Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 19:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe
-
Size
454KB
-
MD5
9bdb9371d4f5c81e0ef03e158e84187a
-
SHA1
141c1d690291866191ac63c41781e05f2c9c5b8e
-
SHA256
07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd
-
SHA512
0d245da98d0686a80f3b988a64b56828bf7bb164c2e6ec3ea025affa7fdeb7b148f7964eb3ab8bc77896d419bece48d37e470fc67fea749b9c0a396743c57121
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbecr:q7Tc2NYHUrAwfMp3CDm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4240-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1784-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1296-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-751-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-818-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-885-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-913-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-975-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4240 nhhbtt.exe 4228 ddpjv.exe 2408 1jjdj.exe 2384 rflfxxr.exe 3164 thnbnn.exe 3820 vppjd.exe 3172 dvdvj.exe 2644 ppvpj.exe 4756 rfllfff.exe 3340 jjvvp.exe 1392 1bnhbh.exe 3024 pjjdv.exe 2180 hbnhnn.exe 4792 lrrlfff.exe 3048 fxlrrxx.exe 3084 9btnhh.exe 2544 vjvpp.exe 3000 pvjdv.exe 3280 fxffxfx.exe 4072 dpvpp.exe 3120 tbnnnb.exe 4024 vpjvp.exe 1784 fxfxxxx.exe 1492 pjddj.exe 4844 lxflffr.exe 1720 vvjjp.exe 1196 rlrllrr.exe 1052 rrxxxxx.exe 1200 tntttb.exe 2808 llxfflr.exe 2668 pppjj.exe 4980 hhnttb.exe 936 djvdd.exe 4940 rrllrrf.exe 5004 tbbhhn.exe 1092 vpjdp.exe 2356 xrrllff.exe 3540 tnbbhb.exe 3276 pjvpp.exe 1148 xxxrxxf.exe 4876 thhhhh.exe 3572 ntntnt.exe 3980 ddvvp.exe 224 lxfffll.exe 4452 xxffffl.exe 4464 nbhbbb.exe 2452 3djpv.exe 1652 xrfxxll.exe 2460 nnhnbb.exe 4124 vpvpj.exe 3268 frfrllf.exe 2984 bnbhtb.exe 1800 vpjdv.exe 4312 lfrrxxf.exe 2484 fflllrr.exe 1816 tthntt.exe 2704 dpjjp.exe 1928 fxfxrrl.exe 3324 hhbhnt.exe 1296 jvppp.exe 456 djjdj.exe 2056 rxrllrr.exe 3592 tbhbhn.exe 4796 pvjpj.exe -
resource yara_rule behavioral2/memory/4240-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1296-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-818-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2452 wrote to memory of 4240 2452 07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe 82 PID 2452 wrote to memory of 4240 2452 07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe 82 PID 2452 wrote to memory of 4240 2452 07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe 82 PID 4240 wrote to memory of 4228 4240 nhhbtt.exe 83 PID 4240 wrote to memory of 4228 4240 nhhbtt.exe 83 PID 4240 wrote to memory of 4228 4240 nhhbtt.exe 83 PID 4228 wrote to memory of 2408 4228 ddpjv.exe 84 PID 4228 wrote to memory of 2408 4228 ddpjv.exe 84 PID 4228 wrote to memory of 2408 4228 ddpjv.exe 84 PID 2408 wrote to memory of 2384 2408 1jjdj.exe 85 PID 2408 wrote to memory of 2384 2408 1jjdj.exe 85 PID 2408 wrote to memory of 2384 2408 1jjdj.exe 85 PID 2384 wrote to memory of 3164 2384 rflfxxr.exe 86 PID 2384 wrote to memory of 3164 2384 rflfxxr.exe 86 PID 2384 wrote to memory of 3164 2384 rflfxxr.exe 86 PID 3164 wrote to memory of 3820 3164 thnbnn.exe 87 PID 3164 wrote to memory of 3820 3164 thnbnn.exe 87 PID 3164 wrote to memory of 3820 3164 thnbnn.exe 87 PID 3820 wrote to memory of 3172 3820 vppjd.exe 88 PID 3820 wrote to memory of 3172 3820 vppjd.exe 88 PID 3820 wrote to memory of 3172 3820 vppjd.exe 88 PID 3172 wrote to memory of 2644 3172 dvdvj.exe 89 PID 3172 wrote to memory of 2644 3172 dvdvj.exe 89 PID 3172 wrote to memory of 2644 3172 dvdvj.exe 89 PID 2644 wrote to memory of 4756 2644 ppvpj.exe 90 PID 2644 wrote to memory of 4756 2644 ppvpj.exe 90 PID 2644 wrote to memory of 4756 2644 ppvpj.exe 90 PID 4756 wrote to memory of 3340 4756 rfllfff.exe 91 PID 4756 wrote to memory of 3340 4756 rfllfff.exe 91 PID 4756 wrote to memory of 3340 4756 rfllfff.exe 91 PID 3340 wrote to memory of 1392 3340 jjvvp.exe 92 PID 3340 wrote to memory of 1392 3340 jjvvp.exe 92 PID 3340 wrote to memory of 1392 3340 jjvvp.exe 92 PID 1392 wrote to memory of 3024 1392 1bnhbh.exe 93 PID 1392 wrote to memory of 3024 1392 1bnhbh.exe 93 PID 1392 wrote to memory of 3024 1392 1bnhbh.exe 93 PID 3024 wrote to memory of 2180 3024 pjjdv.exe 94 PID 3024 wrote to memory of 2180 3024 pjjdv.exe 94 PID 3024 wrote to memory of 2180 3024 pjjdv.exe 94 PID 2180 wrote to memory of 4792 2180 hbnhnn.exe 95 PID 2180 wrote to memory of 4792 2180 hbnhnn.exe 95 PID 2180 wrote to memory of 4792 2180 hbnhnn.exe 95 PID 4792 wrote to memory of 3048 4792 lrrlfff.exe 96 PID 4792 wrote to memory of 3048 4792 lrrlfff.exe 96 PID 4792 wrote to memory of 3048 4792 lrrlfff.exe 96 PID 3048 wrote to memory of 3084 3048 fxlrrxx.exe 97 PID 3048 wrote to memory of 3084 3048 fxlrrxx.exe 97 PID 3048 wrote to memory of 3084 3048 fxlrrxx.exe 97 PID 3084 wrote to memory of 2544 3084 9btnhh.exe 98 PID 3084 wrote to memory of 2544 3084 9btnhh.exe 98 PID 3084 wrote to memory of 2544 3084 9btnhh.exe 98 PID 2544 wrote to memory of 3000 2544 vjvpp.exe 99 PID 2544 wrote to memory of 3000 2544 vjvpp.exe 99 PID 2544 wrote to memory of 3000 2544 vjvpp.exe 99 PID 3000 wrote to memory of 3280 3000 pvjdv.exe 100 PID 3000 wrote to memory of 3280 3000 pvjdv.exe 100 PID 3000 wrote to memory of 3280 3000 pvjdv.exe 100 PID 3280 wrote to memory of 4072 3280 fxffxfx.exe 101 PID 3280 wrote to memory of 4072 3280 fxffxfx.exe 101 PID 3280 wrote to memory of 4072 3280 fxffxfx.exe 101 PID 4072 wrote to memory of 3120 4072 dpvpp.exe 102 PID 4072 wrote to memory of 3120 4072 dpvpp.exe 102 PID 4072 wrote to memory of 3120 4072 dpvpp.exe 102 PID 3120 wrote to memory of 4024 3120 tbnnnb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe"C:\Users\Admin\AppData\Local\Temp\07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\nhhbtt.exec:\nhhbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\ddpjv.exec:\ddpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\1jjdj.exec:\1jjdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\rflfxxr.exec:\rflfxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\thnbnn.exec:\thnbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\vppjd.exec:\vppjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\dvdvj.exec:\dvdvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\ppvpj.exec:\ppvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\rfllfff.exec:\rfllfff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\jjvvp.exec:\jjvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\1bnhbh.exec:\1bnhbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\pjjdv.exec:\pjjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\hbnhnn.exec:\hbnhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\lrrlfff.exec:\lrrlfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\fxlrrxx.exec:\fxlrrxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\9btnhh.exec:\9btnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\vjvpp.exec:\vjvpp.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\pvjdv.exec:\pvjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\fxffxfx.exec:\fxffxfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\dpvpp.exec:\dpvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\tbnnnb.exec:\tbnnnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\vpjvp.exec:\vpjvp.exe23⤵
- Executes dropped EXE
PID:4024 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe24⤵
- Executes dropped EXE
PID:1784 -
\??\c:\pjddj.exec:\pjddj.exe25⤵
- Executes dropped EXE
PID:1492 -
\??\c:\lxflffr.exec:\lxflffr.exe26⤵
- Executes dropped EXE
PID:4844 -
\??\c:\vvjjp.exec:\vvjjp.exe27⤵
- Executes dropped EXE
PID:1720 -
\??\c:\rlrllrr.exec:\rlrllrr.exe28⤵
- Executes dropped EXE
PID:1196 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe29⤵
- Executes dropped EXE
PID:1052 -
\??\c:\tntttb.exec:\tntttb.exe30⤵
- Executes dropped EXE
PID:1200 -
\??\c:\llxfflr.exec:\llxfflr.exe31⤵
- Executes dropped EXE
PID:2808 -
\??\c:\pppjj.exec:\pppjj.exe32⤵
- Executes dropped EXE
PID:2668 -
\??\c:\hhnttb.exec:\hhnttb.exe33⤵
- Executes dropped EXE
PID:4980 -
\??\c:\djvdd.exec:\djvdd.exe34⤵
- Executes dropped EXE
PID:936 -
\??\c:\rrllrrf.exec:\rrllrrf.exe35⤵
- Executes dropped EXE
PID:4940 -
\??\c:\tbbhhn.exec:\tbbhhn.exe36⤵
- Executes dropped EXE
PID:5004 -
\??\c:\vpjdp.exec:\vpjdp.exe37⤵
- Executes dropped EXE
PID:1092 -
\??\c:\xrrllff.exec:\xrrllff.exe38⤵
- Executes dropped EXE
PID:2356 -
\??\c:\tnbbhb.exec:\tnbbhb.exe39⤵
- Executes dropped EXE
PID:3540 -
\??\c:\pjvpp.exec:\pjvpp.exe40⤵
- Executes dropped EXE
PID:3276 -
\??\c:\xxxrxxf.exec:\xxxrxxf.exe41⤵
- Executes dropped EXE
PID:1148 -
\??\c:\thhhhh.exec:\thhhhh.exe42⤵
- Executes dropped EXE
PID:4876 -
\??\c:\ntntnt.exec:\ntntnt.exe43⤵
- Executes dropped EXE
PID:3572 -
\??\c:\ddvvp.exec:\ddvvp.exe44⤵
- Executes dropped EXE
PID:3980 -
\??\c:\lxfffll.exec:\lxfffll.exe45⤵
- Executes dropped EXE
PID:224 -
\??\c:\xxffffl.exec:\xxffffl.exe46⤵
- Executes dropped EXE
PID:4452 -
\??\c:\nbhbbb.exec:\nbhbbb.exe47⤵
- Executes dropped EXE
PID:4464 -
\??\c:\3djpv.exec:\3djpv.exe48⤵
- Executes dropped EXE
PID:2452 -
\??\c:\xrfxxll.exec:\xrfxxll.exe49⤵
- Executes dropped EXE
PID:1652 -
\??\c:\nnhnbb.exec:\nnhnbb.exe50⤵
- Executes dropped EXE
PID:2460 -
\??\c:\vpvpj.exec:\vpvpj.exe51⤵
- Executes dropped EXE
PID:4124 -
\??\c:\frfrllf.exec:\frfrllf.exe52⤵
- Executes dropped EXE
PID:3268 -
\??\c:\bnbhtb.exec:\bnbhtb.exe53⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vpjdv.exec:\vpjdv.exe54⤵
- Executes dropped EXE
PID:1800 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe55⤵
- Executes dropped EXE
PID:4312 -
\??\c:\fflllrr.exec:\fflllrr.exe56⤵
- Executes dropped EXE
PID:2484 -
\??\c:\tthntt.exec:\tthntt.exe57⤵
- Executes dropped EXE
PID:1816 -
\??\c:\dpjjp.exec:\dpjjp.exe58⤵
- Executes dropped EXE
PID:2704 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe59⤵
- Executes dropped EXE
PID:1928 -
\??\c:\hhbhnt.exec:\hhbhnt.exe60⤵
- Executes dropped EXE
PID:3324 -
\??\c:\jvppp.exec:\jvppp.exe61⤵
- Executes dropped EXE
PID:1296 -
\??\c:\djjdj.exec:\djjdj.exe62⤵
- Executes dropped EXE
PID:456 -
\??\c:\rxrllrr.exec:\rxrllrr.exe63⤵
- Executes dropped EXE
PID:2056 -
\??\c:\tbhbhn.exec:\tbhbhn.exe64⤵
- Executes dropped EXE
PID:3592 -
\??\c:\pvjpj.exec:\pvjpj.exe65⤵
- Executes dropped EXE
PID:4796 -
\??\c:\rxrrrfr.exec:\rxrrrfr.exe66⤵PID:1868
-
\??\c:\bbbbnt.exec:\bbbbnt.exe67⤵PID:744
-
\??\c:\vvppj.exec:\vvppj.exe68⤵PID:4180
-
\??\c:\vddpp.exec:\vddpp.exe69⤵PID:4168
-
\??\c:\fflllrr.exec:\fflllrr.exe70⤵PID:2860
-
\??\c:\tnbtnt.exec:\tnbtnt.exe71⤵PID:3992
-
\??\c:\bhnttb.exec:\bhnttb.exe72⤵PID:2024
-
\??\c:\ddppp.exec:\ddppp.exe73⤵PID:1464
-
\??\c:\llxxffl.exec:\llxxffl.exe74⤵PID:4368
-
\??\c:\nnhbbh.exec:\nnhbbh.exe75⤵PID:4828
-
\??\c:\dpdpp.exec:\dpdpp.exe76⤵PID:3916
-
\??\c:\xrrlffx.exec:\xrrlffx.exe77⤵PID:4976
-
\??\c:\ppvvp.exec:\ppvvp.exe78⤵PID:1388
-
\??\c:\xxxxxff.exec:\xxxxxff.exe79⤵PID:1784
-
\??\c:\hhbhbn.exec:\hhbhbn.exe80⤵PID:4020
-
\??\c:\bttnhb.exec:\bttnhb.exe81⤵PID:4428
-
\??\c:\pjpjd.exec:\pjpjd.exe82⤵PID:4944
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe83⤵PID:2744
-
\??\c:\fxlfrlx.exec:\fxlfrlx.exe84⤵PID:2728
-
\??\c:\5bhbbb.exec:\5bhbbb.exe85⤵PID:5088
-
\??\c:\5pvvd.exec:\5pvvd.exe86⤵PID:740
-
\??\c:\fxrrllf.exec:\fxrrllf.exe87⤵PID:3644
-
\??\c:\hntnth.exec:\hntnth.exe88⤵PID:2808
-
\??\c:\tbbttn.exec:\tbbttn.exe89⤵PID:968
-
\??\c:\jvdvv.exec:\jvdvv.exe90⤵PID:3140
-
\??\c:\rlrlffx.exec:\rlrlffx.exe91⤵PID:2228
-
\??\c:\fxrlflf.exec:\fxrlflf.exe92⤵PID:1016
-
\??\c:\hhtnhn.exec:\hhtnhn.exe93⤵PID:2584
-
\??\c:\9jjpj.exec:\9jjpj.exe94⤵PID:2720
-
\??\c:\llfxxlx.exec:\llfxxlx.exe95⤵PID:4776
-
\??\c:\bbthhh.exec:\bbthhh.exe96⤵PID:1260
-
\??\c:\pjjjv.exec:\pjjjv.exe97⤵PID:4524
-
\??\c:\jjjdv.exec:\jjjdv.exe98⤵PID:4960
-
\??\c:\nnnhnt.exec:\nnnhnt.exe99⤵PID:1796
-
\??\c:\nbnhhh.exec:\nbnhhh.exe100⤵PID:548
-
\??\c:\frxrrrl.exec:\frxrrrl.exe101⤵PID:2880
-
\??\c:\xlxrllf.exec:\xlxrllf.exe102⤵PID:3572
-
\??\c:\thhbbb.exec:\thhbbb.exe103⤵PID:4336
-
\??\c:\vvjjp.exec:\vvjjp.exe104⤵PID:1732
-
\??\c:\3vpjp.exec:\3vpjp.exe105⤵PID:1736
-
\??\c:\3lllfll.exec:\3lllfll.exe106⤵PID:3700
-
\??\c:\tnhbtt.exec:\tnhbtt.exe107⤵PID:1688
-
\??\c:\jvvdd.exec:\jvvdd.exe108⤵PID:4688
-
\??\c:\vjvdd.exec:\vjvdd.exe109⤵PID:3744
-
\??\c:\rlrrlrl.exec:\rlrrlrl.exe110⤵PID:3772
-
\??\c:\9nhhbh.exec:\9nhhbh.exe111⤵PID:780
-
\??\c:\jdjjd.exec:\jdjjd.exe112⤵PID:3456
-
\??\c:\vdpjp.exec:\vdpjp.exe113⤵PID:3240
-
\??\c:\jvpdv.exec:\jvpdv.exe114⤵PID:1004
-
\??\c:\ddjjv.exec:\ddjjv.exe115⤵PID:2936
-
\??\c:\xfrrrrl.exec:\xfrrrrl.exe116⤵PID:2376
-
\??\c:\nntnnn.exec:\nntnnn.exe117⤵PID:1124
-
\??\c:\ddjdv.exec:\ddjdv.exe118⤵PID:2368
-
\??\c:\lfrxfrx.exec:\lfrxfrx.exe119⤵PID:4756
-
\??\c:\bnnbhb.exec:\bnnbhb.exe120⤵PID:4244
-
\??\c:\7vjdd.exec:\7vjdd.exe121⤵PID:4056
-
\??\c:\fxrxxll.exec:\fxrxxll.exe122⤵PID:812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-