Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2024 11:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
17a1e2c8786c3182606b4c28fadd915e9d0a618b8f3d1e5dd22f02dddbd1202fN.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
General
-
Target
17a1e2c8786c3182606b4c28fadd915e9d0a618b8f3d1e5dd22f02dddbd1202fN.exe
-
Size
453KB
-
MD5
05f8260b67b540c6cefdf2f93d2efee0
-
SHA1
3cdd15baeca04448957aaae33b9e2f6ac79ec196
-
SHA256
17a1e2c8786c3182606b4c28fadd915e9d0a618b8f3d1e5dd22f02dddbd1202f
-
SHA512
f0d750df373e75986210b6e484b71f9774dc50450784733c92a598c3e63650e5f7d4f016dab05fa01366dab817cdc662bb97e3bbc15f37059591648823fb6ec2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbel:q7Tc2NYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/320-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1740-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3344-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/908-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1248-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1420-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-777-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-781-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-819-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-829-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1408-1013-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 320 hhnnnn.exe 5068 tbbbhh.exe 860 ddjdd.exe 808 pvjjv.exe 1192 flfxffx.exe 4604 hthnnt.exe 1740 xlfflxx.exe 5052 jjjvd.exe 5028 lfrlxrx.exe 212 hnnntb.exe 4808 hhbnhb.exe 3344 dvjpd.exe 3952 hthhhn.exe 2528 xlllffx.exe 1196 bhbnnb.exe 640 nttbhh.exe 908 5dppj.exe 2548 pdjjp.exe 948 5ffrfxr.exe 1220 nbhhtt.exe 2056 rrxrrrr.exe 4212 nnnnnn.exe 4016 nttttb.exe 4952 ppdvv.exe 3024 rrfflrx.exe 1972 hhhbbh.exe 1248 1ntttb.exe 1708 9xrrlrf.exe 1668 xxffflf.exe 376 vjdvp.exe 1780 xfflxxx.exe 1648 nntnhh.exe 1420 9jjjj.exe 396 vdjpp.exe 1596 vjjjj.exe 2408 fflrrxx.exe 4372 nhbthb.exe 64 dpjjj.exe 2740 lflffll.exe 4260 nhhntb.exe 1540 bhnnnn.exe 1824 5dddj.exe 2924 llxxxfr.exe 400 tnnnnn.exe 2284 bhtthn.exe 3676 9jvpp.exe 4604 7bbbbh.exe 2452 ppvvd.exe 2636 1lllflx.exe 4428 bhhhbh.exe 32 tnbhtb.exe 968 jpddd.exe 212 lxlrlll.exe 3944 9tttth.exe 3628 9xlxfll.exe 3952 nnnbbn.exe 2528 ddjjj.exe 3996 xlrxlrx.exe 3232 rfrxxfl.exe 5032 nntnnt.exe 3720 dpjjj.exe 888 1rxllrx.exe 2640 5rrrrxx.exe 4832 vjdjj.exe -
resource yara_rule behavioral2/memory/320-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3344-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/908-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1248-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-777-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/32-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-819-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ffflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4836 wrote to memory of 320 4836 17a1e2c8786c3182606b4c28fadd915e9d0a618b8f3d1e5dd22f02dddbd1202fN.exe 84 PID 4836 wrote to memory of 320 4836 17a1e2c8786c3182606b4c28fadd915e9d0a618b8f3d1e5dd22f02dddbd1202fN.exe 84 PID 4836 wrote to memory of 320 4836 17a1e2c8786c3182606b4c28fadd915e9d0a618b8f3d1e5dd22f02dddbd1202fN.exe 84 PID 320 wrote to memory of 5068 320 hhnnnn.exe 85 PID 320 wrote to memory of 5068 320 hhnnnn.exe 85 PID 320 wrote to memory of 5068 320 hhnnnn.exe 85 PID 5068 wrote to memory of 860 5068 tbbbhh.exe 86 PID 5068 wrote to memory of 860 5068 tbbbhh.exe 86 PID 5068 wrote to memory of 860 5068 tbbbhh.exe 86 PID 860 wrote to memory of 808 860 ddjdd.exe 87 PID 860 wrote to memory of 808 860 ddjdd.exe 87 PID 860 wrote to memory of 808 860 ddjdd.exe 87 PID 808 wrote to memory of 1192 808 pvjjv.exe 88 PID 808 wrote to memory of 1192 808 pvjjv.exe 88 PID 808 wrote to memory of 1192 808 pvjjv.exe 88 PID 1192 wrote to memory of 4604 1192 flfxffx.exe 89 PID 1192 wrote to memory of 4604 1192 flfxffx.exe 89 PID 1192 wrote to memory of 4604 1192 flfxffx.exe 89 PID 4604 wrote to memory of 1740 4604 hthnnt.exe 90 PID 4604 wrote to memory of 1740 4604 hthnnt.exe 90 PID 4604 wrote to memory of 1740 4604 hthnnt.exe 90 PID 1740 wrote to memory of 5052 1740 xlfflxx.exe 91 PID 1740 wrote to memory of 5052 1740 xlfflxx.exe 91 PID 1740 wrote to memory of 5052 1740 xlfflxx.exe 91 PID 5052 wrote to memory of 5028 5052 jjjvd.exe 92 PID 5052 wrote to memory of 5028 5052 jjjvd.exe 92 PID 5052 wrote to memory of 5028 5052 jjjvd.exe 92 PID 5028 wrote to memory of 212 5028 lfrlxrx.exe 93 PID 5028 wrote to memory of 212 5028 lfrlxrx.exe 93 PID 5028 wrote to memory of 212 5028 lfrlxrx.exe 93 PID 212 wrote to memory of 4808 212 hnnntb.exe 94 PID 212 wrote to memory of 4808 212 hnnntb.exe 94 PID 212 wrote to memory of 4808 212 hnnntb.exe 94 PID 4808 wrote to memory of 3344 4808 hhbnhb.exe 95 PID 4808 wrote to memory of 3344 4808 hhbnhb.exe 95 PID 4808 wrote to memory of 3344 4808 hhbnhb.exe 95 PID 3344 wrote to memory of 3952 3344 dvjpd.exe 96 PID 3344 wrote to memory of 3952 3344 dvjpd.exe 96 PID 3344 wrote to memory of 3952 3344 dvjpd.exe 96 PID 3952 wrote to memory of 2528 3952 hthhhn.exe 98 PID 3952 wrote to memory of 2528 3952 hthhhn.exe 98 PID 3952 wrote to memory of 2528 3952 hthhhn.exe 98 PID 2528 wrote to memory of 1196 2528 xlllffx.exe 99 PID 2528 wrote to memory of 1196 2528 xlllffx.exe 99 PID 2528 wrote to memory of 1196 2528 xlllffx.exe 99 PID 1196 wrote to memory of 640 1196 bhbnnb.exe 100 PID 1196 wrote to memory of 640 1196 bhbnnb.exe 100 PID 1196 wrote to memory of 640 1196 bhbnnb.exe 100 PID 640 wrote to memory of 908 640 nttbhh.exe 101 PID 640 wrote to memory of 908 640 nttbhh.exe 101 PID 640 wrote to memory of 908 640 nttbhh.exe 101 PID 908 wrote to memory of 2548 908 5dppj.exe 102 PID 908 wrote to memory of 2548 908 5dppj.exe 102 PID 908 wrote to memory of 2548 908 5dppj.exe 102 PID 2548 wrote to memory of 948 2548 pdjjp.exe 103 PID 2548 wrote to memory of 948 2548 pdjjp.exe 103 PID 2548 wrote to memory of 948 2548 pdjjp.exe 103 PID 948 wrote to memory of 1220 948 5ffrfxr.exe 104 PID 948 wrote to memory of 1220 948 5ffrfxr.exe 104 PID 948 wrote to memory of 1220 948 5ffrfxr.exe 104 PID 1220 wrote to memory of 2056 1220 nbhhtt.exe 106 PID 1220 wrote to memory of 2056 1220 nbhhtt.exe 106 PID 1220 wrote to memory of 2056 1220 nbhhtt.exe 106 PID 2056 wrote to memory of 4212 2056 rrxrrrr.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\17a1e2c8786c3182606b4c28fadd915e9d0a618b8f3d1e5dd22f02dddbd1202fN.exe"C:\Users\Admin\AppData\Local\Temp\17a1e2c8786c3182606b4c28fadd915e9d0a618b8f3d1e5dd22f02dddbd1202fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\hhnnnn.exec:\hhnnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\tbbbhh.exec:\tbbbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\ddjdd.exec:\ddjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\pvjjv.exec:\pvjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\flfxffx.exec:\flfxffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\hthnnt.exec:\hthnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\xlfflxx.exec:\xlfflxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\jjjvd.exec:\jjjvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\lfrlxrx.exec:\lfrlxrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\hnnntb.exec:\hnnntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\hhbnhb.exec:\hhbnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\dvjpd.exec:\dvjpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\hthhhn.exec:\hthhhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\xlllffx.exec:\xlllffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\bhbnnb.exec:\bhbnnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\nttbhh.exec:\nttbhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\5dppj.exec:\5dppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\pdjjp.exec:\pdjjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\5ffrfxr.exec:\5ffrfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\nbhhtt.exec:\nbhhtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\rrxrrrr.exec:\rrxrrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\nnnnnn.exec:\nnnnnn.exe23⤵
- Executes dropped EXE
PID:4212 -
\??\c:\nttttb.exec:\nttttb.exe24⤵
- Executes dropped EXE
PID:4016 -
\??\c:\ppdvv.exec:\ppdvv.exe25⤵
- Executes dropped EXE
PID:4952 -
\??\c:\rrfflrx.exec:\rrfflrx.exe26⤵
- Executes dropped EXE
PID:3024 -
\??\c:\hhhbbh.exec:\hhhbbh.exe27⤵
- Executes dropped EXE
PID:1972 -
\??\c:\1ntttb.exec:\1ntttb.exe28⤵
- Executes dropped EXE
PID:1248 -
\??\c:\9xrrlrf.exec:\9xrrlrf.exe29⤵
- Executes dropped EXE
PID:1708 -
\??\c:\xxffflf.exec:\xxffflf.exe30⤵
- Executes dropped EXE
PID:1668 -
\??\c:\vjdvp.exec:\vjdvp.exe31⤵
- Executes dropped EXE
PID:376 -
\??\c:\xfflxxx.exec:\xfflxxx.exe32⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nntnhh.exec:\nntnhh.exe33⤵
- Executes dropped EXE
PID:1648 -
\??\c:\9jjjj.exec:\9jjjj.exe34⤵
- Executes dropped EXE
PID:1420 -
\??\c:\vdjpp.exec:\vdjpp.exe35⤵
- Executes dropped EXE
PID:396 -
\??\c:\vjjjj.exec:\vjjjj.exe36⤵
- Executes dropped EXE
PID:1596 -
\??\c:\fflrrxx.exec:\fflrrxx.exe37⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nhbthb.exec:\nhbthb.exe38⤵
- Executes dropped EXE
PID:4372 -
\??\c:\dpjjj.exec:\dpjjj.exe39⤵
- Executes dropped EXE
PID:64 -
\??\c:\lflffll.exec:\lflffll.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nhhntb.exec:\nhhntb.exe41⤵
- Executes dropped EXE
PID:4260 -
\??\c:\bhnnnn.exec:\bhnnnn.exe42⤵
- Executes dropped EXE
PID:1540 -
\??\c:\5dddj.exec:\5dddj.exe43⤵
- Executes dropped EXE
PID:1824 -
\??\c:\llxxxfr.exec:\llxxxfr.exe44⤵
- Executes dropped EXE
PID:2924 -
\??\c:\tnnnnn.exec:\tnnnnn.exe45⤵
- Executes dropped EXE
PID:400 -
\??\c:\bhtthn.exec:\bhtthn.exe46⤵
- Executes dropped EXE
PID:2284 -
\??\c:\9jvpp.exec:\9jvpp.exe47⤵
- Executes dropped EXE
PID:3676 -
\??\c:\7bbbbh.exec:\7bbbbh.exe48⤵
- Executes dropped EXE
PID:4604 -
\??\c:\ppvvd.exec:\ppvvd.exe49⤵
- Executes dropped EXE
PID:2452 -
\??\c:\1lllflx.exec:\1lllflx.exe50⤵
- Executes dropped EXE
PID:2636 -
\??\c:\bhhhbh.exec:\bhhhbh.exe51⤵
- Executes dropped EXE
PID:4428 -
\??\c:\tnbhtb.exec:\tnbhtb.exe52⤵
- Executes dropped EXE
PID:32 -
\??\c:\jpddd.exec:\jpddd.exe53⤵
- Executes dropped EXE
PID:968 -
\??\c:\lxlrlll.exec:\lxlrlll.exe54⤵
- Executes dropped EXE
PID:212 -
\??\c:\9tttth.exec:\9tttth.exe55⤵
- Executes dropped EXE
PID:3944 -
\??\c:\9xlxfll.exec:\9xlxfll.exe56⤵
- Executes dropped EXE
PID:3628 -
\??\c:\nnnbbn.exec:\nnnbbn.exe57⤵
- Executes dropped EXE
PID:3952 -
\??\c:\ddjjj.exec:\ddjjj.exe58⤵
- Executes dropped EXE
PID:2528 -
\??\c:\xlrxlrx.exec:\xlrxlrx.exe59⤵
- Executes dropped EXE
PID:3996 -
\??\c:\rfrxxfl.exec:\rfrxxfl.exe60⤵
- Executes dropped EXE
PID:3232 -
\??\c:\nntnnt.exec:\nntnnt.exe61⤵
- Executes dropped EXE
PID:5032 -
\??\c:\dpjjj.exec:\dpjjj.exe62⤵
- Executes dropped EXE
PID:3720 -
\??\c:\1rxllrx.exec:\1rxllrx.exe63⤵
- Executes dropped EXE
PID:888 -
\??\c:\5rrrrxx.exec:\5rrrrxx.exe64⤵
- Executes dropped EXE
PID:2640 -
\??\c:\vjdjj.exec:\vjdjj.exe65⤵
- Executes dropped EXE
PID:4832 -
\??\c:\jpppj.exec:\jpppj.exe66⤵PID:3636
-
\??\c:\rlrrrll.exec:\rlrrrll.exe67⤵PID:224
-
\??\c:\nbtbhn.exec:\nbtbhn.exe68⤵PID:4988
-
\??\c:\djvdp.exec:\djvdp.exe69⤵PID:4528
-
\??\c:\djppp.exec:\djppp.exe70⤵PID:880
-
\??\c:\7rrxxxf.exec:\7rrxxxf.exe71⤵PID:1804
-
\??\c:\hnbbtt.exec:\hnbbtt.exe72⤵PID:4644
-
\??\c:\jpppj.exec:\jpppj.exe73⤵PID:2692
-
\??\c:\lxffflf.exec:\lxffflf.exe74⤵PID:4200
-
\??\c:\bbhnnb.exec:\bbhnnb.exe75⤵PID:1912
-
\??\c:\httttt.exec:\httttt.exe76⤵PID:1180
-
\??\c:\rrrlffx.exec:\rrrlffx.exe77⤵PID:1588
-
\??\c:\xxxxflr.exec:\xxxxflr.exe78⤵PID:1284
-
\??\c:\hhhtnn.exec:\hhhtnn.exe79⤵PID:1792
-
\??\c:\jpddp.exec:\jpddp.exe80⤵PID:4544
-
\??\c:\llrlxrx.exec:\llrlxrx.exe81⤵PID:4344
-
\??\c:\5bhnbt.exec:\5bhnbt.exe82⤵PID:4976
-
\??\c:\nhnnnt.exec:\nhnnnt.exe83⤵PID:3484
-
\??\c:\vvddj.exec:\vvddj.exe84⤵PID:2420
-
\??\c:\lrffrff.exec:\lrffrff.exe85⤵PID:4408
-
\??\c:\htbbtb.exec:\htbbtb.exe86⤵PID:3208
-
\??\c:\jjjdd.exec:\jjjdd.exe87⤵PID:3716
-
\??\c:\jdjdd.exec:\jdjdd.exe88⤵PID:4768
-
\??\c:\rflllll.exec:\rflllll.exe89⤵PID:3960
-
\??\c:\bbnnnn.exec:\bbnnnn.exe90⤵PID:4188
-
\??\c:\bbtbtb.exec:\bbtbtb.exe91⤵PID:1380
-
\??\c:\jvvdd.exec:\jvvdd.exe92⤵PID:2656
-
\??\c:\1xfffff.exec:\1xfffff.exe93⤵PID:2804
-
\??\c:\tnbthh.exec:\tnbthh.exe94⤵PID:2780
-
\??\c:\ntbbtt.exec:\ntbbtt.exe95⤵PID:3280
-
\??\c:\vdvdd.exec:\vdvdd.exe96⤵PID:4044
-
\??\c:\rxxxxff.exec:\rxxxxff.exe97⤵PID:3888
-
\??\c:\bbhhhn.exec:\bbhhhn.exe98⤵PID:212
-
\??\c:\5jpvp.exec:\5jpvp.exe99⤵
- System Location Discovery: System Language Discovery
PID:1908 -
\??\c:\xxflllr.exec:\xxflllr.exe100⤵PID:2144
-
\??\c:\xffllll.exec:\xffllll.exe101⤵PID:1464
-
\??\c:\9llxlrf.exec:\9llxlrf.exe102⤵PID:2496
-
\??\c:\pjddj.exec:\pjddj.exe103⤵PID:1500
-
\??\c:\7flllrr.exec:\7flllrr.exe104⤵PID:4468
-
\??\c:\jjppv.exec:\jjppv.exe105⤵PID:2428
-
\??\c:\1xfllll.exec:\1xfllll.exe106⤵PID:3720
-
\??\c:\3ttnnn.exec:\3ttnnn.exe107⤵PID:4320
-
\??\c:\7djdd.exec:\7djdd.exe108⤵PID:828
-
\??\c:\xllrlxx.exec:\xllrlxx.exe109⤵
- System Location Discovery: System Language Discovery
PID:208 -
\??\c:\bhhhnn.exec:\bhhhnn.exe110⤵PID:2928
-
\??\c:\ddjjj.exec:\ddjjj.exe111⤵PID:432
-
\??\c:\9lxxxfl.exec:\9lxxxfl.exe112⤵PID:928
-
\??\c:\xfffxxx.exec:\xfffxxx.exe113⤵PID:3404
-
\??\c:\ntbntb.exec:\ntbntb.exe114⤵PID:1568
-
\??\c:\7pddd.exec:\7pddd.exe115⤵PID:4500
-
\??\c:\flxfxxf.exec:\flxfxxf.exe116⤵PID:220
-
\??\c:\bnhnhb.exec:\bnhnhb.exe117⤵PID:1828
-
\??\c:\dpdjp.exec:\dpdjp.exe118⤵PID:4272
-
\??\c:\vjvpp.exec:\vjvpp.exe119⤵PID:4432
-
\??\c:\9lfxxxx.exec:\9lfxxxx.exe120⤵PID:392
-
\??\c:\hbnttb.exec:\hbnttb.exe121⤵PID:2792
-
\??\c:\1vvjd.exec:\1vvjd.exe122⤵PID:4008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-