Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2024, 04:54
Behavioral task
behavioral1
Sample
1403df0e66343b644baf45ec8d91a841da825895cc2ee8dde6235a2bac23fceaN.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
1403df0e66343b644baf45ec8d91a841da825895cc2ee8dde6235a2bac23fceaN.exe
-
Size
64KB
-
MD5
ba0883c2a95bc07d1bb84640cc25df30
-
SHA1
e60e7d480be23010dc8d9eb3695e1161c4dacc08
-
SHA256
1403df0e66343b644baf45ec8d91a841da825895cc2ee8dde6235a2bac23fcea
-
SHA512
c77a2bd48c23f599ef5b9df8e2132b6318bf8475442d8b8bfbc5be1c71e92fc5f96293f2b0276b38756b3edc7841c31fa72aed0eb97c3559e59b610fab70aa0e
-
SSDEEP
1536:tvQBeOGtrYS3srx93UBWfwC6Ggnouy8gA2l5CcSgui37:thOmTsF93UYfwC6GIoutgVocSc
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/100-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4340-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1308-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3952-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3960-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2904-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/920-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4772-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3388-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1668-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/764-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2284-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2688-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2736-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3224-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1968-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1228-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4488-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2624-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1504-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3344-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3148-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/540-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3756-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1316-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3116-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2200-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3492-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3468-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2744-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3144-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3108-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1960-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4240-517-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-563-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-648-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1744-724-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3144-800-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/812-816-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-826-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-836-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-1024-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4340 thhbbh.exe 1308 nntnnn.exe 3868 ppdvd.exe 4668 flrlfxl.exe 3952 lxfxfff.exe 3960 tntnhb.exe 4720 vpdvv.exe 3980 llfffff.exe 4524 lrxrlrf.exe 5096 1hthbb.exe 4224 1frllrl.exe 3120 tbbhnn.exe 5000 ntbttt.exe 2452 pdvjd.exe 2904 xrxrxxl.exe 920 bnnhhh.exe 5100 nbbthh.exe 1904 vdddd.exe 3636 rllfxxr.exe 3696 thbnhh.exe 4772 nbhnth.exe 3572 1vdvp.exe 3388 1xlfffl.exe 4392 rfrlrlf.exe 1668 hnnnnt.exe 764 5pppj.exe 2028 lfrrrrr.exe 2420 7bbhbb.exe 3548 btthbt.exe 2284 5jdpj.exe 636 vvddv.exe 2688 fffxlll.exe 2736 tbnnhh.exe 3224 bhnhhh.exe 3188 3pdvp.exe 3568 xxllrxl.exe 2540 frxxrrr.exe 1968 tnnnhh.exe 4920 hbnntt.exe 2324 7djjd.exe 1228 pjvpp.exe 4488 llfxffx.exe 4300 nttnhh.exe 2624 9tbnhh.exe 4500 djjdv.exe 3928 rxffxxf.exe 4588 5rlffff.exe 3276 hbhbbb.exe 3884 bhbbhn.exe 1504 3vddd.exe 3344 rrfrlfx.exe 4720 lxffffr.exe 996 hhnnnb.exe 1440 vpjdd.exe 4524 jvdvv.exe 2052 xrrlffx.exe 3148 nbnnhh.exe 676 nnbbtb.exe 464 ppvpj.exe 4216 fxxxrll.exe 5108 7hbbtb.exe 540 bhnnhh.exe 2376 pjddp.exe 4864 lllfffx.exe -
resource yara_rule behavioral2/memory/100-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023c4e-3.dat upx behavioral2/memory/100-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023cb0-10.dat upx behavioral2/memory/4340-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb1-13.dat upx behavioral2/memory/3868-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1308-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb2-22.dat upx behavioral2/files/0x0007000000023cb3-28.dat upx behavioral2/memory/3952-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4668-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb4-33.dat upx behavioral2/memory/3952-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb5-38.dat upx behavioral2/memory/3960-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb6-44.dat upx behavioral2/memory/4720-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb7-50.dat upx behavioral2/memory/3980-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb8-56.dat upx behavioral2/memory/4524-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb9-62.dat upx behavioral2/memory/5096-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cba-67.dat upx behavioral2/memory/3120-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbb-75.dat upx behavioral2/files/0x0007000000023cbc-78.dat upx behavioral2/memory/5000-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbd-85.dat upx behavioral2/memory/2452-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbe-90.dat upx behavioral2/memory/2904-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbf-96.dat upx behavioral2/memory/920-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc0-102.dat upx behavioral2/memory/5100-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc1-110.dat upx behavioral2/files/0x0007000000023cc2-113.dat upx behavioral2/memory/3636-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc3-119.dat upx behavioral2/memory/4772-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc4-126.dat upx behavioral2/memory/3696-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3572-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc5-131.dat upx behavioral2/files/0x0007000000023cc6-137.dat upx behavioral2/memory/3388-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc7-143.dat upx behavioral2/memory/4392-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc8-151.dat upx behavioral2/memory/1668-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023cc9-155.dat upx behavioral2/memory/764-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023ccb-161.dat upx behavioral2/memory/2028-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023cae-167.dat upx behavioral2/files/0x0007000000023ccc-172.dat upx behavioral2/files/0x0007000000023ccd-177.dat upx behavioral2/memory/2284-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cce-183.dat upx behavioral2/memory/2688-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2736-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3224-197-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 100 wrote to memory of 4340 100 1403df0e66343b644baf45ec8d91a841da825895cc2ee8dde6235a2bac23fceaN.exe 83 PID 100 wrote to memory of 4340 100 1403df0e66343b644baf45ec8d91a841da825895cc2ee8dde6235a2bac23fceaN.exe 83 PID 100 wrote to memory of 4340 100 1403df0e66343b644baf45ec8d91a841da825895cc2ee8dde6235a2bac23fceaN.exe 83 PID 4340 wrote to memory of 1308 4340 thhbbh.exe 84 PID 4340 wrote to memory of 1308 4340 thhbbh.exe 84 PID 4340 wrote to memory of 1308 4340 thhbbh.exe 84 PID 1308 wrote to memory of 3868 1308 nntnnn.exe 85 PID 1308 wrote to memory of 3868 1308 nntnnn.exe 85 PID 1308 wrote to memory of 3868 1308 nntnnn.exe 85 PID 3868 wrote to memory of 4668 3868 ppdvd.exe 86 PID 3868 wrote to memory of 4668 3868 ppdvd.exe 86 PID 3868 wrote to memory of 4668 3868 ppdvd.exe 86 PID 4668 wrote to memory of 3952 4668 flrlfxl.exe 87 PID 4668 wrote to memory of 3952 4668 flrlfxl.exe 87 PID 4668 wrote to memory of 3952 4668 flrlfxl.exe 87 PID 3952 wrote to memory of 3960 3952 lxfxfff.exe 89 PID 3952 wrote to memory of 3960 3952 lxfxfff.exe 89 PID 3952 wrote to memory of 3960 3952 lxfxfff.exe 89 PID 3960 wrote to memory of 4720 3960 tntnhb.exe 90 PID 3960 wrote to memory of 4720 3960 tntnhb.exe 90 PID 3960 wrote to memory of 4720 3960 tntnhb.exe 90 PID 4720 wrote to memory of 3980 4720 vpdvv.exe 91 PID 4720 wrote to memory of 3980 4720 vpdvv.exe 91 PID 4720 wrote to memory of 3980 4720 vpdvv.exe 91 PID 3980 wrote to memory of 4524 3980 llfffff.exe 92 PID 3980 wrote to memory of 4524 3980 llfffff.exe 92 PID 3980 wrote to memory of 4524 3980 llfffff.exe 92 PID 4524 wrote to memory of 5096 4524 lrxrlrf.exe 93 PID 4524 wrote to memory of 5096 4524 lrxrlrf.exe 93 PID 4524 wrote to memory of 5096 4524 lrxrlrf.exe 93 PID 5096 wrote to memory of 4224 5096 1hthbb.exe 94 PID 5096 wrote to memory of 4224 5096 1hthbb.exe 94 PID 5096 wrote to memory of 4224 5096 1hthbb.exe 94 PID 4224 wrote to memory of 3120 4224 1frllrl.exe 96 PID 4224 wrote to memory of 3120 4224 1frllrl.exe 96 PID 4224 wrote to memory of 3120 4224 1frllrl.exe 96 PID 3120 wrote to memory of 5000 3120 tbbhnn.exe 97 PID 3120 wrote to memory of 5000 3120 tbbhnn.exe 97 PID 3120 wrote to memory of 5000 3120 tbbhnn.exe 97 PID 5000 wrote to memory of 2452 5000 ntbttt.exe 98 PID 5000 wrote to memory of 2452 5000 ntbttt.exe 98 PID 5000 wrote to memory of 2452 5000 ntbttt.exe 98 PID 2452 wrote to memory of 2904 2452 pdvjd.exe 99 PID 2452 wrote to memory of 2904 2452 pdvjd.exe 99 PID 2452 wrote to memory of 2904 2452 pdvjd.exe 99 PID 2904 wrote to memory of 920 2904 xrxrxxl.exe 100 PID 2904 wrote to memory of 920 2904 xrxrxxl.exe 100 PID 2904 wrote to memory of 920 2904 xrxrxxl.exe 100 PID 920 wrote to memory of 5100 920 bnnhhh.exe 101 PID 920 wrote to memory of 5100 920 bnnhhh.exe 101 PID 920 wrote to memory of 5100 920 bnnhhh.exe 101 PID 5100 wrote to memory of 1904 5100 nbbthh.exe 102 PID 5100 wrote to memory of 1904 5100 nbbthh.exe 102 PID 5100 wrote to memory of 1904 5100 nbbthh.exe 102 PID 1904 wrote to memory of 3636 1904 vdddd.exe 104 PID 1904 wrote to memory of 3636 1904 vdddd.exe 104 PID 1904 wrote to memory of 3636 1904 vdddd.exe 104 PID 3636 wrote to memory of 3696 3636 rllfxxr.exe 105 PID 3636 wrote to memory of 3696 3636 rllfxxr.exe 105 PID 3636 wrote to memory of 3696 3636 rllfxxr.exe 105 PID 3696 wrote to memory of 4772 3696 thbnhh.exe 106 PID 3696 wrote to memory of 4772 3696 thbnhh.exe 106 PID 3696 wrote to memory of 4772 3696 thbnhh.exe 106 PID 4772 wrote to memory of 3572 4772 nbhnth.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\1403df0e66343b644baf45ec8d91a841da825895cc2ee8dde6235a2bac23fceaN.exe"C:\Users\Admin\AppData\Local\Temp\1403df0e66343b644baf45ec8d91a841da825895cc2ee8dde6235a2bac23fceaN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\thhbbh.exec:\thhbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\nntnnn.exec:\nntnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\ppdvd.exec:\ppdvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\flrlfxl.exec:\flrlfxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\lxfxfff.exec:\lxfxfff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\tntnhb.exec:\tntnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\vpdvv.exec:\vpdvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\llfffff.exec:\llfffff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\lrxrlrf.exec:\lrxrlrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\1hthbb.exec:\1hthbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\1frllrl.exec:\1frllrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\tbbhnn.exec:\tbbhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\ntbttt.exec:\ntbttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\pdvjd.exec:\pdvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\xrxrxxl.exec:\xrxrxxl.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\bnnhhh.exec:\bnnhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\nbbthh.exec:\nbbthh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\vdddd.exec:\vdddd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\rllfxxr.exec:\rllfxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\thbnhh.exec:\thbnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\nbhnth.exec:\nbhnth.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\1vdvp.exec:\1vdvp.exe23⤵
- Executes dropped EXE
PID:3572 -
\??\c:\1xlfffl.exec:\1xlfffl.exe24⤵
- Executes dropped EXE
PID:3388 -
\??\c:\rfrlrlf.exec:\rfrlrlf.exe25⤵
- Executes dropped EXE
PID:4392 -
\??\c:\hnnnnt.exec:\hnnnnt.exe26⤵
- Executes dropped EXE
PID:1668 -
\??\c:\5pppj.exec:\5pppj.exe27⤵
- Executes dropped EXE
PID:764 -
\??\c:\lfrrrrr.exec:\lfrrrrr.exe28⤵
- Executes dropped EXE
PID:2028 -
\??\c:\7bbhbb.exec:\7bbhbb.exe29⤵
- Executes dropped EXE
PID:2420 -
\??\c:\btthbt.exec:\btthbt.exe30⤵
- Executes dropped EXE
PID:3548 -
\??\c:\5jdpj.exec:\5jdpj.exe31⤵
- Executes dropped EXE
PID:2284 -
\??\c:\vvddv.exec:\vvddv.exe32⤵
- Executes dropped EXE
PID:636 -
\??\c:\fffxlll.exec:\fffxlll.exe33⤵
- Executes dropped EXE
PID:2688 -
\??\c:\tbnnhh.exec:\tbnnhh.exe34⤵
- Executes dropped EXE
PID:2736 -
\??\c:\bhnhhh.exec:\bhnhhh.exe35⤵
- Executes dropped EXE
PID:3224 -
\??\c:\3pdvp.exec:\3pdvp.exe36⤵
- Executes dropped EXE
PID:3188 -
\??\c:\xxllrxl.exec:\xxllrxl.exe37⤵
- Executes dropped EXE
PID:3568 -
\??\c:\frxxrrr.exec:\frxxrrr.exe38⤵
- Executes dropped EXE
PID:2540 -
\??\c:\tnnnhh.exec:\tnnnhh.exe39⤵
- Executes dropped EXE
PID:1968 -
\??\c:\hbnntt.exec:\hbnntt.exe40⤵
- Executes dropped EXE
PID:4920 -
\??\c:\7djjd.exec:\7djjd.exe41⤵
- Executes dropped EXE
PID:2324 -
\??\c:\pjvpp.exec:\pjvpp.exe42⤵
- Executes dropped EXE
PID:1228 -
\??\c:\llfxffx.exec:\llfxffx.exe43⤵
- Executes dropped EXE
PID:4488 -
\??\c:\nttnhh.exec:\nttnhh.exe44⤵
- Executes dropped EXE
PID:4300 -
\??\c:\9tbnhh.exec:\9tbnhh.exe45⤵
- Executes dropped EXE
PID:2624 -
\??\c:\djjdv.exec:\djjdv.exe46⤵
- Executes dropped EXE
PID:4500 -
\??\c:\rxffxxf.exec:\rxffxxf.exe47⤵
- Executes dropped EXE
PID:3928 -
\??\c:\5rlffff.exec:\5rlffff.exe48⤵
- Executes dropped EXE
PID:4588 -
\??\c:\hbhbbb.exec:\hbhbbb.exe49⤵
- Executes dropped EXE
PID:3276 -
\??\c:\bhbbhn.exec:\bhbbhn.exe50⤵
- Executes dropped EXE
PID:3884 -
\??\c:\3vddd.exec:\3vddd.exe51⤵
- Executes dropped EXE
PID:1504 -
\??\c:\rrfrlfx.exec:\rrfrlfx.exe52⤵
- Executes dropped EXE
PID:3344 -
\??\c:\lxffffr.exec:\lxffffr.exe53⤵
- Executes dropped EXE
PID:4720 -
\??\c:\hhnnnb.exec:\hhnnnb.exe54⤵
- Executes dropped EXE
PID:996 -
\??\c:\vpjdd.exec:\vpjdd.exe55⤵
- Executes dropped EXE
PID:1440 -
\??\c:\jvdvv.exec:\jvdvv.exe56⤵
- Executes dropped EXE
PID:4524 -
\??\c:\xrrlffx.exec:\xrrlffx.exe57⤵
- Executes dropped EXE
PID:2052 -
\??\c:\nbnnhh.exec:\nbnnhh.exe58⤵
- Executes dropped EXE
PID:3148 -
\??\c:\nnbbtb.exec:\nnbbtb.exe59⤵
- Executes dropped EXE
PID:676 -
\??\c:\ppvpj.exec:\ppvpj.exe60⤵
- Executes dropped EXE
PID:464 -
\??\c:\fxxxrll.exec:\fxxxrll.exe61⤵
- Executes dropped EXE
PID:4216 -
\??\c:\7hbbtb.exec:\7hbbtb.exe62⤵
- Executes dropped EXE
PID:5108 -
\??\c:\bhnnhh.exec:\bhnnhh.exe63⤵
- Executes dropped EXE
PID:540 -
\??\c:\pjddp.exec:\pjddp.exe64⤵
- Executes dropped EXE
PID:2376 -
\??\c:\lllfffx.exec:\lllfffx.exe65⤵
- Executes dropped EXE
PID:4864 -
\??\c:\hhbtnn.exec:\hhbtnn.exe66⤵PID:4212
-
\??\c:\btbttn.exec:\btbttn.exe67⤵PID:4032
-
\??\c:\1xrxlrr.exec:\1xrxlrr.exe68⤵PID:4040
-
\??\c:\lfxxrrl.exec:\lfxxrrl.exe69⤵PID:3756
-
\??\c:\1hbtnt.exec:\1hbtnt.exe70⤵PID:924
-
\??\c:\vpvvv.exec:\vpvvv.exe71⤵PID:1316
-
\??\c:\vvpjd.exec:\vvpjd.exe72⤵PID:3448
-
\??\c:\rlxrrrl.exec:\rlxrrrl.exe73⤵PID:3200
-
\??\c:\3rllffx.exec:\3rllffx.exe74⤵PID:3116
-
\??\c:\pjvpv.exec:\pjvpv.exe75⤵PID:1688
-
\??\c:\vpddv.exec:\vpddv.exe76⤵PID:4476
-
\??\c:\1rffrfx.exec:\1rffrfx.exe77⤵PID:2520
-
\??\c:\xlrrlrl.exec:\xlrrlrl.exe78⤵PID:2200
-
\??\c:\7nnhbb.exec:\7nnhbb.exe79⤵PID:3700
-
\??\c:\vdddv.exec:\vdddv.exe80⤵PID:2088
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe81⤵PID:1868
-
\??\c:\rlrfllf.exec:\rlrfllf.exe82⤵PID:3716
-
\??\c:\btbtbh.exec:\btbtbh.exe83⤵PID:3548
-
\??\c:\hbhbbb.exec:\hbhbbb.exe84⤵PID:1604
-
\??\c:\vpvvp.exec:\vpvvp.exe85⤵PID:2400
-
\??\c:\rxffxxf.exec:\rxffxxf.exe86⤵PID:3688
-
\??\c:\lffxrlf.exec:\lffxrlf.exe87⤵PID:3968
-
\??\c:\hnbnhb.exec:\hnbnhb.exe88⤵PID:3492
-
\??\c:\jvjpj.exec:\jvjpj.exe89⤵PID:4856
-
\??\c:\dpvpj.exec:\dpvpj.exe90⤵PID:3476
-
\??\c:\rrfffrr.exec:\rrfffrr.exe91⤵PID:4352
-
\??\c:\xxlffxx.exec:\xxlffxx.exe92⤵PID:2072
-
\??\c:\3hnnhn.exec:\3hnnhn.exe93⤵PID:4624
-
\??\c:\1djpj.exec:\1djpj.exe94⤵PID:4792
-
\??\c:\xxfxrxr.exec:\xxfxrxr.exe95⤵PID:3468
-
\??\c:\5xfxxxr.exec:\5xfxxxr.exe96⤵PID:4316
-
\??\c:\hbtbbb.exec:\hbtbbb.exe97⤵PID:1016
-
\??\c:\ddddd.exec:\ddddd.exe98⤵PID:2580
-
\??\c:\rffxxxx.exec:\rffxxxx.exe99⤵PID:4468
-
\??\c:\tbttnn.exec:\tbttnn.exe100⤵PID:3444
-
\??\c:\pddvp.exec:\pddvp.exe101⤵PID:3112
-
\??\c:\flfxllx.exec:\flfxllx.exe102⤵PID:2448
-
\??\c:\9rxrlfr.exec:\9rxrlfr.exe103⤵PID:1072
-
\??\c:\hbhbbb.exec:\hbhbbb.exe104⤵PID:3252
-
\??\c:\jjppd.exec:\jjppd.exe105⤵PID:4600
-
\??\c:\rflxrxr.exec:\rflxrxr.exe106⤵PID:1936
-
\??\c:\7xffxrl.exec:\7xffxrl.exe107⤵PID:2744
-
\??\c:\hnttnn.exec:\hnttnn.exe108⤵PID:4908
-
\??\c:\pjddj.exec:\pjddj.exe109⤵PID:2196
-
\??\c:\dpppj.exec:\dpppj.exe110⤵PID:3144
-
\??\c:\1fllffr.exec:\1fllffr.exe111⤵PID:1536
-
\??\c:\nhhhbb.exec:\nhhhbb.exe112⤵PID:3132
-
\??\c:\3vddv.exec:\3vddv.exe113⤵PID:4224
-
\??\c:\fllffxr.exec:\fllffxr.exe114⤵PID:2704
-
\??\c:\5jppj.exec:\5jppj.exe115⤵PID:2144
-
\??\c:\xxlxrrx.exec:\xxlxrrx.exe116⤵PID:2432
-
\??\c:\hbbnhb.exec:\hbbnhb.exe117⤵PID:3108
-
\??\c:\bhbbbb.exec:\bhbbbb.exe118⤵
- System Location Discovery: System Language Discovery
PID:1184 -
\??\c:\djpdd.exec:\djpdd.exe119⤵PID:3608
-
\??\c:\9xfxrrr.exec:\9xfxrrr.exe120⤵PID:4108
-
\??\c:\rfrrfll.exec:\rfrrfll.exe121⤵PID:4596
-
\??\c:\tbtbtt.exec:\tbtbtt.exe122⤵PID:1960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-