Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-10-2024 02:04
Behavioral task
behavioral1
Sample
772af59656addde01066d232796a32d476a17e29f430bf428b5c0f09b0286f73N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
772af59656addde01066d232796a32d476a17e29f430bf428b5c0f09b0286f73N.exe
-
Size
498KB
-
MD5
da7efd76c098212fa79968d67bff6440
-
SHA1
29cd0e12901cef8c1ac24ff41564f8b801e4ad8d
-
SHA256
772af59656addde01066d232796a32d476a17e29f430bf428b5c0f09b0286f73
-
SHA512
09f6286761b7a0a1ca585f2766a2c37cd2aadd3e97ff21af0a9ea28afe9ce68c09bf679d180d91fb209adcfc1d0add565e12cfbb4c5b48ae660474a667201167
-
SSDEEP
12288:S4wFHoSyoS3ebeFmFVvlrmwcT4wpteFmFTxe:0KFmFVtrRcFEFmFo
Malware Config
Signatures
-
Detect Blackmoon payload 58 IoCs
resource yara_rule behavioral2/memory/1008-7-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4748-14-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4032-28-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3124-23-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4032-19-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2768-33-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1116-42-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1892-48-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2076-62-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/804-58-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2076-55-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/444-68-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3176-77-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2812-105-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2964-102-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2388-100-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1488-91-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2348-84-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1488-82-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2812-111-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3576-119-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1724-125-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3044-123-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1724-132-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4844-137-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3424-140-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3424-145-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3348-161-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2380-156-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3348-153-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/884-169-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/884-174-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2236-167-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/5108-179-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4108-189-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2184-197-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2848-211-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2428-205-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2848-202-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/684-216-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2672-223-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4584-228-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2248-229-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2248-235-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2052-239-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/436-244-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2100-248-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3800-253-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4328-259-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2768-268-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3744-263-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4604-273-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3064-279-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1532-283-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4856-288-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3956-293-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3464-298-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2836-303-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4748 xxfxrrl.exe 3124 nbnhnn.exe 4032 pvjvd.exe 2768 xlrrrlr.exe 1116 nnttnn.exe 1892 thtnnt.exe 804 htbhhh.exe 2076 hhhbbb.exe 444 jdppj.exe 3176 7pddd.exe 2348 lxxfrlr.exe 1488 7nbtnn.exe 2388 vdvdj.exe 2964 lrfflrx.exe 2812 3bhnnn.exe 3576 dvvpj.exe 3044 fxfxrrr.exe 1724 hhbbbb.exe 4844 ppjdv.exe 3424 lxllfff.exe 2380 pjdvp.exe 3348 5xlrrxx.exe 2236 1lrxxfl.exe 884 htbbtt.exe 5108 dvdvp.exe 4108 5lrrrrx.exe 2184 fxrlflf.exe 2428 nhbtbb.exe 2848 pvdjd.exe 684 llrlrrx.exe 2672 xllrffr.exe 4584 1jddd.exe 2248 hntnbb.exe 2052 dvppp.exe 436 flxrrrr.exe 2100 7bbnnn.exe 3800 1rxxxff.exe 4328 hhnbhb.exe 3744 jpppv.exe 2768 dpddd.exe 4604 5xlllxl.exe 3064 ffrxllx.exe 1532 vpvvv.exe 4856 xxxrllf.exe 3956 jvddd.exe 3464 rfxrrrl.exe 2836 vpjjj.exe 116 llrxxlf.exe 2424 7nhhbb.exe 836 7nhnbh.exe 2404 7jpjj.exe 3500 rrrllrl.exe 4656 tbhhhb.exe 2968 vvddv.exe 452 xrlflll.exe 5096 bthbtt.exe 828 ddpjp.exe 1916 ddjjj.exe 4600 9lrlllr.exe 1816 tnhbbb.exe 3240 jdjjd.exe 2116 jvppp.exe 3228 rllllrr.exe 4428 nbtttt.exe -
resource yara_rule behavioral2/memory/1008-0-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x000c000000023ba8-3.dat upx behavioral2/memory/1008-7-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4748-6-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0009000000023c93-10.dat upx behavioral2/memory/4748-14-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3124-12-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0007000000023c9b-15.dat upx behavioral2/files/0x0007000000023c9c-25.dat upx behavioral2/memory/2768-29-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4032-28-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3124-23-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4032-19-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2768-33-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0007000000023c9d-31.dat upx behavioral2/memory/1116-35-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0007000000023c9e-38.dat upx behavioral2/memory/1116-42-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1892-40-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0007000000023c9f-45.dat upx behavioral2/memory/804-49-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1892-48-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0007000000023ca0-52.dat upx behavioral2/files/0x0007000000023ca1-59.dat upx behavioral2/memory/2076-62-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/444-60-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/804-58-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2076-55-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/444-68-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3176-70-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0008000000023c98-69.dat upx behavioral2/files/0x0007000000023ca2-73.dat upx behavioral2/memory/2348-75-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3176-77-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0007000000023ca3-81.dat upx behavioral2/files/0x0007000000023ca4-87.dat upx behavioral2/memory/2964-96-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0007000000023ca6-103.dat upx behavioral2/memory/2812-105-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2964-102-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2388-100-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2388-95-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0007000000023ca5-94.dat upx behavioral2/memory/1488-91-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2348-84-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1488-82-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0007000000023caa-108.dat upx behavioral2/memory/3576-109-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2812-111-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0007000000023caf-115.dat upx behavioral2/memory/3044-118-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3576-119-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0007000000023cb0-124.dat upx behavioral2/memory/1724-125-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3044-123-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x000600000001e5b2-129.dat upx behavioral2/memory/4844-134-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1724-132-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4844-137-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0009000000023ca7-138.dat upx behavioral2/memory/3424-140-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2380-148-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0008000000023ca9-146.dat upx behavioral2/memory/3424-145-0x0000000000400000-0x0000000000484000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lfffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1008 wrote to memory of 4748 1008 772af59656addde01066d232796a32d476a17e29f430bf428b5c0f09b0286f73N.exe 84 PID 1008 wrote to memory of 4748 1008 772af59656addde01066d232796a32d476a17e29f430bf428b5c0f09b0286f73N.exe 84 PID 1008 wrote to memory of 4748 1008 772af59656addde01066d232796a32d476a17e29f430bf428b5c0f09b0286f73N.exe 84 PID 4748 wrote to memory of 3124 4748 xxfxrrl.exe 86 PID 4748 wrote to memory of 3124 4748 xxfxrrl.exe 86 PID 4748 wrote to memory of 3124 4748 xxfxrrl.exe 86 PID 3124 wrote to memory of 4032 3124 nbnhnn.exe 88 PID 3124 wrote to memory of 4032 3124 nbnhnn.exe 88 PID 3124 wrote to memory of 4032 3124 nbnhnn.exe 88 PID 4032 wrote to memory of 2768 4032 pvjvd.exe 89 PID 4032 wrote to memory of 2768 4032 pvjvd.exe 89 PID 4032 wrote to memory of 2768 4032 pvjvd.exe 89 PID 2768 wrote to memory of 1116 2768 xlrrrlr.exe 90 PID 2768 wrote to memory of 1116 2768 xlrrrlr.exe 90 PID 2768 wrote to memory of 1116 2768 xlrrrlr.exe 90 PID 1116 wrote to memory of 1892 1116 nnttnn.exe 91 PID 1116 wrote to memory of 1892 1116 nnttnn.exe 91 PID 1116 wrote to memory of 1892 1116 nnttnn.exe 91 PID 1892 wrote to memory of 804 1892 thtnnt.exe 92 PID 1892 wrote to memory of 804 1892 thtnnt.exe 92 PID 1892 wrote to memory of 804 1892 thtnnt.exe 92 PID 804 wrote to memory of 2076 804 htbhhh.exe 93 PID 804 wrote to memory of 2076 804 htbhhh.exe 93 PID 804 wrote to memory of 2076 804 htbhhh.exe 93 PID 2076 wrote to memory of 444 2076 hhhbbb.exe 94 PID 2076 wrote to memory of 444 2076 hhhbbb.exe 94 PID 2076 wrote to memory of 444 2076 hhhbbb.exe 94 PID 444 wrote to memory of 3176 444 jdppj.exe 95 PID 444 wrote to memory of 3176 444 jdppj.exe 95 PID 444 wrote to memory of 3176 444 jdppj.exe 95 PID 3176 wrote to memory of 2348 3176 7pddd.exe 96 PID 3176 wrote to memory of 2348 3176 7pddd.exe 96 PID 3176 wrote to memory of 2348 3176 7pddd.exe 96 PID 2348 wrote to memory of 1488 2348 lxxfrlr.exe 97 PID 2348 wrote to memory of 1488 2348 lxxfrlr.exe 97 PID 2348 wrote to memory of 1488 2348 lxxfrlr.exe 97 PID 1488 wrote to memory of 2388 1488 7nbtnn.exe 98 PID 1488 wrote to memory of 2388 1488 7nbtnn.exe 98 PID 1488 wrote to memory of 2388 1488 7nbtnn.exe 98 PID 2388 wrote to memory of 2964 2388 vdvdj.exe 99 PID 2388 wrote to memory of 2964 2388 vdvdj.exe 99 PID 2388 wrote to memory of 2964 2388 vdvdj.exe 99 PID 2964 wrote to memory of 2812 2964 lrfflrx.exe 100 PID 2964 wrote to memory of 2812 2964 lrfflrx.exe 100 PID 2964 wrote to memory of 2812 2964 lrfflrx.exe 100 PID 2812 wrote to memory of 3576 2812 3bhnnn.exe 101 PID 2812 wrote to memory of 3576 2812 3bhnnn.exe 101 PID 2812 wrote to memory of 3576 2812 3bhnnn.exe 101 PID 3576 wrote to memory of 3044 3576 dvvpj.exe 102 PID 3576 wrote to memory of 3044 3576 dvvpj.exe 102 PID 3576 wrote to memory of 3044 3576 dvvpj.exe 102 PID 3044 wrote to memory of 1724 3044 fxfxrrr.exe 103 PID 3044 wrote to memory of 1724 3044 fxfxrrr.exe 103 PID 3044 wrote to memory of 1724 3044 fxfxrrr.exe 103 PID 1724 wrote to memory of 4844 1724 hhbbbb.exe 104 PID 1724 wrote to memory of 4844 1724 hhbbbb.exe 104 PID 1724 wrote to memory of 4844 1724 hhbbbb.exe 104 PID 4844 wrote to memory of 3424 4844 ppjdv.exe 105 PID 4844 wrote to memory of 3424 4844 ppjdv.exe 105 PID 4844 wrote to memory of 3424 4844 ppjdv.exe 105 PID 3424 wrote to memory of 2380 3424 lxllfff.exe 106 PID 3424 wrote to memory of 2380 3424 lxllfff.exe 106 PID 3424 wrote to memory of 2380 3424 lxllfff.exe 106 PID 2380 wrote to memory of 3348 2380 pjdvp.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\772af59656addde01066d232796a32d476a17e29f430bf428b5c0f09b0286f73N.exe"C:\Users\Admin\AppData\Local\Temp\772af59656addde01066d232796a32d476a17e29f430bf428b5c0f09b0286f73N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\xxfxrrl.exec:\xxfxrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\nbnhnn.exec:\nbnhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\pvjvd.exec:\pvjvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\xlrrrlr.exec:\xlrrrlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\nnttnn.exec:\nnttnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\thtnnt.exec:\thtnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\htbhhh.exec:\htbhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\hhhbbb.exec:\hhhbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\jdppj.exec:\jdppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\7pddd.exec:\7pddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\lxxfrlr.exec:\lxxfrlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\7nbtnn.exec:\7nbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\vdvdj.exec:\vdvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\lrfflrx.exec:\lrfflrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\3bhnnn.exec:\3bhnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\dvvpj.exec:\dvvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\hhbbbb.exec:\hhbbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\ppjdv.exec:\ppjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\lxllfff.exec:\lxllfff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\pjdvp.exec:\pjdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\5xlrrxx.exec:\5xlrrxx.exe23⤵
- Executes dropped EXE
PID:3348 -
\??\c:\1lrxxfl.exec:\1lrxxfl.exe24⤵
- Executes dropped EXE
PID:2236 -
\??\c:\htbbtt.exec:\htbbtt.exe25⤵
- Executes dropped EXE
PID:884 -
\??\c:\dvdvp.exec:\dvdvp.exe26⤵
- Executes dropped EXE
PID:5108 -
\??\c:\5lrrrrx.exec:\5lrrrrx.exe27⤵
- Executes dropped EXE
PID:4108 -
\??\c:\fxrlflf.exec:\fxrlflf.exe28⤵
- Executes dropped EXE
PID:2184 -
\??\c:\nhbtbb.exec:\nhbtbb.exe29⤵
- Executes dropped EXE
PID:2428 -
\??\c:\pvdjd.exec:\pvdjd.exe30⤵
- Executes dropped EXE
PID:2848 -
\??\c:\llrlrrx.exec:\llrlrrx.exe31⤵
- Executes dropped EXE
PID:684 -
\??\c:\xllrffr.exec:\xllrffr.exe32⤵
- Executes dropped EXE
PID:2672 -
\??\c:\1jddd.exec:\1jddd.exe33⤵
- Executes dropped EXE
PID:4584 -
\??\c:\hntnbb.exec:\hntnbb.exe34⤵
- Executes dropped EXE
PID:2248 -
\??\c:\dvppp.exec:\dvppp.exe35⤵
- Executes dropped EXE
PID:2052 -
\??\c:\flxrrrr.exec:\flxrrrr.exe36⤵
- Executes dropped EXE
PID:436 -
\??\c:\7bbnnn.exec:\7bbnnn.exe37⤵
- Executes dropped EXE
PID:2100 -
\??\c:\1rxxxff.exec:\1rxxxff.exe38⤵
- Executes dropped EXE
PID:3800 -
\??\c:\hhnbhb.exec:\hhnbhb.exe39⤵
- Executes dropped EXE
PID:4328 -
\??\c:\jpppv.exec:\jpppv.exe40⤵
- Executes dropped EXE
PID:3744 -
\??\c:\dpddd.exec:\dpddd.exe41⤵
- Executes dropped EXE
PID:2768 -
\??\c:\5xlllxl.exec:\5xlllxl.exe42⤵
- Executes dropped EXE
PID:4604 -
\??\c:\ffrxllx.exec:\ffrxllx.exe43⤵
- Executes dropped EXE
PID:3064 -
\??\c:\vpvvv.exec:\vpvvv.exe44⤵
- Executes dropped EXE
PID:1532 -
\??\c:\xxxrllf.exec:\xxxrllf.exe45⤵
- Executes dropped EXE
PID:4856 -
\??\c:\jvddd.exec:\jvddd.exe46⤵
- Executes dropped EXE
PID:3956 -
\??\c:\rfxrrrl.exec:\rfxrrrl.exe47⤵
- Executes dropped EXE
PID:3464 -
\??\c:\vpjjj.exec:\vpjjj.exe48⤵
- Executes dropped EXE
PID:2836 -
\??\c:\llrxxlf.exec:\llrxxlf.exe49⤵
- Executes dropped EXE
PID:116 -
\??\c:\7nhhbb.exec:\7nhhbb.exe50⤵
- Executes dropped EXE
PID:2424 -
\??\c:\7nhnbh.exec:\7nhnbh.exe51⤵
- Executes dropped EXE
PID:836 -
\??\c:\7jpjj.exec:\7jpjj.exe52⤵
- Executes dropped EXE
PID:2404 -
\??\c:\rrrllrl.exec:\rrrllrl.exe53⤵
- Executes dropped EXE
PID:3500 -
\??\c:\tbhhhb.exec:\tbhhhb.exe54⤵
- Executes dropped EXE
PID:4656 -
\??\c:\vvddv.exec:\vvddv.exe55⤵
- Executes dropped EXE
PID:2968 -
\??\c:\xrlflll.exec:\xrlflll.exe56⤵
- Executes dropped EXE
PID:452 -
\??\c:\bthbtt.exec:\bthbtt.exe57⤵
- Executes dropped EXE
PID:5096 -
\??\c:\ddpjp.exec:\ddpjp.exe58⤵
- Executes dropped EXE
PID:828 -
\??\c:\ddjjj.exec:\ddjjj.exe59⤵
- Executes dropped EXE
PID:1916 -
\??\c:\9lrlllr.exec:\9lrlllr.exe60⤵
- Executes dropped EXE
PID:4600 -
\??\c:\tnhbbb.exec:\tnhbbb.exe61⤵
- Executes dropped EXE
PID:1816 -
\??\c:\jdjjd.exec:\jdjjd.exe62⤵
- Executes dropped EXE
PID:3240 -
\??\c:\jvppp.exec:\jvppp.exe63⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rllllrr.exec:\rllllrr.exe64⤵
- Executes dropped EXE
PID:3228 -
\??\c:\nbtttt.exec:\nbtttt.exe65⤵
- Executes dropped EXE
PID:4428 -
\??\c:\dppjj.exec:\dppjj.exe66⤵PID:4916
-
\??\c:\llxrrrr.exec:\llxrrrr.exe67⤵PID:3376
-
\??\c:\1bbttt.exec:\1bbttt.exe68⤵PID:4468
-
\??\c:\5vjdv.exec:\5vjdv.exe69⤵PID:3580
-
\??\c:\rfxlxrf.exec:\rfxlxrf.exe70⤵
- System Location Discovery: System Language Discovery
PID:4964 -
\??\c:\tnbnnt.exec:\tnbnnt.exe71⤵PID:4268
-
\??\c:\dppjj.exec:\dppjj.exe72⤵PID:5032
-
\??\c:\9lfffrl.exec:\9lfffrl.exe73⤵
- System Location Discovery: System Language Discovery
PID:4300 -
\??\c:\bhnhbn.exec:\bhnhbn.exe74⤵PID:4156
-
\??\c:\jvpjp.exec:\jvpjp.exe75⤵PID:3564
-
\??\c:\vdjdd.exec:\vdjdd.exe76⤵PID:2040
-
\??\c:\rfxxxff.exec:\rfxxxff.exe77⤵PID:3256
-
\??\c:\1vjjd.exec:\1vjjd.exe78⤵PID:672
-
\??\c:\ppjdj.exec:\ppjdj.exe79⤵PID:1960
-
\??\c:\9fxrllx.exec:\9fxrllx.exe80⤵PID:2224
-
\??\c:\thtthh.exec:\thtthh.exe81⤵PID:4748
-
\??\c:\bhhhht.exec:\bhhhht.exe82⤵PID:3916
-
\??\c:\pjvvp.exec:\pjvvp.exe83⤵PID:4032
-
\??\c:\rxfxxxx.exec:\rxfxxxx.exe84⤵PID:4432
-
\??\c:\thnhhb.exec:\thnhhb.exe85⤵PID:1028
-
\??\c:\dvvvd.exec:\dvvvd.exe86⤵PID:2804
-
\??\c:\fxlxfrl.exec:\fxlxfrl.exe87⤵PID:4804
-
\??\c:\bhhbtt.exec:\bhhbtt.exe88⤵PID:1376
-
\??\c:\dpvjj.exec:\dpvjj.exe89⤵PID:1764
-
\??\c:\xfrrxrr.exec:\xfrrxrr.exe90⤵PID:2668
-
\??\c:\1httbn.exec:\1httbn.exe91⤵PID:1456
-
\??\c:\3thbtb.exec:\3thbtb.exe92⤵PID:2524
-
\??\c:\pdpvv.exec:\pdpvv.exe93⤵PID:384
-
\??\c:\rlrllll.exec:\rlrllll.exe94⤵PID:3108
-
\??\c:\btbttt.exec:\btbttt.exe95⤵PID:2836
-
\??\c:\pjpdd.exec:\pjpdd.exe96⤵
- System Location Discovery: System Language Discovery
PID:116 -
\??\c:\3ffxlrl.exec:\3ffxlrl.exe97⤵PID:2696
-
\??\c:\3hbtnh.exec:\3hbtnh.exe98⤵PID:1332
-
\??\c:\1jpjp.exec:\1jpjp.exe99⤵PID:2964
-
\??\c:\xlffxxr.exec:\xlffxxr.exe100⤵PID:5068
-
\??\c:\9xxxxxx.exec:\9xxxxxx.exe101⤵PID:2564
-
\??\c:\9hhbbt.exec:\9hhbbt.exe102⤵PID:4416
-
\??\c:\vdpjd.exec:\vdpjd.exe103⤵PID:1384
-
\??\c:\3llfrxr.exec:\3llfrxr.exe104⤵PID:1720
-
\??\c:\tbhbtn.exec:\tbhbtn.exe105⤵PID:3612
-
\??\c:\tnbtnn.exec:\tnbtnn.exe106⤵PID:2168
-
\??\c:\5ppjj.exec:\5ppjj.exe107⤵PID:4888
-
\??\c:\lrlllll.exec:\lrlllll.exe108⤵PID:4332
-
\??\c:\xxlxxxx.exec:\xxlxxxx.exe109⤵PID:3708
-
\??\c:\hbnhtt.exec:\hbnhtt.exe110⤵PID:4576
-
\??\c:\pjvpv.exec:\pjvpv.exe111⤵PID:4728
-
\??\c:\lxlfxrr.exec:\lxlfxrr.exe112⤵PID:3740
-
\??\c:\bnnbbh.exec:\bnnbbh.exe113⤵PID:1112
-
\??\c:\nbnhbb.exec:\nbnhbb.exe114⤵PID:3028
-
\??\c:\dvvpv.exec:\dvvpv.exe115⤵PID:632
-
\??\c:\lflffll.exec:\lflffll.exe116⤵PID:884
-
\??\c:\ttbbnn.exec:\ttbbnn.exe117⤵PID:5108
-
\??\c:\3tbttt.exec:\3tbttt.exe118⤵PID:1944
-
\??\c:\jdddd.exec:\jdddd.exe119⤵PID:2516
-
\??\c:\7rrlxrl.exec:\7rrlxrl.exe120⤵PID:3664
-
\??\c:\bbhnbt.exec:\bbhnbt.exe121⤵PID:1092
-
\??\c:\tntntn.exec:\tntntn.exe122⤵PID:1548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-