Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2024 18:17
Behavioral task
behavioral1
Sample
ffb15e1ab75eb739ab968f5a6fe5c10c5ff32b37679449314342e1becd2cff54.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
General
-
Target
ffb15e1ab75eb739ab968f5a6fe5c10c5ff32b37679449314342e1becd2cff54.exe
-
Size
3.7MB
-
MD5
42bb15c291efb67575c921348bdc442f
-
SHA1
c31d54b949677456e34f1a17161019dffd08546a
-
SHA256
ffb15e1ab75eb739ab968f5a6fe5c10c5ff32b37679449314342e1becd2cff54
-
SHA512
5bd269f0706b783b809e41d2621d871372da67a3f1726770255f47b236d5c2ef407171d1b06dae828cc83e5497718357c8e97eeb2597817806c47146d6d33468
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF985:U6XLq/qPPslzKx/dJg1ErmNy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2360-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3200-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1812-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5072-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1476-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4680-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3092-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4648-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3840-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4220-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1824-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4980-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/636-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4588-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2148-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/468-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2688-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1984-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/668-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2500-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/536-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1960-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2412-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/348-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1752-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1544-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3660-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3144-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/388-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/896-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/228-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4120-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-561-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-598-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-614-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2200-624-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-628-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1188-770-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-810-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-838-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4228-848-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-1147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-1151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 3200 nnthbt.exe 1812 hbbttt.exe 5072 bntnbh.exe 1844 fxrlxrl.exe 1476 vvjjd.exe 3352 jpdvp.exe 4680 5vdvj.exe 3436 3pdpj.exe 5100 pdpjv.exe 3092 3jvvv.exe 4688 xflllff.exe 4436 fffxllf.exe 4648 fxlxrfx.exe 3840 rrrlllf.exe 4220 vpddp.exe 4720 nbbthb.exe 2692 nnbbnb.exe 3064 bhnbnh.exe 1824 vppjv.exe 636 rfxrfxr.exe 4980 bntnbt.exe 4876 1lrllff.exe 5044 rrxrlfx.exe 4588 thtnbn.exe 936 3rxrllf.exe 2148 pddvp.exe 2688 vjpjd.exe 468 lxrrxxl.exe 3208 9frlfff.exe 372 bbhhnh.exe 1984 pjjdv.exe 4944 vddvv.exe 4856 dvddv.exe 3552 jdpjd.exe 1180 9bhbtt.exe 1068 ttttnn.exe 3216 thtnnn.exe 4988 ttthhh.exe 4740 thhbtt.exe 4984 hnbtnn.exe 1964 nbnhhb.exe 1844 ffxrrlr.exe 668 llxxxxf.exe 4216 xlfffxf.exe 3352 7frlffx.exe 2500 ddpjd.exe 3696 jpjdp.exe 2368 ppvpv.exe 4928 pdvpd.exe 1908 tbhhbh.exe 5064 nnnbbn.exe 244 1hhthb.exe 536 nttnbt.exe 4924 bthhnn.exe 456 nnbbnh.exe 3312 frfrrrf.exe 4060 5ffxrlr.exe 4220 lflflfr.exe 1960 5flxxxl.exe 1352 3vjvj.exe 2412 pdpjd.exe 3412 nntnhh.exe 3960 nbnhnh.exe 5044 hnbnhh.exe -
resource yara_rule behavioral2/memory/2360-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023cbc-3.dat upx behavioral2/memory/2360-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc0-9.dat upx behavioral2/memory/3200-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc2-13.dat upx behavioral2/memory/1812-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5072-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023cbd-23.dat upx behavioral2/files/0x0007000000023cc3-27.dat upx behavioral2/memory/1844-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc4-33.dat upx behavioral2/memory/1476-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc5-39.dat upx behavioral2/memory/3352-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4680-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc6-45.dat upx behavioral2/files/0x0007000000023cc7-50.dat upx behavioral2/memory/3436-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc8-57.dat upx behavioral2/memory/5100-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc9-63.dat upx behavioral2/memory/3092-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cca-70.dat upx behavioral2/memory/4688-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccb-75.dat upx behavioral2/memory/4436-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4648-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccc-83.dat upx behavioral2/files/0x0007000000023ccd-88.dat upx behavioral2/memory/4220-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3840-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000300000001e767-94.dat upx behavioral2/memory/4220-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccf-101.dat upx behavioral2/memory/2692-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4720-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd1-107.dat upx behavioral2/files/0x0007000000023cd2-112.dat upx behavioral2/memory/3064-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1824-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd3-117.dat upx behavioral2/files/0x0007000000023cd4-124.dat upx behavioral2/files/0x0007000000023cd5-130.dat upx behavioral2/memory/4876-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4980-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/636-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd6-136.dat upx behavioral2/files/0x0007000000023cd7-142.dat upx behavioral2/files/0x0007000000023cd8-146.dat upx behavioral2/memory/4588-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cda-152.dat upx behavioral2/memory/2148-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cdb-158.dat upx behavioral2/files/0x0007000000023cdc-163.dat upx behavioral2/memory/468-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2688-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cdd-170.dat upx behavioral2/files/0x0007000000023cde-175.dat upx behavioral2/memory/3208-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cdf-183.dat upx behavioral2/memory/1984-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce0-186.dat upx behavioral2/memory/3216-209-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfrlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rllllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lflffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfrrlx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 3200 2360 ffb15e1ab75eb739ab968f5a6fe5c10c5ff32b37679449314342e1becd2cff54.exe 83 PID 2360 wrote to memory of 3200 2360 ffb15e1ab75eb739ab968f5a6fe5c10c5ff32b37679449314342e1becd2cff54.exe 83 PID 2360 wrote to memory of 3200 2360 ffb15e1ab75eb739ab968f5a6fe5c10c5ff32b37679449314342e1becd2cff54.exe 83 PID 3200 wrote to memory of 1812 3200 nnthbt.exe 84 PID 3200 wrote to memory of 1812 3200 nnthbt.exe 84 PID 3200 wrote to memory of 1812 3200 nnthbt.exe 84 PID 1812 wrote to memory of 5072 1812 hbbttt.exe 85 PID 1812 wrote to memory of 5072 1812 hbbttt.exe 85 PID 1812 wrote to memory of 5072 1812 hbbttt.exe 85 PID 5072 wrote to memory of 1844 5072 bntnbh.exe 86 PID 5072 wrote to memory of 1844 5072 bntnbh.exe 86 PID 5072 wrote to memory of 1844 5072 bntnbh.exe 86 PID 1844 wrote to memory of 1476 1844 fxrlxrl.exe 87 PID 1844 wrote to memory of 1476 1844 fxrlxrl.exe 87 PID 1844 wrote to memory of 1476 1844 fxrlxrl.exe 87 PID 1476 wrote to memory of 3352 1476 vvjjd.exe 88 PID 1476 wrote to memory of 3352 1476 vvjjd.exe 88 PID 1476 wrote to memory of 3352 1476 vvjjd.exe 88 PID 3352 wrote to memory of 4680 3352 jpdvp.exe 89 PID 3352 wrote to memory of 4680 3352 jpdvp.exe 89 PID 3352 wrote to memory of 4680 3352 jpdvp.exe 89 PID 4680 wrote to memory of 3436 4680 5vdvj.exe 90 PID 4680 wrote to memory of 3436 4680 5vdvj.exe 90 PID 4680 wrote to memory of 3436 4680 5vdvj.exe 90 PID 3436 wrote to memory of 5100 3436 3pdpj.exe 91 PID 3436 wrote to memory of 5100 3436 3pdpj.exe 91 PID 3436 wrote to memory of 5100 3436 3pdpj.exe 91 PID 5100 wrote to memory of 3092 5100 pdpjv.exe 92 PID 5100 wrote to memory of 3092 5100 pdpjv.exe 92 PID 5100 wrote to memory of 3092 5100 pdpjv.exe 92 PID 3092 wrote to memory of 4688 3092 3jvvv.exe 93 PID 3092 wrote to memory of 4688 3092 3jvvv.exe 93 PID 3092 wrote to memory of 4688 3092 3jvvv.exe 93 PID 4688 wrote to memory of 4436 4688 xflllff.exe 94 PID 4688 wrote to memory of 4436 4688 xflllff.exe 94 PID 4688 wrote to memory of 4436 4688 xflllff.exe 94 PID 4436 wrote to memory of 4648 4436 fffxllf.exe 95 PID 4436 wrote to memory of 4648 4436 fffxllf.exe 95 PID 4436 wrote to memory of 4648 4436 fffxllf.exe 95 PID 4648 wrote to memory of 3840 4648 fxlxrfx.exe 96 PID 4648 wrote to memory of 3840 4648 fxlxrfx.exe 96 PID 4648 wrote to memory of 3840 4648 fxlxrfx.exe 96 PID 3840 wrote to memory of 4220 3840 rrrlllf.exe 97 PID 3840 wrote to memory of 4220 3840 rrrlllf.exe 97 PID 3840 wrote to memory of 4220 3840 rrrlllf.exe 97 PID 4220 wrote to memory of 4720 4220 vpddp.exe 98 PID 4220 wrote to memory of 4720 4220 vpddp.exe 98 PID 4220 wrote to memory of 4720 4220 vpddp.exe 98 PID 4720 wrote to memory of 2692 4720 nbbthb.exe 99 PID 4720 wrote to memory of 2692 4720 nbbthb.exe 99 PID 4720 wrote to memory of 2692 4720 nbbthb.exe 99 PID 2692 wrote to memory of 3064 2692 nnbbnb.exe 101 PID 2692 wrote to memory of 3064 2692 nnbbnb.exe 101 PID 2692 wrote to memory of 3064 2692 nnbbnb.exe 101 PID 3064 wrote to memory of 1824 3064 bhnbnh.exe 102 PID 3064 wrote to memory of 1824 3064 bhnbnh.exe 102 PID 3064 wrote to memory of 1824 3064 bhnbnh.exe 102 PID 1824 wrote to memory of 636 1824 vppjv.exe 103 PID 1824 wrote to memory of 636 1824 vppjv.exe 103 PID 1824 wrote to memory of 636 1824 vppjv.exe 103 PID 636 wrote to memory of 4980 636 rfxrfxr.exe 104 PID 636 wrote to memory of 4980 636 rfxrfxr.exe 104 PID 636 wrote to memory of 4980 636 rfxrfxr.exe 104 PID 4980 wrote to memory of 4876 4980 bntnbt.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffb15e1ab75eb739ab968f5a6fe5c10c5ff32b37679449314342e1becd2cff54.exe"C:\Users\Admin\AppData\Local\Temp\ffb15e1ab75eb739ab968f5a6fe5c10c5ff32b37679449314342e1becd2cff54.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\nnthbt.exec:\nnthbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\hbbttt.exec:\hbbttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\bntnbh.exec:\bntnbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\vvjjd.exec:\vvjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\jpdvp.exec:\jpdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\5vdvj.exec:\5vdvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\3pdpj.exec:\3pdpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\pdpjv.exec:\pdpjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\3jvvv.exec:\3jvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\xflllff.exec:\xflllff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\fffxllf.exec:\fffxllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\fxlxrfx.exec:\fxlxrfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\rrrlllf.exec:\rrrlllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\vpddp.exec:\vpddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\nbbthb.exec:\nbbthb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\nnbbnb.exec:\nnbbnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\bhnbnh.exec:\bhnbnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\vppjv.exec:\vppjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\rfxrfxr.exec:\rfxrfxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\bntnbt.exec:\bntnbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\1lrllff.exec:\1lrllff.exe23⤵
- Executes dropped EXE
PID:4876 -
\??\c:\rrxrlfx.exec:\rrxrlfx.exe24⤵
- Executes dropped EXE
PID:5044 -
\??\c:\thtnbn.exec:\thtnbn.exe25⤵
- Executes dropped EXE
PID:4588 -
\??\c:\3rxrllf.exec:\3rxrllf.exe26⤵
- Executes dropped EXE
PID:936 -
\??\c:\pddvp.exec:\pddvp.exe27⤵
- Executes dropped EXE
PID:2148 -
\??\c:\vjpjd.exec:\vjpjd.exe28⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lxrrxxl.exec:\lxrrxxl.exe29⤵
- Executes dropped EXE
PID:468 -
\??\c:\9frlfff.exec:\9frlfff.exe30⤵
- Executes dropped EXE
PID:3208 -
\??\c:\bbhhnh.exec:\bbhhnh.exe31⤵
- Executes dropped EXE
PID:372 -
\??\c:\pjjdv.exec:\pjjdv.exe32⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vddvv.exec:\vddvv.exe33⤵
- Executes dropped EXE
PID:4944 -
\??\c:\dvddv.exec:\dvddv.exe34⤵
- Executes dropped EXE
PID:4856 -
\??\c:\jdpjd.exec:\jdpjd.exe35⤵
- Executes dropped EXE
PID:3552 -
\??\c:\9bhbtt.exec:\9bhbtt.exe36⤵
- Executes dropped EXE
PID:1180 -
\??\c:\nhnhhn.exec:\nhnhhn.exe37⤵PID:4652
-
\??\c:\ttttnn.exec:\ttttnn.exe38⤵
- Executes dropped EXE
PID:1068 -
\??\c:\thtnnn.exec:\thtnnn.exe39⤵
- Executes dropped EXE
PID:3216 -
\??\c:\ttthhh.exec:\ttthhh.exe40⤵
- Executes dropped EXE
PID:4988 -
\??\c:\thhbtt.exec:\thhbtt.exe41⤵
- Executes dropped EXE
PID:4740 -
\??\c:\hnbtnn.exec:\hnbtnn.exe42⤵
- Executes dropped EXE
PID:4984 -
\??\c:\nbnhhb.exec:\nbnhhb.exe43⤵
- Executes dropped EXE
PID:1964 -
\??\c:\ffxrrlr.exec:\ffxrrlr.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1844 -
\??\c:\llxxxxf.exec:\llxxxxf.exe45⤵
- Executes dropped EXE
PID:668 -
\??\c:\xlfffxf.exec:\xlfffxf.exe46⤵
- Executes dropped EXE
PID:4216 -
\??\c:\7frlffx.exec:\7frlffx.exe47⤵
- Executes dropped EXE
PID:3352 -
\??\c:\ddpjd.exec:\ddpjd.exe48⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jpjdp.exec:\jpjdp.exe49⤵
- Executes dropped EXE
PID:3696 -
\??\c:\ppvpv.exec:\ppvpv.exe50⤵
- Executes dropped EXE
PID:2368 -
\??\c:\pdvpd.exec:\pdvpd.exe51⤵
- Executes dropped EXE
PID:4928 -
\??\c:\tbhhbh.exec:\tbhhbh.exe52⤵
- Executes dropped EXE
PID:1908 -
\??\c:\nnnbbn.exec:\nnnbbn.exe53⤵
- Executes dropped EXE
PID:5064 -
\??\c:\1hhthb.exec:\1hhthb.exe54⤵
- Executes dropped EXE
PID:244 -
\??\c:\nttnbt.exec:\nttnbt.exe55⤵
- Executes dropped EXE
PID:536 -
\??\c:\bthhnn.exec:\bthhnn.exe56⤵
- Executes dropped EXE
PID:4924 -
\??\c:\nnbbnh.exec:\nnbbnh.exe57⤵
- Executes dropped EXE
PID:456 -
\??\c:\frfrrrf.exec:\frfrrrf.exe58⤵
- Executes dropped EXE
PID:3312 -
\??\c:\5ffxrlr.exec:\5ffxrlr.exe59⤵
- Executes dropped EXE
PID:4060 -
\??\c:\lflflfr.exec:\lflflfr.exe60⤵
- Executes dropped EXE
PID:4220 -
\??\c:\5flxxxl.exec:\5flxxxl.exe61⤵
- Executes dropped EXE
PID:1960 -
\??\c:\3vjvj.exec:\3vjvj.exe62⤵
- Executes dropped EXE
PID:1352 -
\??\c:\pdpjd.exec:\pdpjd.exe63⤵
- Executes dropped EXE
PID:2412 -
\??\c:\nntnhh.exec:\nntnhh.exe64⤵
- Executes dropped EXE
PID:3412 -
\??\c:\nbnhnh.exec:\nbnhnh.exe65⤵
- Executes dropped EXE
PID:3960 -
\??\c:\hnbnhh.exec:\hnbnhh.exe66⤵
- Executes dropped EXE
PID:5044 -
\??\c:\3bhbnh.exec:\3bhbnh.exe67⤵PID:4700
-
\??\c:\bntnbb.exec:\bntnbb.exe68⤵PID:5012
-
\??\c:\lffffxr.exec:\lffffxr.exe69⤵PID:348
-
\??\c:\xxrrlff.exec:\xxrrlff.exe70⤵PID:2124
-
\??\c:\xrllfrr.exec:\xrllfrr.exe71⤵PID:1752
-
\??\c:\pjjdd.exec:\pjjdd.exe72⤵PID:1544
-
\??\c:\jppjd.exec:\jppjd.exe73⤵
- System Location Discovery: System Language Discovery
PID:5028 -
\??\c:\jvdvp.exec:\jvdvp.exe74⤵PID:2888
-
\??\c:\5jjjd.exec:\5jjjd.exe75⤵PID:2764
-
\??\c:\jjdvp.exec:\jjdvp.exe76⤵PID:3660
-
\??\c:\nntnnn.exec:\nntnnn.exe77⤵PID:1432
-
\??\c:\nhnnnt.exec:\nhnnnt.exe78⤵PID:388
-
\??\c:\thhnbt.exec:\thhnbt.exe79⤵PID:1984
-
\??\c:\hhnnnn.exec:\hhnnnn.exe80⤵PID:828
-
\??\c:\hhbbtb.exec:\hhbbtb.exe81⤵PID:4120
-
\??\c:\lfrlllr.exec:\lfrlllr.exe82⤵PID:4380
-
\??\c:\xxfxrll.exec:\xxfxrll.exe83⤵PID:4360
-
\??\c:\flrlfxr.exec:\flrlfxr.exe84⤵PID:2360
-
\??\c:\rrfxrff.exec:\rrfxrff.exe85⤵PID:1068
-
\??\c:\llxxrrr.exec:\llxxrrr.exe86⤵PID:3144
-
\??\c:\lfrlllr.exec:\lfrlllr.exe87⤵PID:2208
-
\??\c:\3rlfrlx.exec:\3rlfrlx.exe88⤵PID:3488
-
\??\c:\9dvpd.exec:\9dvpd.exe89⤵PID:4088
-
\??\c:\pvjvp.exec:\pvjvp.exe90⤵PID:1444
-
\??\c:\pvdpd.exec:\pvdpd.exe91⤵PID:3108
-
\??\c:\hhnbhh.exec:\hhnbhh.exe92⤵PID:3480
-
\??\c:\9nhbtt.exec:\9nhbtt.exe93⤵PID:3756
-
\??\c:\httntn.exec:\httntn.exe94⤵PID:2924
-
\??\c:\hbhbtt.exec:\hbhbtt.exe95⤵
- System Location Discovery: System Language Discovery
PID:2276 -
\??\c:\lffxffr.exec:\lffxffr.exe96⤵PID:1944
-
\??\c:\htbnhh.exec:\htbnhh.exe97⤵PID:3696
-
\??\c:\xrfxxxr.exec:\xrfxxxr.exe98⤵PID:2368
-
\??\c:\fffxlfr.exec:\fffxlfr.exe99⤵PID:3092
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe100⤵PID:4688
-
\??\c:\pjjdv.exec:\pjjdv.exe101⤵PID:1384
-
\??\c:\dvppd.exec:\dvppd.exe102⤵PID:3384
-
\??\c:\jddvp.exec:\jddvp.exe103⤵PID:2376
-
\??\c:\vpjdj.exec:\vpjdj.exe104⤵PID:4168
-
\??\c:\pjpjd.exec:\pjpjd.exe105⤵PID:1364
-
\??\c:\hbhbbb.exec:\hbhbbb.exe106⤵PID:432
-
\??\c:\nhbtnh.exec:\nhbtnh.exe107⤵PID:896
-
\??\c:\nnhbth.exec:\nnhbth.exe108⤵PID:3168
-
\??\c:\nhtbtn.exec:\nhtbtn.exe109⤵PID:4044
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe110⤵PID:2436
-
\??\c:\rllfxrl.exec:\rllfxrl.exe111⤵PID:2412
-
\??\c:\xllxrlf.exec:\xllxrlf.exe112⤵PID:2692
-
\??\c:\xxlffff.exec:\xxlffff.exe113⤵PID:912
-
\??\c:\rfrllfx.exec:\rfrllfx.exe114⤵PID:3816
-
\??\c:\dpdvj.exec:\dpdvj.exe115⤵
- System Location Discovery: System Language Discovery
PID:2596 -
\??\c:\dddvj.exec:\dddvj.exe116⤵PID:2588
-
\??\c:\dvddp.exec:\dvddp.exe117⤵PID:2948
-
\??\c:\jddvp.exec:\jddvp.exe118⤵PID:4560
-
\??\c:\bbhhhh.exec:\bbhhhh.exe119⤵
- System Location Discovery: System Language Discovery
PID:4156 -
\??\c:\1nnhnh.exec:\1nnhnh.exe120⤵PID:4508
-
\??\c:\tnhhhn.exec:\tnhhhn.exe121⤵PID:3376
-
\??\c:\hhtnnh.exec:\hhtnnh.exe122⤵PID:440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-