Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2024 18:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
150 seconds
General
-
Target
400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe
-
Size
455KB
-
MD5
6914a1848857524a5438d099196890a0
-
SHA1
657f13c3da848c5db678479ace772869098045fd
-
SHA256
400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666
-
SHA512
baff3a48b023035a909c7aeb75350bdeecfb53d55d13b8ce3a5f600793eb432fbb117570f33d756bad8ca5b5768fff6e4c04628b218b2adc69c10bfe0496a577
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRG:q7Tc2NYHUrAwfMp3CDRG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4836-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2100-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1904-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/672-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/332-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/384-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-691-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-744-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-845-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-903-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-1439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-1737-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4844 ppjpv.exe 968 7hbthh.exe 1968 bhttnt.exe 1188 lfrlrrf.exe 3008 xxllfll.exe 2100 1vvdd.exe 4940 htnbnb.exe 4156 rfxflrr.exe 2280 hnhnbh.exe 1904 tnnnnt.exe 452 hhbbnb.exe 5072 ddjjp.exe 4656 tnbbbh.exe 1372 xxrrflx.exe 4424 lrlllrx.exe 4620 frlrlrl.exe 4104 3lllxfr.exe 1648 hnttbh.exe 4604 nnbntb.exe 2056 dpvvd.exe 740 7ttttb.exe 1400 djjjv.exe 2900 ppvdd.exe 4916 hbnbnt.exe 3632 xlxflfl.exe 2920 hnhhhn.exe 4576 jjvvd.exe 3468 9ttbbn.exe 2716 jppdj.exe 4972 tnbttt.exe 1728 bbtbbn.exe 1960 rlllflx.exe 1860 ppddd.exe 4388 lxxxxxf.exe 4368 hhnnht.exe 1680 jjjvd.exe 4844 rrffxll.exe 860 rrllrxl.exe 3880 tbhhht.exe 2520 vdppv.exe 1708 1pdjd.exe 1188 fflllll.exe 672 ntbhtb.exe 3744 pvdvp.exe 1420 fxfflrl.exe 220 ttnttb.exe 3520 dvppp.exe 3080 pvvdd.exe 4268 rrfflrx.exe 4012 nbbhbh.exe 3236 7bnnnn.exe 3376 dvppp.exe 1956 rfxxfxl.exe 2624 rrxxflr.exe 5072 vdpvv.exe 2372 3xlrrxf.exe 1480 ttbnhn.exe 4980 7ppvj.exe 3932 rrfrrrx.exe 3296 bhbtbn.exe 3708 nhttbb.exe 4892 jvdpv.exe 1848 ffrrxfl.exe 3536 htttnh.exe -
resource yara_rule behavioral2/memory/4836-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/672-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3312-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/332-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/384-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-744-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-845-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4836 wrote to memory of 4844 4836 400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe 84 PID 4836 wrote to memory of 4844 4836 400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe 84 PID 4836 wrote to memory of 4844 4836 400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe 84 PID 4844 wrote to memory of 968 4844 ppjpv.exe 85 PID 4844 wrote to memory of 968 4844 ppjpv.exe 85 PID 4844 wrote to memory of 968 4844 ppjpv.exe 85 PID 968 wrote to memory of 1968 968 7hbthh.exe 86 PID 968 wrote to memory of 1968 968 7hbthh.exe 86 PID 968 wrote to memory of 1968 968 7hbthh.exe 86 PID 1968 wrote to memory of 1188 1968 bhttnt.exe 87 PID 1968 wrote to memory of 1188 1968 bhttnt.exe 87 PID 1968 wrote to memory of 1188 1968 bhttnt.exe 87 PID 1188 wrote to memory of 3008 1188 lfrlrrf.exe 89 PID 1188 wrote to memory of 3008 1188 lfrlrrf.exe 89 PID 1188 wrote to memory of 3008 1188 lfrlrrf.exe 89 PID 3008 wrote to memory of 2100 3008 xxllfll.exe 91 PID 3008 wrote to memory of 2100 3008 xxllfll.exe 91 PID 3008 wrote to memory of 2100 3008 xxllfll.exe 91 PID 2100 wrote to memory of 4940 2100 1vvdd.exe 92 PID 2100 wrote to memory of 4940 2100 1vvdd.exe 92 PID 2100 wrote to memory of 4940 2100 1vvdd.exe 92 PID 4940 wrote to memory of 4156 4940 htnbnb.exe 94 PID 4940 wrote to memory of 4156 4940 htnbnb.exe 94 PID 4940 wrote to memory of 4156 4940 htnbnb.exe 94 PID 4156 wrote to memory of 2280 4156 rfxflrr.exe 95 PID 4156 wrote to memory of 2280 4156 rfxflrr.exe 95 PID 4156 wrote to memory of 2280 4156 rfxflrr.exe 95 PID 2280 wrote to memory of 1904 2280 hnhnbh.exe 96 PID 2280 wrote to memory of 1904 2280 hnhnbh.exe 96 PID 2280 wrote to memory of 1904 2280 hnhnbh.exe 96 PID 1904 wrote to memory of 452 1904 tnnnnt.exe 97 PID 1904 wrote to memory of 452 1904 tnnnnt.exe 97 PID 1904 wrote to memory of 452 1904 tnnnnt.exe 97 PID 452 wrote to memory of 5072 452 hhbbnb.exe 98 PID 452 wrote to memory of 5072 452 hhbbnb.exe 98 PID 452 wrote to memory of 5072 452 hhbbnb.exe 98 PID 5072 wrote to memory of 4656 5072 ddjjp.exe 99 PID 5072 wrote to memory of 4656 5072 ddjjp.exe 99 PID 5072 wrote to memory of 4656 5072 ddjjp.exe 99 PID 4656 wrote to memory of 1372 4656 tnbbbh.exe 100 PID 4656 wrote to memory of 1372 4656 tnbbbh.exe 100 PID 4656 wrote to memory of 1372 4656 tnbbbh.exe 100 PID 1372 wrote to memory of 4424 1372 xxrrflx.exe 101 PID 1372 wrote to memory of 4424 1372 xxrrflx.exe 101 PID 1372 wrote to memory of 4424 1372 xxrrflx.exe 101 PID 4424 wrote to memory of 4620 4424 lrlllrx.exe 102 PID 4424 wrote to memory of 4620 4424 lrlllrx.exe 102 PID 4424 wrote to memory of 4620 4424 lrlllrx.exe 102 PID 4620 wrote to memory of 4104 4620 frlrlrl.exe 103 PID 4620 wrote to memory of 4104 4620 frlrlrl.exe 103 PID 4620 wrote to memory of 4104 4620 frlrlrl.exe 103 PID 4104 wrote to memory of 1648 4104 3lllxfr.exe 104 PID 4104 wrote to memory of 1648 4104 3lllxfr.exe 104 PID 4104 wrote to memory of 1648 4104 3lllxfr.exe 104 PID 1648 wrote to memory of 4604 1648 hnttbh.exe 105 PID 1648 wrote to memory of 4604 1648 hnttbh.exe 105 PID 1648 wrote to memory of 4604 1648 hnttbh.exe 105 PID 4604 wrote to memory of 2056 4604 nnbntb.exe 106 PID 4604 wrote to memory of 2056 4604 nnbntb.exe 106 PID 4604 wrote to memory of 2056 4604 nnbntb.exe 106 PID 2056 wrote to memory of 740 2056 dpvvd.exe 107 PID 2056 wrote to memory of 740 2056 dpvvd.exe 107 PID 2056 wrote to memory of 740 2056 dpvvd.exe 107 PID 740 wrote to memory of 1400 740 7ttttb.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe"C:\Users\Admin\AppData\Local\Temp\400be83843cbeecfb5056984cb704d39e0fe8721be7eab48b5cef0c2e6724666N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\ppjpv.exec:\ppjpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\7hbthh.exec:\7hbthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\bhttnt.exec:\bhttnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\lfrlrrf.exec:\lfrlrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\xxllfll.exec:\xxllfll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\1vvdd.exec:\1vvdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\htnbnb.exec:\htnbnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\rfxflrr.exec:\rfxflrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\hnhnbh.exec:\hnhnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\tnnnnt.exec:\tnnnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\hhbbnb.exec:\hhbbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\ddjjp.exec:\ddjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\tnbbbh.exec:\tnbbbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\xxrrflx.exec:\xxrrflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\lrlllrx.exec:\lrlllrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\frlrlrl.exec:\frlrlrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\3lllxfr.exec:\3lllxfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\hnttbh.exec:\hnttbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\nnbntb.exec:\nnbntb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\dpvvd.exec:\dpvvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\7ttttb.exec:\7ttttb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\djjjv.exec:\djjjv.exe23⤵
- Executes dropped EXE
PID:1400 -
\??\c:\ppvdd.exec:\ppvdd.exe24⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hbnbnt.exec:\hbnbnt.exe25⤵
- Executes dropped EXE
PID:4916 -
\??\c:\xlxflfl.exec:\xlxflfl.exe26⤵
- Executes dropped EXE
PID:3632 -
\??\c:\hnhhhn.exec:\hnhhhn.exe27⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jjvvd.exec:\jjvvd.exe28⤵
- Executes dropped EXE
PID:4576 -
\??\c:\9ttbbn.exec:\9ttbbn.exe29⤵
- Executes dropped EXE
PID:3468 -
\??\c:\jppdj.exec:\jppdj.exe30⤵
- Executes dropped EXE
PID:2716 -
\??\c:\tnbttt.exec:\tnbttt.exe31⤵
- Executes dropped EXE
PID:4972 -
\??\c:\bbtbbn.exec:\bbtbbn.exe32⤵
- Executes dropped EXE
PID:1728 -
\??\c:\rlllflx.exec:\rlllflx.exe33⤵
- Executes dropped EXE
PID:1960 -
\??\c:\ppddd.exec:\ppddd.exe34⤵
- Executes dropped EXE
PID:1860 -
\??\c:\lxxxxxf.exec:\lxxxxxf.exe35⤵
- Executes dropped EXE
PID:4388 -
\??\c:\hhnnht.exec:\hhnnht.exe36⤵
- Executes dropped EXE
PID:4368 -
\??\c:\jjjvd.exec:\jjjvd.exe37⤵
- Executes dropped EXE
PID:1680 -
\??\c:\rrffxll.exec:\rrffxll.exe38⤵
- Executes dropped EXE
PID:4844 -
\??\c:\rrllrxl.exec:\rrllrxl.exe39⤵
- Executes dropped EXE
PID:860 -
\??\c:\tbhhht.exec:\tbhhht.exe40⤵
- Executes dropped EXE
PID:3880 -
\??\c:\vdppv.exec:\vdppv.exe41⤵
- Executes dropped EXE
PID:2520 -
\??\c:\1pdjd.exec:\1pdjd.exe42⤵
- Executes dropped EXE
PID:1708 -
\??\c:\fflllll.exec:\fflllll.exe43⤵
- Executes dropped EXE
PID:1188 -
\??\c:\ntbhtb.exec:\ntbhtb.exe44⤵
- Executes dropped EXE
PID:672 -
\??\c:\pvdvp.exec:\pvdvp.exe45⤵
- Executes dropped EXE
PID:3744 -
\??\c:\fxfflrl.exec:\fxfflrl.exe46⤵
- Executes dropped EXE
PID:1420 -
\??\c:\ttnttb.exec:\ttnttb.exe47⤵
- Executes dropped EXE
PID:220 -
\??\c:\dvppp.exec:\dvppp.exe48⤵
- Executes dropped EXE
PID:3520 -
\??\c:\pvvdd.exec:\pvvdd.exe49⤵
- Executes dropped EXE
PID:3080 -
\??\c:\rrfflrx.exec:\rrfflrx.exe50⤵
- Executes dropped EXE
PID:4268 -
\??\c:\nbbhbh.exec:\nbbhbh.exe51⤵
- Executes dropped EXE
PID:4012 -
\??\c:\7bnnnn.exec:\7bnnnn.exe52⤵
- Executes dropped EXE
PID:3236 -
\??\c:\dvppp.exec:\dvppp.exe53⤵
- Executes dropped EXE
PID:3376 -
\??\c:\rfxxfxl.exec:\rfxxfxl.exe54⤵
- Executes dropped EXE
PID:1956 -
\??\c:\rrxxflr.exec:\rrxxflr.exe55⤵
- Executes dropped EXE
PID:2624 -
\??\c:\vdpvv.exec:\vdpvv.exe56⤵
- Executes dropped EXE
PID:5072 -
\??\c:\3xlrrxf.exec:\3xlrrxf.exe57⤵
- Executes dropped EXE
PID:2372 -
\??\c:\ttbnhn.exec:\ttbnhn.exe58⤵
- Executes dropped EXE
PID:1480 -
\??\c:\7ppvj.exec:\7ppvj.exe59⤵
- Executes dropped EXE
PID:4980 -
\??\c:\rrfrrrx.exec:\rrfrrrx.exe60⤵
- Executes dropped EXE
PID:3932 -
\??\c:\bhbtbn.exec:\bhbtbn.exe61⤵
- Executes dropped EXE
PID:3296 -
\??\c:\nhttbb.exec:\nhttbb.exe62⤵
- Executes dropped EXE
PID:3708 -
\??\c:\jvdpv.exec:\jvdpv.exe63⤵
- Executes dropped EXE
PID:4892 -
\??\c:\ffrrxfl.exec:\ffrrxfl.exe64⤵
- Executes dropped EXE
PID:1848 -
\??\c:\htttnh.exec:\htttnh.exe65⤵
- Executes dropped EXE
PID:3536 -
\??\c:\dpvvd.exec:\dpvvd.exe66⤵PID:4324
-
\??\c:\fflrxfl.exec:\fflrxfl.exe67⤵PID:4948
-
\??\c:\5tnbnb.exec:\5tnbnb.exe68⤵PID:740
-
\??\c:\djvvp.exec:\djvvp.exe69⤵PID:3332
-
\??\c:\1dppd.exec:\1dppd.exe70⤵PID:2868
-
\??\c:\fxfxxrr.exec:\fxfxxrr.exe71⤵PID:1300
-
\??\c:\vdppp.exec:\vdppp.exe72⤵PID:2660
-
\??\c:\1dpjv.exec:\1dpjv.exe73⤵PID:3240
-
\??\c:\rrlrxfl.exec:\rrlrxfl.exe74⤵PID:2888
-
\??\c:\hbttbh.exec:\hbttbh.exe75⤵PID:2920
-
\??\c:\vjjjd.exec:\vjjjd.exe76⤵PID:2296
-
\??\c:\xflrrxf.exec:\xflrrxf.exe77⤵PID:2696
-
\??\c:\nnhntb.exec:\nnhntb.exe78⤵PID:3312
-
\??\c:\9tbbhn.exec:\9tbbhn.exe79⤵PID:2704
-
\??\c:\jdppv.exec:\jdppv.exe80⤵PID:1020
-
\??\c:\lfxffff.exec:\lfxffff.exe81⤵PID:928
-
\??\c:\bhntth.exec:\bhntth.exe82⤵PID:3876
-
\??\c:\hhbtht.exec:\hhbtht.exe83⤵PID:2720
-
\??\c:\5jppv.exec:\5jppv.exe84⤵PID:4608
-
\??\c:\9rlxflr.exec:\9rlxflr.exe85⤵PID:1452
-
\??\c:\xlflrxf.exec:\xlflrxf.exe86⤵PID:3284
-
\??\c:\1djvv.exec:\1djvv.exe87⤵PID:332
-
\??\c:\flxrffr.exec:\flxrffr.exe88⤵PID:4688
-
\??\c:\hnbhnt.exec:\hnbhnt.exe89⤵PID:3948
-
\??\c:\jvvdd.exec:\jvvdd.exe90⤵PID:2520
-
\??\c:\jvvdv.exec:\jvvdv.exe91⤵PID:2620
-
\??\c:\flrlflr.exec:\flrlflr.exe92⤵PID:4968
-
\??\c:\hhtttb.exec:\hhtttb.exe93⤵PID:2100
-
\??\c:\3ddjv.exec:\3ddjv.exe94⤵PID:4848
-
\??\c:\fffffxf.exec:\fffffxf.exe95⤵PID:2172
-
\??\c:\nnhbnt.exec:\nnhbnt.exe96⤵PID:5016
-
\??\c:\pvjjp.exec:\pvjjp.exe97⤵PID:384
-
\??\c:\xfrxflr.exec:\xfrxflr.exe98⤵PID:2280
-
\??\c:\bthhhn.exec:\bthhhn.exe99⤵PID:4312
-
\??\c:\7ppjj.exec:\7ppjj.exe100⤵PID:1720
-
\??\c:\llxrxxx.exec:\llxrxxx.exe101⤵PID:488
-
\??\c:\ffxfxll.exec:\ffxfxll.exe102⤵PID:2564
-
\??\c:\9nbbbh.exec:\9nbbbh.exe103⤵PID:1732
-
\??\c:\vpdjd.exec:\vpdjd.exe104⤵PID:2784
-
\??\c:\vpjdv.exec:\vpjdv.exe105⤵PID:1372
-
\??\c:\llffxfx.exec:\llffxfx.exe106⤵PID:3252
-
\??\c:\3htbbb.exec:\3htbbb.exe107⤵PID:2216
-
\??\c:\vjdvv.exec:\vjdvv.exe108⤵PID:2328
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe109⤵PID:4104
-
\??\c:\nthhhb.exec:\nthhhb.exe110⤵PID:3660
-
\??\c:\tthhnt.exec:\tthhnt.exe111⤵PID:3916
-
\??\c:\vjvjp.exec:\vjvjp.exe112⤵PID:2420
-
\??\c:\xflllxl.exec:\xflllxl.exe113⤵PID:3460
-
\??\c:\3bhhbn.exec:\3bhhbn.exe114⤵PID:4948
-
\??\c:\dddjp.exec:\dddjp.exe115⤵PID:1644
-
\??\c:\djjjp.exec:\djjjp.exe116⤵PID:1400
-
\??\c:\lfxflrf.exec:\lfxflrf.exe117⤵PID:4756
-
\??\c:\3ntntb.exec:\3ntntb.exe118⤵PID:3644
-
\??\c:\pvddd.exec:\pvddd.exe119⤵PID:3632
-
\??\c:\flfllrr.exec:\flfllrr.exe120⤵PID:3240
-
\??\c:\nntttb.exec:\nntttb.exe121⤵PID:2888
-
\??\c:\vpvvv.exec:\vpvvv.exe122⤵PID:4668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-