Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2024 12:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
824010abf68bd802490d8720428a49a6a4a24260bfb9f54a47d5644add0183b7.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
824010abf68bd802490d8720428a49a6a4a24260bfb9f54a47d5644add0183b7.exe
-
Size
454KB
-
MD5
7ba5cf9ccf91971156e89587a374d2ef
-
SHA1
59df94ed6115acbb131c06be2da06ae8c96367d8
-
SHA256
824010abf68bd802490d8720428a49a6a4a24260bfb9f54a47d5644add0183b7
-
SHA512
a261d1bcb548a05ba2906b4738aeff1b39e032ee2a441eb1ba6bb4d923598302aaaa9ea313818e139a56b9d6f190e7fb9efc4a0895c99c21d2592f574419f503
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRJ:q7Tc2NYHUrAwfMp3CDRJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3616-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1148-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/716-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2492-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1264-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4140-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/688-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4140-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1272-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3816-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/460-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-700-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-749-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-1070-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-1608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-1882-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4936 jvdvp.exe 2296 nnbbbb.exe 1148 7xlfrrx.exe 4224 tnnnbb.exe 1464 ntnnbh.exe 4560 ppdjp.exe 716 lxrxxrr.exe 2124 ffrlxfl.exe 1224 bhbttb.exe 3516 rffffxr.exe 4488 bbbbbh.exe 4992 jddpj.exe 1616 bhtttt.exe 2964 rrllfll.exe 2132 htbbbb.exe 764 rrfxrxf.exe 2492 hnttbb.exe 556 ddjjd.exe 1424 bnthnb.exe 1068 3pvvv.exe 2656 lrrrlrr.exe 1524 djppp.exe 4904 pddvv.exe 5028 jpvvj.exe 3216 dpppj.exe 1004 frxxxfr.exe 2536 djpjd.exe 1764 1pjdj.exe 3236 nnnttb.exe 704 7bhbbb.exe 540 tbbhhn.exe 2020 ddppp.exe 4832 rxlrrxx.exe 4408 fxxxrrr.exe 4968 9hnntb.exe 4052 dpddj.exe 2192 ppppj.exe 244 xlllrrr.exe 4576 nbhbtb.exe 1264 thhbbb.exe 2840 dvppp.exe 3008 rrxxxfx.exe 4644 ntbbbh.exe 2892 vvvvd.exe 4728 llrxxfl.exe 2440 hhbbbb.exe 2444 hnbnnn.exe 4140 bhnnnn.exe 1224 jvppv.exe 4704 flllrxx.exe 3896 xlxxrlf.exe 2652 vdvdd.exe 3976 xlrrffl.exe 4188 tbnnbh.exe 1540 hhhhhn.exe 700 jvpjj.exe 1616 9rllrxx.exe 4924 rlfffrx.exe 1792 tttttb.exe 4980 vdvpd.exe 2328 jjvpp.exe 4208 1xffxfr.exe 1072 bbbbbh.exe 1424 vjjjp.exe -
resource yara_rule behavioral2/memory/3616-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/716-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2492-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1264-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4140-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/688-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4140-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1272-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3816-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/460-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1272-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-749-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3616 wrote to memory of 4936 3616 824010abf68bd802490d8720428a49a6a4a24260bfb9f54a47d5644add0183b7.exe 84 PID 3616 wrote to memory of 4936 3616 824010abf68bd802490d8720428a49a6a4a24260bfb9f54a47d5644add0183b7.exe 84 PID 3616 wrote to memory of 4936 3616 824010abf68bd802490d8720428a49a6a4a24260bfb9f54a47d5644add0183b7.exe 84 PID 4936 wrote to memory of 2296 4936 jvdvp.exe 85 PID 4936 wrote to memory of 2296 4936 jvdvp.exe 85 PID 4936 wrote to memory of 2296 4936 jvdvp.exe 85 PID 2296 wrote to memory of 1148 2296 nnbbbb.exe 86 PID 2296 wrote to memory of 1148 2296 nnbbbb.exe 86 PID 2296 wrote to memory of 1148 2296 nnbbbb.exe 86 PID 1148 wrote to memory of 4224 1148 7xlfrrx.exe 87 PID 1148 wrote to memory of 4224 1148 7xlfrrx.exe 87 PID 1148 wrote to memory of 4224 1148 7xlfrrx.exe 87 PID 4224 wrote to memory of 1464 4224 tnnnbb.exe 88 PID 4224 wrote to memory of 1464 4224 tnnnbb.exe 88 PID 4224 wrote to memory of 1464 4224 tnnnbb.exe 88 PID 1464 wrote to memory of 4560 1464 ntnnbh.exe 89 PID 1464 wrote to memory of 4560 1464 ntnnbh.exe 89 PID 1464 wrote to memory of 4560 1464 ntnnbh.exe 89 PID 4560 wrote to memory of 716 4560 ppdjp.exe 90 PID 4560 wrote to memory of 716 4560 ppdjp.exe 90 PID 4560 wrote to memory of 716 4560 ppdjp.exe 90 PID 716 wrote to memory of 2124 716 lxrxxrr.exe 92 PID 716 wrote to memory of 2124 716 lxrxxrr.exe 92 PID 716 wrote to memory of 2124 716 lxrxxrr.exe 92 PID 2124 wrote to memory of 1224 2124 ffrlxfl.exe 93 PID 2124 wrote to memory of 1224 2124 ffrlxfl.exe 93 PID 2124 wrote to memory of 1224 2124 ffrlxfl.exe 93 PID 1224 wrote to memory of 3516 1224 bhbttb.exe 94 PID 1224 wrote to memory of 3516 1224 bhbttb.exe 94 PID 1224 wrote to memory of 3516 1224 bhbttb.exe 94 PID 3516 wrote to memory of 4488 3516 rffffxr.exe 95 PID 3516 wrote to memory of 4488 3516 rffffxr.exe 95 PID 3516 wrote to memory of 4488 3516 rffffxr.exe 95 PID 4488 wrote to memory of 4992 4488 bbbbbh.exe 96 PID 4488 wrote to memory of 4992 4488 bbbbbh.exe 96 PID 4488 wrote to memory of 4992 4488 bbbbbh.exe 96 PID 4992 wrote to memory of 1616 4992 jddpj.exe 98 PID 4992 wrote to memory of 1616 4992 jddpj.exe 98 PID 4992 wrote to memory of 1616 4992 jddpj.exe 98 PID 1616 wrote to memory of 2964 1616 bhtttt.exe 99 PID 1616 wrote to memory of 2964 1616 bhtttt.exe 99 PID 1616 wrote to memory of 2964 1616 bhtttt.exe 99 PID 2964 wrote to memory of 2132 2964 rrllfll.exe 101 PID 2964 wrote to memory of 2132 2964 rrllfll.exe 101 PID 2964 wrote to memory of 2132 2964 rrllfll.exe 101 PID 2132 wrote to memory of 764 2132 htbbbb.exe 102 PID 2132 wrote to memory of 764 2132 htbbbb.exe 102 PID 2132 wrote to memory of 764 2132 htbbbb.exe 102 PID 764 wrote to memory of 2492 764 rrfxrxf.exe 103 PID 764 wrote to memory of 2492 764 rrfxrxf.exe 103 PID 764 wrote to memory of 2492 764 rrfxrxf.exe 103 PID 2492 wrote to memory of 556 2492 hnttbb.exe 104 PID 2492 wrote to memory of 556 2492 hnttbb.exe 104 PID 2492 wrote to memory of 556 2492 hnttbb.exe 104 PID 556 wrote to memory of 1424 556 ddjjd.exe 105 PID 556 wrote to memory of 1424 556 ddjjd.exe 105 PID 556 wrote to memory of 1424 556 ddjjd.exe 105 PID 1424 wrote to memory of 1068 1424 bnthnb.exe 106 PID 1424 wrote to memory of 1068 1424 bnthnb.exe 106 PID 1424 wrote to memory of 1068 1424 bnthnb.exe 106 PID 1068 wrote to memory of 2656 1068 3pvvv.exe 107 PID 1068 wrote to memory of 2656 1068 3pvvv.exe 107 PID 1068 wrote to memory of 2656 1068 3pvvv.exe 107 PID 2656 wrote to memory of 1524 2656 lrrrlrr.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\824010abf68bd802490d8720428a49a6a4a24260bfb9f54a47d5644add0183b7.exe"C:\Users\Admin\AppData\Local\Temp\824010abf68bd802490d8720428a49a6a4a24260bfb9f54a47d5644add0183b7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\jvdvp.exec:\jvdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\nnbbbb.exec:\nnbbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\7xlfrrx.exec:\7xlfrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\tnnnbb.exec:\tnnnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\ntnnbh.exec:\ntnnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\ppdjp.exec:\ppdjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\lxrxxrr.exec:\lxrxxrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\ffrlxfl.exec:\ffrlxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\bhbttb.exec:\bhbttb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\rffffxr.exec:\rffffxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\bbbbbh.exec:\bbbbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\jddpj.exec:\jddpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\bhtttt.exec:\bhtttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\rrllfll.exec:\rrllfll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\htbbbb.exec:\htbbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\rrfxrxf.exec:\rrfxrxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\hnttbb.exec:\hnttbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\ddjjd.exec:\ddjjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\bnthnb.exec:\bnthnb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\3pvvv.exec:\3pvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\lrrrlrr.exec:\lrrrlrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\djppp.exec:\djppp.exe23⤵
- Executes dropped EXE
PID:1524 -
\??\c:\pddvv.exec:\pddvv.exe24⤵
- Executes dropped EXE
PID:4904 -
\??\c:\jpvvj.exec:\jpvvj.exe25⤵
- Executes dropped EXE
PID:5028 -
\??\c:\dpppj.exec:\dpppj.exe26⤵
- Executes dropped EXE
PID:3216 -
\??\c:\frxxxfr.exec:\frxxxfr.exe27⤵
- Executes dropped EXE
PID:1004 -
\??\c:\djpjd.exec:\djpjd.exe28⤵
- Executes dropped EXE
PID:2536 -
\??\c:\1pjdj.exec:\1pjdj.exe29⤵
- Executes dropped EXE
PID:1764 -
\??\c:\nnnttb.exec:\nnnttb.exe30⤵
- Executes dropped EXE
PID:3236 -
\??\c:\7bhbbb.exec:\7bhbbb.exe31⤵
- Executes dropped EXE
PID:704 -
\??\c:\tbbhhn.exec:\tbbhhn.exe32⤵
- Executes dropped EXE
PID:540 -
\??\c:\ddppp.exec:\ddppp.exe33⤵
- Executes dropped EXE
PID:2020 -
\??\c:\rxlrrxx.exec:\rxlrrxx.exe34⤵
- Executes dropped EXE
PID:4832 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe35⤵
- Executes dropped EXE
PID:4408 -
\??\c:\9hnntb.exec:\9hnntb.exe36⤵
- Executes dropped EXE
PID:4968 -
\??\c:\dpddj.exec:\dpddj.exe37⤵
- Executes dropped EXE
PID:4052 -
\??\c:\ppppj.exec:\ppppj.exe38⤵
- Executes dropped EXE
PID:2192 -
\??\c:\xlllrrr.exec:\xlllrrr.exe39⤵
- Executes dropped EXE
PID:244 -
\??\c:\nbhbtb.exec:\nbhbtb.exe40⤵
- Executes dropped EXE
PID:4576 -
\??\c:\thhbbb.exec:\thhbbb.exe41⤵
- Executes dropped EXE
PID:1264 -
\??\c:\dvppp.exec:\dvppp.exe42⤵
- Executes dropped EXE
PID:2840 -
\??\c:\rrxxxfx.exec:\rrxxxfx.exe43⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ntbbbh.exec:\ntbbbh.exe44⤵
- Executes dropped EXE
PID:4644 -
\??\c:\vvvvd.exec:\vvvvd.exe45⤵
- Executes dropped EXE
PID:2892 -
\??\c:\llrxxfl.exec:\llrxxfl.exe46⤵
- Executes dropped EXE
PID:4728 -
\??\c:\hhbbbb.exec:\hhbbbb.exe47⤵
- Executes dropped EXE
PID:2440 -
\??\c:\hnbnnn.exec:\hnbnnn.exe48⤵
- Executes dropped EXE
PID:2444 -
\??\c:\bhnnnn.exec:\bhnnnn.exe49⤵
- Executes dropped EXE
PID:4140 -
\??\c:\jvppv.exec:\jvppv.exe50⤵
- Executes dropped EXE
PID:1224 -
\??\c:\flllrxx.exec:\flllrxx.exe51⤵
- Executes dropped EXE
PID:4704 -
\??\c:\xlxxrlf.exec:\xlxxrlf.exe52⤵
- Executes dropped EXE
PID:3896 -
\??\c:\vdvdd.exec:\vdvdd.exe53⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xlrrffl.exec:\xlrrffl.exe54⤵
- Executes dropped EXE
PID:3976 -
\??\c:\tbnnbh.exec:\tbnnbh.exe55⤵
- Executes dropped EXE
PID:4188 -
\??\c:\hhhhhn.exec:\hhhhhn.exe56⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jvpjj.exec:\jvpjj.exe57⤵
- Executes dropped EXE
PID:700 -
\??\c:\9rllrxx.exec:\9rllrxx.exe58⤵
- Executes dropped EXE
PID:1616 -
\??\c:\rlfffrx.exec:\rlfffrx.exe59⤵
- Executes dropped EXE
PID:4924 -
\??\c:\tttttb.exec:\tttttb.exe60⤵
- Executes dropped EXE
PID:1792 -
\??\c:\vdvpd.exec:\vdvpd.exe61⤵
- Executes dropped EXE
PID:4980 -
\??\c:\jjvpp.exec:\jjvpp.exe62⤵
- Executes dropped EXE
PID:2328 -
\??\c:\1xffxfr.exec:\1xffxfr.exe63⤵
- Executes dropped EXE
PID:4208 -
\??\c:\bbbbbh.exec:\bbbbbh.exe64⤵
- Executes dropped EXE
PID:1072 -
\??\c:\vjjjp.exec:\vjjjp.exe65⤵
- Executes dropped EXE
PID:1424 -
\??\c:\xxxflxf.exec:\xxxflxf.exe66⤵PID:2360
-
\??\c:\ntbbhn.exec:\ntbbhn.exe67⤵PID:2696
-
\??\c:\thhhbb.exec:\thhhbb.exe68⤵PID:2180
-
\??\c:\5vvdv.exec:\5vvdv.exe69⤵PID:3144
-
\??\c:\fxxxxff.exec:\fxxxxff.exe70⤵PID:4212
-
\??\c:\1tbbbh.exec:\1tbbbh.exe71⤵PID:4848
-
\??\c:\vddvv.exec:\vddvv.exe72⤵PID:1904
-
\??\c:\xfrrffr.exec:\xfrrffr.exe73⤵PID:724
-
\??\c:\rrrrrrl.exec:\rrrrrrl.exe74⤵PID:5028
-
\??\c:\nhnnnn.exec:\nhnnnn.exe75⤵PID:2496
-
\??\c:\jpppp.exec:\jpppp.exe76⤵PID:3152
-
\??\c:\pjppp.exec:\pjppp.exe77⤵PID:2292
-
\??\c:\rffxflr.exec:\rffxflr.exe78⤵PID:1668
-
\??\c:\7hnnnn.exec:\7hnnnn.exe79⤵PID:1648
-
\??\c:\ntnnhh.exec:\ntnnhh.exe80⤵PID:688
-
\??\c:\7pvvv.exec:\7pvvv.exe81⤵PID:5096
-
\??\c:\5fllfll.exec:\5fllfll.exe82⤵PID:3104
-
\??\c:\lllfffx.exec:\lllfffx.exe83⤵PID:3488
-
\??\c:\nthhnn.exec:\nthhnn.exe84⤵PID:4568
-
\??\c:\pjjdv.exec:\pjjdv.exe85⤵PID:3764
-
\??\c:\7lfxxxx.exec:\7lfxxxx.exe86⤵PID:2148
-
\??\c:\tbnnbh.exec:\tbnnbh.exe87⤵PID:4896
-
\??\c:\thnbtb.exec:\thnbtb.exe88⤵PID:1884
-
\??\c:\jppdd.exec:\jppdd.exe89⤵PID:4420
-
\??\c:\xxfffff.exec:\xxfffff.exe90⤵PID:4224
-
\??\c:\xfxxxxx.exec:\xfxxxxx.exe91⤵PID:3008
-
\??\c:\tbnntb.exec:\tbnntb.exe92⤵PID:2612
-
\??\c:\pvddd.exec:\pvddd.exe93⤵PID:4728
-
\??\c:\vvjpp.exec:\vvjpp.exe94⤵PID:3288
-
\??\c:\rxfxxfx.exec:\rxfxxfx.exe95⤵PID:380
-
\??\c:\nhhtth.exec:\nhhtth.exe96⤵PID:4140
-
\??\c:\vdjdd.exec:\vdjdd.exe97⤵PID:2052
-
\??\c:\jjjjd.exec:\jjjjd.exe98⤵PID:4056
-
\??\c:\fflfffx.exec:\fflfffx.exe99⤵PID:2588
-
\??\c:\pvddv.exec:\pvddv.exe100⤵PID:4668
-
\??\c:\ttbbhn.exec:\ttbbhn.exe101⤵PID:1272
-
\??\c:\jjjjj.exec:\jjjjj.exe102⤵PID:2324
-
\??\c:\xffffll.exec:\xffffll.exe103⤵PID:3388
-
\??\c:\1ntbnt.exec:\1ntbnt.exe104⤵PID:372
-
\??\c:\jjddv.exec:\jjddv.exe105⤵PID:2752
-
\??\c:\7flllrx.exec:\7flllrx.exe106⤵PID:116
-
\??\c:\pdppd.exec:\pdppd.exe107⤵PID:640
-
\??\c:\bnnnhh.exec:\bnnnhh.exe108⤵PID:2700
-
\??\c:\jjddj.exec:\jjddj.exe109⤵PID:2300
-
\??\c:\llxlfxr.exec:\llxlfxr.exe110⤵PID:3432
-
\??\c:\bhhhbb.exec:\bhhhbb.exe111⤵PID:4000
-
\??\c:\3jdjp.exec:\3jdjp.exe112⤵PID:4732
-
\??\c:\rlrxlll.exec:\rlrxlll.exe113⤵PID:1980
-
\??\c:\tthhnn.exec:\tthhnn.exe114⤵PID:4072
-
\??\c:\pjvpj.exec:\pjvpj.exe115⤵PID:2896
-
\??\c:\ddvdd.exec:\ddvdd.exe116⤵PID:4956
-
\??\c:\lrxxxfl.exec:\lrxxxfl.exe117⤵PID:3816
-
\??\c:\nbhhht.exec:\nbhhht.exe118⤵PID:1100
-
\??\c:\vjddd.exec:\vjddd.exe119⤵PID:3820
-
\??\c:\1xllxfl.exec:\1xllxfl.exe120⤵PID:4080
-
\??\c:\tttttt.exec:\tttttt.exe121⤵PID:1692
-
\??\c:\5vvpp.exec:\5vvpp.exe122⤵PID:4228
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-