Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2024 22:39
Behavioral task
behavioral1
Sample
b84eb741b8fcfcd892fca53f4af597c0N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
b84eb741b8fcfcd892fca53f4af597c0N.exe
-
Size
443KB
-
MD5
b84eb741b8fcfcd892fca53f4af597c0
-
SHA1
91a34dd6391af8708482cb6e513a451ca8636712
-
SHA256
8ff61e464a1c49c1bd6a1e43f7d6c439dc264df0166c146badfc39d9cfa5b730
-
SHA512
dbf32daff0261ce4de465d2d16e2b25597b6fe89135e265bda4ca1a3891756c1b704386de48e7ac9f3e8a27a07e8b473cae0fc1bd4e7214462fe7601b1411b44
-
SSDEEP
12288:M4wFHoSpg4wFHonR/nPF2LnFL4wF04wFK4wFK4wluAQ:UrR/nPRQ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3132-6-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3116-28-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2280-35-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/372-163-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1064-229-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2868-311-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1928-359-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1452-367-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3112-363-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3172-355-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4856-352-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1584-350-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4856-346-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4704-343-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4704-338-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2516-333-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3124-330-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2744-327-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2516-325-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2104-323-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2744-320-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4140-319-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3976-315-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3976-307-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4476-304-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4288-302-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4476-298-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4356-297-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3708-293-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4356-289-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2964-286-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3708-284-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3540-283-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4824-279-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3540-275-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4380-272-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2556-270-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3088-264-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2556-262-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3132-259-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4408-257-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4300-253-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4300-246-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4652-243-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/908-241-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4524-240-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4652-236-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2464-225-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1644-222-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3104-219-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1644-216-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4776-213-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4368-210-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3112-207-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4368-201-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3112-195-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3844-193-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2684-187-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/440-181-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2040-175-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2040-161-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/540-157-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1648-154-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/372-151-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3852 djppj.exe 3228 lflllff.exe 3116 1hnthh.exe 2280 ppppj.exe 4824 7ffxxxx.exe 3540 rlrffrr.exe 4320 dvpjv.exe 2532 rflfffl.exe 4912 bntnnn.exe 3008 hbbbbt.exe 916 vdddd.exe 3144 llxxrxr.exe 400 nnhnnh.exe 4816 dpjpp.exe 4040 xlrrlxr.exe 4364 hnttnn.exe 2404 btbbnn.exe 1872 ppvvv.exe 3468 rrxffll.exe 448 nbtnnn.exe 5072 vvvpp.exe 540 fxxrrfl.exe 1648 5llfrlf.exe 372 5bhbbb.exe 2040 pppjd.exe 440 3xxxrrr.exe 2684 hbtnhh.exe 3844 nhhbbt.exe 1452 pjjpj.exe 3112 7rrlffx.exe 4368 9tttnn.exe 4776 ppvvp.exe 3104 7jjpj.exe 1644 fxllfll.exe 1064 hnbnhb.exe 2464 pjpdv.exe 992 flxxrrl.exe 4524 fffxxrr.exe 4652 tthhbb.exe 908 1jvvp.exe 4300 frfxrxl.exe 4408 btbbbh.exe 3132 bhnhtb.exe 3088 pdpjd.exe 2556 rxxlxlf.exe 4380 thhhhb.exe 4824 jjjdp.exe 3540 rlxrrfl.exe 2964 nhhbnn.exe 3708 btthtb.exe 4356 5rrfxlr.exe 4288 vvppp.exe 4476 lxfrxxf.exe 2868 nhnbnh.exe 3976 1jdjd.exe 4140 pjjpj.exe 2104 3lllflf.exe 2744 bntnnn.exe 2516 ppdjd.exe 3124 xxxrlll.exe 3488 hbhhhn.exe 4704 jdjdp.exe 1584 jdvpv.exe 4856 frrfxxl.exe -
resource yara_rule behavioral2/memory/3132-0-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0009000000023476-7.dat upx behavioral2/memory/3132-6-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3852-5-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x00070000000234d5-17.dat upx behavioral2/memory/2280-26-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3116-28-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x00070000000234d7-31.dat upx behavioral2/memory/2280-35-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x00070000000234d8-39.dat upx behavioral2/files/0x00070000000234d9-46.dat upx behavioral2/files/0x00070000000234dc-63.dat upx behavioral2/files/0x00070000000234dd-71.dat upx behavioral2/files/0x00070000000234de-75.dat upx behavioral2/files/0x00070000000234e3-106.dat upx behavioral2/files/0x00070000000234e4-114.dat upx behavioral2/files/0x00070000000234e6-125.dat upx behavioral2/memory/372-163-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x00070000000234ef-182.dat upx behavioral2/memory/1064-229-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2868-311-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1928-359-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1452-367-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3112-363-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3172-355-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4856-352-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1584-350-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4856-346-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4704-343-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4704-338-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2516-333-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3124-330-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2744-327-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2516-325-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2104-323-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2744-320-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4140-319-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3976-315-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3976-307-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4476-304-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4288-302-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4476-298-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4356-297-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3708-293-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4356-289-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2964-286-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3708-284-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3540-283-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4824-279-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3540-275-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4380-272-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2556-270-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3088-264-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2556-262-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3132-259-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4408-257-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4300-253-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4300-246-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4652-243-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/908-241-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4524-240-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4652-236-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2464-225-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1644-222-0x0000000000400000-0x000000000048C000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3132 wrote to memory of 3852 3132 b84eb741b8fcfcd892fca53f4af597c0N.exe 83 PID 3132 wrote to memory of 3852 3132 b84eb741b8fcfcd892fca53f4af597c0N.exe 83 PID 3132 wrote to memory of 3852 3132 b84eb741b8fcfcd892fca53f4af597c0N.exe 83 PID 3852 wrote to memory of 3228 3852 djppj.exe 85 PID 3852 wrote to memory of 3228 3852 djppj.exe 85 PID 3852 wrote to memory of 3228 3852 djppj.exe 85 PID 3228 wrote to memory of 3116 3228 lflllff.exe 86 PID 3228 wrote to memory of 3116 3228 lflllff.exe 86 PID 3228 wrote to memory of 3116 3228 lflllff.exe 86 PID 3116 wrote to memory of 2280 3116 1hnthh.exe 87 PID 3116 wrote to memory of 2280 3116 1hnthh.exe 87 PID 3116 wrote to memory of 2280 3116 1hnthh.exe 87 PID 2280 wrote to memory of 4824 2280 ppppj.exe 88 PID 2280 wrote to memory of 4824 2280 ppppj.exe 88 PID 2280 wrote to memory of 4824 2280 ppppj.exe 88 PID 4824 wrote to memory of 3540 4824 7ffxxxx.exe 89 PID 4824 wrote to memory of 3540 4824 7ffxxxx.exe 89 PID 4824 wrote to memory of 3540 4824 7ffxxxx.exe 89 PID 3540 wrote to memory of 4320 3540 rlrffrr.exe 90 PID 3540 wrote to memory of 4320 3540 rlrffrr.exe 90 PID 3540 wrote to memory of 4320 3540 rlrffrr.exe 90 PID 4320 wrote to memory of 2532 4320 dvpjv.exe 91 PID 4320 wrote to memory of 2532 4320 dvpjv.exe 91 PID 4320 wrote to memory of 2532 4320 dvpjv.exe 91 PID 2532 wrote to memory of 4912 2532 rflfffl.exe 92 PID 2532 wrote to memory of 4912 2532 rflfffl.exe 92 PID 2532 wrote to memory of 4912 2532 rflfffl.exe 92 PID 4912 wrote to memory of 3008 4912 bntnnn.exe 93 PID 4912 wrote to memory of 3008 4912 bntnnn.exe 93 PID 4912 wrote to memory of 3008 4912 bntnnn.exe 93 PID 3008 wrote to memory of 916 3008 hbbbbt.exe 94 PID 3008 wrote to memory of 916 3008 hbbbbt.exe 94 PID 3008 wrote to memory of 916 3008 hbbbbt.exe 94 PID 916 wrote to memory of 3144 916 vdddd.exe 95 PID 916 wrote to memory of 3144 916 vdddd.exe 95 PID 916 wrote to memory of 3144 916 vdddd.exe 95 PID 3144 wrote to memory of 400 3144 llxxrxr.exe 96 PID 3144 wrote to memory of 400 3144 llxxrxr.exe 96 PID 3144 wrote to memory of 400 3144 llxxrxr.exe 96 PID 400 wrote to memory of 4816 400 nnhnnh.exe 97 PID 400 wrote to memory of 4816 400 nnhnnh.exe 97 PID 400 wrote to memory of 4816 400 nnhnnh.exe 97 PID 4816 wrote to memory of 4040 4816 dpjpp.exe 98 PID 4816 wrote to memory of 4040 4816 dpjpp.exe 98 PID 4816 wrote to memory of 4040 4816 dpjpp.exe 98 PID 4040 wrote to memory of 4364 4040 xlrrlxr.exe 99 PID 4040 wrote to memory of 4364 4040 xlrrlxr.exe 99 PID 4040 wrote to memory of 4364 4040 xlrrlxr.exe 99 PID 4364 wrote to memory of 2404 4364 hnttnn.exe 100 PID 4364 wrote to memory of 2404 4364 hnttnn.exe 100 PID 4364 wrote to memory of 2404 4364 hnttnn.exe 100 PID 2404 wrote to memory of 1872 2404 btbbnn.exe 101 PID 2404 wrote to memory of 1872 2404 btbbnn.exe 101 PID 2404 wrote to memory of 1872 2404 btbbnn.exe 101 PID 1872 wrote to memory of 3468 1872 ppvvv.exe 102 PID 1872 wrote to memory of 3468 1872 ppvvv.exe 102 PID 1872 wrote to memory of 3468 1872 ppvvv.exe 102 PID 3468 wrote to memory of 448 3468 rrxffll.exe 103 PID 3468 wrote to memory of 448 3468 rrxffll.exe 103 PID 3468 wrote to memory of 448 3468 rrxffll.exe 103 PID 448 wrote to memory of 5072 448 nbtnnn.exe 244 PID 448 wrote to memory of 5072 448 nbtnnn.exe 244 PID 448 wrote to memory of 5072 448 nbtnnn.exe 244 PID 5072 wrote to memory of 540 5072 vvvpp.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\b84eb741b8fcfcd892fca53f4af597c0N.exe"C:\Users\Admin\AppData\Local\Temp\b84eb741b8fcfcd892fca53f4af597c0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\djppj.exec:\djppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\lflllff.exec:\lflllff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\1hnthh.exec:\1hnthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\ppppj.exec:\ppppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\7ffxxxx.exec:\7ffxxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\rlrffrr.exec:\rlrffrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\dvpjv.exec:\dvpjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\rflfffl.exec:\rflfffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\bntnnn.exec:\bntnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\hbbbbt.exec:\hbbbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\vdddd.exec:\vdddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\llxxrxr.exec:\llxxrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\nnhnnh.exec:\nnhnnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\dpjpp.exec:\dpjpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\xlrrlxr.exec:\xlrrlxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\hnttnn.exec:\hnttnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\btbbnn.exec:\btbbnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\ppvvv.exec:\ppvvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\rrxffll.exec:\rrxffll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\nbtnnn.exec:\nbtnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\vvvpp.exec:\vvvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\fxxrrfl.exec:\fxxrrfl.exe23⤵
- Executes dropped EXE
PID:540 -
\??\c:\5llfrlf.exec:\5llfrlf.exe24⤵
- Executes dropped EXE
PID:1648 -
\??\c:\5bhbbb.exec:\5bhbbb.exe25⤵
- Executes dropped EXE
PID:372 -
\??\c:\pppjd.exec:\pppjd.exe26⤵
- Executes dropped EXE
PID:2040 -
\??\c:\3xxxrrr.exec:\3xxxrrr.exe27⤵
- Executes dropped EXE
PID:440 -
\??\c:\hbtnhh.exec:\hbtnhh.exe28⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nhhbbt.exec:\nhhbbt.exe29⤵
- Executes dropped EXE
PID:3844 -
\??\c:\pjjpj.exec:\pjjpj.exe30⤵
- Executes dropped EXE
PID:1452 -
\??\c:\7rrlffx.exec:\7rrlffx.exe31⤵
- Executes dropped EXE
PID:3112 -
\??\c:\9tttnn.exec:\9tttnn.exe32⤵
- Executes dropped EXE
PID:4368 -
\??\c:\ppvvp.exec:\ppvvp.exe33⤵
- Executes dropped EXE
PID:4776 -
\??\c:\7jjpj.exec:\7jjpj.exe34⤵
- Executes dropped EXE
PID:3104 -
\??\c:\fxllfll.exec:\fxllfll.exe35⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hnbnhb.exec:\hnbnhb.exe36⤵
- Executes dropped EXE
PID:1064 -
\??\c:\pjpdv.exec:\pjpdv.exe37⤵
- Executes dropped EXE
PID:2464 -
\??\c:\flxxrrl.exec:\flxxrrl.exe38⤵
- Executes dropped EXE
PID:992 -
\??\c:\fffxxrr.exec:\fffxxrr.exe39⤵
- Executes dropped EXE
PID:4524 -
\??\c:\tthhbb.exec:\tthhbb.exe40⤵
- Executes dropped EXE
PID:4652 -
\??\c:\1jvvp.exec:\1jvvp.exe41⤵
- Executes dropped EXE
PID:908 -
\??\c:\frfxrxl.exec:\frfxrxl.exe42⤵
- Executes dropped EXE
PID:4300 -
\??\c:\btbbbh.exec:\btbbbh.exe43⤵
- Executes dropped EXE
PID:4408 -
\??\c:\bhnhtb.exec:\bhnhtb.exe44⤵
- Executes dropped EXE
PID:3132 -
\??\c:\pdpjd.exec:\pdpjd.exe45⤵
- Executes dropped EXE
PID:3088 -
\??\c:\rxxlxlf.exec:\rxxlxlf.exe46⤵
- Executes dropped EXE
PID:2556 -
\??\c:\thhhhb.exec:\thhhhb.exe47⤵
- Executes dropped EXE
PID:4380 -
\??\c:\jjjdp.exec:\jjjdp.exe48⤵
- Executes dropped EXE
PID:4824 -
\??\c:\rlxrrfl.exec:\rlxrrfl.exe49⤵
- Executes dropped EXE
PID:3540 -
\??\c:\nhhbnn.exec:\nhhbnn.exe50⤵
- Executes dropped EXE
PID:2964 -
\??\c:\btthtb.exec:\btthtb.exe51⤵
- Executes dropped EXE
PID:3708 -
\??\c:\5rrfxlr.exec:\5rrfxlr.exe52⤵
- Executes dropped EXE
PID:4356 -
\??\c:\vvppp.exec:\vvppp.exe53⤵
- Executes dropped EXE
PID:4288 -
\??\c:\lxfrxxf.exec:\lxfrxxf.exe54⤵
- Executes dropped EXE
PID:4476 -
\??\c:\nhnbnh.exec:\nhnbnh.exe55⤵
- Executes dropped EXE
PID:2868 -
\??\c:\1jdjd.exec:\1jdjd.exe56⤵
- Executes dropped EXE
PID:3976 -
\??\c:\pjjpj.exec:\pjjpj.exe57⤵
- Executes dropped EXE
PID:4140 -
\??\c:\3lllflf.exec:\3lllflf.exe58⤵
- Executes dropped EXE
PID:2104 -
\??\c:\bntnnn.exec:\bntnnn.exe59⤵
- Executes dropped EXE
PID:2744 -
\??\c:\ppdjd.exec:\ppdjd.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2516 -
\??\c:\xxxrlll.exec:\xxxrlll.exe61⤵
- Executes dropped EXE
PID:3124 -
\??\c:\hbhhhn.exec:\hbhhhn.exe62⤵
- Executes dropped EXE
PID:3488 -
\??\c:\jdjdp.exec:\jdjdp.exe63⤵
- Executes dropped EXE
PID:4704 -
\??\c:\jdvpv.exec:\jdvpv.exe64⤵
- Executes dropped EXE
PID:1584 -
\??\c:\frrfxxl.exec:\frrfxxl.exe65⤵
- Executes dropped EXE
PID:4856 -
\??\c:\tbbnbb.exec:\tbbnbb.exe66⤵PID:1928
-
\??\c:\pddvv.exec:\pddvv.exe67⤵PID:3172
-
\??\c:\lffxrxl.exec:\lffxrxl.exe68⤵PID:1452
-
\??\c:\hhbtnn.exec:\hhbtnn.exe69⤵PID:3112
-
\??\c:\7ppdv.exec:\7ppdv.exe70⤵PID:412
-
\??\c:\pvvpj.exec:\pvvpj.exe71⤵PID:2924
-
\??\c:\rlllfxr.exec:\rlllfxr.exe72⤵PID:2276
-
\??\c:\pjjvj.exec:\pjjvj.exe73⤵PID:3420
-
\??\c:\lfxxrxr.exec:\lfxxrxr.exe74⤵PID:1636
-
\??\c:\hhthbb.exec:\hhthbb.exe75⤵PID:4592
-
\??\c:\vvppv.exec:\vvppv.exe76⤵PID:3396
-
\??\c:\hnbhbh.exec:\hnbhbh.exe77⤵PID:4652
-
\??\c:\1djjv.exec:\1djjv.exe78⤵PID:1428
-
\??\c:\xrxrlll.exec:\xrxrlll.exe79⤵PID:1464
-
\??\c:\thnhbb.exec:\thnhbb.exe80⤵PID:2320
-
\??\c:\jjdvv.exec:\jjdvv.exe81⤵PID:628
-
\??\c:\3lrrrrr.exec:\3lrrrrr.exe82⤵PID:3000
-
\??\c:\thtttt.exec:\thtttt.exe83⤵PID:1228
-
\??\c:\nntnnn.exec:\nntnnn.exe84⤵PID:2676
-
\??\c:\1djpj.exec:\1djpj.exe85⤵PID:1484
-
\??\c:\xrxlffx.exec:\xrxlffx.exe86⤵PID:4828
-
\??\c:\hnnnhb.exec:\hnnnhb.exe87⤵PID:4740
-
\??\c:\jppjv.exec:\jppjv.exe88⤵PID:1332
-
\??\c:\frffrfl.exec:\frffrfl.exe89⤵PID:4436
-
\??\c:\hnbntb.exec:\hnbntb.exe90⤵PID:1908
-
\??\c:\jvpjj.exec:\jvpjj.exe91⤵PID:3056
-
\??\c:\rrrxrxl.exec:\rrrxrxl.exe92⤵PID:3804
-
\??\c:\btnbnb.exec:\btnbnb.exe93⤵PID:3976
-
\??\c:\vvjpv.exec:\vvjpv.exe94⤵
- System Location Discovery: System Language Discovery
PID:4780 -
\??\c:\lxlxfrr.exec:\lxlxfrr.exe95⤵PID:1232
-
\??\c:\bnnhbb.exec:\bnnhbb.exe96⤵PID:2484
-
\??\c:\vvvdj.exec:\vvvdj.exe97⤵PID:3124
-
\??\c:\jpdjv.exec:\jpdjv.exe98⤵
- System Location Discovery: System Language Discovery
PID:2848 -
\??\c:\rxfxrrl.exec:\rxfxrrl.exe99⤵PID:1704
-
\??\c:\nbbtnh.exec:\nbbtnh.exe100⤵PID:3348
-
\??\c:\jvvvp.exec:\jvvvp.exe101⤵PID:5096
-
\??\c:\fxxrllf.exec:\fxxrllf.exe102⤵PID:1668
-
\??\c:\xrllflr.exec:\xrllflr.exe103⤵PID:2808
-
\??\c:\btbtnh.exec:\btbtnh.exe104⤵PID:116
-
\??\c:\dvvvp.exec:\dvvvp.exe105⤵PID:5028
-
\??\c:\fxrlrrx.exec:\fxrlrrx.exe106⤵PID:540
-
\??\c:\1tnttn.exec:\1tnttn.exe107⤵PID:1320
-
\??\c:\dpjdd.exec:\dpjdd.exe108⤵PID:3428
-
\??\c:\vppjj.exec:\vppjj.exe109⤵PID:516
-
\??\c:\lflfllf.exec:\lflfllf.exe110⤵PID:4500
-
\??\c:\1bnhbb.exec:\1bnhbb.exe111⤵PID:1428
-
\??\c:\vjppj.exec:\vjppj.exe112⤵PID:4820
-
\??\c:\pvvpv.exec:\pvvpv.exe113⤵PID:1464
-
\??\c:\9xfllrr.exec:\9xfllrr.exe114⤵PID:3860
-
\??\c:\tthhnt.exec:\tthhnt.exe115⤵PID:3000
-
\??\c:\jjddj.exec:\jjddj.exe116⤵PID:868
-
\??\c:\9flxlfx.exec:\9flxlfx.exe117⤵PID:3424
-
\??\c:\7lfxxll.exec:\7lfxxll.exe118⤵PID:2964
-
\??\c:\tnnhbb.exec:\tnnhbb.exe119⤵PID:3636
-
\??\c:\vvjdv.exec:\vvjdv.exe120⤵PID:1812
-
\??\c:\3flfflf.exec:\3flfflf.exe121⤵PID:1740
-
\??\c:\hhtnhh.exec:\hhtnhh.exe122⤵PID:908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-