Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 23:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6242ed4789f0af8d67b4dc4e555bd9ff2d0d4a5bb46536379f4ee74b12e88f6c.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
6242ed4789f0af8d67b4dc4e555bd9ff2d0d4a5bb46536379f4ee74b12e88f6c.exe
-
Size
455KB
-
MD5
e5a3a06ee07398694aeb8dbff135a276
-
SHA1
ee6fe4fd543dc2a5487ce91b48da9b9a8af27cfe
-
SHA256
6242ed4789f0af8d67b4dc4e555bd9ff2d0d4a5bb46536379f4ee74b12e88f6c
-
SHA512
be3e95a803497ea2670592e1a97f82b377e7d55b8f89c08885d63d9de2e2348a0fd2df808eec1fe0bdfe913c4412673ffbdeaf6ef051283bbf4f3891525a3a54
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRK:q7Tc2NYHUrAwfMp3CDRK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2016-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/984-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/652-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1336-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1760-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1324-798-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-814-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-830-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-1654-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1640 1hnhtt.exe 3560 nhnnnn.exe 1224 vpdjp.exe 1820 jvpvp.exe 3028 dvppd.exe 548 1htnhh.exe 1352 pvjpj.exe 3872 lllrlrr.exe 4240 7hbbhn.exe 4736 xxlflff.exe 3588 pvjjj.exe 224 ffrffxx.exe 3684 9dpvj.exe 2968 hhhbtn.exe 4000 dpddp.exe 4428 1lrrrxx.exe 208 dvddv.exe 2408 7rrlllf.exe 2172 rrflfrx.exe 1968 hbhbnh.exe 640 5ffxrrl.exe 1984 vjjjj.exe 4840 lrllrlr.exe 1760 htbhtb.exe 3384 vpdjj.exe 2584 fflxrxf.exe 2004 1ttbbn.exe 4144 rxxrrrr.exe 984 vjvjv.exe 4256 fllxfll.exe 1792 rrflrrr.exe 4880 3pdvv.exe 2060 3fffffx.exe 1040 1bnbth.exe 1764 9jjjd.exe 3640 btttnn.exe 2756 vdppj.exe 4380 fflfxxr.exe 3236 jjdvv.exe 3052 llllrxl.exe 2548 nthnnt.exe 2432 pdpvp.exe 2752 frrrlll.exe 4536 tbnnbb.exe 2192 jvvpd.exe 2244 lfrrlxl.exe 4200 hntttb.exe 4684 dpjpp.exe 816 fxffflx.exe 1168 nbhhtt.exe 4376 vvvpv.exe 652 3rlxxxx.exe 2636 tntnnn.exe 184 tbbttt.exe 3656 bnhhnt.exe 2552 pdppd.exe 4952 fflfxff.exe 2808 nntnbh.exe 3212 vdpdd.exe 1580 3djjj.exe 1336 rrfxxxx.exe 1924 nnbhhb.exe 4316 1vdpj.exe 2572 xfrlllx.exe -
resource yara_rule behavioral2/memory/2016-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/984-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/652-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1336-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-798-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-814-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1640 2016 6242ed4789f0af8d67b4dc4e555bd9ff2d0d4a5bb46536379f4ee74b12e88f6c.exe 83 PID 2016 wrote to memory of 1640 2016 6242ed4789f0af8d67b4dc4e555bd9ff2d0d4a5bb46536379f4ee74b12e88f6c.exe 83 PID 2016 wrote to memory of 1640 2016 6242ed4789f0af8d67b4dc4e555bd9ff2d0d4a5bb46536379f4ee74b12e88f6c.exe 83 PID 1640 wrote to memory of 3560 1640 1hnhtt.exe 84 PID 1640 wrote to memory of 3560 1640 1hnhtt.exe 84 PID 1640 wrote to memory of 3560 1640 1hnhtt.exe 84 PID 3560 wrote to memory of 1224 3560 nhnnnn.exe 85 PID 3560 wrote to memory of 1224 3560 nhnnnn.exe 85 PID 3560 wrote to memory of 1224 3560 nhnnnn.exe 85 PID 1224 wrote to memory of 1820 1224 vpdjp.exe 86 PID 1224 wrote to memory of 1820 1224 vpdjp.exe 86 PID 1224 wrote to memory of 1820 1224 vpdjp.exe 86 PID 1820 wrote to memory of 3028 1820 jvpvp.exe 87 PID 1820 wrote to memory of 3028 1820 jvpvp.exe 87 PID 1820 wrote to memory of 3028 1820 jvpvp.exe 87 PID 3028 wrote to memory of 548 3028 dvppd.exe 88 PID 3028 wrote to memory of 548 3028 dvppd.exe 88 PID 3028 wrote to memory of 548 3028 dvppd.exe 88 PID 548 wrote to memory of 1352 548 1htnhh.exe 89 PID 548 wrote to memory of 1352 548 1htnhh.exe 89 PID 548 wrote to memory of 1352 548 1htnhh.exe 89 PID 1352 wrote to memory of 3872 1352 pvjpj.exe 90 PID 1352 wrote to memory of 3872 1352 pvjpj.exe 90 PID 1352 wrote to memory of 3872 1352 pvjpj.exe 90 PID 3872 wrote to memory of 4240 3872 lllrlrr.exe 91 PID 3872 wrote to memory of 4240 3872 lllrlrr.exe 91 PID 3872 wrote to memory of 4240 3872 lllrlrr.exe 91 PID 4240 wrote to memory of 4736 4240 7hbbhn.exe 92 PID 4240 wrote to memory of 4736 4240 7hbbhn.exe 92 PID 4240 wrote to memory of 4736 4240 7hbbhn.exe 92 PID 4736 wrote to memory of 3588 4736 xxlflff.exe 93 PID 4736 wrote to memory of 3588 4736 xxlflff.exe 93 PID 4736 wrote to memory of 3588 4736 xxlflff.exe 93 PID 3588 wrote to memory of 224 3588 pvjjj.exe 94 PID 3588 wrote to memory of 224 3588 pvjjj.exe 94 PID 3588 wrote to memory of 224 3588 pvjjj.exe 94 PID 224 wrote to memory of 3684 224 ffrffxx.exe 95 PID 224 wrote to memory of 3684 224 ffrffxx.exe 95 PID 224 wrote to memory of 3684 224 ffrffxx.exe 95 PID 3684 wrote to memory of 2968 3684 9dpvj.exe 96 PID 3684 wrote to memory of 2968 3684 9dpvj.exe 96 PID 3684 wrote to memory of 2968 3684 9dpvj.exe 96 PID 2968 wrote to memory of 4000 2968 hhhbtn.exe 97 PID 2968 wrote to memory of 4000 2968 hhhbtn.exe 97 PID 2968 wrote to memory of 4000 2968 hhhbtn.exe 97 PID 4000 wrote to memory of 4428 4000 dpddp.exe 98 PID 4000 wrote to memory of 4428 4000 dpddp.exe 98 PID 4000 wrote to memory of 4428 4000 dpddp.exe 98 PID 4428 wrote to memory of 208 4428 1lrrrxx.exe 99 PID 4428 wrote to memory of 208 4428 1lrrrxx.exe 99 PID 4428 wrote to memory of 208 4428 1lrrrxx.exe 99 PID 208 wrote to memory of 2408 208 dvddv.exe 100 PID 208 wrote to memory of 2408 208 dvddv.exe 100 PID 208 wrote to memory of 2408 208 dvddv.exe 100 PID 2408 wrote to memory of 2172 2408 7rrlllf.exe 101 PID 2408 wrote to memory of 2172 2408 7rrlllf.exe 101 PID 2408 wrote to memory of 2172 2408 7rrlllf.exe 101 PID 2172 wrote to memory of 1968 2172 rrflfrx.exe 102 PID 2172 wrote to memory of 1968 2172 rrflfrx.exe 102 PID 2172 wrote to memory of 1968 2172 rrflfrx.exe 102 PID 1968 wrote to memory of 640 1968 hbhbnh.exe 103 PID 1968 wrote to memory of 640 1968 hbhbnh.exe 103 PID 1968 wrote to memory of 640 1968 hbhbnh.exe 103 PID 640 wrote to memory of 1984 640 5ffxrrl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\6242ed4789f0af8d67b4dc4e555bd9ff2d0d4a5bb46536379f4ee74b12e88f6c.exe"C:\Users\Admin\AppData\Local\Temp\6242ed4789f0af8d67b4dc4e555bd9ff2d0d4a5bb46536379f4ee74b12e88f6c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\1hnhtt.exec:\1hnhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\nhnnnn.exec:\nhnnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\vpdjp.exec:\vpdjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\jvpvp.exec:\jvpvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\dvppd.exec:\dvppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\1htnhh.exec:\1htnhh.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\pvjpj.exec:\pvjpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\lllrlrr.exec:\lllrlrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\7hbbhn.exec:\7hbbhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\xxlflff.exec:\xxlflff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\pvjjj.exec:\pvjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\ffrffxx.exec:\ffrffxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\9dpvj.exec:\9dpvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\hhhbtn.exec:\hhhbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\dpddp.exec:\dpddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\1lrrrxx.exec:\1lrrrxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\dvddv.exec:\dvddv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\7rrlllf.exec:\7rrlllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\rrflfrx.exec:\rrflfrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\hbhbnh.exec:\hbhbnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\5ffxrrl.exec:\5ffxrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\vjjjj.exec:\vjjjj.exe23⤵
- Executes dropped EXE
PID:1984 -
\??\c:\lrllrlr.exec:\lrllrlr.exe24⤵
- Executes dropped EXE
PID:4840 -
\??\c:\htbhtb.exec:\htbhtb.exe25⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vpdjj.exec:\vpdjj.exe26⤵
- Executes dropped EXE
PID:3384 -
\??\c:\fflxrxf.exec:\fflxrxf.exe27⤵
- Executes dropped EXE
PID:2584 -
\??\c:\1ttbbn.exec:\1ttbbn.exe28⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rxxrrrr.exec:\rxxrrrr.exe29⤵
- Executes dropped EXE
PID:4144 -
\??\c:\vjvjv.exec:\vjvjv.exe30⤵
- Executes dropped EXE
PID:984 -
\??\c:\fllxfll.exec:\fllxfll.exe31⤵
- Executes dropped EXE
PID:4256 -
\??\c:\rrflrrr.exec:\rrflrrr.exe32⤵
- Executes dropped EXE
PID:1792 -
\??\c:\3pdvv.exec:\3pdvv.exe33⤵
- Executes dropped EXE
PID:4880 -
\??\c:\3fffffx.exec:\3fffffx.exe34⤵
- Executes dropped EXE
PID:2060 -
\??\c:\1bnbth.exec:\1bnbth.exe35⤵
- Executes dropped EXE
PID:1040 -
\??\c:\9jjjd.exec:\9jjjd.exe36⤵
- Executes dropped EXE
PID:1764 -
\??\c:\btttnn.exec:\btttnn.exe37⤵
- Executes dropped EXE
PID:3640 -
\??\c:\vdppj.exec:\vdppj.exe38⤵
- Executes dropped EXE
PID:2756 -
\??\c:\fflfxxr.exec:\fflfxxr.exe39⤵
- Executes dropped EXE
PID:4380 -
\??\c:\jjdvv.exec:\jjdvv.exe40⤵
- Executes dropped EXE
PID:3236 -
\??\c:\llllrxl.exec:\llllrxl.exe41⤵
- Executes dropped EXE
PID:3052 -
\??\c:\nthnnt.exec:\nthnnt.exe42⤵
- Executes dropped EXE
PID:2548 -
\??\c:\pdpvp.exec:\pdpvp.exe43⤵
- Executes dropped EXE
PID:2432 -
\??\c:\frrrlll.exec:\frrrlll.exe44⤵
- Executes dropped EXE
PID:2752 -
\??\c:\tbnnbb.exec:\tbnnbb.exe45⤵
- Executes dropped EXE
PID:4536 -
\??\c:\jvvpd.exec:\jvvpd.exe46⤵
- Executes dropped EXE
PID:2192 -
\??\c:\lfrrlxl.exec:\lfrrlxl.exe47⤵
- Executes dropped EXE
PID:2244 -
\??\c:\hntttb.exec:\hntttb.exe48⤵
- Executes dropped EXE
PID:4200 -
\??\c:\dpjpp.exec:\dpjpp.exe49⤵
- Executes dropped EXE
PID:4684 -
\??\c:\fxffflx.exec:\fxffflx.exe50⤵
- Executes dropped EXE
PID:816 -
\??\c:\nbhhtt.exec:\nbhhtt.exe51⤵
- Executes dropped EXE
PID:1168 -
\??\c:\vvvpv.exec:\vvvpv.exe52⤵
- Executes dropped EXE
PID:4376 -
\??\c:\3rlxxxx.exec:\3rlxxxx.exe53⤵
- Executes dropped EXE
PID:652 -
\??\c:\tntnnn.exec:\tntnnn.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2636 -
\??\c:\tbbttt.exec:\tbbttt.exe55⤵
- Executes dropped EXE
PID:184 -
\??\c:\bnhhnt.exec:\bnhhnt.exe56⤵
- Executes dropped EXE
PID:3656 -
\??\c:\pdppd.exec:\pdppd.exe57⤵
- Executes dropped EXE
PID:2552 -
\??\c:\fflfxff.exec:\fflfxff.exe58⤵
- Executes dropped EXE
PID:4952 -
\??\c:\nntnbh.exec:\nntnbh.exe59⤵
- Executes dropped EXE
PID:2808 -
\??\c:\vdpdd.exec:\vdpdd.exe60⤵
- Executes dropped EXE
PID:3212 -
\??\c:\3djjj.exec:\3djjj.exe61⤵
- Executes dropped EXE
PID:1580 -
\??\c:\rrfxxxx.exec:\rrfxxxx.exe62⤵
- Executes dropped EXE
PID:1336 -
\??\c:\nnbhhb.exec:\nnbhhb.exe63⤵
- Executes dropped EXE
PID:1924 -
\??\c:\1vdpj.exec:\1vdpj.exe64⤵
- Executes dropped EXE
PID:4316 -
\??\c:\xfrlllx.exec:\xfrlllx.exe65⤵
- Executes dropped EXE
PID:2572 -
\??\c:\hhbttb.exec:\hhbttb.exe66⤵PID:4428
-
\??\c:\ddjjj.exec:\ddjjj.exe67⤵PID:4052
-
\??\c:\7xfflll.exec:\7xfflll.exe68⤵PID:1552
-
\??\c:\bbtbnh.exec:\bbtbnh.exe69⤵PID:2172
-
\??\c:\5pddj.exec:\5pddj.exe70⤵PID:3708
-
\??\c:\frrffxx.exec:\frrffxx.exe71⤵PID:776
-
\??\c:\nhtttb.exec:\nhtttb.exe72⤵PID:2464
-
\??\c:\pjvvv.exec:\pjvvv.exe73⤵PID:4092
-
\??\c:\7llflrr.exec:\7llflrr.exe74⤵PID:2092
-
\??\c:\xlxxrxx.exec:\xlxxrxx.exe75⤵PID:1760
-
\??\c:\tnnhhb.exec:\tnnhhb.exe76⤵PID:1448
-
\??\c:\jdppv.exec:\jdppv.exe77⤵
- System Location Discovery: System Language Discovery
PID:3384 -
\??\c:\fxflrll.exec:\fxflrll.exe78⤵PID:4024
-
\??\c:\ttbbhb.exec:\ttbbhb.exe79⤵PID:3256
-
\??\c:\djjpp.exec:\djjpp.exe80⤵PID:1108
-
\??\c:\5xlxxll.exec:\5xlxxll.exe81⤵PID:4144
-
\??\c:\nnhntt.exec:\nnhntt.exe82⤵PID:4868
-
\??\c:\3ppjj.exec:\3ppjj.exe83⤵PID:2576
-
\??\c:\rfrlfxx.exec:\rfrlfxx.exe84⤵
- System Location Discovery: System Language Discovery
PID:5088 -
\??\c:\ttbbtb.exec:\ttbbtb.exe85⤵PID:1772
-
\??\c:\hbtnhn.exec:\hbtnhn.exe86⤵PID:636
-
\??\c:\vjddd.exec:\vjddd.exe87⤵PID:4856
-
\??\c:\bhtbhn.exec:\bhtbhn.exe88⤵PID:4960
-
\??\c:\ntntbh.exec:\ntntbh.exe89⤵PID:4368
-
\??\c:\vdppp.exec:\vdppp.exe90⤵PID:3512
-
\??\c:\lxffxxr.exec:\lxffxxr.exe91⤵PID:2744
-
\??\c:\hthbtt.exec:\hthbtt.exe92⤵PID:332
-
\??\c:\xxffxff.exec:\xxffxff.exe93⤵PID:2520
-
\??\c:\hhttbh.exec:\hhttbh.exe94⤵PID:1504
-
\??\c:\dpvvj.exec:\dpvvj.exe95⤵PID:368
-
\??\c:\pdvvp.exec:\pdvvp.exe96⤵PID:1472
-
\??\c:\xfxxrrx.exec:\xfxxrrx.exe97⤵PID:1248
-
\??\c:\nthbtt.exec:\nthbtt.exe98⤵PID:1748
-
\??\c:\vpjjj.exec:\vpjjj.exe99⤵PID:2192
-
\??\c:\lxlllfl.exec:\lxlllfl.exe100⤵PID:2068
-
\??\c:\tbttbh.exec:\tbttbh.exe101⤵PID:5032
-
\??\c:\9pppp.exec:\9pppp.exe102⤵PID:4192
-
\??\c:\9rflfll.exec:\9rflfll.exe103⤵PID:876
-
\??\c:\nttnnn.exec:\nttnnn.exe104⤵PID:1676
-
\??\c:\5vdvv.exec:\5vdvv.exe105⤵PID:548
-
\??\c:\jpvdj.exec:\jpvdj.exe106⤵PID:3616
-
\??\c:\rfrrrrl.exec:\rfrrrrl.exe107⤵PID:968
-
\??\c:\tnhntn.exec:\tnhntn.exe108⤵PID:4920
-
\??\c:\vjjdd.exec:\vjjdd.exe109⤵
- System Location Discovery: System Language Discovery
PID:2196 -
\??\c:\xfrllrr.exec:\xfrllrr.exe110⤵PID:1520
-
\??\c:\bntbtb.exec:\bntbtb.exe111⤵PID:5108
-
\??\c:\ppvpd.exec:\ppvpd.exe112⤵PID:4236
-
\??\c:\rrllffx.exec:\rrllffx.exe113⤵PID:3360
-
\??\c:\9ntnbh.exec:\9ntnbh.exe114⤵PID:3212
-
\??\c:\pvvpv.exec:\pvvpv.exe115⤵PID:4424
-
\??\c:\frlrrxx.exec:\frlrrxx.exe116⤵PID:1684
-
\??\c:\3nbttb.exec:\3nbttb.exe117⤵PID:2816
-
\??\c:\djjjd.exec:\djjjd.exe118⤵PID:4048
-
\??\c:\rxlrxxx.exec:\rxlrxxx.exe119⤵PID:1844
-
\??\c:\thbntt.exec:\thbntt.exe120⤵PID:3864
-
\??\c:\pvvvv.exec:\pvvvv.exe121⤵PID:4836
-
\??\c:\xxxxrxf.exec:\xxxxrxf.exe122⤵PID:4064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-