Analysis
-
max time kernel
118s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2024 10:21
Behavioral task
behavioral1
Sample
3cde120534bd025cbb5fe6309adff820N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
3cde120534bd025cbb5fe6309adff820N.exe
-
Size
66KB
-
MD5
3cde120534bd025cbb5fe6309adff820
-
SHA1
20c06204c8221e5c8f7dbac06decd2142780dc45
-
SHA256
4d187763423dc8b8326126654012bd2aa2ddfeb3580307fd9153e9fb314bfc6c
-
SHA512
0eaeff459d4bfe32a5ccb6729cecc76639669cd0dd486f454f340267dfa7b95bdecdba74912692f4d0c30c70d9bd15adebe5ed32e2ad4c27be292486c27f0176
-
SSDEEP
1536:WvQBeOGtrYS3srx93UBWfwC6Ggnouy8DKsrQHbhnyLFWZ:WhOmTsF93UYfwC6GIoutz075yL6
Malware Config
Signatures
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1076-4-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2724-9-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3724-17-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4820-22-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5032-28-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2480-34-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3044-40-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5056-46-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2276-64-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2564-67-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3084-76-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3916-100-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4064-125-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1468-163-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1104-147-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1580-111-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3356-90-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4924-88-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3596-82-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1484-52-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5064-182-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1380-186-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/816-190-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5044-196-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2752-204-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4388-209-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/532-221-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/944-225-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1752-235-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4648-266-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2812-270-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1872-279-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4872-302-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1716-306-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2152-309-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1184-323-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2336-327-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3948-337-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1500-344-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2996-351-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1628-361-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2224-392-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4824-396-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4168-416-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5040-420-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5008-439-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2556-445-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3352-459-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4552-500-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5024-511-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1368-515-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1116-536-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3748-541-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5020-662-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4940-666-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5112-730-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3224-746-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/216-832-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5020-1027-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4948-1185-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1784-1365-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2196-1665-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2724 nhhhtb.exe 3724 jpppd.exe 4820 xxxlxxr.exe 5032 nnnnhn.exe 2480 hnhbtn.exe 3044 ddvdd.exe 5056 dpppv.exe 1484 fxrlffl.exe 4888 hnbbtb.exe 2276 hhhbhh.exe 2564 pvdpd.exe 3084 7pvvj.exe 3596 rfrrffl.exe 3356 lxxrrlf.exe 4924 nhhhbb.exe 3916 bhnnbt.exe 2496 9hhbbb.exe 1580 7pvpj.exe 4936 xrrlxxl.exe 2948 lfffrlf.exe 4064 9bttnn.exe 1876 hbnbbt.exe 4460 djppj.exe 2152 1pdpj.exe 1104 frlxlrr.exe 4032 3ffxfxr.exe 2336 hbbbhh.exe 3648 7tthbb.exe 1468 vdjvj.exe 3032 7jjjp.exe 4224 fllfrrl.exe 5064 ttnnhh.exe 1380 pvpdv.exe 816 xrrfllf.exe 5044 tttnht.exe 2872 3hbbnb.exe 3924 ppvpj.exe 2752 jdddd.exe 928 fxxxxxx.exe 4388 nhtnhn.exe 4756 ntbthh.exe 3876 vpjjj.exe 532 jdjdv.exe 944 lllfllr.exe 5108 hnbttt.exe 3080 tbtthn.exe 1752 ddvpj.exe 2740 vppvp.exe 5028 7flfxxx.exe 1484 ntbbtt.exe 3196 jvvvv.exe 4432 7jddv.exe 4168 frlfxxx.exe 868 rllfxxr.exe 4668 nnbbtt.exe 3488 bnnnbh.exe 4648 pjjdv.exe 2812 1jppv.exe 4340 xrrxfrl.exe 1872 nthhbb.exe 2556 thbtnh.exe 264 djjdp.exe 3220 vdpjv.exe 4472 frxrfff.exe -
resource yara_rule behavioral2/memory/1076-0-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x00090000000233fb-3.dat upx behavioral2/memory/1076-4-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/2724-9-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000a000000023454-10.dat upx behavioral2/files/0x000700000002345b-12.dat upx behavioral2/memory/3724-17-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002345c-20.dat upx behavioral2/memory/4820-22-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/5032-28-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002345e-26.dat upx behavioral2/files/0x000700000002345f-32.dat upx behavioral2/memory/2480-34-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3044-40-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023460-41.dat upx behavioral2/files/0x0007000000023461-44.dat upx behavioral2/memory/5056-46-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023462-50.dat upx behavioral2/files/0x0007000000023463-58.dat upx behavioral2/files/0x0007000000023464-61.dat upx behavioral2/memory/2276-64-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023465-68.dat upx behavioral2/memory/2564-67-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3596-74-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3084-76-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023468-86.dat upx behavioral2/memory/3916-100-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002346b-103.dat upx behavioral2/files/0x000700000002346e-114.dat upx behavioral2/memory/4064-125-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023471-130.dat upx behavioral2/files/0x0007000000023472-135.dat upx behavioral2/files/0x0007000000023473-142.dat upx behavioral2/files/0x0007000000023470-127.dat upx behavioral2/files/0x0007000000023474-145.dat upx behavioral2/files/0x0007000000023476-156.dat upx behavioral2/files/0x0007000000023477-162.dat upx behavioral2/memory/1468-163-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023478-167.dat upx behavioral2/files/0x0007000000023479-173.dat upx behavioral2/files/0x0007000000023475-152.dat upx behavioral2/memory/1104-147-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002346f-120.dat upx behavioral2/memory/1580-111-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002346c-110.dat upx behavioral2/files/0x000700000002346a-99.dat upx behavioral2/files/0x0007000000023469-94.dat upx behavioral2/memory/3356-90-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4924-88-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3596-82-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023467-81.dat upx behavioral2/files/0x0007000000023466-73.dat upx behavioral2/memory/1484-52-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002347a-177.dat upx behavioral2/memory/5064-182-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/1380-186-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/816-190-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/5044-196-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/2752-204-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4388-209-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/532-221-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/944-225-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/1752-235-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4648-266-0x0000000000400000-0x0000000000432000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1076 wrote to memory of 2724 1076 3cde120534bd025cbb5fe6309adff820N.exe 84 PID 1076 wrote to memory of 2724 1076 3cde120534bd025cbb5fe6309adff820N.exe 84 PID 1076 wrote to memory of 2724 1076 3cde120534bd025cbb5fe6309adff820N.exe 84 PID 2724 wrote to memory of 3724 2724 nhhhtb.exe 85 PID 2724 wrote to memory of 3724 2724 nhhhtb.exe 85 PID 2724 wrote to memory of 3724 2724 nhhhtb.exe 85 PID 3724 wrote to memory of 4820 3724 jpppd.exe 86 PID 3724 wrote to memory of 4820 3724 jpppd.exe 86 PID 3724 wrote to memory of 4820 3724 jpppd.exe 86 PID 4820 wrote to memory of 5032 4820 xxxlxxr.exe 87 PID 4820 wrote to memory of 5032 4820 xxxlxxr.exe 87 PID 4820 wrote to memory of 5032 4820 xxxlxxr.exe 87 PID 5032 wrote to memory of 2480 5032 nnnnhn.exe 88 PID 5032 wrote to memory of 2480 5032 nnnnhn.exe 88 PID 5032 wrote to memory of 2480 5032 nnnnhn.exe 88 PID 2480 wrote to memory of 3044 2480 hnhbtn.exe 89 PID 2480 wrote to memory of 3044 2480 hnhbtn.exe 89 PID 2480 wrote to memory of 3044 2480 hnhbtn.exe 89 PID 3044 wrote to memory of 5056 3044 ddvdd.exe 90 PID 3044 wrote to memory of 5056 3044 ddvdd.exe 90 PID 3044 wrote to memory of 5056 3044 ddvdd.exe 90 PID 5056 wrote to memory of 1484 5056 dpppv.exe 91 PID 5056 wrote to memory of 1484 5056 dpppv.exe 91 PID 5056 wrote to memory of 1484 5056 dpppv.exe 91 PID 1484 wrote to memory of 4888 1484 fxrlffl.exe 92 PID 1484 wrote to memory of 4888 1484 fxrlffl.exe 92 PID 1484 wrote to memory of 4888 1484 fxrlffl.exe 92 PID 4888 wrote to memory of 2276 4888 hnbbtb.exe 93 PID 4888 wrote to memory of 2276 4888 hnbbtb.exe 93 PID 4888 wrote to memory of 2276 4888 hnbbtb.exe 93 PID 2276 wrote to memory of 2564 2276 hhhbhh.exe 94 PID 2276 wrote to memory of 2564 2276 hhhbhh.exe 94 PID 2276 wrote to memory of 2564 2276 hhhbhh.exe 94 PID 2564 wrote to memory of 3084 2564 pvdpd.exe 95 PID 2564 wrote to memory of 3084 2564 pvdpd.exe 95 PID 2564 wrote to memory of 3084 2564 pvdpd.exe 95 PID 3084 wrote to memory of 3596 3084 7pvvj.exe 96 PID 3084 wrote to memory of 3596 3084 7pvvj.exe 96 PID 3084 wrote to memory of 3596 3084 7pvvj.exe 96 PID 3596 wrote to memory of 3356 3596 rfrrffl.exe 97 PID 3596 wrote to memory of 3356 3596 rfrrffl.exe 97 PID 3596 wrote to memory of 3356 3596 rfrrffl.exe 97 PID 3356 wrote to memory of 4924 3356 lxxrrlf.exe 98 PID 3356 wrote to memory of 4924 3356 lxxrrlf.exe 98 PID 3356 wrote to memory of 4924 3356 lxxrrlf.exe 98 PID 4924 wrote to memory of 3916 4924 nhhhbb.exe 100 PID 4924 wrote to memory of 3916 4924 nhhhbb.exe 100 PID 4924 wrote to memory of 3916 4924 nhhhbb.exe 100 PID 3916 wrote to memory of 2496 3916 bhnnbt.exe 101 PID 3916 wrote to memory of 2496 3916 bhnnbt.exe 101 PID 3916 wrote to memory of 2496 3916 bhnnbt.exe 101 PID 2496 wrote to memory of 1580 2496 9hhbbb.exe 102 PID 2496 wrote to memory of 1580 2496 9hhbbb.exe 102 PID 2496 wrote to memory of 1580 2496 9hhbbb.exe 102 PID 1580 wrote to memory of 4936 1580 7pvpj.exe 103 PID 1580 wrote to memory of 4936 1580 7pvpj.exe 103 PID 1580 wrote to memory of 4936 1580 7pvpj.exe 103 PID 4936 wrote to memory of 2948 4936 xrrlxxl.exe 104 PID 4936 wrote to memory of 2948 4936 xrrlxxl.exe 104 PID 4936 wrote to memory of 2948 4936 xrrlxxl.exe 104 PID 2948 wrote to memory of 4064 2948 lfffrlf.exe 105 PID 2948 wrote to memory of 4064 2948 lfffrlf.exe 105 PID 2948 wrote to memory of 4064 2948 lfffrlf.exe 105 PID 4064 wrote to memory of 1876 4064 9bttnn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cde120534bd025cbb5fe6309adff820N.exe"C:\Users\Admin\AppData\Local\Temp\3cde120534bd025cbb5fe6309adff820N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\nhhhtb.exec:\nhhhtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\jpppd.exec:\jpppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\xxxlxxr.exec:\xxxlxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\nnnnhn.exec:\nnnnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\hnhbtn.exec:\hnhbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\ddvdd.exec:\ddvdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\dpppv.exec:\dpppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\fxrlffl.exec:\fxrlffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\hnbbtb.exec:\hnbbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\hhhbhh.exec:\hhhbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\pvdpd.exec:\pvdpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\7pvvj.exec:\7pvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\rfrrffl.exec:\rfrrffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\lxxrrlf.exec:\lxxrrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\nhhhbb.exec:\nhhhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\bhnnbt.exec:\bhnnbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\9hhbbb.exec:\9hhbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\7pvpj.exec:\7pvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\xrrlxxl.exec:\xrrlxxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\lfffrlf.exec:\lfffrlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\9bttnn.exec:\9bttnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\hbnbbt.exec:\hbnbbt.exe23⤵
- Executes dropped EXE
PID:1876 -
\??\c:\djppj.exec:\djppj.exe24⤵
- Executes dropped EXE
PID:4460 -
\??\c:\1pdpj.exec:\1pdpj.exe25⤵
- Executes dropped EXE
PID:2152 -
\??\c:\frlxlrr.exec:\frlxlrr.exe26⤵
- Executes dropped EXE
PID:1104 -
\??\c:\3ffxfxr.exec:\3ffxfxr.exe27⤵
- Executes dropped EXE
PID:4032 -
\??\c:\hbbbhh.exec:\hbbbhh.exe28⤵
- Executes dropped EXE
PID:2336 -
\??\c:\7tthbb.exec:\7tthbb.exe29⤵
- Executes dropped EXE
PID:3648 -
\??\c:\vdjvj.exec:\vdjvj.exe30⤵
- Executes dropped EXE
PID:1468 -
\??\c:\7jjjp.exec:\7jjjp.exe31⤵
- Executes dropped EXE
PID:3032 -
\??\c:\fllfrrl.exec:\fllfrrl.exe32⤵
- Executes dropped EXE
PID:4224 -
\??\c:\ttnnhh.exec:\ttnnhh.exe33⤵
- Executes dropped EXE
PID:5064 -
\??\c:\pvpdv.exec:\pvpdv.exe34⤵
- Executes dropped EXE
PID:1380 -
\??\c:\xrrfllf.exec:\xrrfllf.exe35⤵
- Executes dropped EXE
PID:816 -
\??\c:\tttnht.exec:\tttnht.exe36⤵
- Executes dropped EXE
PID:5044 -
\??\c:\3hbbnb.exec:\3hbbnb.exe37⤵
- Executes dropped EXE
PID:2872 -
\??\c:\ppvpj.exec:\ppvpj.exe38⤵
- Executes dropped EXE
PID:3924 -
\??\c:\jdddd.exec:\jdddd.exe39⤵
- Executes dropped EXE
PID:2752 -
\??\c:\fxxxxxx.exec:\fxxxxxx.exe40⤵
- Executes dropped EXE
PID:928 -
\??\c:\nhtnhn.exec:\nhtnhn.exe41⤵
- Executes dropped EXE
PID:4388 -
\??\c:\ntbthh.exec:\ntbthh.exe42⤵
- Executes dropped EXE
PID:4756 -
\??\c:\vpjjj.exec:\vpjjj.exe43⤵
- Executes dropped EXE
PID:3876 -
\??\c:\jdjdv.exec:\jdjdv.exe44⤵
- Executes dropped EXE
PID:532 -
\??\c:\lllfllr.exec:\lllfllr.exe45⤵
- Executes dropped EXE
PID:944 -
\??\c:\hnbttt.exec:\hnbttt.exe46⤵
- Executes dropped EXE
PID:5108 -
\??\c:\tbtthn.exec:\tbtthn.exe47⤵
- Executes dropped EXE
PID:3080 -
\??\c:\ddvpj.exec:\ddvpj.exe48⤵
- Executes dropped EXE
PID:1752 -
\??\c:\vppvp.exec:\vppvp.exe49⤵
- Executes dropped EXE
PID:2740 -
\??\c:\7flfxxx.exec:\7flfxxx.exe50⤵
- Executes dropped EXE
PID:5028 -
\??\c:\ntbbtt.exec:\ntbbtt.exe51⤵
- Executes dropped EXE
PID:1484 -
\??\c:\jvvvv.exec:\jvvvv.exe52⤵
- Executes dropped EXE
PID:3196 -
\??\c:\7jddv.exec:\7jddv.exe53⤵
- Executes dropped EXE
PID:4432 -
\??\c:\frlfxxx.exec:\frlfxxx.exe54⤵
- Executes dropped EXE
PID:4168 -
\??\c:\rllfxxr.exec:\rllfxxr.exe55⤵
- Executes dropped EXE
PID:868 -
\??\c:\nnbbtt.exec:\nnbbtt.exe56⤵
- Executes dropped EXE
PID:4668 -
\??\c:\bnnnbh.exec:\bnnnbh.exe57⤵
- Executes dropped EXE
PID:3488 -
\??\c:\pjjdv.exec:\pjjdv.exe58⤵
- Executes dropped EXE
PID:4648 -
\??\c:\1jppv.exec:\1jppv.exe59⤵
- Executes dropped EXE
PID:2812 -
\??\c:\xrrxfrl.exec:\xrrxfrl.exe60⤵
- Executes dropped EXE
PID:4340 -
\??\c:\nthhbb.exec:\nthhbb.exe61⤵
- Executes dropped EXE
PID:1872 -
\??\c:\thbtnh.exec:\thbtnh.exe62⤵
- Executes dropped EXE
PID:2556 -
\??\c:\djjdp.exec:\djjdp.exe63⤵
- Executes dropped EXE
PID:264 -
\??\c:\vdpjv.exec:\vdpjv.exe64⤵
- Executes dropped EXE
PID:3220 -
\??\c:\frxrfff.exec:\frxrfff.exe65⤵
- Executes dropped EXE
PID:4472 -
\??\c:\rxrffrl.exec:\rxrffrl.exe66⤵PID:2768
-
\??\c:\3rlfxlf.exec:\3rlfxlf.exe67⤵PID:1964
-
\??\c:\5bntbh.exec:\5bntbh.exe68⤵PID:3796
-
\??\c:\dvpdj.exec:\dvpdj.exe69⤵PID:4872
-
\??\c:\5dppd.exec:\5dppd.exe70⤵PID:1716
-
\??\c:\9rrlllf.exec:\9rrlllf.exe71⤵PID:2152
-
\??\c:\5nnbth.exec:\5nnbth.exe72⤵
- System Location Discovery: System Language Discovery
PID:2416 -
\??\c:\5tnnbb.exec:\5tnnbb.exe73⤵PID:3952
-
\??\c:\djpdv.exec:\djpdv.exe74⤵PID:4032
-
\??\c:\5ffxrrl.exec:\5ffxrrl.exe75⤵PID:1184
-
\??\c:\9rllflf.exec:\9rllflf.exe76⤵PID:2336
-
\??\c:\9bhhnn.exec:\9bhhnn.exe77⤵PID:2252
-
\??\c:\tnnnbb.exec:\tnnnbb.exe78⤵PID:2848
-
\??\c:\dvppp.exec:\dvppp.exe79⤵PID:3948
-
\??\c:\vvddv.exec:\vvddv.exe80⤵PID:4224
-
\??\c:\xxflllr.exec:\xxflllr.exe81⤵PID:1500
-
\??\c:\rlrffxl.exec:\rlrffxl.exe82⤵PID:3448
-
\??\c:\thhbtt.exec:\thhbtt.exe83⤵PID:2996
-
\??\c:\dvpdv.exec:\dvpdv.exe84⤵PID:3588
-
\??\c:\xflxlxl.exec:\xflxlxl.exe85⤵PID:3864
-
\??\c:\xxxfxrl.exec:\xxxfxrl.exe86⤵PID:1628
-
\??\c:\bnnnhh.exec:\bnnnhh.exe87⤵PID:3524
-
\??\c:\bbttbb.exec:\bbttbb.exe88⤵PID:2980
-
\??\c:\jddvp.exec:\jddvp.exe89⤵PID:2120
-
\??\c:\7jvjp.exec:\7jvjp.exe90⤵PID:2148
-
\??\c:\1rflfxx.exec:\1rflfxx.exe91⤵PID:3008
-
\??\c:\rxxrllf.exec:\rxxrllf.exe92⤵PID:1504
-
\??\c:\ddpdp.exec:\ddpdp.exe93⤵PID:4028
-
\??\c:\pvpjd.exec:\pvpjd.exe94⤵PID:3748
-
\??\c:\vpvpd.exec:\vpvpd.exe95⤵PID:3484
-
\??\c:\5llffxr.exec:\5llffxr.exe96⤵PID:2224
-
\??\c:\5xllffx.exec:\5xllffx.exe97⤵PID:4824
-
\??\c:\btttnh.exec:\btttnh.exe98⤵PID:3044
-
\??\c:\hnbbtt.exec:\hnbbtt.exe99⤵PID:2800
-
\??\c:\3pjpp.exec:\3pjpp.exe100⤵PID:1484
-
\??\c:\3jddv.exec:\3jddv.exe101⤵PID:1288
-
\??\c:\llrfrrr.exec:\llrfrrr.exe102⤵PID:3452
-
\??\c:\3flflfl.exec:\3flflfl.exe103⤵PID:4168
-
\??\c:\xlflfxr.exec:\xlflfxr.exe104⤵PID:5040
-
\??\c:\9bbbnh.exec:\9bbbnh.exe105⤵PID:3300
-
\??\c:\hthtnn.exec:\hthtnn.exe106⤵PID:5004
-
\??\c:\jvpjj.exec:\jvpjj.exe107⤵PID:1536
-
\??\c:\3dppj.exec:\3dppj.exe108⤵PID:3960
-
\??\c:\xxfxrxr.exec:\xxfxrxr.exe109⤵
- System Location Discovery: System Language Discovery
PID:4352 -
\??\c:\xxlrllf.exec:\xxlrllf.exe110⤵PID:5008
-
\??\c:\ttttnt.exec:\ttttnt.exe111⤵PID:2556
-
\??\c:\tbnnnh.exec:\tbnnnh.exe112⤵PID:2412
-
\??\c:\ppvpj.exec:\ppvpj.exe113⤵PID:4072
-
\??\c:\dvpvp.exec:\dvpvp.exe114⤵PID:4688
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe115⤵PID:1528
-
\??\c:\fxffxxf.exec:\fxffxxf.exe116⤵PID:3352
-
\??\c:\htnntt.exec:\htnntt.exe117⤵PID:1960
-
\??\c:\bbnhbn.exec:\bbnhbn.exe118⤵PID:4336
-
\??\c:\hbnhnn.exec:\hbnhnn.exe119⤵PID:1776
-
\??\c:\djpjd.exec:\djpjd.exe120⤵PID:4468
-
\??\c:\5djdj.exec:\5djdj.exe121⤵
- System Location Discovery: System Language Discovery
PID:1544 -
\??\c:\lfxxrll.exec:\lfxxrll.exe122⤵PID:3952
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-