Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 00:47
Behavioral task
behavioral1
Sample
8220357b46bdb5346636fe7aa70a0c5854726d73db34fa7ef7a9f2adc9f5c12c.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
8220357b46bdb5346636fe7aa70a0c5854726d73db34fa7ef7a9f2adc9f5c12c.exe
-
Size
94KB
-
MD5
d4e54043e5abd0546b16cf4440d338be
-
SHA1
60870eecb8e5209474de922aa4a5666c5fac6afd
-
SHA256
8220357b46bdb5346636fe7aa70a0c5854726d73db34fa7ef7a9f2adc9f5c12c
-
SHA512
c6e69b40d8779151bfbec0d506ce9aa7c4a3320dd425666f6c3a7be8efff2dab43881e0e84a07790ae76921632d8c2f96af330a3fec1a6ca987e2033db725af6
-
SSDEEP
1536:cvQBeOGtrYS3srx93UBWfwC6Ggnouy8mVeygryFU2li0gx4EBbhnyLFW+eme:chOmTsF93UYfwC6GIoutieyhC2lbgGiP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/224-8-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1476-6-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4840-20-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4752-19-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2792-30-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1040-44-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3452-40-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4312-62-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3956-70-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5032-68-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3888-38-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4892-78-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4688-85-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2876-90-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/536-96-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4680-112-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4372-118-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1704-124-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4148-130-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4364-137-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/512-147-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2160-154-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1044-170-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4900-189-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2364-196-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1460-200-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2408-204-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4420-208-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1452-211-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/60-215-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1168-222-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4384-226-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4672-230-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3584-240-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1824-254-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1624-258-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5028-263-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1444-267-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3888-276-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/884-283-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/940-293-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1228-309-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2876-316-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1076-323-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2704-327-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4888-340-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4088-344-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3168-366-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4708-373-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1096-386-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2656-397-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3728-409-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4448-416-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2384-426-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4896-431-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4472-446-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/632-480-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3120-484-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3156-491-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3712-501-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2716-538-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4892-665-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3276-831-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4744-1266-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 224 xlxrrrf.exe 4752 xflfxxr.exe 4840 nnbthb.exe 2792 nhthbb.exe 3888 lffxxxl.exe 3452 nhbhbt.exe 1040 ntttnh.exe 2932 jvpjd.exe 4312 7rlfxxl.exe 5032 rrlfxxr.exe 3956 nhbtnh.exe 4892 ddvpp.exe 4688 lxxxrrr.exe 2876 nhtnhh.exe 536 5ppvp.exe 4240 dvppd.exe 404 1nnhnn.exe 4680 btttnh.exe 4372 dvpdp.exe 1704 flfxxff.exe 4148 hhhhnh.exe 2608 hhhtnh.exe 4364 9jddv.exe 512 llxlfrx.exe 2160 xrlxrrl.exe 4032 5bbtnn.exe 1464 dppjd.exe 3176 1rxfrxr.exe 1044 fllfxxx.exe 3020 9thhhh.exe 1028 dpppp.exe 4900 xllfxxr.exe 4568 thhbbt.exe 2364 htthht.exe 1460 3vvpj.exe 2408 jpjdv.exe 4420 llrrlxx.exe 1452 btbbhh.exe 60 dddjj.exe 2556 ffrxxxr.exe 1168 fxfffff.exe 4384 bhnhnb.exe 4672 dvjvj.exe 1876 xxrlfxr.exe 1512 hhhhbh.exe 3584 hhnnbb.exe 4884 ppdpj.exe 1440 5fffxxr.exe 5060 pjjpj.exe 1824 jvppp.exe 1624 lllxrfx.exe 4564 xfrfxlf.exe 5028 nbthhn.exe 1444 1jddp.exe 2432 jpppj.exe 3888 llfffff.exe 2920 rlllflf.exe 884 hnbbbb.exe 3188 vdddv.exe 3596 frxffrr.exe 940 hhhhbh.exe 4140 nthhbh.exe 3952 pvjjp.exe 2908 dvvdd.exe -
resource yara_rule behavioral2/memory/1476-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000023caa-3.dat upx behavioral2/memory/224-8-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000023cad-10.dat upx behavioral2/files/0x0007000000023cb1-13.dat upx behavioral2/memory/1476-6-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4840-20-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023cb3-23.dat upx behavioral2/memory/4752-19-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023cb4-27.dat upx behavioral2/memory/3888-32-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2792-30-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023cb5-34.dat upx behavioral2/files/0x0007000000023cb6-42.dat upx behavioral2/files/0x0007000000023cb7-47.dat upx behavioral2/memory/2932-49-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4312-56-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023cb8-54.dat upx behavioral2/memory/1040-44-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3452-40-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023cb9-59.dat upx behavioral2/files/0x0007000000023cba-65.dat upx behavioral2/memory/4312-62-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3956-70-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023cbb-73.dat upx behavioral2/memory/5032-68-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3888-38-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023cbc-77.dat upx behavioral2/memory/4892-78-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023cbd-82.dat upx behavioral2/memory/4688-85-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2876-90-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023cbe-91.dat upx behavioral2/memory/536-96-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023cbf-94.dat upx behavioral2/files/0x0007000000023cc0-100.dat upx behavioral2/files/0x0007000000023cc2-105.dat upx behavioral2/files/0x0007000000023cc3-110.dat upx behavioral2/memory/4680-112-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023cc4-116.dat upx behavioral2/memory/4372-118-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023cc5-122.dat upx behavioral2/memory/1704-124-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4148-130-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023cc6-128.dat upx behavioral2/files/0x0007000000023cc7-134.dat upx behavioral2/memory/4364-137-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023cc8-140.dat upx behavioral2/files/0x0007000000023cc9-145.dat upx behavioral2/memory/512-147-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2160-154-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023ccb-158.dat upx behavioral2/files/0x0007000000023cca-151.dat upx behavioral2/files/0x0007000000023ccc-163.dat upx behavioral2/files/0x0008000000023cae-168.dat upx behavioral2/memory/1044-170-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023ccd-173.dat upx behavioral2/files/0x0007000000023cce-178.dat upx behavioral2/files/0x0007000000023ccf-184.dat upx behavioral2/memory/4900-189-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2364-196-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1460-200-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2408-204-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4420-208-0x0000000000400000-0x0000000000436000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1476 wrote to memory of 224 1476 8220357b46bdb5346636fe7aa70a0c5854726d73db34fa7ef7a9f2adc9f5c12c.exe 83 PID 1476 wrote to memory of 224 1476 8220357b46bdb5346636fe7aa70a0c5854726d73db34fa7ef7a9f2adc9f5c12c.exe 83 PID 1476 wrote to memory of 224 1476 8220357b46bdb5346636fe7aa70a0c5854726d73db34fa7ef7a9f2adc9f5c12c.exe 83 PID 224 wrote to memory of 4752 224 xlxrrrf.exe 84 PID 224 wrote to memory of 4752 224 xlxrrrf.exe 84 PID 224 wrote to memory of 4752 224 xlxrrrf.exe 84 PID 4752 wrote to memory of 4840 4752 xflfxxr.exe 85 PID 4752 wrote to memory of 4840 4752 xflfxxr.exe 85 PID 4752 wrote to memory of 4840 4752 xflfxxr.exe 85 PID 4840 wrote to memory of 2792 4840 nnbthb.exe 86 PID 4840 wrote to memory of 2792 4840 nnbthb.exe 86 PID 4840 wrote to memory of 2792 4840 nnbthb.exe 86 PID 2792 wrote to memory of 3888 2792 nhthbb.exe 87 PID 2792 wrote to memory of 3888 2792 nhthbb.exe 87 PID 2792 wrote to memory of 3888 2792 nhthbb.exe 87 PID 3888 wrote to memory of 3452 3888 lffxxxl.exe 88 PID 3888 wrote to memory of 3452 3888 lffxxxl.exe 88 PID 3888 wrote to memory of 3452 3888 lffxxxl.exe 88 PID 3452 wrote to memory of 1040 3452 nhbhbt.exe 89 PID 3452 wrote to memory of 1040 3452 nhbhbt.exe 89 PID 3452 wrote to memory of 1040 3452 nhbhbt.exe 89 PID 1040 wrote to memory of 2932 1040 ntttnh.exe 90 PID 1040 wrote to memory of 2932 1040 ntttnh.exe 90 PID 1040 wrote to memory of 2932 1040 ntttnh.exe 90 PID 2932 wrote to memory of 4312 2932 jvpjd.exe 91 PID 2932 wrote to memory of 4312 2932 jvpjd.exe 91 PID 2932 wrote to memory of 4312 2932 jvpjd.exe 91 PID 4312 wrote to memory of 5032 4312 7rlfxxl.exe 92 PID 4312 wrote to memory of 5032 4312 7rlfxxl.exe 92 PID 4312 wrote to memory of 5032 4312 7rlfxxl.exe 92 PID 5032 wrote to memory of 3956 5032 rrlfxxr.exe 93 PID 5032 wrote to memory of 3956 5032 rrlfxxr.exe 93 PID 5032 wrote to memory of 3956 5032 rrlfxxr.exe 93 PID 3956 wrote to memory of 4892 3956 nhbtnh.exe 94 PID 3956 wrote to memory of 4892 3956 nhbtnh.exe 94 PID 3956 wrote to memory of 4892 3956 nhbtnh.exe 94 PID 4892 wrote to memory of 4688 4892 ddvpp.exe 95 PID 4892 wrote to memory of 4688 4892 ddvpp.exe 95 PID 4892 wrote to memory of 4688 4892 ddvpp.exe 95 PID 4688 wrote to memory of 2876 4688 lxxxrrr.exe 96 PID 4688 wrote to memory of 2876 4688 lxxxrrr.exe 96 PID 4688 wrote to memory of 2876 4688 lxxxrrr.exe 96 PID 2876 wrote to memory of 536 2876 nhtnhh.exe 97 PID 2876 wrote to memory of 536 2876 nhtnhh.exe 97 PID 2876 wrote to memory of 536 2876 nhtnhh.exe 97 PID 536 wrote to memory of 4240 536 5ppvp.exe 98 PID 536 wrote to memory of 4240 536 5ppvp.exe 98 PID 536 wrote to memory of 4240 536 5ppvp.exe 98 PID 4240 wrote to memory of 404 4240 dvppd.exe 99 PID 4240 wrote to memory of 404 4240 dvppd.exe 99 PID 4240 wrote to memory of 404 4240 dvppd.exe 99 PID 404 wrote to memory of 4680 404 1nnhnn.exe 100 PID 404 wrote to memory of 4680 404 1nnhnn.exe 100 PID 404 wrote to memory of 4680 404 1nnhnn.exe 100 PID 4680 wrote to memory of 4372 4680 btttnh.exe 101 PID 4680 wrote to memory of 4372 4680 btttnh.exe 101 PID 4680 wrote to memory of 4372 4680 btttnh.exe 101 PID 4372 wrote to memory of 1704 4372 dvpdp.exe 102 PID 4372 wrote to memory of 1704 4372 dvpdp.exe 102 PID 4372 wrote to memory of 1704 4372 dvpdp.exe 102 PID 1704 wrote to memory of 4148 1704 flfxxff.exe 103 PID 1704 wrote to memory of 4148 1704 flfxxff.exe 103 PID 1704 wrote to memory of 4148 1704 flfxxff.exe 103 PID 4148 wrote to memory of 2608 4148 hhhhnh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\8220357b46bdb5346636fe7aa70a0c5854726d73db34fa7ef7a9f2adc9f5c12c.exe"C:\Users\Admin\AppData\Local\Temp\8220357b46bdb5346636fe7aa70a0c5854726d73db34fa7ef7a9f2adc9f5c12c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\xlxrrrf.exec:\xlxrrrf.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\xflfxxr.exec:\xflfxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\nnbthb.exec:\nnbthb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\nhthbb.exec:\nhthbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\lffxxxl.exec:\lffxxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\nhbhbt.exec:\nhbhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\ntttnh.exec:\ntttnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\jvpjd.exec:\jvpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\7rlfxxl.exec:\7rlfxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\rrlfxxr.exec:\rrlfxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\nhbtnh.exec:\nhbtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\ddvpp.exec:\ddvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\nhtnhh.exec:\nhtnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\5ppvp.exec:\5ppvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\dvppd.exec:\dvppd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\1nnhnn.exec:\1nnhnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\btttnh.exec:\btttnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\dvpdp.exec:\dvpdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\flfxxff.exec:\flfxxff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\hhhhnh.exec:\hhhhnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\hhhtnh.exec:\hhhtnh.exe23⤵
- Executes dropped EXE
PID:2608 -
\??\c:\9jddv.exec:\9jddv.exe24⤵
- Executes dropped EXE
PID:4364 -
\??\c:\llxlfrx.exec:\llxlfrx.exe25⤵
- Executes dropped EXE
PID:512 -
\??\c:\xrlxrrl.exec:\xrlxrrl.exe26⤵
- Executes dropped EXE
PID:2160 -
\??\c:\5bbtnn.exec:\5bbtnn.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4032 -
\??\c:\dppjd.exec:\dppjd.exe28⤵
- Executes dropped EXE
PID:1464 -
\??\c:\1rxfrxr.exec:\1rxfrxr.exe29⤵
- Executes dropped EXE
PID:3176 -
\??\c:\fllfxxx.exec:\fllfxxx.exe30⤵
- Executes dropped EXE
PID:1044 -
\??\c:\9thhhh.exec:\9thhhh.exe31⤵
- Executes dropped EXE
PID:3020 -
\??\c:\dpppp.exec:\dpppp.exe32⤵
- Executes dropped EXE
PID:1028 -
\??\c:\xllfxxr.exec:\xllfxxr.exe33⤵
- Executes dropped EXE
PID:4900 -
\??\c:\thhbbt.exec:\thhbbt.exe34⤵
- Executes dropped EXE
PID:4568 -
\??\c:\htthht.exec:\htthht.exe35⤵
- Executes dropped EXE
PID:2364 -
\??\c:\3vvpj.exec:\3vvpj.exe36⤵
- Executes dropped EXE
PID:1460 -
\??\c:\jpjdv.exec:\jpjdv.exe37⤵
- Executes dropped EXE
PID:2408 -
\??\c:\llrrlxx.exec:\llrrlxx.exe38⤵
- Executes dropped EXE
PID:4420 -
\??\c:\btbbhh.exec:\btbbhh.exe39⤵
- Executes dropped EXE
PID:1452 -
\??\c:\dddjj.exec:\dddjj.exe40⤵
- Executes dropped EXE
PID:60 -
\??\c:\ffrxxxr.exec:\ffrxxxr.exe41⤵
- Executes dropped EXE
PID:2556 -
\??\c:\fxfffff.exec:\fxfffff.exe42⤵
- Executes dropped EXE
PID:1168 -
\??\c:\bhnhnb.exec:\bhnhnb.exe43⤵
- Executes dropped EXE
PID:4384 -
\??\c:\dvjvj.exec:\dvjvj.exe44⤵
- Executes dropped EXE
PID:4672 -
\??\c:\xxrlfxr.exec:\xxrlfxr.exe45⤵
- Executes dropped EXE
PID:1876 -
\??\c:\hhhhbh.exec:\hhhhbh.exe46⤵
- Executes dropped EXE
PID:1512 -
\??\c:\hhnnbb.exec:\hhnnbb.exe47⤵
- Executes dropped EXE
PID:3584 -
\??\c:\ppdpj.exec:\ppdpj.exe48⤵
- Executes dropped EXE
PID:4884 -
\??\c:\5fffxxr.exec:\5fffxxr.exe49⤵
- Executes dropped EXE
PID:1440 -
\??\c:\7hbbnn.exec:\7hbbnn.exe50⤵PID:4400
-
\??\c:\pjjpj.exec:\pjjpj.exe51⤵
- Executes dropped EXE
PID:5060 -
\??\c:\jvppp.exec:\jvppp.exe52⤵
- Executes dropped EXE
PID:1824 -
\??\c:\lllxrfx.exec:\lllxrfx.exe53⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xfrfxlf.exec:\xfrfxlf.exe54⤵
- Executes dropped EXE
PID:4564 -
\??\c:\nbthhn.exec:\nbthhn.exe55⤵
- Executes dropped EXE
PID:5028 -
\??\c:\1jddp.exec:\1jddp.exe56⤵
- Executes dropped EXE
PID:1444 -
\??\c:\jpppj.exec:\jpppj.exe57⤵
- Executes dropped EXE
PID:2432 -
\??\c:\llfffff.exec:\llfffff.exe58⤵
- Executes dropped EXE
PID:3888 -
\??\c:\rlllflf.exec:\rlllflf.exe59⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hnbbbb.exec:\hnbbbb.exe60⤵
- Executes dropped EXE
PID:884 -
\??\c:\vdddv.exec:\vdddv.exe61⤵
- Executes dropped EXE
PID:3188 -
\??\c:\frxffrr.exec:\frxffrr.exe62⤵
- Executes dropped EXE
PID:3596 -
\??\c:\hhhhbh.exec:\hhhhbh.exe63⤵
- Executes dropped EXE
PID:940 -
\??\c:\nthhbh.exec:\nthhbh.exe64⤵
- Executes dropped EXE
PID:4140 -
\??\c:\pvjjp.exec:\pvjjp.exe65⤵
- Executes dropped EXE
PID:3952 -
\??\c:\dvvdd.exec:\dvvdd.exe66⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xxxxxxx.exec:\xxxxxxx.exe67⤵PID:3156
-
\??\c:\bbhbbh.exec:\bbhbbh.exe68⤵PID:1228
-
\??\c:\7ddjd.exec:\7ddjd.exe69⤵PID:5092
-
\??\c:\vvjpd.exec:\vvjpd.exe70⤵PID:2876
-
\??\c:\lxlllxf.exec:\lxlllxf.exe71⤵PID:3300
-
\??\c:\ffxxxll.exec:\ffxxxll.exe72⤵PID:1076
-
\??\c:\xfrrffl.exec:\xfrrffl.exe73⤵PID:2704
-
\??\c:\htbbbb.exec:\htbbbb.exe74⤵PID:3672
-
\??\c:\vvpjj.exec:\vvpjj.exe75⤵PID:3456
-
\??\c:\vpvdd.exec:\vpvdd.exe76⤵PID:3440
-
\??\c:\xrfxfff.exec:\xrfxfff.exe77⤵PID:4888
-
\??\c:\ffrrffr.exec:\ffrrffr.exe78⤵PID:4088
-
\??\c:\nnnnhh.exec:\nnnnhh.exe79⤵PID:3184
-
\??\c:\1jpvv.exec:\1jpvv.exe80⤵PID:3572
-
\??\c:\vvvpd.exec:\vvvpd.exe81⤵PID:1132
-
\??\c:\llrrffr.exec:\llrrffr.exe82⤵PID:2052
-
\??\c:\hhbbbh.exec:\hhbbbh.exe83⤵PID:3824
-
\??\c:\vvddv.exec:\vvddv.exe84⤵PID:4412
-
\??\c:\vdddd.exec:\vdddd.exe85⤵PID:3168
-
\??\c:\btbbtt.exec:\btbbtt.exe86⤵PID:4032
-
\??\c:\nthhhn.exec:\nthhhn.exe87⤵PID:4708
-
\??\c:\vddvv.exec:\vddvv.exe88⤵PID:4644
-
\??\c:\1frrfrr.exec:\1frrfrr.exe89⤵PID:3176
-
\??\c:\tntttb.exec:\tntttb.exe90⤵PID:1640
-
\??\c:\nhhbnn.exec:\nhhbnn.exe91⤵PID:1096
-
\??\c:\llrrrrr.exec:\llrrrrr.exe92⤵PID:880
-
\??\c:\xxrrllf.exec:\xxrrllf.exe93⤵PID:1832
-
\??\c:\hbbbbn.exec:\hbbbbn.exe94⤵PID:4044
-
\??\c:\tbtnhn.exec:\tbtnhn.exe95⤵PID:2656
-
\??\c:\vjvvv.exec:\vjvvv.exe96⤵PID:3424
-
\??\c:\jpjdv.exec:\jpjdv.exe97⤵PID:3848
-
\??\c:\9xlllrx.exec:\9xlllrx.exe98⤵PID:3728
-
\??\c:\bbnnnt.exec:\bbnnnt.exe99⤵PID:4356
-
\??\c:\hbbbbb.exec:\hbbbbb.exe100⤵PID:4448
-
\??\c:\vdvvp.exec:\vdvvp.exe101⤵PID:2208
-
\??\c:\pvppp.exec:\pvppp.exe102⤵PID:1384
-
\??\c:\rlffrrl.exec:\rlffrrl.exe103⤵PID:2384
-
\??\c:\9rxrlrr.exec:\9rxrlrr.exe104⤵PID:4896
-
\??\c:\nntttt.exec:\nntttt.exe105⤵PID:4884
-
\??\c:\nnnnnn.exec:\nnnnnn.exe106⤵PID:2512
-
\??\c:\ddppv.exec:\ddppv.exe107⤵PID:1476
-
\??\c:\ddjpd.exec:\ddjpd.exe108⤵PID:4540
-
\??\c:\jjvvj.exec:\jjvvj.exe109⤵
- System Location Discovery: System Language Discovery
PID:4472 -
\??\c:\fxxxfll.exec:\fxxxfll.exe110⤵PID:4564
-
\??\c:\thtttt.exec:\thtttt.exe111⤵PID:2168
-
\??\c:\jdddj.exec:\jdddj.exe112⤵PID:4796
-
\??\c:\vvjjd.exec:\vvjjd.exe113⤵PID:2432
-
\??\c:\xflfrxl.exec:\xflfrxl.exe114⤵PID:2016
-
\??\c:\rfxrfff.exec:\rfxrfff.exe115⤵PID:3992
-
\??\c:\vdvvp.exec:\vdvvp.exe116⤵PID:884
-
\??\c:\xlffflf.exec:\xlffflf.exe117⤵PID:3188
-
\??\c:\jddpp.exec:\jddpp.exe118⤵PID:3596
-
\??\c:\3jjpp.exec:\3jjpp.exe119⤵PID:4320
-
\??\c:\nbtntn.exec:\nbtntn.exe120⤵PID:632
-
\??\c:\bbtbtt.exec:\bbtbtt.exe121⤵PID:3120
-
\??\c:\lxrrlrl.exec:\lxrrlrl.exe122⤵PID:2232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-