Analysis
-
max time kernel
120s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 12:54
Static task
static1
Behavioral task
behavioral1
Sample
3c2bfbac76438fe9d1455109f919f7055bbad1ec5ac4cd063b1fe9c10b2e4c14N.exe
Resource
win7-20240903-en
General
-
Target
3c2bfbac76438fe9d1455109f919f7055bbad1ec5ac4cd063b1fe9c10b2e4c14N.exe
-
Size
332KB
-
MD5
80c4395fe156657ea63667139098a570
-
SHA1
98fdd59c5cfa67908446a0febc9d7265f6ca6582
-
SHA256
3c2bfbac76438fe9d1455109f919f7055bbad1ec5ac4cd063b1fe9c10b2e4c14
-
SHA512
0aebd47ed4dd8128ab87bae6ab9ec92b74ec6404a66eab0033de51e776d51fbd4cf8f2b1924af5f0713b99812e8591448fe26076c47a5a5a264496cb15595df3
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhu:F7Tc8JdSjylh2b77BoTMA9gX59sTsuT+
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3332-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2836-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/712-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-789-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-829-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-902-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-1064-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3332 7nnnnn.exe 1968 jpjjv.exe 2340 xrxfffr.exe 2728 nhnnnt.exe 1048 hnbnnh.exe 2836 pjpvj.exe 1912 lxxxrrl.exe 4300 btbbtt.exe 1568 nhnhhn.exe 4576 dvjpv.exe 4632 frffxxr.exe 2760 flxxrxr.exe 4076 tthbhn.exe 4748 jvjdd.exe 532 1djdv.exe 4776 fxrrxll.exe 444 1nhhbb.exe 3592 bthbbb.exe 4564 jvjjj.exe 4196 xlxrrxl.exe 4200 lllfxfl.exe 5032 thnnhn.exe 3588 djvvv.exe 632 ddppp.exe 3860 xlxxlll.exe 4584 tnhthn.exe 2364 9pddp.exe 1112 jjddj.exe 3968 xxxrrrl.exe 3476 thbttb.exe 3800 7htnhn.exe 3360 vpjdd.exe 4816 pjdjv.exe 3388 rrlxxlr.exe 1204 btbbbb.exe 2976 thnntn.exe 4108 vpvvj.exe 3556 rllllll.exe 2796 9rfxxff.exe 1688 bnhhnt.exe 2724 vpjdp.exe 4368 vjjdp.exe 4520 1rxllrl.exe 1536 tnbbbt.exe 4324 hbhhbh.exe 1676 vvdvv.exe 1832 xxxxrxx.exe 3264 9llxxfl.exe 1968 tnhtth.exe 4536 dvdvv.exe 2728 xxxxfff.exe 2840 xrlfffl.exe 512 ttnnnn.exe 1288 jdpjj.exe 2700 jvvpv.exe 1800 1llllrr.exe 60 hhhhnn.exe 4440 bhtntn.exe 1700 pjpvv.exe 2760 rlfxlxr.exe 3956 nnhhhh.exe 3052 7vjjp.exe 5056 rrllxxf.exe 5024 vvvvp.exe -
resource yara_rule behavioral2/memory/3332-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1536-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4196-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1568-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/712-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-770-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-789-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-902-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-930-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dddd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3876 wrote to memory of 3332 3876 3c2bfbac76438fe9d1455109f919f7055bbad1ec5ac4cd063b1fe9c10b2e4c14N.exe 82 PID 3876 wrote to memory of 3332 3876 3c2bfbac76438fe9d1455109f919f7055bbad1ec5ac4cd063b1fe9c10b2e4c14N.exe 82 PID 3876 wrote to memory of 3332 3876 3c2bfbac76438fe9d1455109f919f7055bbad1ec5ac4cd063b1fe9c10b2e4c14N.exe 82 PID 3332 wrote to memory of 1968 3332 7nnnnn.exe 130 PID 3332 wrote to memory of 1968 3332 7nnnnn.exe 130 PID 3332 wrote to memory of 1968 3332 7nnnnn.exe 130 PID 1968 wrote to memory of 2340 1968 jpjjv.exe 84 PID 1968 wrote to memory of 2340 1968 jpjjv.exe 84 PID 1968 wrote to memory of 2340 1968 jpjjv.exe 84 PID 2340 wrote to memory of 2728 2340 xrxfffr.exe 132 PID 2340 wrote to memory of 2728 2340 xrxfffr.exe 132 PID 2340 wrote to memory of 2728 2340 xrxfffr.exe 132 PID 2728 wrote to memory of 1048 2728 nhnnnt.exe 86 PID 2728 wrote to memory of 1048 2728 nhnnnt.exe 86 PID 2728 wrote to memory of 1048 2728 nhnnnt.exe 86 PID 1048 wrote to memory of 2836 1048 hnbnnh.exe 87 PID 1048 wrote to memory of 2836 1048 hnbnnh.exe 87 PID 1048 wrote to memory of 2836 1048 hnbnnh.exe 87 PID 2836 wrote to memory of 1912 2836 pjpvj.exe 88 PID 2836 wrote to memory of 1912 2836 pjpvj.exe 88 PID 2836 wrote to memory of 1912 2836 pjpvj.exe 88 PID 1912 wrote to memory of 4300 1912 lxxxrrl.exe 89 PID 1912 wrote to memory of 4300 1912 lxxxrrl.exe 89 PID 1912 wrote to memory of 4300 1912 lxxxrrl.exe 89 PID 4300 wrote to memory of 1568 4300 btbbtt.exe 90 PID 4300 wrote to memory of 1568 4300 btbbtt.exe 90 PID 4300 wrote to memory of 1568 4300 btbbtt.exe 90 PID 1568 wrote to memory of 4576 1568 nhnhhn.exe 91 PID 1568 wrote to memory of 4576 1568 nhnhhn.exe 91 PID 1568 wrote to memory of 4576 1568 nhnhhn.exe 91 PID 4576 wrote to memory of 4632 4576 dvjpv.exe 92 PID 4576 wrote to memory of 4632 4576 dvjpv.exe 92 PID 4576 wrote to memory of 4632 4576 dvjpv.exe 92 PID 4632 wrote to memory of 2760 4632 frffxxr.exe 93 PID 4632 wrote to memory of 2760 4632 frffxxr.exe 93 PID 4632 wrote to memory of 2760 4632 frffxxr.exe 93 PID 2760 wrote to memory of 4076 2760 flxxrxr.exe 94 PID 2760 wrote to memory of 4076 2760 flxxrxr.exe 94 PID 2760 wrote to memory of 4076 2760 flxxrxr.exe 94 PID 4076 wrote to memory of 4748 4076 tthbhn.exe 95 PID 4076 wrote to memory of 4748 4076 tthbhn.exe 95 PID 4076 wrote to memory of 4748 4076 tthbhn.exe 95 PID 4748 wrote to memory of 532 4748 jvjdd.exe 96 PID 4748 wrote to memory of 532 4748 jvjdd.exe 96 PID 4748 wrote to memory of 532 4748 jvjdd.exe 96 PID 532 wrote to memory of 4776 532 1djdv.exe 97 PID 532 wrote to memory of 4776 532 1djdv.exe 97 PID 532 wrote to memory of 4776 532 1djdv.exe 97 PID 4776 wrote to memory of 444 4776 fxrrxll.exe 98 PID 4776 wrote to memory of 444 4776 fxrrxll.exe 98 PID 4776 wrote to memory of 444 4776 fxrrxll.exe 98 PID 444 wrote to memory of 3592 444 1nhhbb.exe 99 PID 444 wrote to memory of 3592 444 1nhhbb.exe 99 PID 444 wrote to memory of 3592 444 1nhhbb.exe 99 PID 3592 wrote to memory of 4564 3592 bthbbb.exe 100 PID 3592 wrote to memory of 4564 3592 bthbbb.exe 100 PID 3592 wrote to memory of 4564 3592 bthbbb.exe 100 PID 4564 wrote to memory of 4196 4564 jvjjj.exe 101 PID 4564 wrote to memory of 4196 4564 jvjjj.exe 101 PID 4564 wrote to memory of 4196 4564 jvjjj.exe 101 PID 4196 wrote to memory of 4200 4196 xlxrrxl.exe 102 PID 4196 wrote to memory of 4200 4196 xlxrrxl.exe 102 PID 4196 wrote to memory of 4200 4196 xlxrrxl.exe 102 PID 4200 wrote to memory of 5032 4200 lllfxfl.exe 150
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c2bfbac76438fe9d1455109f919f7055bbad1ec5ac4cd063b1fe9c10b2e4c14N.exe"C:\Users\Admin\AppData\Local\Temp\3c2bfbac76438fe9d1455109f919f7055bbad1ec5ac4cd063b1fe9c10b2e4c14N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\7nnnnn.exec:\7nnnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\jpjjv.exec:\jpjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\xrxfffr.exec:\xrxfffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\nhnnnt.exec:\nhnnnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\hnbnnh.exec:\hnbnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\pjpvj.exec:\pjpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\lxxxrrl.exec:\lxxxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\btbbtt.exec:\btbbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\nhnhhn.exec:\nhnhhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\dvjpv.exec:\dvjpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\frffxxr.exec:\frffxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\flxxrxr.exec:\flxxrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\tthbhn.exec:\tthbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\jvjdd.exec:\jvjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\1djdv.exec:\1djdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\fxrrxll.exec:\fxrrxll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\1nhhbb.exec:\1nhhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\bthbbb.exec:\bthbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\jvjjj.exec:\jvjjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\xlxrrxl.exec:\xlxrrxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\lllfxfl.exec:\lllfxfl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\thnnhn.exec:\thnnhn.exe23⤵
- Executes dropped EXE
PID:5032 -
\??\c:\djvvv.exec:\djvvv.exe24⤵
- Executes dropped EXE
PID:3588 -
\??\c:\ddppp.exec:\ddppp.exe25⤵
- Executes dropped EXE
PID:632 -
\??\c:\xlxxlll.exec:\xlxxlll.exe26⤵
- Executes dropped EXE
PID:3860 -
\??\c:\tnhthn.exec:\tnhthn.exe27⤵
- Executes dropped EXE
PID:4584 -
\??\c:\9pddp.exec:\9pddp.exe28⤵
- Executes dropped EXE
PID:2364 -
\??\c:\jjddj.exec:\jjddj.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1112 -
\??\c:\xxxrrrl.exec:\xxxrrrl.exe30⤵
- Executes dropped EXE
PID:3968 -
\??\c:\thbttb.exec:\thbttb.exe31⤵
- Executes dropped EXE
PID:3476 -
\??\c:\7htnhn.exec:\7htnhn.exe32⤵
- Executes dropped EXE
PID:3800 -
\??\c:\vpjdd.exec:\vpjdd.exe33⤵
- Executes dropped EXE
PID:3360 -
\??\c:\pjdjv.exec:\pjdjv.exe34⤵
- Executes dropped EXE
PID:4816 -
\??\c:\rrlxxlr.exec:\rrlxxlr.exe35⤵
- Executes dropped EXE
PID:3388 -
\??\c:\btbbbb.exec:\btbbbb.exe36⤵
- Executes dropped EXE
PID:1204 -
\??\c:\thnntn.exec:\thnntn.exe37⤵
- Executes dropped EXE
PID:2976 -
\??\c:\vpvvj.exec:\vpvvj.exe38⤵
- Executes dropped EXE
PID:4108 -
\??\c:\rllllll.exec:\rllllll.exe39⤵
- Executes dropped EXE
PID:3556 -
\??\c:\9rfxxff.exec:\9rfxxff.exe40⤵
- Executes dropped EXE
PID:2796 -
\??\c:\bnhhnt.exec:\bnhhnt.exe41⤵
- Executes dropped EXE
PID:1688 -
\??\c:\vpjdp.exec:\vpjdp.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\vjjdp.exec:\vjjdp.exe43⤵
- Executes dropped EXE
PID:4368 -
\??\c:\1rxllrl.exec:\1rxllrl.exe44⤵
- Executes dropped EXE
PID:4520 -
\??\c:\tnbbbt.exec:\tnbbbt.exe45⤵
- Executes dropped EXE
PID:1536 -
\??\c:\hbhhbh.exec:\hbhhbh.exe46⤵
- Executes dropped EXE
PID:4324 -
\??\c:\vvdvv.exec:\vvdvv.exe47⤵
- Executes dropped EXE
PID:1676 -
\??\c:\xxxxrxx.exec:\xxxxrxx.exe48⤵
- Executes dropped EXE
PID:1832 -
\??\c:\9llxxfl.exec:\9llxxfl.exe49⤵
- Executes dropped EXE
PID:3264 -
\??\c:\tnhtth.exec:\tnhtth.exe50⤵
- Executes dropped EXE
PID:1968 -
\??\c:\dvdvv.exec:\dvdvv.exe51⤵
- Executes dropped EXE
PID:4536 -
\??\c:\xxxxfff.exec:\xxxxfff.exe52⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xrlfffl.exec:\xrlfffl.exe53⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ttnnnn.exec:\ttnnnn.exe54⤵
- Executes dropped EXE
PID:512 -
\??\c:\jdpjj.exec:\jdpjj.exe55⤵
- Executes dropped EXE
PID:1288 -
\??\c:\jvvpv.exec:\jvvpv.exe56⤵
- Executes dropped EXE
PID:2700 -
\??\c:\1llllrr.exec:\1llllrr.exe57⤵
- Executes dropped EXE
PID:1800 -
\??\c:\hhhhnn.exec:\hhhhnn.exe58⤵
- Executes dropped EXE
PID:60 -
\??\c:\bhtntn.exec:\bhtntn.exe59⤵
- Executes dropped EXE
PID:4440 -
\??\c:\pjpvv.exec:\pjpvv.exe60⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rlfxlxr.exec:\rlfxlxr.exe61⤵
- Executes dropped EXE
PID:2760 -
\??\c:\nnhhhh.exec:\nnhhhh.exe62⤵
- Executes dropped EXE
PID:3956 -
\??\c:\7vjjp.exec:\7vjjp.exe63⤵
- Executes dropped EXE
PID:3052 -
\??\c:\rrllxxf.exec:\rrllxxf.exe64⤵
- Executes dropped EXE
PID:5056 -
\??\c:\vvvvp.exec:\vvvvp.exe65⤵
- Executes dropped EXE
PID:5024 -
\??\c:\xfrrlrr.exec:\xfrrlrr.exe66⤵PID:4072
-
\??\c:\nnnhtb.exec:\nnnhtb.exe67⤵PID:3928
-
\??\c:\vpdjv.exec:\vpdjv.exe68⤵PID:3272
-
\??\c:\xxfxxxr.exec:\xxfxxxr.exe69⤵PID:4876
-
\??\c:\7btttt.exec:\7btttt.exe70⤵
- System Location Discovery: System Language Discovery
PID:5032 -
\??\c:\9dddv.exec:\9dddv.exe71⤵PID:1416
-
\??\c:\xxfrrrl.exec:\xxfrrrl.exe72⤵PID:632
-
\??\c:\xrrxxxx.exec:\xrrxxxx.exe73⤵PID:4008
-
\??\c:\tnbntt.exec:\tnbntt.exe74⤵PID:3384
-
\??\c:\ppppv.exec:\ppppv.exe75⤵PID:3616
-
\??\c:\frlfflr.exec:\frlfflr.exe76⤵PID:1112
-
\??\c:\tntntn.exec:\tntntn.exe77⤵PID:3968
-
\??\c:\vdjdv.exec:\vdjdv.exe78⤵PID:3476
-
\??\c:\ffffffl.exec:\ffffffl.exe79⤵PID:2900
-
\??\c:\nntbbh.exec:\nntbbh.exe80⤵PID:1312
-
\??\c:\9nbnnt.exec:\9nbnnt.exe81⤵PID:2896
-
\??\c:\hbhnbt.exec:\hbhnbt.exe82⤵PID:544
-
\??\c:\jjvvj.exec:\jjvvj.exe83⤵PID:2600
-
\??\c:\tbhhhh.exec:\tbhhhh.exe84⤵PID:2020
-
\??\c:\fxfffff.exec:\fxfffff.exe85⤵PID:4552
-
\??\c:\llffffx.exec:\llffffx.exe86⤵PID:1284
-
\??\c:\hnbbnn.exec:\hnbbnn.exe87⤵PID:220
-
\??\c:\jjvjd.exec:\jjvjd.exe88⤵PID:2140
-
\??\c:\rlxxlrx.exec:\rlxxlrx.exe89⤵PID:3472
-
\??\c:\nhnnhn.exec:\nhnnhn.exe90⤵PID:3232
-
\??\c:\nnnhhn.exec:\nnnhhn.exe91⤵PID:4904
-
\??\c:\vjppp.exec:\vjppp.exe92⤵PID:1956
-
\??\c:\lllllxx.exec:\lllllxx.exe93⤵PID:712
-
\??\c:\bthhhh.exec:\bthhhh.exe94⤵PID:4332
-
\??\c:\5jvvv.exec:\5jvvv.exe95⤵PID:4328
-
\??\c:\9xrxfrx.exec:\9xrxfrx.exe96⤵PID:1252
-
\??\c:\tbnnbb.exec:\tbnnbb.exe97⤵PID:2312
-
\??\c:\jjdjd.exec:\jjdjd.exe98⤵PID:3628
-
\??\c:\hnnnhb.exec:\hnnnhb.exe99⤵PID:1048
-
\??\c:\1jvvj.exec:\1jvvj.exe100⤵PID:1548
-
\??\c:\5bnntb.exec:\5bnntb.exe101⤵PID:4432
-
\??\c:\jppjj.exec:\jppjj.exe102⤵PID:3480
-
\??\c:\tbhhhb.exec:\tbhhhb.exe103⤵PID:1420
-
\??\c:\xrlllll.exec:\xrlllll.exe104⤵PID:2836
-
\??\c:\pvdvp.exec:\pvdvp.exe105⤵PID:2656
-
\??\c:\rfrffxr.exec:\rfrffxr.exe106⤵PID:3724
-
\??\c:\nnhbtt.exec:\nnhbtt.exe107⤵PID:4928
-
\??\c:\tnhbnn.exec:\tnhbnn.exe108⤵PID:4076
-
\??\c:\ddppp.exec:\ddppp.exe109⤵PID:3620
-
\??\c:\xxllrrl.exec:\xxllrrl.exe110⤵PID:2588
-
\??\c:\vjvpp.exec:\vjvpp.exe111⤵PID:3284
-
\??\c:\xrxrffx.exec:\xrxrffx.exe112⤵PID:2668
-
\??\c:\thtnhh.exec:\thtnhh.exe113⤵PID:760
-
\??\c:\bbbbbb.exec:\bbbbbb.exe114⤵PID:4836
-
\??\c:\3djjp.exec:\3djjp.exe115⤵PID:4712
-
\??\c:\rrlrfrf.exec:\rrlrfrf.exe116⤵PID:4396
-
\??\c:\hhbbtt.exec:\hhbbtt.exe117⤵PID:4776
-
\??\c:\vpjpp.exec:\vpjpp.exe118⤵PID:2148
-
\??\c:\vpvjd.exec:\vpvjd.exe119⤵
- System Location Discovery: System Language Discovery
PID:3428 -
\??\c:\fxrrllr.exec:\fxrrllr.exe120⤵PID:3380
-
\??\c:\thtnhn.exec:\thtnhn.exe121⤵PID:4244
-
\??\c:\dvvdv.exec:\dvvdv.exe122⤵PID:4200
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-