote to memory of 4556 2908 7djdd.exe 90 PID 2908 wrote to memory of 4556 2908 7djdd.exe 90 PID 2908 wrote to memory of 4556 2908 7djdd.exe 90 PID 4556 wrote to memory of 2988 4556 tnbttn.exe 91 PID 4556 wrote to memory of 2988 4556 tnbttn.exe 91 PID 4556 wrote to memory of 2988 4556 tnbttn.exe 91 PID 2988 wrote to memory of 2784 2988 dvdpj.exe 92 PID 2988 wrote to memory of 2784 2988 dvdpj.exe 92 PID 2988 wrote to memory of 2784 2988 dvdpj.exe 92 PID 2784 wrote to memory of 5104 2784 ppvpp.exe 93 PID 2784 wrote to memory of 5104 2784 ppvpp.exe 93 PID 2784 wrote to memory of 5104 2784 ppvpp.exe 93 PID 5104 wrote to memory of 2072 5104 htbtnn.exe 94 PID 5104 wrote to memory of 2072 5104 htbtnn.exe 94 PID 5104 wrote to memory of 2072 5104 htbtnn.exe 94 PID 2072 wrote to memory of 3784 2072 5lrrrxr.exe 95 PID 2072 wrote to memory of 3784 2072 5lrrrxr.exe 95 PID 2072 wrote to memory of 3784 2072 5lrrrxr.exe 95 PID 3784 wrote to memory of 4864 3784 hnnnhh.exe 96 PID 3784 wrote to memory of 4864 3784 hnnnhh.exe 96 PID 3784 wrote to memory of 4864 3784 hnnnhh.exe 96 PID 4864 wrote to memory of 1680 4864 dvjjv.exe 97 PID 4864 wrote to memory of 1680 4864 dvjjv.exe 97 PID 4864 wrote to memory of 1680 4864 dvjjv.exe 97 PID 1680 wrote to memory of 2932 1680 xrxxxff.exe 98 PID 1680 wrote to memory of 2932 1680 xrxxxff.exe 98 PID 1680 wrote to memory of 2932 1680 xrxxxff.exe 98 PID 2932 wrote to memory of 3616 2932 lfxflll.exe 99 PID 2932 wrote to memory of 3616 2932 lfxflll.exe 99 PID 2932 wrote to memory of 3616 2932 lfxflll.exe 99 PID 3616 wrote to memory of 556 3616 tbhbtn.exe 100 PID 3616 wrote to memory of 556 3616 tbhbtn.exe 100 PID 3616 wrote to memory of 556 3616 tbhbtn.exe 100 PID 556 wrote to memory of 1288 556 xxffxxx.exe 101 PID 556 wrote to memory of 1288 556 xxffxxx.exe 101 PID 556 wrote to memory of 1288 556 xxffxxx.exe 101 PID 1288 wrote to memory of 4516 1288 9xxlffx.exe 102 PID 1288 wrote to memory of 4516 1288 9xxlffx.exe 102 PID 1288 wrote to memory of 4516 1288 9xxlffx.exe 102 PID 4516 wrote to memory of 2980 4516 vvjdd.exe 103 PID 4516 wrote to memory of 2980 4516 vvjdd.exe 103 PID 4516 wrote to memory of 2980 4516 vvjdd.exe 103 PID 2980 wrote to memory of 2236 2980 frxrrrl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\01efc569cc5999e89491ac44735545a2cc63e69eec61c838da721cac1307c10c.exe"C:\Users\Admin\AppData\Local\Temp\01efc569cc5999e89491ac44735545a2cc63e69eec61c838da721cac1307c10c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\pjppp.exec:\pjppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\djpjj.exec:\djpjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\jjjjd.exec:\jjjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\lflfllr.exec:\lflfllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\bbbttt.exec:\bbbttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\ddvpj.exec:\ddvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\7djdd.exec:\7djdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\tnbttn.exec:\tnbttn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\dvdpj.exec:\dvdpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\ppvpp.exec:\ppvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\htbtnn.exec:\htbtnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\5lrrrxr.exec:\5lrrrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\hnnnhh.exec:\hnnnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\dvjjv.exec:\dvjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\xrxxxff.exec:\xrxxxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\lfxflll.exec:\lfxflll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\tbhbtn.exec:\tbhbtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\xxffxxx.exec:\xxffxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\9xxlffx.exec:\9xxlffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\vvjdd.exec:\vvjdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\frxrrrl.exec:\frxrrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\9lrrfff.exec:\9lrrfff.exe23⤵
- Executes dropped EXE
PID:2236 -
\??\c:\lfxrlfl.exec:\lfxrlfl.exe24⤵
- Executes dropped EXE
PID:4508 -
\??\c:\nhbtnh.exec:\nhbtnh.exe25⤵
- Executes dropped EXE
PID:3936 -
\??\c:\dvdvp.exec:\dvdvp.exe26⤵
- Executes dropped EXE
PID:4640 -
\??\c:\xrxfllr.exec:\xrxfllr.exe27⤵
- Executes dropped EXE
PID:768 -
\??\c:\ffrlrrr.exec:\ffrlrrr.exe28⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jdjdv.exec:\jdjdv.exe29⤵
- Executes dropped EXE
PID:1792 -
\??\c:\htbthb.exec:\htbthb.exe30⤵
- Executes dropped EXE
PID:3560 -
\??\c:\ppdpv.exec:\ppdpv.exe31⤵
- Executes dropped EXE
PID:2064 -
\??\c:\tnbtbb.exec:\tnbtbb.exe32⤵
- Executes dropped EXE
PID:4572 -
\??\c:\3htnbt.exec:\3htnbt.exe33⤵
- Executes dropped EXE
PID:3412 -
\??\c:\dpjdp.exec:\dpjdp.exe34⤵
- Executes dropped EXE
PID:1584 -
\??\c:\rlrllll.exec:\rlrllll.exe35⤵
- Executes dropped EXE
PID:4624 -
\??\c:\7ttttt.exec:\7ttttt.exe36⤵
- Executes dropped EXE
PID:2220 -
\??\c:\frrlfll.exec:\frrlfll.exe37⤵
- Executes dropped EXE
PID:4772 -
\??\c:\1ntnbb.exec:\1ntnbb.exe38⤵
- Executes dropped EXE
PID:2592 -
\??\c:\vvddd.exec:\vvddd.exe39⤵
- Executes dropped EXE
PID:3632 -
\??\c:\hntbbb.exec:\hntbbb.exe40⤵
- Executes dropped EXE
PID:4448 -
\??\c:\pvddv.exec:\pvddv.exe41⤵
- Executes dropped EXE
PID:216 -
\??\c:\fllfxrr.exec:\fllfxrr.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4248 -
\??\c:\bnttnt.exec:\bnttnt.exe43⤵
- Executes dropped EXE
PID:3200 -
\??\c:\ppjpd.exec:\ppjpd.exe44⤵
- Executes dropped EXE
PID:2040 -
\??\c:\rrrlfff.exec:\rrrlfff.exe45⤵
- Executes dropped EXE
PID:4144 -
\??\c:\tbnhhh.exec:\tbnhhh.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2436 -
\??\c:\3vddp.exec:\3vddp.exe47⤵
- Executes dropped EXE
PID:3452 -
\??\c:\xxffxrl.exec:\xxffxrl.exe48⤵
- Executes dropped EXE
PID:1888 -
\??\c:\tbbbtt.exec:\tbbbtt.exe49⤵
- Executes dropped EXE
PID:2540 -
\??\c:\ntnhhh.exec:\ntnhhh.exe50⤵
- Executes dropped EXE
PID:1744 -
\??\c:\7jpjd.exec:\7jpjd.exe51⤵
- Executes dropped EXE
PID:2660 -
\??\c:\xxffxxf.exec:\xxffxxf.exe52⤵
- Executes dropped EXE
PID:3204 -
\??\c:\9nnhhh.exec:\9nnhhh.exe53⤵
- Executes dropped EXE
PID:4336 -
\??\c:\5pjjd.exec:\5pjjd.exe54⤵
- Executes dropped EXE
PID:3952 -
\??\c:\rfrlrlf.exec:\rfrlrlf.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2464 -
\??\c:\tbhbbb.exec:\tbhbbb.exe56⤵
- Executes dropped EXE
PID:4088 -
\??\c:\tnbbbt.exec:\tnbbbt.exe57⤵
- Executes dropped EXE
PID:3516 -
\??\c:\vvvpj.exec:\vvvpj.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3544 -
\??\c:\9rrlrrl.exec:\9rrlrrl.exe59⤵
- Executes dropped EXE
PID:2848 -
\??\c:\lflffxx.exec:\lflffxx.exe60⤵
- Executes dropped EXE
PID:4940 -
\??\c:\ttbbtb.exec:\ttbbtb.exe61⤵
- Executes dropped EXE
PID:1400 -
\??\c:\ddjdp.exec:\ddjdp.exe62⤵
- Executes dropped EXE
PID:3596 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe63⤵
- Executes dropped EXE
PID:2100 -
\??\c:\9bhbtt.exec:\9bhbtt.exe64⤵
- Executes dropped EXE
PID:232 -
\??\c:\hhnhhh.exec:\hhnhhh.exe65⤵
- Executes dropped EXE
PID:4592 -
\??\c:\pjpjj.exec:\pjpjj.exe66⤵PID:1112
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe67⤵PID:4556
-
\??\c:\frrrrrr.exec:\frrrrrr.exe68⤵PID:1036
-
\??\c:\7tnhhh.exec:\7tnhhh.exe69⤵
- System Location Discovery: System Language Discovery
PID:2784 -
\??\c:\vvdvp.exec:\vvdvp.exe70⤵PID:4472
-
\??\c:\jpddd.exec:\jpddd.exe71⤵PID:2036
-
\??\c:\lrxxrxr.exec:\lrxxrxr.exe72⤵PID:4084
-
\??\c:\hnhhhb.exec:\hnhhhb.exe73⤵PID:4988
-
\??\c:\jjddd.exec:\jjddd.exe74⤵PID:4072
-
\??\c:\lxlfxrl.exec:\lxlfxrl.exe75⤵PID:4756
-
\??\c:\tnhhbb.exec:\tnhhbb.exe76⤵PID:4864
-
\??\c:\3pvpp.exec:\3pvpp.exe77⤵PID:2412
-
\??\c:\lrfxrlf.exec:\lrfxrlf.exe78⤵PID:2296
-
\??\c:\5tnnhh.exec:\5tnnhh.exe79⤵PID:5108
-
\??\c:\vvpjv.exec:\vvpjv.exe80⤵PID:3616
-
\??\c:\rrlfrrx.exec:\rrlfrrx.exe81⤵PID:1852
-
\??\c:\7bbbtb.exec:\7bbbtb.exe82⤵PID:1428
-
\??\c:\htbtnn.exec:\htbtnn.exe83⤵PID:740
-
\??\c:\ddvdd.exec:\ddvdd.exe84⤵PID:3500
-
\??\c:\9llffff.exec:\9llffff.exe85⤵PID:1040
-
\??\c:\tnnhbt.exec:\tnnhbt.exe86⤵PID:4816
-
\??\c:\1vdvj.exec:\1vdvj.exe87⤵PID:3132
-
\??\c:\jddvj.exec:\jddvj.exe88⤵PID:980
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe89⤵PID:1264
-
\??\c:\7bhhbh.exec:\7bhhbh.exe90⤵
- System Location Discovery: System Language Discovery
PID:4832 -
\??\c:\pppjv.exec:\pppjv.exe91⤵PID:4640
-
\??\c:\ppvpv.exec:\ppvpv.exe92⤵PID:4120
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe93⤵PID:4432
-
\??\c:\bhnhbb.exec:\bhnhbb.exe94⤵PID:5016
-
\??\c:\jjddv.exec:\jjddv.exe95⤵PID:4652
-
\??\c:\xxxrrll.exec:\xxxrrll.exe96⤵PID:4008
-
\??\c:\9ttttt.exec:\9ttttt.exe97⤵PID:1796
-
\??\c:\jjvvp.exec:\jjvvp.exe98⤵PID:1864
-
\??\c:\rllfxrl.exec:\rllfxrl.exe99⤵PID:3532
-
\??\c:\rlrrxfl.exec:\rlrrxfl.exe100⤵PID:368
-
\??\c:\tntnhh.exec:\tntnhh.exe101⤵PID:1584
-
\??\c:\vvddv.exec:\vvddv.exe102⤵PID:2208
-
\??\c:\9xxxrrx.exec:\9xxxrrx.exe103⤵PID:2952
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe104⤵PID:1768
-
\??\c:\7hnnhn.exec:\7hnnhn.exe105⤵PID:3404
-
\??\c:\vjpjp.exec:\vjpjp.exe106⤵PID:3748
-
\??\c:\fllrlll.exec:\fllrlll.exe107⤵PID:4388
-
\??\c:\rflffff.exec:\rflffff.exe108⤵PID:2216
-
\??\c:\nhbbtt.exec:\nhbbtt.exe109⤵PID:3000
-
\??\c:\jjvvd.exec:\jjvvd.exe110⤵PID:3640
-
\??\c:\rxrlfff.exec:\rxrlfff.exe111⤵PID:4860
-
\??\c:\3nnnhh.exec:\3nnnhh.exe112⤵PID:4144
-
\??\c:\hbhtnn.exec:\hbhtnn.exe113⤵PID:3808
-
\??\c:\9pddd.exec:\9pddd.exe114⤵PID:3188
-
\??\c:\frxrrxr.exec:\frxrrxr.exe115⤵PID:1888
-
\??\c:\hnttnt.exec:\hnttnt.exe116⤵PID:3984
-
\??\c:\bbbhht.exec:\bbbhht.exe117⤵PID:2972
-
\??\c:\vjjdv.exec:\vjjdv.exe118⤵PID:1452
-
\??\c:\ffxrllf.exec:\ffxrllf.exe119⤵PID:2764
-
\??\c:\xlllfff.exec:\xlllfff.exe120⤵PID:640
-
\??\c:\3vpjp.exec:\3vpjp.exe121⤵PID:3840
-
\??\c:\lllfffx.exec:\lllfffx.exe122⤵PID:3648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-