Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 13:54
Behavioral task
behavioral1
Sample
d8a921b02e3ae437d87d99480a731c5f75920eaf7e08935d00e3f3b0cf229025N.exe
Resource
win7-20240729-en
7 signatures
120 seconds
General
-
Target
d8a921b02e3ae437d87d99480a731c5f75920eaf7e08935d00e3f3b0cf229025N.exe
-
Size
66KB
-
MD5
10ffdedd0a9260affc335d14f3c54bf0
-
SHA1
1638b7882a6ed271b09c27adc4876741affe97a5
-
SHA256
d8a921b02e3ae437d87d99480a731c5f75920eaf7e08935d00e3f3b0cf229025
-
SHA512
5ce8f6a59dfe66bd487cffa477c17e7c9d3036d24f5a9bfed7d37c6e79e220cd37b21eca3952bc8f1d2b82e40c05ecf2ccc932045af668331e7a67596c223469
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNlIQldqHIxemlZv:khOmTsF93UYfwC6GIoutpYcvldKIxtbv
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3912-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/788-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3080-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2292-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1012-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4052-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/904-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1984-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4880-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2068-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/676-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1428-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4192-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2828-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4092-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1840-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/528-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2492-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3160-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/536-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1912-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2944-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/660-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2372-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3568-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4052-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3512-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2768-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4192-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1636-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3684-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1552-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/632-475-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1228-490-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-497-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-550-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-578-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3544-585-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-628-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1160-722-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-726-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/760-760-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3392-861-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4356 3nhbbb.exe 4804 bbtnbn.exe 788 lxfrrrl.exe 3080 5flrrxx.exe 2292 tnhbtt.exe 1012 vvvvj.exe 4052 nbhtnh.exe 904 3vjdj.exe 1632 pvdvd.exe 1984 3lxxffx.exe 2596 hbnnnn.exe 4736 ppvvv.exe 4880 1ffrrxx.exe 1320 tthhhn.exe 2068 ppdjj.exe 5012 ffflrrl.exe 676 lxxfxfl.exe 1428 tnnnhh.exe 5116 vjpjd.exe 4192 xrrrflf.exe 2088 btttnn.exe 2828 fffxxff.exe 4092 bnhbhh.exe 1840 pdjpd.exe 5028 lllrlrf.exe 528 jdddd.exe 2664 dvjdv.exe 4496 llxrxlf.exe 2492 tnnhhn.exe 4956 jjddj.exe 3156 hhhhhh.exe 3160 djvdv.exe 1860 7xxrxxf.exe 3208 bhtbtn.exe 5044 dpppp.exe 536 rflffxx.exe 1912 lrlrlll.exe 1768 5tthhh.exe 2976 lxllrxx.exe 5000 nhnhhh.exe 2944 vpdpp.exe 4424 ffffxff.exe 4320 3bhnhh.exe 3556 bhnntt.exe 3548 jjdpp.exe 2872 fxlrfrx.exe 4696 nhbbhb.exe 660 pjppd.exe 2372 hbttnn.exe 3780 9tbbnb.exe 1680 jdppp.exe 3568 rflrrll.exe 4940 tbbbbb.exe 4052 pvddj.exe 1544 vjdjj.exe 1020 llrrxxx.exe 1560 7lfffff.exe 3724 nnhhnn.exe 3700 dvvvp.exe 2044 dvppj.exe 4644 nbtnhh.exe 3512 nbttnb.exe 3096 1jddp.exe 2324 pjvvv.exe -
resource yara_rule behavioral2/memory/3912-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b7e-4.dat upx behavioral2/memory/3912-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4356-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b85-10.dat upx behavioral2/files/0x000a000000023b86-12.dat upx behavioral2/memory/788-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4804-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b87-22.dat upx behavioral2/files/0x000a000000023b88-26.dat upx behavioral2/memory/3080-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b89-32.dat upx behavioral2/memory/2292-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8a-38.dat upx behavioral2/memory/1012-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4052-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8b-44.dat upx behavioral2/files/0x000a000000023b8c-50.dat upx behavioral2/memory/904-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8d-55.dat upx behavioral2/memory/1984-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8e-62.dat upx behavioral2/files/0x000a000000023b8f-66.dat upx behavioral2/files/0x000a000000023b90-71.dat upx behavioral2/memory/4736-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b91-77.dat upx behavioral2/memory/4880-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b92-83.dat upx behavioral2/files/0x000a000000023b93-88.dat upx behavioral2/memory/2068-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5012-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b94-96.dat upx behavioral2/files/0x000a000000023b95-100.dat upx behavioral2/memory/676-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1428-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b96-108.dat upx behavioral2/memory/5116-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b97-113.dat upx behavioral2/memory/4192-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b98-118.dat upx behavioral2/files/0x000a000000023b99-125.dat upx behavioral2/memory/2088-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b82-133.dat upx behavioral2/memory/2828-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b9b-136.dat upx behavioral2/memory/4092-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1840-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b9c-144.dat upx behavioral2/files/0x000a000000023ba4-150.dat upx behavioral2/memory/528-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000e000000023bab-156.dat upx behavioral2/memory/2664-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bb4-160.dat upx behavioral2/files/0x0009000000023bb9-165.dat upx behavioral2/files/0x0009000000023bba-170.dat upx behavioral2/memory/2492-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023bbb-176.dat upx behavioral2/files/0x000e000000023bbf-181.dat upx behavioral2/memory/3160-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3208-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5044-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/536-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1912-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1768-210-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhbbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3912 wrote to memory of 4356 3912 d8a921b02e3ae437d87d99480a731c5f75920eaf7e08935d00e3f3b0cf229025N.exe 83 PID 3912 wrote to memory of 4356 3912 d8a921b02e3ae437d87d99480a731c5f75920eaf7e08935d00e3f3b0cf229025N.exe 83 PID 3912 wrote to memory of 4356 3912 d8a921b02e3ae437d87d99480a731c5f75920eaf7e08935d00e3f3b0cf229025N.exe 83 PID 4356 wrote to memory of 4804 4356 3nhbbb.exe 84 PID 4356 wrote to memory of 4804 4356 3nhbbb.exe 84 PID 4356 wrote to memory of 4804 4356 3nhbbb.exe 84 PID 4804 wrote to memory of 788 4804 bbtnbn.exe 85 PID 4804 wrote to memory of 788 4804 bbtnbn.exe 85 PID 4804 wrote to memory of 788 4804 bbtnbn.exe 85 PID 788 wrote to memory of 3080 788 lxfrrrl.exe 86 PID 788 wrote to memory of 3080 788 lxfrrrl.exe 86 PID 788 wrote to memory of 3080 788 lxfrrrl.exe 86 PID 3080 wrote to memory of 2292 3080 5flrrxx.exe 87 PID 3080 wrote to memory of 2292 3080 5flrrxx.exe 87 PID 3080 wrote to memory of 2292 3080 5flrrxx.exe 87 PID 2292 wrote to memory of 1012 2292 tnhbtt.exe 88 PID 2292 wrote to memory of 1012 2292 tnhbtt.exe 88 PID 2292 wrote to memory of 1012 2292 tnhbtt.exe 88 PID 1012 wrote to memory of 4052 1012 vvvvj.exe 89 PID 1012 wrote to memory of 4052 1012 vvvvj.exe 89 PID 1012 wrote to memory of 4052 1012 vvvvj.exe 89 PID 4052 wrote to memory of 904 4052 nbhtnh.exe 90 PID 4052 wrote to memory of 904 4052 nbhtnh.exe 90 PID 4052 wrote to memory of 904 4052 nbhtnh.exe 90 PID 904 wrote to memory of 1632 904 3vjdj.exe 91 PID 904 wrote to memory of 1632 904 3vjdj.exe 91 PID 904 wrote to memory of 1632 904 3vjdj.exe 91 PID 1632 wrote to memory of 1984 1632 pvdvd.exe 92 PID 1632 wrote to memory of 1984 1632 pvdvd.exe 92 PID 1632 wrote to memory of 1984 1632 pvdvd.exe 92 PID 1984 wrote to memory of 2596 1984 3lxxffx.exe 93 PID 1984 wrote to memory of 2596 1984 3lxxffx.exe 93 PID 1984 wrote to memory of 2596 1984 3lxxffx.exe 93 PID 2596 wrote to memory of 4736 2596 hbnnnn.exe 94 PID 2596 wrote to memory of 4736 2596 hbnnnn.exe 94 PID 2596 wrote to memory of 4736 2596 hbnnnn.exe 94 PID 4736 wrote to memory of 4880 4736 ppvvv.exe 95 PID 4736 wrote to memory of 4880 4736 ppvvv.exe 95 PID 4736 wrote to memory of 4880 4736 ppvvv.exe 95 PID 4880 wrote to memory of 1320 4880 1ffrrxx.exe 96 PID 4880 wrote to memory of 1320 4880 1ffrrxx.exe 96 PID 4880 wrote to memory of 1320 4880 1ffrrxx.exe 96 PID 1320 wrote to memory of 2068 1320 tthhhn.exe 97 PID 1320 wrote to memory of 2068 1320 tthhhn.exe 97 PID 1320 wrote to memory of 2068 1320 tthhhn.exe 97 PID 2068 wrote to memory of 5012 2068 ppdjj.exe 98 PID 2068 wrote to memory of 5012 2068 ppdjj.exe 98 PID 2068 wrote to memory of 5012 2068 ppdjj.exe 98 PID 5012 wrote to memory of 676 5012 ffflrrl.exe 99 PID 5012 wrote to memory of 676 5012 ffflrrl.exe 99 PID 5012 wrote to memory of 676 5012 ffflrrl.exe 99 PID 676 wrote to memory of 1428 676 lxxfxfl.exe 100 PID 676 wrote to memory of 1428 676 lxxfxfl.exe 100 PID 676 wrote to memory of 1428 676 lxxfxfl.exe 100 PID 1428 wrote to memory of 5116 1428 tnnnhh.exe 101 PID 1428 wrote to memory of 5116 1428 tnnnhh.exe 101 PID 1428 wrote to memory of 5116 1428 tnnnhh.exe 101 PID 5116 wrote to memory of 4192 5116 vjpjd.exe 102 PID 5116 wrote to memory of 4192 5116 vjpjd.exe 102 PID 5116 wrote to memory of 4192 5116 vjpjd.exe 102 PID 4192 wrote to memory of 2088 4192 xrrrflf.exe 103 PID 4192 wrote to memory of 2088 4192 xrrrflf.exe 103 PID 4192 wrote to memory of 2088 4192 xrrrflf.exe 103 PID 2088 wrote to memory of 2828 2088 btttnn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8a921b02e3ae437d87d99480a731c5f75920eaf7e08935d00e3f3b0cf229025N.exe"C:\Users\Admin\AppData\Local\Temp\d8a921b02e3ae437d87d99480a731c5f75920eaf7e08935d00e3f3b0cf229025N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\3nhbbb.exec:\3nhbbb.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\bbtnbn.exec:\bbtnbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\lxfrrrl.exec:\lxfrrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\5flrrxx.exec:\5flrrxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\tnhbtt.exec:\tnhbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\vvvvj.exec:\vvvvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\nbhtnh.exec:\nbhtnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\3vjdj.exec:\3vjdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
\??\c:\pvdvd.exec:\pvdvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\3lxxffx.exec:\3lxxffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\hbnnnn.exec:\hbnnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\ppvvv.exec:\ppvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\1ffrrxx.exec:\1ffrrxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\tthhhn.exec:\tthhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\ppdjj.exec:\ppdjj.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\ffflrrl.exec:\ffflrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\lxxfxfl.exec:\lxxfxfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\tnnnhh.exec:\tnnnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\vjpjd.exec:\vjpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\xrrrflf.exec:\xrrrflf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\btttnn.exec:\btttnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\fffxxff.exec:\fffxxff.exe23⤵
- Executes dropped EXE
PID:2828 -
\??\c:\bnhbhh.exec:\bnhbhh.exe24⤵
- Executes dropped EXE
PID:4092 -
\??\c:\pdjpd.exec:\pdjpd.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1840 -
\??\c:\lllrlrf.exec:\lllrlrf.exe26⤵
- Executes dropped EXE
PID:5028 -
\??\c:\jdddd.exec:\jdddd.exe27⤵
- Executes dropped EXE
PID:528 -
\??\c:\dvjdv.exec:\dvjdv.exe28⤵
- Executes dropped EXE
PID:2664 -
\??\c:\llxrxlf.exec:\llxrxlf.exe29⤵
- Executes dropped EXE
PID:4496 -
\??\c:\tnnhhn.exec:\tnnhhn.exe30⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jjddj.exec:\jjddj.exe31⤵
- Executes dropped EXE
PID:4956 -
\??\c:\hhhhhh.exec:\hhhhhh.exe32⤵
- Executes dropped EXE
PID:3156 -
\??\c:\djvdv.exec:\djvdv.exe33⤵
- Executes dropped EXE
PID:3160 -
\??\c:\7xxrxxf.exec:\7xxrxxf.exe34⤵
- Executes dropped EXE
PID:1860 -
\??\c:\bhtbtn.exec:\bhtbtn.exe35⤵
- Executes dropped EXE
PID:3208 -
\??\c:\dpppp.exec:\dpppp.exe36⤵
- Executes dropped EXE
PID:5044 -
\??\c:\rflffxx.exec:\rflffxx.exe37⤵
- Executes dropped EXE
PID:536 -
\??\c:\lrlrlll.exec:\lrlrlll.exe38⤵
- Executes dropped EXE
PID:1912 -
\??\c:\5tthhh.exec:\5tthhh.exe39⤵
- Executes dropped EXE
PID:1768 -
\??\c:\lxllrxx.exec:\lxllrxx.exe40⤵
- Executes dropped EXE
PID:2976 -
\??\c:\nhnhhh.exec:\nhnhhh.exe41⤵
- Executes dropped EXE
PID:5000 -
\??\c:\vpdpp.exec:\vpdpp.exe42⤵
- Executes dropped EXE
PID:2944 -
\??\c:\ffffxff.exec:\ffffxff.exe43⤵
- Executes dropped EXE
PID:4424 -
\??\c:\3bhnhh.exec:\3bhnhh.exe44⤵
- Executes dropped EXE
PID:4320 -
\??\c:\bhnntt.exec:\bhnntt.exe45⤵
- Executes dropped EXE
PID:3556 -
\??\c:\jjdpp.exec:\jjdpp.exe46⤵
- Executes dropped EXE
PID:3548 -
\??\c:\fxlrfrx.exec:\fxlrfrx.exe47⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nhbbhb.exec:\nhbbhb.exe48⤵
- Executes dropped EXE
PID:4696 -
\??\c:\pjppd.exec:\pjppd.exe49⤵
- Executes dropped EXE
PID:660 -
\??\c:\hbttnn.exec:\hbttnn.exe50⤵
- Executes dropped EXE
PID:2372 -
\??\c:\9tbbnb.exec:\9tbbnb.exe51⤵
- Executes dropped EXE
PID:3780 -
\??\c:\jdppp.exec:\jdppp.exe52⤵
- Executes dropped EXE
PID:1680 -
\??\c:\rflrrll.exec:\rflrrll.exe53⤵
- Executes dropped EXE
PID:3568 -
\??\c:\tbbbbb.exec:\tbbbbb.exe54⤵
- Executes dropped EXE
PID:4940 -
\??\c:\pvddj.exec:\pvddj.exe55⤵
- Executes dropped EXE
PID:4052 -
\??\c:\vjdjj.exec:\vjdjj.exe56⤵
- Executes dropped EXE
PID:1544 -
\??\c:\llrrxxx.exec:\llrrxxx.exe57⤵
- Executes dropped EXE
PID:1020 -
\??\c:\7lfffff.exec:\7lfffff.exe58⤵
- Executes dropped EXE
PID:1560 -
\??\c:\nnhhnn.exec:\nnhhnn.exe59⤵
- Executes dropped EXE
PID:3724 -
\??\c:\dvvvp.exec:\dvvvp.exe60⤵
- Executes dropped EXE
PID:3700 -
\??\c:\dvppj.exec:\dvppj.exe61⤵
- Executes dropped EXE
PID:2044 -
\??\c:\nbtnhh.exec:\nbtnhh.exe62⤵
- Executes dropped EXE
PID:4644 -
\??\c:\nbttnb.exec:\nbttnb.exe63⤵
- Executes dropped EXE
PID:3512 -
\??\c:\1jddp.exec:\1jddp.exe64⤵
- Executes dropped EXE
PID:3096 -
\??\c:\pjvvv.exec:\pjvvv.exe65⤵
- Executes dropped EXE
PID:2324 -
\??\c:\3xxxlll.exec:\3xxxlll.exe66⤵PID:4072
-
\??\c:\bhtbnn.exec:\bhtbnn.exe67⤵PID:708
-
\??\c:\tnbtbn.exec:\tnbtbn.exe68⤵PID:3980
-
\??\c:\ddjdp.exec:\ddjdp.exe69⤵PID:2840
-
\??\c:\3xxrlll.exec:\3xxrlll.exe70⤵PID:4532
-
\??\c:\btbbbb.exec:\btbbbb.exe71⤵PID:2768
-
\??\c:\9dddp.exec:\9dddp.exe72⤵PID:3984
-
\??\c:\xlfxxrl.exec:\xlfxxrl.exe73⤵PID:4192
-
\??\c:\nhttbb.exec:\nhttbb.exe74⤵PID:1636
-
\??\c:\tbthbb.exec:\tbthbb.exe75⤵PID:4976
-
\??\c:\vvvpj.exec:\vvvpj.exe76⤵PID:3280
-
\??\c:\rrllrlr.exec:\rrllrlr.exe77⤵PID:3348
-
\??\c:\hbhthn.exec:\hbhthn.exe78⤵PID:5020
-
\??\c:\vjvvp.exec:\vjvvp.exe79⤵PID:1716
-
\??\c:\btnhbb.exec:\btnhbb.exe80⤵PID:2584
-
\??\c:\vdddd.exec:\vdddd.exe81⤵PID:3444
-
\??\c:\ddvvd.exec:\ddvvd.exe82⤵PID:852
-
\??\c:\rlffxxx.exec:\rlffxxx.exe83⤵PID:3712
-
\??\c:\nhbbhh.exec:\nhbbhh.exe84⤵PID:4576
-
\??\c:\djppj.exec:\djppj.exe85⤵PID:2636
-
\??\c:\fflllll.exec:\fflllll.exe86⤵PID:2736
-
\??\c:\rrxlrxf.exec:\rrxlrxf.exe87⤵PID:3612
-
\??\c:\btbtnb.exec:\btbtnb.exe88⤵PID:3684
-
\??\c:\pdjpd.exec:\pdjpd.exe89⤵PID:4556
-
\??\c:\9djdp.exec:\9djdp.exe90⤵PID:1552
-
\??\c:\xrrrlrr.exec:\xrrrlrr.exe91⤵PID:3064
-
\??\c:\btbnnn.exec:\btbnnn.exe92⤵PID:536
-
\??\c:\3tthnh.exec:\3tthnh.exe93⤵PID:4188
-
\??\c:\jjpdp.exec:\jjpdp.exe94⤵PID:1768
-
\??\c:\rxlllrr.exec:\rxlllrr.exe95⤵PID:1184
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe96⤵PID:4460
-
\??\c:\tbbbnn.exec:\tbbbnn.exe97⤵PID:2236
-
\??\c:\pvdjp.exec:\pvdjp.exe98⤵PID:4316
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe99⤵
- System Location Discovery: System Language Discovery
PID:4376 -
\??\c:\bbbbtb.exec:\bbbbtb.exe100⤵PID:4652
-
\??\c:\9bhhhn.exec:\9bhhhn.exe101⤵PID:4904
-
\??\c:\vppjd.exec:\vppjd.exe102⤵PID:2032
-
\??\c:\vdjdv.exec:\vdjdv.exe103⤵PID:2980
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe104⤵PID:460
-
\??\c:\nnttnn.exec:\nnttnn.exe105⤵PID:3080
-
\??\c:\bhbnbb.exec:\bhbnbb.exe106⤵PID:3500
-
\??\c:\9jjjp.exec:\9jjjp.exe107⤵PID:4836
-
\??\c:\llxrrlf.exec:\llxrrlf.exe108⤵PID:2468
-
\??\c:\lfrffrx.exec:\lfrffrx.exe109⤵PID:3380
-
\??\c:\hnnbtb.exec:\hnnbtb.exe110⤵PID:4052
-
\??\c:\pjvvd.exec:\pjvvd.exe111⤵PID:1984
-
\??\c:\rxlxfrl.exec:\rxlxfrl.exe112⤵PID:4704
-
\??\c:\flfflll.exec:\flfflll.exe113⤵PID:2968
-
\??\c:\hhnhhn.exec:\hhnhhn.exe114⤵PID:2596
-
\??\c:\bbtnnn.exec:\bbtnnn.exe115⤵PID:3596
-
\??\c:\pvpdp.exec:\pvpdp.exe116⤵PID:1612
-
\??\c:\5fffrrl.exec:\5fffrrl.exe117⤵PID:956
-
\??\c:\fxlflll.exec:\fxlflll.exe118⤵PID:1172
-
\??\c:\9hhbbb.exec:\9hhbbb.exe119⤵PID:1208
-
\??\c:\9vvvj.exec:\9vvvj.exe120⤵PID:632
-
\??\c:\pvpdj.exec:\pvpdj.exe121⤵PID:2012
-
\??\c:\frffrrx.exec:\frffrrx.exe122⤵PID:2768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-