Analysis
-
max time kernel
120s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2024, 22:33
Behavioral task
behavioral1
Sample
f7c292db8e0f3fc8ebbac71966119830N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
f7c292db8e0f3fc8ebbac71966119830N.exe
-
Size
296KB
-
MD5
f7c292db8e0f3fc8ebbac71966119830
-
SHA1
51bda2de6b7dffe09ac8b296ab922e0f37b8acb6
-
SHA256
fe4c918639b8b69165208e767abf0043776909a946a09839988a1f97fd121fb8
-
SHA512
9f79b796a91861fc07efba524aa21dd82478e650d9b44bb2d3d2012f5ccc3544e3f2272f93ac26fb82f8012468cd4a7b7468873f11e72d71f61e978388f8dd7f
-
SSDEEP
6144:ccm4FmowdHoSQkuObHq9ltAszBd+za/p1slTjZXvEQo9dftOM:K4wFHoSQkuUHk1zBR/pMT9XvEhdf1
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3556-5-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2460-12-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2860-29-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3732-24-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/764-14-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1532-42-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2896-47-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4408-53-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3000-59-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3892-65-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5032-69-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4208-76-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4764-84-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3832-105-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2992-95-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3884-83-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/428-123-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4344-131-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2400-160-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/824-153-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2500-119-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3692-117-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4912-174-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1340-185-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2820-190-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4148-197-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2212-204-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4888-213-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4800-232-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/976-248-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4208-252-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3884-256-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2336-266-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4428-279-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2780-286-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/972-290-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4132-294-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3712-307-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2264-311-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1616-315-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4792-328-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3732-350-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/208-366-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3264-370-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/232-380-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3876-387-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3196-391-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2288-420-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3524-439-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2912-455-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1224-495-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2748-529-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5028-536-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/976-547-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3284-551-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1088-564-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5056-610-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2140-704-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4236-744-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4312-781-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4876-788-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4980-804-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4020-1022-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 764 5xfxxxr.exe 2460 7bhhtb.exe 3052 vvjdj.exe 3732 rlrlffx.exe 2860 bhhhbb.exe 1532 rrffxxr.exe 2896 ntthhb.exe 4408 lllfflf.exe 3000 nntntt.exe 3892 1rflffx.exe 5032 5pvpp.exe 4208 9tbnbn.exe 3884 pdjjp.exe 4764 fxrrlll.exe 2992 5ffrrxf.exe 3640 vjvvp.exe 3832 rllllll.exe 5116 nnnbhh.exe 3692 nhttnn.exe 2500 7bnhtt.exe 428 3pppj.exe 4344 lxlfffx.exe 3524 xxllrrx.exe 4748 dvjdv.exe 4464 1llfxxr.exe 824 3hnhhh.exe 2400 pppjp.exe 4052 frxrrrr.exe 4912 rffflfl.exe 2128 9hnhnn.exe 1340 flrxxfx.exe 2820 btbbtb.exe 1224 pppvp.exe 4148 llllffx.exe 1008 thnnhh.exe 2212 7bhhbb.exe 4648 vpddp.exe 4024 fxrlxxf.exe 4888 hnbtnh.exe 1888 3tnnnn.exe 4856 dpvpj.exe 3400 dvdvv.exe 2632 5xlllll.exe 4868 rffxrrl.exe 4800 hbhbbb.exe 1456 3vpjj.exe 984 lxlfxrr.exe 3892 rflllll.exe 2576 tbbbbb.exe 976 jpjpj.exe 4208 rfxfxff.exe 3884 7ttnbb.exe 4840 9jdjd.exe 2992 3rxrrrr.exe 2336 fxxrrlx.exe 2288 bbbttt.exe 2824 dppjd.exe 1280 frlxrlx.exe 4428 xxfxxff.exe 4820 bntnnn.exe 2780 1dpjp.exe 972 xrrlfxl.exe 4132 bnhbtt.exe 772 vjddv.exe -
resource yara_rule behavioral2/memory/3556-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000900000002341e-3.dat upx behavioral2/memory/3556-5-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002347c-11.dat upx behavioral2/memory/2460-12-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002347d-21.dat upx behavioral2/files/0x000700000002347f-28.dat upx behavioral2/memory/2860-29-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3732-24-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/764-14-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000900000002346a-10.dat upx behavioral2/files/0x0007000000023480-33.dat upx behavioral2/memory/1532-36-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023481-39.dat upx behavioral2/memory/1532-42-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023482-45.dat upx behavioral2/memory/2896-47-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4408-53-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023483-51.dat upx behavioral2/files/0x0007000000023484-57.dat upx behavioral2/memory/3000-59-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3892-65-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023485-63.dat upx behavioral2/memory/5032-69-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023486-70.dat upx behavioral2/files/0x0007000000023487-74.dat upx behavioral2/memory/4208-76-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023488-80.dat upx behavioral2/memory/4764-84-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023489-88.dat upx behavioral2/files/0x000700000002348a-92.dat upx behavioral2/files/0x000b000000023470-98.dat upx behavioral2/memory/3832-105-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002348b-103.dat upx behavioral2/memory/2992-95-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3884-83-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002348c-109.dat upx behavioral2/files/0x000700000002348d-114.dat upx behavioral2/files/0x000700000002348e-121.dat upx behavioral2/memory/428-123-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002348f-127.dat upx behavioral2/memory/4344-131-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023490-133.dat upx behavioral2/files/0x000a0000000233bc-140.dat upx behavioral2/memory/4748-141-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023492-144.dat upx behavioral2/files/0x0007000000023493-150.dat upx behavioral2/files/0x0007000000023494-155.dat upx behavioral2/memory/2400-160-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4052-163-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023495-162.dat upx behavioral2/memory/824-153-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2500-119-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3692-117-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023496-168.dat upx behavioral2/files/0x0007000000023497-172.dat upx behavioral2/memory/4912-174-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023498-179.dat upx behavioral2/files/0x0007000000023499-183.dat upx behavioral2/memory/1340-185-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2820-190-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4148-197-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2212-204-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4888-213-0x0000000000400000-0x0000000000434000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3556 wrote to memory of 764 3556 f7c292db8e0f3fc8ebbac71966119830N.exe 84 PID 3556 wrote to memory of 764 3556 f7c292db8e0f3fc8ebbac71966119830N.exe 84 PID 3556 wrote to memory of 764 3556 f7c292db8e0f3fc8ebbac71966119830N.exe 84 PID 764 wrote to memory of 2460 764 5xfxxxr.exe 85 PID 764 wrote to memory of 2460 764 5xfxxxr.exe 85 PID 764 wrote to memory of 2460 764 5xfxxxr.exe 85 PID 2460 wrote to memory of 3052 2460 7bhhtb.exe 86 PID 2460 wrote to memory of 3052 2460 7bhhtb.exe 86 PID 2460 wrote to memory of 3052 2460 7bhhtb.exe 86 PID 3052 wrote to memory of 3732 3052 vvjdj.exe 87 PID 3052 wrote to memory of 3732 3052 vvjdj.exe 87 PID 3052 wrote to memory of 3732 3052 vvjdj.exe 87 PID 3732 wrote to memory of 2860 3732 rlrlffx.exe 88 PID 3732 wrote to memory of 2860 3732 rlrlffx.exe 88 PID 3732 wrote to memory of 2860 3732 rlrlffx.exe 88 PID 2860 wrote to memory of 1532 2860 bhhhbb.exe 89 PID 2860 wrote to memory of 1532 2860 bhhhbb.exe 89 PID 2860 wrote to memory of 1532 2860 bhhhbb.exe 89 PID 1532 wrote to memory of 2896 1532 rrffxxr.exe 90 PID 1532 wrote to memory of 2896 1532 rrffxxr.exe 90 PID 1532 wrote to memory of 2896 1532 rrffxxr.exe 90 PID 2896 wrote to memory of 4408 2896 ntthhb.exe 91 PID 2896 wrote to memory of 4408 2896 ntthhb.exe 91 PID 2896 wrote to memory of 4408 2896 ntthhb.exe 91 PID 4408 wrote to memory of 3000 4408 lllfflf.exe 92 PID 4408 wrote to memory of 3000 4408 lllfflf.exe 92 PID 4408 wrote to memory of 3000 4408 lllfflf.exe 92 PID 3000 wrote to memory of 3892 3000 nntntt.exe 95 PID 3000 wrote to memory of 3892 3000 nntntt.exe 95 PID 3000 wrote to memory of 3892 3000 nntntt.exe 95 PID 3892 wrote to memory of 5032 3892 1rflffx.exe 97 PID 3892 wrote to memory of 5032 3892 1rflffx.exe 97 PID 3892 wrote to memory of 5032 3892 1rflffx.exe 97 PID 5032 wrote to memory of 4208 5032 5pvpp.exe 98 PID 5032 wrote to memory of 4208 5032 5pvpp.exe 98 PID 5032 wrote to memory of 4208 5032 5pvpp.exe 98 PID 4208 wrote to memory of 3884 4208 9tbnbn.exe 99 PID 4208 wrote to memory of 3884 4208 9tbnbn.exe 99 PID 4208 wrote to memory of 3884 4208 9tbnbn.exe 99 PID 3884 wrote to memory of 4764 3884 pdjjp.exe 100 PID 3884 wrote to memory of 4764 3884 pdjjp.exe 100 PID 3884 wrote to memory of 4764 3884 pdjjp.exe 100 PID 4764 wrote to memory of 2992 4764 fxrrlll.exe 101 PID 4764 wrote to memory of 2992 4764 fxrrlll.exe 101 PID 4764 wrote to memory of 2992 4764 fxrrlll.exe 101 PID 2992 wrote to memory of 3640 2992 5ffrrxf.exe 102 PID 2992 wrote to memory of 3640 2992 5ffrrxf.exe 102 PID 2992 wrote to memory of 3640 2992 5ffrrxf.exe 102 PID 3640 wrote to memory of 3832 3640 vjvvp.exe 103 PID 3640 wrote to memory of 3832 3640 vjvvp.exe 103 PID 3640 wrote to memory of 3832 3640 vjvvp.exe 103 PID 3832 wrote to memory of 5116 3832 rllllll.exe 104 PID 3832 wrote to memory of 5116 3832 rllllll.exe 104 PID 3832 wrote to memory of 5116 3832 rllllll.exe 104 PID 5116 wrote to memory of 3692 5116 nnnbhh.exe 105 PID 5116 wrote to memory of 3692 5116 nnnbhh.exe 105 PID 5116 wrote to memory of 3692 5116 nnnbhh.exe 105 PID 3692 wrote to memory of 2500 3692 nhttnn.exe 106 PID 3692 wrote to memory of 2500 3692 nhttnn.exe 106 PID 3692 wrote to memory of 2500 3692 nhttnn.exe 106 PID 2500 wrote to memory of 428 2500 7bnhtt.exe 107 PID 2500 wrote to memory of 428 2500 7bnhtt.exe 107 PID 2500 wrote to memory of 428 2500 7bnhtt.exe 107 PID 428 wrote to memory of 4344 428 3pppj.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7c292db8e0f3fc8ebbac71966119830N.exe"C:\Users\Admin\AppData\Local\Temp\f7c292db8e0f3fc8ebbac71966119830N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\5xfxxxr.exec:\5xfxxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\7bhhtb.exec:\7bhhtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\vvjdj.exec:\vvjdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\rlrlffx.exec:\rlrlffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\bhhhbb.exec:\bhhhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\rrffxxr.exec:\rrffxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\ntthhb.exec:\ntthhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\lllfflf.exec:\lllfflf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\nntntt.exec:\nntntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\1rflffx.exec:\1rflffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\5pvpp.exec:\5pvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\9tbnbn.exec:\9tbnbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\pdjjp.exec:\pdjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\fxrrlll.exec:\fxrrlll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\5ffrrxf.exec:\5ffrrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\vjvvp.exec:\vjvvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\rllllll.exec:\rllllll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\nnnbhh.exec:\nnnbhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\nhttnn.exec:\nhttnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\7bnhtt.exec:\7bnhtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\3pppj.exec:\3pppj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\lxlfffx.exec:\lxlfffx.exe23⤵
- Executes dropped EXE
PID:4344 -
\??\c:\xxllrrx.exec:\xxllrrx.exe24⤵
- Executes dropped EXE
PID:3524 -
\??\c:\dvjdv.exec:\dvjdv.exe25⤵
- Executes dropped EXE
PID:4748 -
\??\c:\1llfxxr.exec:\1llfxxr.exe26⤵
- Executes dropped EXE
PID:4464 -
\??\c:\3hnhhh.exec:\3hnhhh.exe27⤵
- Executes dropped EXE
PID:824 -
\??\c:\pppjp.exec:\pppjp.exe28⤵
- Executes dropped EXE
PID:2400 -
\??\c:\frxrrrr.exec:\frxrrrr.exe29⤵
- Executes dropped EXE
PID:4052 -
\??\c:\rffflfl.exec:\rffflfl.exe30⤵
- Executes dropped EXE
PID:4912 -
\??\c:\9hnhnn.exec:\9hnhnn.exe31⤵
- Executes dropped EXE
PID:2128 -
\??\c:\flrxxfx.exec:\flrxxfx.exe32⤵
- Executes dropped EXE
PID:1340 -
\??\c:\btbbtb.exec:\btbbtb.exe33⤵
- Executes dropped EXE
PID:2820 -
\??\c:\pppvp.exec:\pppvp.exe34⤵
- Executes dropped EXE
PID:1224 -
\??\c:\llllffx.exec:\llllffx.exe35⤵
- Executes dropped EXE
PID:4148 -
\??\c:\thnnhh.exec:\thnnhh.exe36⤵
- Executes dropped EXE
PID:1008 -
\??\c:\7bhhbb.exec:\7bhhbb.exe37⤵
- Executes dropped EXE
PID:2212 -
\??\c:\vpddp.exec:\vpddp.exe38⤵
- Executes dropped EXE
PID:4648 -
\??\c:\fxrlxxf.exec:\fxrlxxf.exe39⤵
- Executes dropped EXE
PID:4024 -
\??\c:\hnbtnh.exec:\hnbtnh.exe40⤵
- Executes dropped EXE
PID:4888 -
\??\c:\3tnnnn.exec:\3tnnnn.exe41⤵
- Executes dropped EXE
PID:1888 -
\??\c:\dpvpj.exec:\dpvpj.exe42⤵
- Executes dropped EXE
PID:4856 -
\??\c:\dvdvv.exec:\dvdvv.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3400 -
\??\c:\5xlllll.exec:\5xlllll.exe44⤵
- Executes dropped EXE
PID:2632 -
\??\c:\rffxrrl.exec:\rffxrrl.exe45⤵
- Executes dropped EXE
PID:4868 -
\??\c:\hbhbbb.exec:\hbhbbb.exe46⤵
- Executes dropped EXE
PID:4800 -
\??\c:\3vpjj.exec:\3vpjj.exe47⤵
- Executes dropped EXE
PID:1456 -
\??\c:\lxlfxrr.exec:\lxlfxrr.exe48⤵
- Executes dropped EXE
PID:984 -
\??\c:\rflllll.exec:\rflllll.exe49⤵
- Executes dropped EXE
PID:3892 -
\??\c:\tbbbbb.exec:\tbbbbb.exe50⤵
- Executes dropped EXE
PID:2576 -
\??\c:\jpjpj.exec:\jpjpj.exe51⤵
- Executes dropped EXE
PID:976 -
\??\c:\rfxfxff.exec:\rfxfxff.exe52⤵
- Executes dropped EXE
PID:4208 -
\??\c:\7ttnbb.exec:\7ttnbb.exe53⤵
- Executes dropped EXE
PID:3884 -
\??\c:\9jdjd.exec:\9jdjd.exe54⤵
- Executes dropped EXE
PID:4840 -
\??\c:\3rxrrrr.exec:\3rxrrrr.exe55⤵
- Executes dropped EXE
PID:2992 -
\??\c:\fxxrrlx.exec:\fxxrrlx.exe56⤵
- Executes dropped EXE
PID:2336 -
\??\c:\bbbttt.exec:\bbbttt.exe57⤵
- Executes dropped EXE
PID:2288 -
\??\c:\dppjd.exec:\dppjd.exe58⤵
- Executes dropped EXE
PID:2824 -
\??\c:\frlxrlx.exec:\frlxrlx.exe59⤵
- Executes dropped EXE
PID:1280 -
\??\c:\xxfxxff.exec:\xxfxxff.exe60⤵
- Executes dropped EXE
PID:4428 -
\??\c:\bntnnn.exec:\bntnnn.exe61⤵
- Executes dropped EXE
PID:4820 -
\??\c:\1dpjp.exec:\1dpjp.exe62⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xrrlfxl.exec:\xrrlfxl.exe63⤵
- Executes dropped EXE
PID:972 -
\??\c:\bnhbtt.exec:\bnhbtt.exe64⤵
- Executes dropped EXE
PID:4132 -
\??\c:\vjddv.exec:\vjddv.exe65⤵
- Executes dropped EXE
PID:772 -
\??\c:\jvvjd.exec:\jvvjd.exe66⤵PID:3440
-
\??\c:\frrlxxr.exec:\frrlxxr.exe67⤵PID:1004
-
\??\c:\hbbnnh.exec:\hbbnnh.exe68⤵PID:3712
-
\??\c:\9btthb.exec:\9btthb.exe69⤵PID:2264
-
\??\c:\jvdvj.exec:\jvdvj.exe70⤵PID:1616
-
\??\c:\rlxrfff.exec:\rlxrfff.exe71⤵PID:2840
-
\??\c:\7tbtnn.exec:\7tbtnn.exe72⤵PID:4580
-
\??\c:\pjvdj.exec:\pjvdj.exe73⤵PID:1664
-
\??\c:\llxlxrx.exec:\llxlxrx.exe74⤵PID:4792
-
\??\c:\3fxlrlr.exec:\3fxlrlr.exe75⤵PID:1548
-
\??\c:\hnnttn.exec:\hnnttn.exe76⤵PID:2144
-
\??\c:\jpvpd.exec:\jpvpd.exe77⤵PID:4468
-
\??\c:\lxfrrll.exec:\lxfrrll.exe78⤵PID:2260
-
\??\c:\bhttnn.exec:\bhttnn.exe79⤵PID:380
-
\??\c:\htnbhh.exec:\htnbhh.exe80⤵PID:4548
-
\??\c:\jpvjd.exec:\jpvjd.exe81⤵PID:3732
-
\??\c:\lrxrfxr.exec:\lrxrfxr.exe82⤵PID:3048
-
\??\c:\bbhhhb.exec:\bbhhhb.exe83⤵PID:4756
-
\??\c:\bhnnnh.exec:\bhnnnh.exe84⤵PID:4256
-
\??\c:\jvpjd.exec:\jvpjd.exe85⤵PID:4144
-
\??\c:\3xlfxxr.exec:\3xlfxxr.exe86⤵PID:208
-
\??\c:\3vpjd.exec:\3vpjd.exe87⤵PID:3264
-
\??\c:\1fllfff.exec:\1fllfff.exe88⤵PID:1332
-
\??\c:\5tbttt.exec:\5tbttt.exe89⤵PID:3932
-
\??\c:\bbhhbh.exec:\bbhhbh.exe90⤵PID:232
-
\??\c:\jvvvp.exec:\jvvvp.exe91⤵PID:4516
-
\??\c:\rxrrllf.exec:\rxrrllf.exe92⤵PID:3876
-
\??\c:\xflffxr.exec:\xflffxr.exe93⤵PID:3196
-
\??\c:\hnhtnh.exec:\hnhtnh.exe94⤵PID:3892
-
\??\c:\vvvpj.exec:\vvvpj.exe95⤵PID:4400
-
\??\c:\xxfxlff.exec:\xxfxlff.exe96⤵PID:3668
-
\??\c:\tnbhbb.exec:\tnbhbb.exe97⤵PID:4632
-
\??\c:\jjjdp.exec:\jjjdp.exe98⤵PID:4764
-
\??\c:\vddvp.exec:\vddvp.exe99⤵PID:1996
-
\??\c:\7rrrllf.exec:\7rrrllf.exe100⤵PID:748
-
\??\c:\nbbbbb.exec:\nbbbbb.exe101⤵PID:3952
-
\??\c:\jdvdv.exec:\jdvdv.exe102⤵PID:2288
-
\??\c:\9lxrxfx.exec:\9lxrxfx.exe103⤵PID:4268
-
\??\c:\1rxrlxr.exec:\1rxrlxr.exe104⤵PID:216
-
\??\c:\hhhbtn.exec:\hhhbtn.exe105⤵PID:3848
-
\??\c:\1vddv.exec:\1vddv.exe106⤵
- System Location Discovery: System Language Discovery
PID:2792 -
\??\c:\1llfxrl.exec:\1llfxrl.exe107⤵PID:4440
-
\??\c:\xlrlxfx.exec:\xlrlxfx.exe108⤵PID:3524
-
\??\c:\ttbthb.exec:\ttbthb.exe109⤵PID:1048
-
\??\c:\3pvpv.exec:\3pvpv.exe110⤵PID:4652
-
\??\c:\ppvpp.exec:\ppvpp.exe111⤵PID:3404
-
\??\c:\7ffffxf.exec:\7ffffxf.exe112⤵PID:2124
-
\??\c:\5rxrllf.exec:\5rxrllf.exe113⤵PID:2912
-
\??\c:\hhhhtt.exec:\hhhhtt.exe114⤵PID:928
-
\??\c:\9ddvj.exec:\9ddvj.exe115⤵PID:64
-
\??\c:\frrfxfx.exec:\frrfxfx.exe116⤵PID:3708
-
\??\c:\lflflfl.exec:\lflflfl.exe117⤵PID:2120
-
\??\c:\ttbnnh.exec:\ttbnnh.exe118⤵PID:4724
-
\??\c:\jddvj.exec:\jddvj.exe119⤵PID:1036
-
\??\c:\3ddpj.exec:\3ddpj.exe120⤵PID:4040
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe121⤵PID:2112
-
\??\c:\7bbbtb.exec:\7bbbtb.exe122⤵PID:4316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-