Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad3e133a1d97addedb841ddb0f92d42dcbaa5c6910bc854d622e07d4e3c8ed91.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
ad3e133a1d97addedb841ddb0f92d42dcbaa5c6910bc854d622e07d4e3c8ed91.exe
-
Size
455KB
-
MD5
4408c81524407c77c2f5d538d0590e16
-
SHA1
a95426ff6df0c3a9243879492a0ebd6bea2d799a
-
SHA256
ad3e133a1d97addedb841ddb0f92d42dcbaa5c6910bc854d622e07d4e3c8ed91
-
SHA512
4ad5a8bf407742c288e0ccb669e384d434a73889588d0ed174be927d58eea1fa33fca3ea8bcb0523923e868229e534f7f27ac6f272535146330cd7928dd04c89
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe7:q7Tc2NYHUrAwfMp3CD7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/3364-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2568-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1760-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/996-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3884-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-890-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-1230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-1527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4916 jjvvd.exe 3124 5xfxrrr.exe 4400 vdppv.exe 1240 rlffxxx.exe 1432 hhnbnh.exe 1372 pjvpv.exe 2400 tnnnhh.exe 3016 dvjjj.exe 4416 7xxrrrl.exe 1292 htbttt.exe 1108 ddpjj.exe 1748 vppjd.exe 1964 tbhnht.exe 660 jpppp.exe 444 rrxxrff.exe 3060 9hhbtt.exe 1464 jpvpp.exe 1048 jjddp.exe 4276 hbhbtn.exe 2568 nnhbtt.exe 4936 ddpjd.exe 4156 jdpjj.exe 2484 bbnnbt.exe 1760 vpvvv.exe 3976 llllxxl.exe 2236 rlrrlll.exe 3268 thnthh.exe 2380 pvpdp.exe 3648 rrfxrxr.exe 540 bttbtt.exe 4852 vpvpp.exe 3064 pjjpj.exe 3024 llfxffl.exe 1060 thbbtt.exe 916 jdddv.exe 3576 rrfflrr.exe 3308 nhtttt.exe 212 vvppd.exe 2828 lllfrxx.exe 2360 nnbhbb.exe 3424 ffxrlrx.exe 3920 1httth.exe 5060 vppdv.exe 4736 rffxrfx.exe 4572 vjdpj.exe 5032 jvjdd.exe 4340 xrxrffx.exe 1460 tnthtn.exe 1432 vvjdv.exe 2900 rfflxxl.exe 756 ntbbtt.exe 2032 jpjjj.exe 5028 rxrrxxf.exe 4172 tntnhh.exe 3904 pvdjd.exe 4176 lrxrlxr.exe 2632 fxflxxr.exe 1292 thbbbb.exe 1584 pjjdv.exe 3052 fffxxxr.exe 4508 rfffxxx.exe 4900 nhhbtt.exe 3660 pppjd.exe 1376 frxrrrl.exe -
resource yara_rule behavioral2/memory/3364-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1432-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1292-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1108-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2568-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1432-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1292-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/996-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3884-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-890-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-1230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-1453-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rfxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3364 wrote to memory of 4916 3364 ad3e133a1d97addedb841ddb0f92d42dcbaa5c6910bc854d622e07d4e3c8ed91.exe 83 PID 3364 wrote to memory of 4916 3364 ad3e133a1d97addedb841ddb0f92d42dcbaa5c6910bc854d622e07d4e3c8ed91.exe 83 PID 3364 wrote to memory of 4916 3364 ad3e133a1d97addedb841ddb0f92d42dcbaa5c6910bc854d622e07d4e3c8ed91.exe 83 PID 4916 wrote to memory of 3124 4916 jjvvd.exe 84 PID 4916 wrote to memory of 3124 4916 jjvvd.exe 84 PID 4916 wrote to memory of 3124 4916 jjvvd.exe 84 PID 3124 wrote to memory of 4400 3124 5xfxrrr.exe 85 PID 3124 wrote to memory of 4400 3124 5xfxrrr.exe 85 PID 3124 wrote to memory of 4400 3124 5xfxrrr.exe 85 PID 4400 wrote to memory of 1240 4400 vdppv.exe 86 PID 4400 wrote to memory of 1240 4400 vdppv.exe 86 PID 4400 wrote to memory of 1240 4400 vdppv.exe 86 PID 1240 wrote to memory of 1432 1240 rlffxxx.exe 87 PID 1240 wrote to memory of 1432 1240 rlffxxx.exe 87 PID 1240 wrote to memory of 1432 1240 rlffxxx.exe 87 PID 1432 wrote to memory of 1372 1432 hhnbnh.exe 88 PID 1432 wrote to memory of 1372 1432 hhnbnh.exe 88 PID 1432 wrote to memory of 1372 1432 hhnbnh.exe 88 PID 1372 wrote to memory of 2400 1372 pjvpv.exe 89 PID 1372 wrote to memory of 2400 1372 pjvpv.exe 89 PID 1372 wrote to memory of 2400 1372 pjvpv.exe 89 PID 2400 wrote to memory of 3016 2400 tnnnhh.exe 90 PID 2400 wrote to memory of 3016 2400 tnnnhh.exe 90 PID 2400 wrote to memory of 3016 2400 tnnnhh.exe 90 PID 3016 wrote to memory of 4416 3016 dvjjj.exe 91 PID 3016 wrote to memory of 4416 3016 dvjjj.exe 91 PID 3016 wrote to memory of 4416 3016 dvjjj.exe 91 PID 4416 wrote to memory of 1292 4416 7xxrrrl.exe 92 PID 4416 wrote to memory of 1292 4416 7xxrrrl.exe 92 PID 4416 wrote to memory of 1292 4416 7xxrrrl.exe 92 PID 1292 wrote to memory of 1108 1292 htbttt.exe 93 PID 1292 wrote to memory of 1108 1292 htbttt.exe 93 PID 1292 wrote to memory of 1108 1292 htbttt.exe 93 PID 1108 wrote to memory of 1748 1108 ddpjj.exe 94 PID 1108 wrote to memory of 1748 1108 ddpjj.exe 94 PID 1108 wrote to memory of 1748 1108 ddpjj.exe 94 PID 1748 wrote to memory of 1964 1748 vppjd.exe 95 PID 1748 wrote to memory of 1964 1748 vppjd.exe 95 PID 1748 wrote to memory of 1964 1748 vppjd.exe 95 PID 1964 wrote to memory of 660 1964 tbhnht.exe 96 PID 1964 wrote to memory of 660 1964 tbhnht.exe 96 PID 1964 wrote to memory of 660 1964 tbhnht.exe 96 PID 660 wrote to memory of 444 660 jpppp.exe 97 PID 660 wrote to memory of 444 660 jpppp.exe 97 PID 660 wrote to memory of 444 660 jpppp.exe 97 PID 444 wrote to memory of 3060 444 rrxxrff.exe 98 PID 444 wrote to memory of 3060 444 rrxxrff.exe 98 PID 444 wrote to memory of 3060 444 rrxxrff.exe 98 PID 3060 wrote to memory of 1464 3060 9hhbtt.exe 99 PID 3060 wrote to memory of 1464 3060 9hhbtt.exe 99 PID 3060 wrote to memory of 1464 3060 9hhbtt.exe 99 PID 1464 wrote to memory of 1048 1464 jpvpp.exe 100 PID 1464 wrote to memory of 1048 1464 jpvpp.exe 100 PID 1464 wrote to memory of 1048 1464 jpvpp.exe 100 PID 1048 wrote to memory of 4276 1048 jjddp.exe 101 PID 1048 wrote to memory of 4276 1048 jjddp.exe 101 PID 1048 wrote to memory of 4276 1048 jjddp.exe 101 PID 4276 wrote to memory of 2568 4276 hbhbtn.exe 102 PID 4276 wrote to memory of 2568 4276 hbhbtn.exe 102 PID 4276 wrote to memory of 2568 4276 hbhbtn.exe 102 PID 2568 wrote to memory of 4936 2568 nnhbtt.exe 103 PID 2568 wrote to memory of 4936 2568 nnhbtt.exe 103 PID 2568 wrote to memory of 4936 2568 nnhbtt.exe 103 PID 4936 wrote to memory of 4156 4936 ddpjd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad3e133a1d97addedb841ddb0f92d42dcbaa5c6910bc854d622e07d4e3c8ed91.exe"C:\Users\Admin\AppData\Local\Temp\ad3e133a1d97addedb841ddb0f92d42dcbaa5c6910bc854d622e07d4e3c8ed91.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\jjvvd.exec:\jjvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\5xfxrrr.exec:\5xfxrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\vdppv.exec:\vdppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\rlffxxx.exec:\rlffxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\hhnbnh.exec:\hhnbnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\pjvpv.exec:\pjvpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\tnnnhh.exec:\tnnnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\dvjjj.exec:\dvjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\7xxrrrl.exec:\7xxrrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\htbttt.exec:\htbttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\ddpjj.exec:\ddpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\vppjd.exec:\vppjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\tbhnht.exec:\tbhnht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\jpppp.exec:\jpppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\rrxxrff.exec:\rrxxrff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\9hhbtt.exec:\9hhbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\jpvpp.exec:\jpvpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\jjddp.exec:\jjddp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\hbhbtn.exec:\hbhbtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\nnhbtt.exec:\nnhbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\ddpjd.exec:\ddpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\jdpjj.exec:\jdpjj.exe23⤵
- Executes dropped EXE
PID:4156 -
\??\c:\bbnnbt.exec:\bbnnbt.exe24⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vpvvv.exec:\vpvvv.exe25⤵
- Executes dropped EXE
PID:1760 -
\??\c:\llllxxl.exec:\llllxxl.exe26⤵
- Executes dropped EXE
PID:3976 -
\??\c:\rlrrlll.exec:\rlrrlll.exe27⤵
- Executes dropped EXE
PID:2236 -
\??\c:\thnthh.exec:\thnthh.exe28⤵
- Executes dropped EXE
PID:3268 -
\??\c:\pvpdp.exec:\pvpdp.exe29⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rrfxrxr.exec:\rrfxrxr.exe30⤵
- Executes dropped EXE
PID:3648 -
\??\c:\bttbtt.exec:\bttbtt.exe31⤵
- Executes dropped EXE
PID:540 -
\??\c:\vpvpp.exec:\vpvpp.exe32⤵
- Executes dropped EXE
PID:4852 -
\??\c:\pjjpj.exec:\pjjpj.exe33⤵
- Executes dropped EXE
PID:3064 -
\??\c:\llfxffl.exec:\llfxffl.exe34⤵
- Executes dropped EXE
PID:3024 -
\??\c:\thbbtt.exec:\thbbtt.exe35⤵
- Executes dropped EXE
PID:1060 -
\??\c:\jdddv.exec:\jdddv.exe36⤵
- Executes dropped EXE
PID:916 -
\??\c:\rrfflrr.exec:\rrfflrr.exe37⤵
- Executes dropped EXE
PID:3576 -
\??\c:\nhtttt.exec:\nhtttt.exe38⤵
- Executes dropped EXE
PID:3308 -
\??\c:\vvppd.exec:\vvppd.exe39⤵
- Executes dropped EXE
PID:212 -
\??\c:\lllfrxx.exec:\lllfrxx.exe40⤵
- Executes dropped EXE
PID:2828 -
\??\c:\nnbhbb.exec:\nnbhbb.exe41⤵
- Executes dropped EXE
PID:2360 -
\??\c:\ffxrlrx.exec:\ffxrlrx.exe42⤵
- Executes dropped EXE
PID:3424 -
\??\c:\1httth.exec:\1httth.exe43⤵
- Executes dropped EXE
PID:3920 -
\??\c:\vppdv.exec:\vppdv.exe44⤵
- Executes dropped EXE
PID:5060 -
\??\c:\rffxrfx.exec:\rffxrfx.exe45⤵
- Executes dropped EXE
PID:4736 -
\??\c:\vjdpj.exec:\vjdpj.exe46⤵
- Executes dropped EXE
PID:4572 -
\??\c:\jvjdd.exec:\jvjdd.exe47⤵
- Executes dropped EXE
PID:5032 -
\??\c:\xrxrffx.exec:\xrxrffx.exe48⤵
- Executes dropped EXE
PID:4340 -
\??\c:\tnthtn.exec:\tnthtn.exe49⤵
- Executes dropped EXE
PID:1460 -
\??\c:\vvjdv.exec:\vvjdv.exe50⤵
- Executes dropped EXE
PID:1432 -
\??\c:\rfflxxl.exec:\rfflxxl.exe51⤵
- Executes dropped EXE
PID:2900 -
\??\c:\ntbbtt.exec:\ntbbtt.exe52⤵
- Executes dropped EXE
PID:756 -
\??\c:\jpjjj.exec:\jpjjj.exe53⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rxrrxxf.exec:\rxrrxxf.exe54⤵
- Executes dropped EXE
PID:5028 -
\??\c:\tntnhh.exec:\tntnhh.exe55⤵
- Executes dropped EXE
PID:4172 -
\??\c:\pvdjd.exec:\pvdjd.exe56⤵
- Executes dropped EXE
PID:3904 -
\??\c:\lrxrlxr.exec:\lrxrlxr.exe57⤵
- Executes dropped EXE
PID:4176 -
\??\c:\fxflxxr.exec:\fxflxxr.exe58⤵
- Executes dropped EXE
PID:2632 -
\??\c:\thbbbb.exec:\thbbbb.exe59⤵
- Executes dropped EXE
PID:1292 -
\??\c:\pjjdv.exec:\pjjdv.exe60⤵
- Executes dropped EXE
PID:1584 -
\??\c:\fffxxxr.exec:\fffxxxr.exe61⤵
- Executes dropped EXE
PID:3052 -
\??\c:\rfffxxx.exec:\rfffxxx.exe62⤵
- Executes dropped EXE
PID:4508 -
\??\c:\nhhbtt.exec:\nhhbtt.exe63⤵
- Executes dropped EXE
PID:4900 -
\??\c:\pppjd.exec:\pppjd.exe64⤵
- Executes dropped EXE
PID:3660 -
\??\c:\frxrrrl.exec:\frxrrrl.exe65⤵
- Executes dropped EXE
PID:1376 -
\??\c:\nntnnt.exec:\nntnnt.exe66⤵PID:4168
-
\??\c:\dvvpj.exec:\dvvpj.exe67⤵PID:4844
-
\??\c:\fxxrfff.exec:\fxxrfff.exe68⤵PID:3664
-
\??\c:\bhbbtt.exec:\bhbbtt.exe69⤵PID:1480
-
\??\c:\dvdvv.exec:\dvdvv.exe70⤵PID:3912
-
\??\c:\5rrlxlf.exec:\5rrlxlf.exe71⤵PID:4616
-
\??\c:\thnhhh.exec:\thnhhh.exe72⤵
- System Location Discovery: System Language Discovery
PID:4552 -
\??\c:\7ddvp.exec:\7ddvp.exe73⤵PID:3844
-
\??\c:\9jjdv.exec:\9jjdv.exe74⤵PID:2252
-
\??\c:\frfxrrl.exec:\frfxrrl.exe75⤵PID:5008
-
\??\c:\3nttnn.exec:\3nttnn.exe76⤵PID:4068
-
\??\c:\jvdpj.exec:\jvdpj.exe77⤵PID:1708
-
\??\c:\rrxrlll.exec:\rrxrlll.exe78⤵PID:2976
-
\??\c:\xrrfxlf.exec:\xrrfxlf.exe79⤵PID:4348
-
\??\c:\tnnbtn.exec:\tnnbtn.exe80⤵PID:952
-
\??\c:\bhbtnh.exec:\bhbtnh.exe81⤵PID:3956
-
\??\c:\jjddp.exec:\jjddp.exe82⤵PID:1492
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe83⤵PID:116
-
\??\c:\7tnbnn.exec:\7tnbnn.exe84⤵PID:4796
-
\??\c:\7nthhh.exec:\7nthhh.exe85⤵PID:4944
-
\??\c:\dppjp.exec:\dppjp.exe86⤵PID:4372
-
\??\c:\rffxffr.exec:\rffxffr.exe87⤵PID:3064
-
\??\c:\nntnhh.exec:\nntnhh.exe88⤵PID:4880
-
\??\c:\vvvdp.exec:\vvvdp.exe89⤵PID:208
-
\??\c:\7vvjd.exec:\7vvjd.exe90⤵PID:916
-
\??\c:\btbhbb.exec:\btbhbb.exe91⤵PID:2068
-
\??\c:\dpvvv.exec:\dpvvv.exe92⤵PID:5048
-
\??\c:\pjjjp.exec:\pjjjp.exe93⤵PID:1908
-
\??\c:\frrrrlf.exec:\frrrrlf.exe94⤵
- System Location Discovery: System Language Discovery
PID:2828 -
\??\c:\htnhbh.exec:\htnhbh.exe95⤵PID:2360
-
\??\c:\jdvdv.exec:\jdvdv.exe96⤵PID:1896
-
\??\c:\xrlllrx.exec:\xrlllrx.exe97⤵PID:316
-
\??\c:\lrrxrff.exec:\lrrxrff.exe98⤵PID:3628
-
\??\c:\vjpjv.exec:\vjpjv.exe99⤵PID:4736
-
\??\c:\vpvpj.exec:\vpvpj.exe100⤵PID:996
-
\??\c:\xlxllll.exec:\xlxllll.exe101⤵PID:924
-
\??\c:\5hbtnh.exec:\5hbtnh.exe102⤵PID:5068
-
\??\c:\jvdpj.exec:\jvdpj.exe103⤵PID:4868
-
\??\c:\1vppj.exec:\1vppj.exe104⤵PID:2960
-
\??\c:\3fxlxxr.exec:\3fxlxxr.exe105⤵PID:3884
-
\??\c:\3hhbnt.exec:\3hhbnt.exe106⤵PID:2900
-
\??\c:\pvpdv.exec:\pvpdv.exe107⤵PID:1384
-
\??\c:\1rlffll.exec:\1rlffll.exe108⤵PID:2032
-
\??\c:\hnhtnn.exec:\hnhtnn.exe109⤵PID:2152
-
\??\c:\pvvpd.exec:\pvvpd.exe110⤵PID:1984
-
\??\c:\rxlxrrr.exec:\rxlxrrr.exe111⤵PID:3904
-
\??\c:\bntnhn.exec:\bntnhn.exe112⤵PID:4808
-
\??\c:\tnnhbb.exec:\tnnhbb.exe113⤵PID:4896
-
\??\c:\3vvpp.exec:\3vvpp.exe114⤵PID:3932
-
\??\c:\1frlfff.exec:\1frlfff.exe115⤵PID:1292
-
\??\c:\hthbbt.exec:\hthbbt.exe116⤵PID:2140
-
\??\c:\pjpjd.exec:\pjpjd.exe117⤵PID:4692
-
\??\c:\1lxrrxl.exec:\1lxrrxl.exe118⤵PID:4964
-
\??\c:\bnhbhb.exec:\bnhbhb.exe119⤵PID:4508
-
\??\c:\9htntt.exec:\9htntt.exe120⤵PID:3472
-
\??\c:\dpvpj.exec:\dpvpj.exe121⤵PID:1948
-
\??\c:\lrfxxxr.exec:\lrfxxxr.exe122⤵PID:3660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-