Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e090f8ec3f8ab9ed5418d366424c1f5c4c0eae3d7156954ad54f5ffd908ed8d8.exe
Resource
win7-20240708-en
7 signatures
150 seconds
General
-
Target
e090f8ec3f8ab9ed5418d366424c1f5c4c0eae3d7156954ad54f5ffd908ed8d8.exe
-
Size
456KB
-
MD5
32e1140843a49039d3ec5ddcf59f863f
-
SHA1
7310c203f93cf5ec03e248c95301c765c94d0af8
-
SHA256
e090f8ec3f8ab9ed5418d366424c1f5c4c0eae3d7156954ad54f5ffd908ed8d8
-
SHA512
883812f676d582ec24b20b45f99f89f5349e8d1d0ffcd4a974d99d96c949a3048d371fc89c6ebdd1c1f947bf51213964729052d9fd55d3f75d0dbd0623b1bd8a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT6:q7Tc2NYHUrAwfMp3CDu
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1760-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/836-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1324-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2624-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/988-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-855-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-946-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-1043-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-1161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-1391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-1512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3240 jvdvp.exe 2908 frlflll.exe 3700 hhbbbb.exe 4616 1pjdv.exe 540 hbbbtn.exe 3112 bnbnbt.exe 4236 5dvdp.exe 4500 vpvjd.exe 2608 lflxlrf.exe 3136 bttnhb.exe 3572 1xxlfxf.exe 2832 1nbttt.exe 4708 5frlllx.exe 2460 xlrlrlx.exe 3888 bnnbnh.exe 928 9pddv.exe 2248 fllxlfr.exe 1736 tttnhb.exe 4480 jpvpp.exe 1920 rlfxlxr.exe 2212 ppjjd.exe 4992 ntthth.exe 2680 btthtn.exe 836 7pdvp.exe 2900 rxxrlfx.exe 4008 xxflxrf.exe 2068 7vvpd.exe 1324 ntbthb.exe 4476 pvvjd.exe 5020 ddvjj.exe 4688 3pvvv.exe 3220 5ddvd.exe 1284 rflfffx.exe 1468 pjpdd.exe 3632 pjpdp.exe 3756 lfflxxr.exe 2952 tttntn.exe 1508 ddjdp.exe 4404 xrfrllr.exe 3100 nnthtn.exe 2888 ttthtn.exe 4536 5pjdj.exe 1132 rlrlxll.exe 4956 nnbhbb.exe 3956 ntthtn.exe 4552 jdjdp.exe 4388 lffxlrr.exe 1196 hbbnhb.exe 4788 1pdvp.exe 2956 9ffxlfr.exe 4304 hnnbtn.exe 4792 ntbbnh.exe 2216 dvjpv.exe 3404 frrlfxx.exe 5076 nnnhbb.exe 3960 vdpjp.exe 3852 rllfrrl.exe 4616 9bbnbb.exe 216 hbtnhn.exe 4844 djjdd.exe 1724 3rlfrlx.exe 4556 nbbthb.exe 3192 htnnbh.exe 3980 1djdd.exe -
resource yara_rule behavioral2/memory/1760-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2624-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/988-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-855-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-946-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-1043-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-1161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-1321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-1391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-1512-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1760 wrote to memory of 3240 1760 e090f8ec3f8ab9ed5418d366424c1f5c4c0eae3d7156954ad54f5ffd908ed8d8.exe 82 PID 1760 wrote to memory of 3240 1760 e090f8ec3f8ab9ed5418d366424c1f5c4c0eae3d7156954ad54f5ffd908ed8d8.exe 82 PID 1760 wrote to memory of 3240 1760 e090f8ec3f8ab9ed5418d366424c1f5c4c0eae3d7156954ad54f5ffd908ed8d8.exe 82 PID 3240 wrote to memory of 2908 3240 jvdvp.exe 83 PID 3240 wrote to memory of 2908 3240 jvdvp.exe 83 PID 3240 wrote to memory of 2908 3240 jvdvp.exe 83 PID 2908 wrote to memory of 3700 2908 frlflll.exe 84 PID 2908 wrote to memory of 3700 2908 frlflll.exe 84 PID 2908 wrote to memory of 3700 2908 frlflll.exe 84 PID 3700 wrote to memory of 4616 3700 hhbbbb.exe 85 PID 3700 wrote to memory of 4616 3700 hhbbbb.exe 85 PID 3700 wrote to memory of 4616 3700 hhbbbb.exe 85 PID 4616 wrote to memory of 540 4616 1pjdv.exe 86 PID 4616 wrote to memory of 540 4616 1pjdv.exe 86 PID 4616 wrote to memory of 540 4616 1pjdv.exe 86 PID 540 wrote to memory of 3112 540 hbbbtn.exe 87 PID 540 wrote to memory of 3112 540 hbbbtn.exe 87 PID 540 wrote to memory of 3112 540 hbbbtn.exe 87 PID 3112 wrote to memory of 4236 3112 bnbnbt.exe 88 PID 3112 wrote to memory of 4236 3112 bnbnbt.exe 88 PID 3112 wrote to memory of 4236 3112 bnbnbt.exe 88 PID 4236 wrote to memory of 4500 4236 5dvdp.exe 89 PID 4236 wrote to memory of 4500 4236 5dvdp.exe 89 PID 4236 wrote to memory of 4500 4236 5dvdp.exe 89 PID 4500 wrote to memory of 2608 4500 vpvjd.exe 90 PID 4500 wrote to memory of 2608 4500 vpvjd.exe 90 PID 4500 wrote to memory of 2608 4500 vpvjd.exe 90 PID 2608 wrote to memory of 3136 2608 lflxlrf.exe 91 PID 2608 wrote to memory of 3136 2608 lflxlrf.exe 91 PID 2608 wrote to memory of 3136 2608 lflxlrf.exe 91 PID 3136 wrote to memory of 3572 3136 bttnhb.exe 92 PID 3136 wrote to memory of 3572 3136 bttnhb.exe 92 PID 3136 wrote to memory of 3572 3136 bttnhb.exe 92 PID 3572 wrote to memory of 2832 3572 1xxlfxf.exe 93 PID 3572 wrote to memory of 2832 3572 1xxlfxf.exe 93 PID 3572 wrote to memory of 2832 3572 1xxlfxf.exe 93 PID 2832 wrote to memory of 4708 2832 1nbttt.exe 94 PID 2832 wrote to memory of 4708 2832 1nbttt.exe 94 PID 2832 wrote to memory of 4708 2832 1nbttt.exe 94 PID 4708 wrote to memory of 2460 4708 5frlllx.exe 95 PID 4708 wrote to memory of 2460 4708 5frlllx.exe 95 PID 4708 wrote to memory of 2460 4708 5frlllx.exe 95 PID 2460 wrote to memory of 3888 2460 xlrlrlx.exe 96 PID 2460 wrote to memory of 3888 2460 xlrlrlx.exe 96 PID 2460 wrote to memory of 3888 2460 xlrlrlx.exe 96 PID 3888 wrote to memory of 928 3888 bnnbnh.exe 97 PID 3888 wrote to memory of 928 3888 bnnbnh.exe 97 PID 3888 wrote to memory of 928 3888 bnnbnh.exe 97 PID 928 wrote to memory of 2248 928 9pddv.exe 98 PID 928 wrote to memory of 2248 928 9pddv.exe 98 PID 928 wrote to memory of 2248 928 9pddv.exe 98 PID 2248 wrote to memory of 1736 2248 fllxlfr.exe 99 PID 2248 wrote to memory of 1736 2248 fllxlfr.exe 99 PID 2248 wrote to memory of 1736 2248 fllxlfr.exe 99 PID 1736 wrote to memory of 4480 1736 tttnhb.exe 100 PID 1736 wrote to memory of 4480 1736 tttnhb.exe 100 PID 1736 wrote to memory of 4480 1736 tttnhb.exe 100 PID 4480 wrote to memory of 1920 4480 jpvpp.exe 101 PID 4480 wrote to memory of 1920 4480 jpvpp.exe 101 PID 4480 wrote to memory of 1920 4480 jpvpp.exe 101 PID 1920 wrote to memory of 2212 1920 rlfxlxr.exe 102 PID 1920 wrote to memory of 2212 1920 rlfxlxr.exe 102 PID 1920 wrote to memory of 2212 1920 rlfxlxr.exe 102 PID 2212 wrote to memory of 4992 2212 ppjjd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\e090f8ec3f8ab9ed5418d366424c1f5c4c0eae3d7156954ad54f5ffd908ed8d8.exe"C:\Users\Admin\AppData\Local\Temp\e090f8ec3f8ab9ed5418d366424c1f5c4c0eae3d7156954ad54f5ffd908ed8d8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\jvdvp.exec:\jvdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\frlflll.exec:\frlflll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\hhbbbb.exec:\hhbbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\1pjdv.exec:\1pjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\hbbbtn.exec:\hbbbtn.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\bnbnbt.exec:\bnbnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\5dvdp.exec:\5dvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\vpvjd.exec:\vpvjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\lflxlrf.exec:\lflxlrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\bttnhb.exec:\bttnhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\1xxlfxf.exec:\1xxlfxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\1nbttt.exec:\1nbttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\5frlllx.exec:\5frlllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\xlrlrlx.exec:\xlrlrlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\bnnbnh.exec:\bnnbnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\9pddv.exec:\9pddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\fllxlfr.exec:\fllxlfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\tttnhb.exec:\tttnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\jpvpp.exec:\jpvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\rlfxlxr.exec:\rlfxlxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\ppjjd.exec:\ppjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\ntthth.exec:\ntthth.exe23⤵
- Executes dropped EXE
PID:4992 -
\??\c:\btthtn.exec:\btthtn.exe24⤵
- Executes dropped EXE
PID:2680 -
\??\c:\7pdvp.exec:\7pdvp.exe25⤵
- Executes dropped EXE
PID:836 -
\??\c:\rxxrlfx.exec:\rxxrlfx.exe26⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xxflxrf.exec:\xxflxrf.exe27⤵
- Executes dropped EXE
PID:4008 -
\??\c:\7vvpd.exec:\7vvpd.exe28⤵
- Executes dropped EXE
PID:2068 -
\??\c:\ntbthb.exec:\ntbthb.exe29⤵
- Executes dropped EXE
PID:1324 -
\??\c:\pvvjd.exec:\pvvjd.exe30⤵
- Executes dropped EXE
PID:4476 -
\??\c:\ddvjj.exec:\ddvjj.exe31⤵
- Executes dropped EXE
PID:5020 -
\??\c:\3pvvv.exec:\3pvvv.exe32⤵
- Executes dropped EXE
PID:4688 -
\??\c:\5ddvd.exec:\5ddvd.exe33⤵
- Executes dropped EXE
PID:3220 -
\??\c:\rflfffx.exec:\rflfffx.exe34⤵
- Executes dropped EXE
PID:1284 -
\??\c:\pjpdd.exec:\pjpdd.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1468 -
\??\c:\pjpdp.exec:\pjpdp.exe36⤵
- Executes dropped EXE
PID:3632 -
\??\c:\lfflxxr.exec:\lfflxxr.exe37⤵
- Executes dropped EXE
PID:3756 -
\??\c:\tttntn.exec:\tttntn.exe38⤵
- Executes dropped EXE
PID:2952 -
\??\c:\ddjdp.exec:\ddjdp.exe39⤵
- Executes dropped EXE
PID:1508 -
\??\c:\xrfrllr.exec:\xrfrllr.exe40⤵
- Executes dropped EXE
PID:4404 -
\??\c:\nnthtn.exec:\nnthtn.exe41⤵
- Executes dropped EXE
PID:3100 -
\??\c:\ttthtn.exec:\ttthtn.exe42⤵
- Executes dropped EXE
PID:2888 -
\??\c:\5pjdj.exec:\5pjdj.exe43⤵
- Executes dropped EXE
PID:4536 -
\??\c:\rlrlxll.exec:\rlrlxll.exe44⤵
- Executes dropped EXE
PID:1132 -
\??\c:\nnbhbb.exec:\nnbhbb.exe45⤵
- Executes dropped EXE
PID:4956 -
\??\c:\ntthtn.exec:\ntthtn.exe46⤵
- Executes dropped EXE
PID:3956 -
\??\c:\jdjdp.exec:\jdjdp.exe47⤵
- Executes dropped EXE
PID:4552 -
\??\c:\lffxlrr.exec:\lffxlrr.exe48⤵
- Executes dropped EXE
PID:4388 -
\??\c:\hbbnhb.exec:\hbbnhb.exe49⤵
- Executes dropped EXE
PID:1196 -
\??\c:\1pdvp.exec:\1pdvp.exe50⤵
- Executes dropped EXE
PID:4788 -
\??\c:\9ffxlfr.exec:\9ffxlfr.exe51⤵
- Executes dropped EXE
PID:2956 -
\??\c:\hnnbtn.exec:\hnnbtn.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4304 -
\??\c:\ntbbnh.exec:\ntbbnh.exe53⤵
- Executes dropped EXE
PID:4792 -
\??\c:\dvjpv.exec:\dvjpv.exe54⤵
- Executes dropped EXE
PID:2216 -
\??\c:\frrlfxx.exec:\frrlfxx.exe55⤵
- Executes dropped EXE
PID:3404 -
\??\c:\nnnhbb.exec:\nnnhbb.exe56⤵
- Executes dropped EXE
PID:5076 -
\??\c:\vdpjp.exec:\vdpjp.exe57⤵
- Executes dropped EXE
PID:3960 -
\??\c:\rllfrrl.exec:\rllfrrl.exe58⤵
- Executes dropped EXE
PID:3852 -
\??\c:\9bbnbb.exec:\9bbnbb.exe59⤵
- Executes dropped EXE
PID:4616 -
\??\c:\hbtnhn.exec:\hbtnhn.exe60⤵
- Executes dropped EXE
PID:216 -
\??\c:\djjdd.exec:\djjdd.exe61⤵
- Executes dropped EXE
PID:4844 -
\??\c:\3rlfrlx.exec:\3rlfrlx.exe62⤵
- Executes dropped EXE
PID:1724 -
\??\c:\nbbthb.exec:\nbbthb.exe63⤵
- Executes dropped EXE
PID:4556 -
\??\c:\htnnbh.exec:\htnnbh.exe64⤵
- Executes dropped EXE
PID:3192 -
\??\c:\1djdd.exec:\1djdd.exe65⤵
- Executes dropped EXE
PID:3980 -
\??\c:\lrfxlfx.exec:\lrfxlfx.exe66⤵PID:2168
-
\??\c:\hhnbnh.exec:\hhnbnh.exe67⤵PID:512
-
\??\c:\nnhtnh.exec:\nnhtnh.exe68⤵PID:4856
-
\??\c:\jpvdv.exec:\jpvdv.exe69⤵PID:3572
-
\??\c:\rlflxlr.exec:\rlflxlr.exe70⤵PID:2832
-
\??\c:\htbttt.exec:\htbttt.exe71⤵PID:2644
-
\??\c:\vpjdv.exec:\vpjdv.exe72⤵PID:2816
-
\??\c:\flrflfx.exec:\flrflfx.exe73⤵PID:4716
-
\??\c:\nbbnbn.exec:\nbbnbn.exe74⤵PID:3760
-
\??\c:\vdpjd.exec:\vdpjd.exe75⤵PID:2124
-
\??\c:\pvvjv.exec:\pvvjv.exe76⤵PID:3184
-
\??\c:\xxxlxrf.exec:\xxxlxrf.exe77⤵PID:4820
-
\??\c:\1ttnhn.exec:\1ttnhn.exe78⤵PID:552
-
\??\c:\7tbtbb.exec:\7tbtbb.exe79⤵PID:2748
-
\??\c:\ddjdj.exec:\ddjdj.exe80⤵PID:4380
-
\??\c:\frfxlff.exec:\frfxlff.exe81⤵PID:2924
-
\??\c:\hthbtn.exec:\hthbtn.exe82⤵PID:4740
-
\??\c:\9tbnhn.exec:\9tbnhn.exe83⤵PID:1308
-
\??\c:\5pvpp.exec:\5pvpp.exe84⤵PID:3088
-
\??\c:\frrlfxr.exec:\frrlfxr.exe85⤵PID:1800
-
\??\c:\btnbnb.exec:\btnbnb.exe86⤵PID:4228
-
\??\c:\ttnhht.exec:\ttnhht.exe87⤵PID:2544
-
\??\c:\vpjdp.exec:\vpjdp.exe88⤵PID:972
-
\??\c:\lfrllrr.exec:\lfrllrr.exe89⤵PID:5000
-
\??\c:\bbhhtn.exec:\bbhhtn.exe90⤵PID:2080
-
\??\c:\jpvjd.exec:\jpvjd.exe91⤵PID:4904
-
\??\c:\vpddv.exec:\vpddv.exe92⤵PID:3000
-
\??\c:\flrlxxr.exec:\flrlxxr.exe93⤵PID:4072
-
\??\c:\7bbnbt.exec:\7bbnbt.exe94⤵PID:1380
-
\??\c:\bhhbnh.exec:\bhhbnh.exe95⤵PID:1752
-
\??\c:\9ddpd.exec:\9ddpd.exe96⤵PID:4540
-
\??\c:\lxxrffx.exec:\lxxrffx.exe97⤵PID:2820
-
\??\c:\nbbtbt.exec:\nbbtbt.exe98⤵PID:2948
-
\??\c:\7vjdp.exec:\7vjdp.exe99⤵PID:1276
-
\??\c:\vpvjv.exec:\vpvjv.exe100⤵PID:532
-
\??\c:\llrlfxf.exec:\llrlfxf.exe101⤵PID:1304
-
\??\c:\hbnhhb.exec:\hbnhhb.exe102⤵PID:1316
-
\??\c:\dpdvp.exec:\dpdvp.exe103⤵PID:3928
-
\??\c:\9xrxlxf.exec:\9xrxlxf.exe104⤵PID:2408
-
\??\c:\thnbbt.exec:\thnbbt.exe105⤵PID:1600
-
\??\c:\3pppj.exec:\3pppj.exe106⤵PID:1876
-
\??\c:\xllrffx.exec:\xllrffx.exe107⤵PID:4312
-
\??\c:\nhnhbb.exec:\nhnhbb.exe108⤵PID:3820
-
\??\c:\1nnbnn.exec:\1nnbnn.exe109⤵PID:2624
-
\??\c:\7vvpj.exec:\7vvpj.exe110⤵PID:1904
-
\??\c:\rllxrrl.exec:\rllxrrl.exe111⤵PID:2504
-
\??\c:\hbntnt.exec:\hbntnt.exe112⤵PID:3024
-
\??\c:\thnnbt.exec:\thnnbt.exe113⤵PID:2332
-
\??\c:\1dvpp.exec:\1dvpp.exe114⤵
- System Location Discovery: System Language Discovery
PID:208 -
\??\c:\frfxlfr.exec:\frfxlfr.exe115⤵PID:3144
-
\??\c:\nntnhb.exec:\nntnhb.exe116⤵PID:700
-
\??\c:\nttnbt.exec:\nttnbt.exe117⤵PID:748
-
\??\c:\jpvpd.exec:\jpvpd.exe118⤵PID:1964
-
\??\c:\pddpj.exec:\pddpj.exe119⤵PID:2324
-
\??\c:\rfxrllf.exec:\rfxrllf.exe120⤵PID:4440
-
\??\c:\hbbhhb.exec:\hbbhhb.exe121⤵PID:3224
-
\??\c:\jdddp.exec:\jdddp.exe122⤵PID:5076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-