Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-09-2024 20:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3e447b612f8c6e89a24802b10631915a604ededf8932e665c574340f17c49031N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
3e447b612f8c6e89a24802b10631915a604ededf8932e665c574340f17c49031N.exe
-
Size
452KB
-
MD5
9258ee0c5df646f0efc06f8f313e0e00
-
SHA1
877ec4ca9593b79d2b627a431a8ee127f72e9415
-
SHA256
3e447b612f8c6e89a24802b10631915a604ededf8932e665c574340f17c49031
-
SHA512
e50510d29fd9a61384aaefad19f28d29869a3df7e3aebe26b03d67b862c39f5c5843ce041d2f57a0f71030ec441e107b6c1ff94c8406c956424ef49a6f60bd57
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeQ:q7Tc2NYHUrAwfMp3CDQ
Malware Config
Signatures
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1792-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3288-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/312-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2480-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1756-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1732-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2772-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/312-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1248-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1740-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-953-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-1107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1308 9bnhhh.exe 3244 1vddd.exe 2888 dvppj.exe 3308 tnnhhh.exe 4684 dvvpp.exe 3864 lllffff.exe 3528 xxlllll.exe 1360 3tnnhn.exe 4020 pjppp.exe 1216 nntnhh.exe 3004 3pvvv.exe 3288 1dvpd.exe 312 lxxrlff.exe 1752 hhnnnb.exe 4064 dvdvp.exe 2552 thnhhh.exe 2480 pjvvj.exe 1832 xlrrffl.exe 4688 btbttt.exe 4844 dvvpj.exe 4568 lrxxxrr.exe 5028 vvvvv.exe 2132 7rfxrrf.exe 1756 lrlllrr.exe 400 thnhbt.exe 2456 jjjjd.exe 2596 3xxxrrr.exe 3036 lfllfff.exe 1952 ttnntt.exe 3468 dpvvv.exe 4536 9jpvv.exe 4552 lllllll.exe 3080 3tbbhh.exe 3780 htbbtb.exe 2536 lxfffxx.exe 1732 ppvpj.exe 4364 lfrlfff.exe 1748 rflllrr.exe 1860 9hnnhn.exe 1476 5ddvv.exe 3684 5dppp.exe 1168 llrllll.exe 3548 bnbtnn.exe 4144 nnhbhh.exe 3124 djvjp.exe 4108 dpddv.exe 5084 rfrrxxx.exe 2952 frrrrrl.exe 3472 hnnnhh.exe 4540 pvdvd.exe 3664 5vdvj.exe 3712 llfxrlf.exe 4292 hbbtnn.exe 4876 hbnhtt.exe 380 pjvvp.exe 4052 pjjdv.exe 3324 ffxrxxl.exe 3436 ntnhhb.exe 2920 7nhnhh.exe 3668 5pjdp.exe 4684 xlflxrf.exe 4380 xllfxxr.exe 2148 hhbtbb.exe 2848 jdddd.exe -
resource yara_rule behavioral2/memory/1792-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3288-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/312-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1732-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1292-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2772-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/312-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1248-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1712-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-616-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1792 wrote to memory of 1308 1792 3e447b612f8c6e89a24802b10631915a604ededf8932e665c574340f17c49031N.exe 82 PID 1792 wrote to memory of 1308 1792 3e447b612f8c6e89a24802b10631915a604ededf8932e665c574340f17c49031N.exe 82 PID 1792 wrote to memory of 1308 1792 3e447b612f8c6e89a24802b10631915a604ededf8932e665c574340f17c49031N.exe 82 PID 1308 wrote to memory of 3244 1308 9bnhhh.exe 83 PID 1308 wrote to memory of 3244 1308 9bnhhh.exe 83 PID 1308 wrote to memory of 3244 1308 9bnhhh.exe 83 PID 3244 wrote to memory of 2888 3244 1vddd.exe 84 PID 3244 wrote to memory of 2888 3244 1vddd.exe 84 PID 3244 wrote to memory of 2888 3244 1vddd.exe 84 PID 2888 wrote to memory of 3308 2888 dvppj.exe 85 PID 2888 wrote to memory of 3308 2888 dvppj.exe 85 PID 2888 wrote to memory of 3308 2888 dvppj.exe 85 PID 3308 wrote to memory of 4684 3308 tnnhhh.exe 142 PID 3308 wrote to memory of 4684 3308 tnnhhh.exe 142 PID 3308 wrote to memory of 4684 3308 tnnhhh.exe 142 PID 4684 wrote to memory of 3864 4684 dvvpp.exe 87 PID 4684 wrote to memory of 3864 4684 dvvpp.exe 87 PID 4684 wrote to memory of 3864 4684 dvvpp.exe 87 PID 3864 wrote to memory of 3528 3864 lllffff.exe 88 PID 3864 wrote to memory of 3528 3864 lllffff.exe 88 PID 3864 wrote to memory of 3528 3864 lllffff.exe 88 PID 3528 wrote to memory of 1360 3528 xxlllll.exe 89 PID 3528 wrote to memory of 1360 3528 xxlllll.exe 89 PID 3528 wrote to memory of 1360 3528 xxlllll.exe 89 PID 1360 wrote to memory of 4020 1360 3tnnhn.exe 149 PID 1360 wrote to memory of 4020 1360 3tnnhn.exe 149 PID 1360 wrote to memory of 4020 1360 3tnnhn.exe 149 PID 4020 wrote to memory of 1216 4020 pjppp.exe 91 PID 4020 wrote to memory of 1216 4020 pjppp.exe 91 PID 4020 wrote to memory of 1216 4020 pjppp.exe 91 PID 1216 wrote to memory of 3004 1216 nntnhh.exe 92 PID 1216 wrote to memory of 3004 1216 nntnhh.exe 92 PID 1216 wrote to memory of 3004 1216 nntnhh.exe 92 PID 3004 wrote to memory of 3288 3004 3pvvv.exe 93 PID 3004 wrote to memory of 3288 3004 3pvvv.exe 93 PID 3004 wrote to memory of 3288 3004 3pvvv.exe 93 PID 3288 wrote to memory of 312 3288 1dvpd.exe 153 PID 3288 wrote to memory of 312 3288 1dvpd.exe 153 PID 3288 wrote to memory of 312 3288 1dvpd.exe 153 PID 312 wrote to memory of 1752 312 lxxrlff.exe 95 PID 312 wrote to memory of 1752 312 lxxrlff.exe 95 PID 312 wrote to memory of 1752 312 lxxrlff.exe 95 PID 1752 wrote to memory of 4064 1752 hhnnnb.exe 96 PID 1752 wrote to memory of 4064 1752 hhnnnb.exe 96 PID 1752 wrote to memory of 4064 1752 hhnnnb.exe 96 PID 4064 wrote to memory of 2552 4064 dvdvp.exe 97 PID 4064 wrote to memory of 2552 4064 dvdvp.exe 97 PID 4064 wrote to memory of 2552 4064 dvdvp.exe 97 PID 2552 wrote to memory of 2480 2552 thnhhh.exe 98 PID 2552 wrote to memory of 2480 2552 thnhhh.exe 98 PID 2552 wrote to memory of 2480 2552 thnhhh.exe 98 PID 2480 wrote to memory of 1832 2480 pjvvj.exe 99 PID 2480 wrote to memory of 1832 2480 pjvvj.exe 99 PID 2480 wrote to memory of 1832 2480 pjvvj.exe 99 PID 1832 wrote to memory of 4688 1832 xlrrffl.exe 100 PID 1832 wrote to memory of 4688 1832 xlrrffl.exe 100 PID 1832 wrote to memory of 4688 1832 xlrrffl.exe 100 PID 4688 wrote to memory of 4844 4688 btbttt.exe 101 PID 4688 wrote to memory of 4844 4688 btbttt.exe 101 PID 4688 wrote to memory of 4844 4688 btbttt.exe 101 PID 4844 wrote to memory of 4568 4844 dvvpj.exe 102 PID 4844 wrote to memory of 4568 4844 dvvpj.exe 102 PID 4844 wrote to memory of 4568 4844 dvvpj.exe 102 PID 4568 wrote to memory of 5028 4568 lrxxxrr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e447b612f8c6e89a24802b10631915a604ededf8932e665c574340f17c49031N.exe"C:\Users\Admin\AppData\Local\Temp\3e447b612f8c6e89a24802b10631915a604ededf8932e665c574340f17c49031N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\9bnhhh.exec:\9bnhhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\1vddd.exec:\1vddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\dvppj.exec:\dvppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\tnnhhh.exec:\tnnhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\dvvpp.exec:\dvvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\lllffff.exec:\lllffff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\xxlllll.exec:\xxlllll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\3tnnhn.exec:\3tnnhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\pjppp.exec:\pjppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\nntnhh.exec:\nntnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\3pvvv.exec:\3pvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\1dvpd.exec:\1dvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\lxxrlff.exec:\lxxrlff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\hhnnnb.exec:\hhnnnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\dvdvp.exec:\dvdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\thnhhh.exec:\thnhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\pjvvj.exec:\pjvvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\xlrrffl.exec:\xlrrffl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\btbttt.exec:\btbttt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\dvvpj.exec:\dvvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\lrxxxrr.exec:\lrxxxrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\vvvvv.exec:\vvvvv.exe23⤵
- Executes dropped EXE
PID:5028 -
\??\c:\7rfxrrf.exec:\7rfxrrf.exe24⤵
- Executes dropped EXE
PID:2132 -
\??\c:\lrlllrr.exec:\lrlllrr.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1756 -
\??\c:\thnhbt.exec:\thnhbt.exe26⤵
- Executes dropped EXE
PID:400 -
\??\c:\jjjjd.exec:\jjjjd.exe27⤵
- Executes dropped EXE
PID:2456 -
\??\c:\3xxxrrr.exec:\3xxxrrr.exe28⤵
- Executes dropped EXE
PID:2596 -
\??\c:\lfllfff.exec:\lfllfff.exe29⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ttnntt.exec:\ttnntt.exe30⤵
- Executes dropped EXE
PID:1952 -
\??\c:\dpvvv.exec:\dpvvv.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3468 -
\??\c:\9jpvv.exec:\9jpvv.exe32⤵
- Executes dropped EXE
PID:4536 -
\??\c:\lllllll.exec:\lllllll.exe33⤵
- Executes dropped EXE
PID:4552 -
\??\c:\3tbbhh.exec:\3tbbhh.exe34⤵
- Executes dropped EXE
PID:3080 -
\??\c:\htbbtb.exec:\htbbtb.exe35⤵
- Executes dropped EXE
PID:3780 -
\??\c:\lxfffxx.exec:\lxfffxx.exe36⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ppvpj.exec:\ppvpj.exe37⤵
- Executes dropped EXE
PID:1732 -
\??\c:\lfrlfff.exec:\lfrlfff.exe38⤵
- Executes dropped EXE
PID:4364 -
\??\c:\rflllrr.exec:\rflllrr.exe39⤵
- Executes dropped EXE
PID:1748 -
\??\c:\9hnnhn.exec:\9hnnhn.exe40⤵
- Executes dropped EXE
PID:1860 -
\??\c:\5ddvv.exec:\5ddvv.exe41⤵
- Executes dropped EXE
PID:1476 -
\??\c:\5dppp.exec:\5dppp.exe42⤵
- Executes dropped EXE
PID:3684 -
\??\c:\llrllll.exec:\llrllll.exe43⤵
- Executes dropped EXE
PID:1168 -
\??\c:\bnbtnn.exec:\bnbtnn.exe44⤵
- Executes dropped EXE
PID:3548 -
\??\c:\nnhbhh.exec:\nnhbhh.exe45⤵
- Executes dropped EXE
PID:4144 -
\??\c:\djvjp.exec:\djvjp.exe46⤵
- Executes dropped EXE
PID:3124 -
\??\c:\dpddv.exec:\dpddv.exe47⤵
- Executes dropped EXE
PID:4108 -
\??\c:\rfrrxxx.exec:\rfrrxxx.exe48⤵
- Executes dropped EXE
PID:5084 -
\??\c:\frrrrrl.exec:\frrrrrl.exe49⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hnnnhh.exec:\hnnnhh.exe50⤵
- Executes dropped EXE
PID:3472 -
\??\c:\pvdvd.exec:\pvdvd.exe51⤵
- Executes dropped EXE
PID:4540 -
\??\c:\5vdvj.exec:\5vdvj.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3664 -
\??\c:\llfxrlf.exec:\llfxrlf.exe53⤵
- Executes dropped EXE
PID:3712 -
\??\c:\hbbtnn.exec:\hbbtnn.exe54⤵
- Executes dropped EXE
PID:4292 -
\??\c:\hbnhtt.exec:\hbnhtt.exe55⤵
- Executes dropped EXE
PID:4876 -
\??\c:\pjvvp.exec:\pjvvp.exe56⤵
- Executes dropped EXE
PID:380 -
\??\c:\pjjdv.exec:\pjjdv.exe57⤵
- Executes dropped EXE
PID:4052 -
\??\c:\ffxrxxl.exec:\ffxrxxl.exe58⤵
- Executes dropped EXE
PID:3324 -
\??\c:\ntnhhb.exec:\ntnhhb.exe59⤵
- Executes dropped EXE
PID:3436 -
\??\c:\7nhnhh.exec:\7nhnhh.exe60⤵
- Executes dropped EXE
PID:2920 -
\??\c:\5pjdp.exec:\5pjdp.exe61⤵
- Executes dropped EXE
PID:3668 -
\??\c:\xlflxrf.exec:\xlflxrf.exe62⤵
- Executes dropped EXE
PID:4684 -
\??\c:\xllfxxr.exec:\xllfxxr.exe63⤵
- Executes dropped EXE
PID:4380 -
\??\c:\hhbtbb.exec:\hhbtbb.exe64⤵
- Executes dropped EXE
PID:2148 -
\??\c:\jdddd.exec:\jdddd.exe65⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vdpjj.exec:\vdpjj.exe66⤵PID:3052
-
\??\c:\9rrrffx.exec:\9rrrffx.exe67⤵PID:3064
-
\??\c:\hhbtnn.exec:\hhbtnn.exe68⤵PID:1292
-
\??\c:\hhnhhb.exec:\hhnhhb.exe69⤵PID:4020
-
\??\c:\pvpjd.exec:\pvpjd.exe70⤵PID:3084
-
\??\c:\xrfxxrf.exec:\xrfxxrf.exe71⤵PID:2772
-
\??\c:\nhbttt.exec:\nhbttt.exe72⤵PID:4396
-
\??\c:\bbtbht.exec:\bbtbht.exe73⤵PID:312
-
\??\c:\rfrflfl.exec:\rfrflfl.exe74⤵PID:1036
-
\??\c:\1jjdv.exec:\1jjdv.exe75⤵PID:1768
-
\??\c:\lfrlllf.exec:\lfrlllf.exe76⤵PID:4064
-
\??\c:\bnnnnh.exec:\bnnnnh.exe77⤵PID:4828
-
\??\c:\1pjjv.exec:\1pjjv.exe78⤵PID:624
-
\??\c:\flllfrl.exec:\flllfrl.exe79⤵PID:1832
-
\??\c:\7hnhnn.exec:\7hnhnn.exe80⤵PID:1784
-
\??\c:\1nnhth.exec:\1nnhth.exe81⤵PID:2252
-
\??\c:\3dvpj.exec:\3dvpj.exe82⤵PID:4184
-
\??\c:\5xrrlll.exec:\5xrrlll.exe83⤵PID:4060
-
\??\c:\7ttttt.exec:\7ttttt.exe84⤵PID:4452
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe85⤵PID:3660
-
\??\c:\hhbbbt.exec:\hhbbbt.exe86⤵PID:4740
-
\??\c:\tnbtnn.exec:\tnbtnn.exe87⤵PID:4200
-
\??\c:\vjppp.exec:\vjppp.exe88⤵PID:1736
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe89⤵PID:920
-
\??\c:\3hnhbb.exec:\3hnhbb.exe90⤵PID:3620
-
\??\c:\9flllll.exec:\9flllll.exe91⤵PID:760
-
\??\c:\3bbttn.exec:\3bbttn.exe92⤵PID:464
-
\??\c:\hbtttn.exec:\hbtttn.exe93⤵PID:3488
-
\??\c:\llflrll.exec:\llflrll.exe94⤵PID:3624
-
\??\c:\vjvvv.exec:\vjvvv.exe95⤵PID:628
-
\??\c:\fxlrrrf.exec:\fxlrrrf.exe96⤵PID:3060
-
\??\c:\nbnnnt.exec:\nbnnnt.exe97⤵PID:2472
-
\??\c:\jjdvp.exec:\jjdvp.exe98⤵PID:976
-
\??\c:\ppvpp.exec:\ppvpp.exe99⤵PID:3336
-
\??\c:\xlxrlrl.exec:\xlxrlrl.exe100⤵PID:1052
-
\??\c:\nnbthb.exec:\nnbthb.exe101⤵PID:632
-
\??\c:\ppppp.exec:\ppppp.exe102⤵PID:4640
-
\??\c:\7vvpj.exec:\7vvpj.exe103⤵PID:4428
-
\??\c:\5nhtnn.exec:\5nhtnn.exe104⤵PID:548
-
\??\c:\jdpjd.exec:\jdpjd.exe105⤵PID:1860
-
\??\c:\jpjdv.exec:\jpjdv.exe106⤵PID:3612
-
\??\c:\xrrxrrl.exec:\xrrxrrl.exe107⤵PID:3684
-
\??\c:\jdjdp.exec:\jdjdp.exe108⤵PID:4880
-
\??\c:\ffffffx.exec:\ffffffx.exe109⤵PID:4832
-
\??\c:\9nnhbt.exec:\9nnhbt.exe110⤵PID:3216
-
\??\c:\dvdvp.exec:\dvdvp.exe111⤵PID:1020
-
\??\c:\xxxllrx.exec:\xxxllrx.exe112⤵PID:4512
-
\??\c:\tnnhbt.exec:\tnnhbt.exe113⤵
- System Location Discovery: System Language Discovery
PID:4520 -
\??\c:\1bhntb.exec:\1bhntb.exe114⤵PID:5016
-
\??\c:\pdppj.exec:\pdppj.exe115⤵PID:4920
-
\??\c:\rfxxrrr.exec:\rfxxrrr.exe116⤵PID:1564
-
\??\c:\bhnhbt.exec:\bhnhbt.exe117⤵PID:1092
-
\??\c:\9pvjd.exec:\9pvjd.exe118⤵PID:4272
-
\??\c:\ffrlfxr.exec:\ffrlfxr.exe119⤵PID:1084
-
\??\c:\bbnntt.exec:\bbnntt.exe120⤵PID:4968
-
\??\c:\djjvp.exec:\djjvp.exe121⤵PID:4876
-
\??\c:\pdpdv.exec:\pdpdv.exe122⤵PID:412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-