Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 01:57
Static task
static1
Behavioral task
behavioral1
Sample
8ee1379ee9b3ad588715e12bbea03acf1c771c6449ceab360fb1e0ac4c8d8ce2.exe
Resource
win7-20241023-en
General
-
Target
8ee1379ee9b3ad588715e12bbea03acf1c771c6449ceab360fb1e0ac4c8d8ce2.exe
-
Size
455KB
-
MD5
3ab6b4f090cbbed10e9b78296a059cad
-
SHA1
14c2b8d29fba31a45631b7e47260511470779f11
-
SHA256
8ee1379ee9b3ad588715e12bbea03acf1c771c6449ceab360fb1e0ac4c8d8ce2
-
SHA512
62338cb1353e1a90263d8764b989230ce6fa91be7864f7c61a652030b2132fd7f7d788b4cf464fbdf3551ca0335a272d0062b6319e129ffe6643ef54e2a04b6a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR7:q7Tc2NYHUrAwfMp3CDR7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
Processes:
resource yara_rule behavioral2/memory/4196-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1512-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4248-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/892-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/944-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/848-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/364-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1428-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-568-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-661-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-759-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-868-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-1527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7nnbtt.exettbtnn.exehbtnhb.exexrxlflr.exe1lfxrxr.exeflxrxrx.exevvpjj.exelxxrrfx.exerlrlllx.exelxffxxx.exe5hhhtt.exedvdpd.exeppjdp.exebbnhtn.exenhnbnh.exevjpjv.exehhtttn.exedjpjv.exepddjd.exe3nhbtn.exetbtttt.exejdppj.exerfllllr.exelrllrrr.exe7lflxlx.exefxllrrr.exe1jdjj.exelfxxrxx.exeppppj.exe9pvvp.exebhttbb.exe1bbbtb.exeddjjd.exexxxxxxf.exebthhhh.exevpjjp.exeffrxrxf.exeffxlrxl.exehhttnt.exepvddv.exerrllflr.exerrfffff.exehbhhhn.exeddjjd.exellrxrxx.exehnbttb.exevvpvj.exelfrxxff.exexxfffll.exehhnntb.exejpvvp.exeflfxxfx.exehntthn.exe7jddv.exe7xxfxll.exe3nbbbh.exejjjjd.exevpdvv.exellxfxfl.exenhhnhn.exepvddv.exejjvvp.exellrlfff.exehntbbb.exepid Process 5032 7nnbtt.exe 3464 ttbtnn.exe 4488 hbtnhb.exe 3412 xrxlflr.exe 2160 1lfxrxr.exe 400 flxrxrx.exe 4324 vvpjj.exe 2912 lxxrrfx.exe 4264 rlrlllx.exe 1800 lxffxxx.exe 2272 5hhhtt.exe 1512 dvdpd.exe 2000 ppjdp.exe 4248 bbnhtn.exe 1984 nhnbnh.exe 1440 vjpjv.exe 3116 hhtttn.exe 3176 djpjv.exe 3744 pddjd.exe 3704 3nhbtn.exe 1772 tbtttt.exe 2228 jdppj.exe 4972 rfllllr.exe 424 lrllrrr.exe 1196 7lflxlx.exe 1344 fxllrrr.exe 2564 1jdjj.exe 1108 lfxxrxx.exe 2932 ppppj.exe 2364 9pvvp.exe 4496 bhttbb.exe 2300 1bbbtb.exe 2152 ddjjd.exe 892 xxxxxxf.exe 944 bthhhh.exe 3028 vpjjp.exe 2424 ffrxrxf.exe 3436 ffxlrxl.exe 1768 hhttnt.exe 1456 pvddv.exe 848 rrllflr.exe 3924 rrfffff.exe 3504 hbhhhn.exe 2504 ddjjd.exe 4256 llrxrxx.exe 2028 hnbttb.exe 4208 vvpvj.exe 364 lfrxxff.exe 4036 xxfffll.exe 4944 hhnntb.exe 4376 jpvvp.exe 3372 flfxxfx.exe 3588 hntthn.exe 220 7jddv.exe 1640 7xxfxll.exe 5100 3nbbbh.exe 1684 jjjjd.exe 1016 vpdvv.exe 2056 llxfxfl.exe 956 nhhnhn.exe 4676 pvddv.exe 5072 jjvvp.exe 1532 llrlfff.exe 4564 hntbbb.exe -
Processes:
resource yara_rule behavioral2/memory/4196-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2272-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1512-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3704-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1108-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/892-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/944-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/848-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/364-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1428-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-759-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-868-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-1527-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
xxllflr.exevdjjj.exetnhbbb.exejpjpp.exexxflfll.exepddjd.exe7rrrffl.exeppdpj.exexrxlflr.exerlrlllx.exeddjdp.exehntnnn.exexxlrfrr.exebbbhhn.exenbbtnn.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxlflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8ee1379ee9b3ad588715e12bbea03acf1c771c6449ceab360fb1e0ac4c8d8ce2.exe7nnbtt.exettbtnn.exehbtnhb.exexrxlflr.exe1lfxrxr.exeflxrxrx.exevvpjj.exelxxrrfx.exerlrlllx.exelxffxxx.exe5hhhtt.exedvdpd.exeppjdp.exebbnhtn.exenhnbnh.exevjpjv.exehhtttn.exedjpjv.exepddjd.exe3nhbtn.exetbtttt.exedescription pid Process procid_target PID 4196 wrote to memory of 5032 4196 8ee1379ee9b3ad588715e12bbea03acf1c771c6449ceab360fb1e0ac4c8d8ce2.exe 82 PID 4196 wrote to memory of 5032 4196 8ee1379ee9b3ad588715e12bbea03acf1c771c6449ceab360fb1e0ac4c8d8ce2.exe 82 PID 4196 wrote to memory of 5032 4196 8ee1379ee9b3ad588715e12bbea03acf1c771c6449ceab360fb1e0ac4c8d8ce2.exe 82 PID 5032 wrote to memory of 3464 5032 7nnbtt.exe 83 PID 5032 wrote to memory of 3464 5032 7nnbtt.exe 83 PID 5032 wrote to memory of 3464 5032 7nnbtt.exe 83 PID 3464 wrote to memory of 4488 3464 ttbtnn.exe 84 PID 3464 wrote to memory of 4488 3464 ttbtnn.exe 84 PID 3464 wrote to memory of 4488 3464 ttbtnn.exe 84 PID 4488 wrote to memory of 3412 4488 hbtnhb.exe 85 PID 4488 wrote to memory of 3412 4488 hbtnhb.exe 85 PID 4488 wrote to memory of 3412 4488 hbtnhb.exe 85 PID 3412 wrote to memory of 2160 3412 xrxlflr.exe 86 PID 3412 wrote to memory of 2160 3412 xrxlflr.exe 86 PID 3412 wrote to memory of 2160 3412 xrxlflr.exe 86 PID 2160 wrote to memory of 400 2160 1lfxrxr.exe 87 PID 2160 wrote to memory of 400 2160 1lfxrxr.exe 87 PID 2160 wrote to memory of 400 2160 1lfxrxr.exe 87 PID 400 wrote to memory of 4324 400 flxrxrx.exe 88 PID 400 wrote to memory of 4324 400 flxrxrx.exe 88 PID 400 wrote to memory of 4324 400 flxrxrx.exe 88 PID 4324 wrote to memory of 2912 4324 vvpjj.exe 89 PID 4324 wrote to memory of 2912 4324 vvpjj.exe 89 PID 4324 wrote to memory of 2912 4324 vvpjj.exe 89 PID 2912 wrote to memory of 4264 2912 lxxrrfx.exe 90 PID 2912 wrote to memory of 4264 2912 lxxrrfx.exe 90 PID 2912 wrote to memory of 4264 2912 lxxrrfx.exe 90 PID 4264 wrote to memory of 1800 4264 rlrlllx.exe 91 PID 4264 wrote to memory of 1800 4264 rlrlllx.exe 91 PID 4264 wrote to memory of 1800 4264 rlrlllx.exe 91 PID 1800 wrote to memory of 2272 1800 lxffxxx.exe 92 PID 1800 wrote to memory of 2272 1800 lxffxxx.exe 92 PID 1800 wrote to memory of 2272 1800 lxffxxx.exe 92 PID 2272 wrote to memory of 1512 2272 5hhhtt.exe 93 PID 2272 wrote to memory of 1512 2272 5hhhtt.exe 93 PID 2272 wrote to memory of 1512 2272 5hhhtt.exe 93 PID 1512 wrote to memory of 2000 1512 dvdpd.exe 94 PID 1512 wrote to memory of 2000 1512 dvdpd.exe 94 PID 1512 wrote to memory of 2000 1512 dvdpd.exe 94 PID 2000 wrote to memory of 4248 2000 ppjdp.exe 95 PID 2000 wrote to memory of 4248 2000 ppjdp.exe 95 PID 2000 wrote to memory of 4248 2000 ppjdp.exe 95 PID 4248 wrote to memory of 1984 4248 bbnhtn.exe 96 PID 4248 wrote to memory of 1984 4248 bbnhtn.exe 96 PID 4248 wrote to memory of 1984 4248 bbnhtn.exe 96 PID 1984 wrote to memory of 1440 1984 nhnbnh.exe 97 PID 1984 wrote to memory of 1440 1984 nhnbnh.exe 97 PID 1984 wrote to memory of 1440 1984 nhnbnh.exe 97 PID 1440 wrote to memory of 3116 1440 vjpjv.exe 98 PID 1440 wrote to memory of 3116 1440 vjpjv.exe 98 PID 1440 wrote to memory of 3116 1440 vjpjv.exe 98 PID 3116 wrote to memory of 3176 3116 hhtttn.exe 99 PID 3116 wrote to memory of 3176 3116 hhtttn.exe 99 PID 3116 wrote to memory of 3176 3116 hhtttn.exe 99 PID 3176 wrote to memory of 3744 3176 djpjv.exe 100 PID 3176 wrote to memory of 3744 3176 djpjv.exe 100 PID 3176 wrote to memory of 3744 3176 djpjv.exe 100 PID 3744 wrote to memory of 3704 3744 pddjd.exe 101 PID 3744 wrote to memory of 3704 3744 pddjd.exe 101 PID 3744 wrote to memory of 3704 3744 pddjd.exe 101 PID 3704 wrote to memory of 1772 3704 3nhbtn.exe 102 PID 3704 wrote to memory of 1772 3704 3nhbtn.exe 102 PID 3704 wrote to memory of 1772 3704 3nhbtn.exe 102 PID 1772 wrote to memory of 2228 1772 tbtttt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ee1379ee9b3ad588715e12bbea03acf1c771c6449ceab360fb1e0ac4c8d8ce2.exe"C:\Users\Admin\AppData\Local\Temp\8ee1379ee9b3ad588715e12bbea03acf1c771c6449ceab360fb1e0ac4c8d8ce2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\7nnbtt.exec:\7nnbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\ttbtnn.exec:\ttbtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\hbtnhb.exec:\hbtnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\xrxlflr.exec:\xrxlflr.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\1lfxrxr.exec:\1lfxrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\flxrxrx.exec:\flxrxrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\vvpjj.exec:\vvpjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\lxxrrfx.exec:\lxxrrfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\rlrlllx.exec:\rlrlllx.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\lxffxxx.exec:\lxffxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\5hhhtt.exec:\5hhhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\dvdpd.exec:\dvdpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\ppjdp.exec:\ppjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\bbnhtn.exec:\bbnhtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\nhnbnh.exec:\nhnbnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\vjpjv.exec:\vjpjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\hhtttn.exec:\hhtttn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\djpjv.exec:\djpjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\pddjd.exec:\pddjd.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\3nhbtn.exec:\3nhbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\tbtttt.exec:\tbtttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\jdppj.exec:\jdppj.exe23⤵
- Executes dropped EXE
PID:2228 -
\??\c:\rfllllr.exec:\rfllllr.exe24⤵
- Executes dropped EXE
PID:4972 -
\??\c:\lrllrrr.exec:\lrllrrr.exe25⤵
- Executes dropped EXE
PID:424 -
\??\c:\7lflxlx.exec:\7lflxlx.exe26⤵
- Executes dropped EXE
PID:1196 -
\??\c:\fxllrrr.exec:\fxllrrr.exe27⤵
- Executes dropped EXE
PID:1344 -
\??\c:\1jdjj.exec:\1jdjj.exe28⤵
- Executes dropped EXE
PID:2564 -
\??\c:\lfxxrxx.exec:\lfxxrxx.exe29⤵
- Executes dropped EXE
PID:1108 -
\??\c:\ppppj.exec:\ppppj.exe30⤵
- Executes dropped EXE
PID:2932 -
\??\c:\9pvvp.exec:\9pvvp.exe31⤵
- Executes dropped EXE
PID:2364 -
\??\c:\bhttbb.exec:\bhttbb.exe32⤵
- Executes dropped EXE
PID:4496 -
\??\c:\1bbbtb.exec:\1bbbtb.exe33⤵
- Executes dropped EXE
PID:2300 -
\??\c:\ddjjd.exec:\ddjjd.exe34⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xxxxxxf.exec:\xxxxxxf.exe35⤵
- Executes dropped EXE
PID:892 -
\??\c:\bthhhh.exec:\bthhhh.exe36⤵
- Executes dropped EXE
PID:944 -
\??\c:\vpjjp.exec:\vpjjp.exe37⤵
- Executes dropped EXE
PID:3028 -
\??\c:\ffrxrxf.exec:\ffrxrxf.exe38⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ffxlrxl.exec:\ffxlrxl.exe39⤵
- Executes dropped EXE
PID:3436 -
\??\c:\hhttnt.exec:\hhttnt.exe40⤵
- Executes dropped EXE
PID:1768 -
\??\c:\pvddv.exec:\pvddv.exe41⤵
- Executes dropped EXE
PID:1456 -
\??\c:\rrllflr.exec:\rrllflr.exe42⤵
- Executes dropped EXE
PID:848 -
\??\c:\rrfffff.exec:\rrfffff.exe43⤵
- Executes dropped EXE
PID:3924 -
\??\c:\hbhhhn.exec:\hbhhhn.exe44⤵
- Executes dropped EXE
PID:3504 -
\??\c:\ddjjd.exec:\ddjjd.exe45⤵
- Executes dropped EXE
PID:2504 -
\??\c:\llrxrxx.exec:\llrxrxx.exe46⤵
- Executes dropped EXE
PID:4256 -
\??\c:\hnbttb.exec:\hnbttb.exe47⤵
- Executes dropped EXE
PID:2028 -
\??\c:\vvpvj.exec:\vvpvj.exe48⤵
- Executes dropped EXE
PID:4208 -
\??\c:\lfrxxff.exec:\lfrxxff.exe49⤵
- Executes dropped EXE
PID:364 -
\??\c:\xxfffll.exec:\xxfffll.exe50⤵
- Executes dropped EXE
PID:4036 -
\??\c:\hhnntb.exec:\hhnntb.exe51⤵
- Executes dropped EXE
PID:4944 -
\??\c:\jpvvp.exec:\jpvvp.exe52⤵
- Executes dropped EXE
PID:4376 -
\??\c:\flfxxfx.exec:\flfxxfx.exe53⤵
- Executes dropped EXE
PID:3372 -
\??\c:\hntthn.exec:\hntthn.exe54⤵
- Executes dropped EXE
PID:3588 -
\??\c:\7jddv.exec:\7jddv.exe55⤵
- Executes dropped EXE
PID:220 -
\??\c:\7xxfxll.exec:\7xxfxll.exe56⤵
- Executes dropped EXE
PID:1640 -
\??\c:\3nbbbh.exec:\3nbbbh.exe57⤵
- Executes dropped EXE
PID:5100 -
\??\c:\jjjjd.exec:\jjjjd.exe58⤵
- Executes dropped EXE
PID:1684 -
\??\c:\vpdvv.exec:\vpdvv.exe59⤵
- Executes dropped EXE
PID:1016 -
\??\c:\llxfxfl.exec:\llxfxfl.exe60⤵
- Executes dropped EXE
PID:2056 -
\??\c:\nhhnhn.exec:\nhhnhn.exe61⤵
- Executes dropped EXE
PID:956 -
\??\c:\pvddv.exec:\pvddv.exe62⤵
- Executes dropped EXE
PID:4676 -
\??\c:\jjvvp.exec:\jjvvp.exe63⤵
- Executes dropped EXE
PID:5072 -
\??\c:\llrlfff.exec:\llrlfff.exe64⤵
- Executes dropped EXE
PID:1532 -
\??\c:\hntbbb.exec:\hntbbb.exe65⤵
- Executes dropped EXE
PID:4564 -
\??\c:\ppdpj.exec:\ppdpj.exe66⤵
- System Location Discovery: System Language Discovery
PID:1824 -
\??\c:\lrxrlrr.exec:\lrxrlrr.exe67⤵PID:2272
-
\??\c:\9ttnhn.exec:\9ttnhn.exe68⤵PID:3032
-
\??\c:\vvdjd.exec:\vvdjd.exe69⤵PID:2416
-
\??\c:\llrlfff.exec:\llrlfff.exe70⤵PID:4920
-
\??\c:\1bbbtt.exec:\1bbbtt.exe71⤵PID:4016
-
\??\c:\hbnnhh.exec:\hbnnhh.exe72⤵PID:212
-
\??\c:\ddddd.exec:\ddddd.exe73⤵PID:3764
-
\??\c:\xflrlrr.exec:\xflrlrr.exe74⤵PID:228
-
\??\c:\tbhhbb.exec:\tbhhbb.exe75⤵PID:1944
-
\??\c:\pjdvd.exec:\pjdvd.exe76⤵PID:2276
-
\??\c:\jjddj.exec:\jjddj.exe77⤵PID:1148
-
\??\c:\fllffff.exec:\fllffff.exe78⤵PID:2064
-
\??\c:\tnbbbh.exec:\tnbbbh.exe79⤵PID:3060
-
\??\c:\1jjjd.exec:\1jjjd.exe80⤵PID:1428
-
\??\c:\1pvpp.exec:\1pvpp.exe81⤵PID:1648
-
\??\c:\xrfxlll.exec:\xrfxlll.exe82⤵PID:60
-
\??\c:\nnnntb.exec:\nnnntb.exe83⤵PID:3680
-
\??\c:\ppppp.exec:\ppppp.exe84⤵PID:3796
-
\??\c:\ffllrrr.exec:\ffllrrr.exe85⤵PID:916
-
\??\c:\fxfrrrl.exec:\fxfrrrl.exe86⤵PID:2248
-
\??\c:\hntttb.exec:\hntttb.exe87⤵PID:4992
-
\??\c:\vvvdp.exec:\vvvdp.exe88⤵PID:1572
-
\??\c:\dvddv.exec:\dvddv.exe89⤵PID:4848
-
\??\c:\frlffxl.exec:\frlffxl.exe90⤵PID:2068
-
\??\c:\rxflflr.exec:\rxflflr.exe91⤵PID:2392
-
\??\c:\nthhnt.exec:\nthhnt.exe92⤵PID:752
-
\??\c:\jjpvd.exec:\jjpvd.exe93⤵PID:4784
-
\??\c:\lfrllll.exec:\lfrllll.exe94⤵PID:232
-
\??\c:\nhtttt.exec:\nhtttt.exe95⤵PID:4252
-
\??\c:\pjvjj.exec:\pjvjj.exe96⤵PID:2404
-
\??\c:\jdppj.exec:\jdppj.exe97⤵PID:2624
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe98⤵PID:3916
-
\??\c:\hbhbhh.exec:\hbhbhh.exe99⤵PID:2468
-
\??\c:\vpdjp.exec:\vpdjp.exe100⤵PID:4272
-
\??\c:\rrflfxx.exec:\rrflfxx.exe101⤵PID:3924
-
\??\c:\7hhbtb.exec:\7hhbtb.exe102⤵PID:4960
-
\??\c:\5bhhhh.exec:\5bhhhh.exe103⤵PID:2504
-
\??\c:\7dddv.exec:\7dddv.exe104⤵PID:5048
-
\??\c:\xxrrlrr.exec:\xxrrlrr.exe105⤵PID:3460
-
\??\c:\tthhhn.exec:\tthhhn.exe106⤵PID:3956
-
\??\c:\vpddv.exec:\vpddv.exe107⤵PID:3152
-
\??\c:\dvdvp.exec:\dvdvp.exe108⤵PID:3900
-
\??\c:\rrxrlrr.exec:\rrxrlrr.exe109⤵PID:2240
-
\??\c:\bbnnnh.exec:\bbnnnh.exe110⤵PID:4376
-
\??\c:\jdvvv.exec:\jdvvv.exe111⤵PID:4580
-
\??\c:\xfffffl.exec:\xfffffl.exe112⤵PID:1416
-
\??\c:\thnhnn.exec:\thnhnn.exe113⤵PID:5012
-
\??\c:\hhhhnh.exec:\hhhhnh.exe114⤵PID:3312
-
\??\c:\pvppd.exec:\pvppd.exe115⤵PID:2744
-
\??\c:\xlxlxrr.exec:\xlxlxrr.exe116⤵PID:4104
-
\??\c:\ttnnbh.exec:\ttnnbh.exe117⤵PID:3892
-
\??\c:\ppvvv.exec:\ppvvv.exe118⤵PID:2360
-
\??\c:\pjvvp.exec:\pjvvp.exe119⤵PID:868
-
\??\c:\rrxfffl.exec:\rrxfffl.exe120⤵PID:2444
-
\??\c:\hbnhhn.exec:\hbnhhn.exe121⤵PID:3444
-
\??\c:\djvpj.exec:\djvpj.exe122⤵PID:2756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-