Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/12/2024, 01:07
Behavioral task
behavioral1
Sample
9abf1dbb1400f9bd05a7bb046ec334862132a19e67d97f707268ae733b26d0c6.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
9abf1dbb1400f9bd05a7bb046ec334862132a19e67d97f707268ae733b26d0c6.exe
-
Size
255KB
-
MD5
8827bb58621129e32be1727b5cfa1e07
-
SHA1
0812c019ad8ec21ec8ae45fc1210e08a1cc7a5dd
-
SHA256
9abf1dbb1400f9bd05a7bb046ec334862132a19e67d97f707268ae733b26d0c6
-
SHA512
6cdbeeb768aa9f6b72e6fe5014a5a2e03218c5f5a7623da1c3d60a173a90d3c07c95c03cde5c6d8dc92843bb07f0cbef148163a3f406a0ed5f0342c8df143602
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpolTjZXvEQo9dfBP/9:y4wFHoS3eFaKHpKT9XvEhdfBP/9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1692-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/364-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/980-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3612-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/556-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1020-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4216-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4164-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/460-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4212-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3220-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1212-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2472-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4732-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1788-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2676-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3268-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3688-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/844-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/232-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1652-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1276-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2516-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2472-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3420-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-460-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1300-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4236-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-541-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-561-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-604-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1868-719-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1936-801-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-871-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2676-1056-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-1406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 364 tnhhnn.exe 4180 jvdvp.exe 980 fxlllfl.exe 3612 dpppv.exe 556 frfxfxl.exe 4004 ttbnhb.exe 216 9djdp.exe 1852 nhttnn.exe 1020 1jjvj.exe 3552 lxrfrlf.exe 3260 hbnnbh.exe 4304 xrlxlfx.exe 4936 1ffrlrl.exe 3232 1hhbtn.exe 4876 nbnhth.exe 4216 9flxlfl.exe 4624 1tthtn.exe 1484 vvdpp.exe 4164 vjdvj.exe 4884 rxxrffx.exe 1056 tnnhbt.exe 2804 ddpdd.exe 460 9jpjv.exe 4212 3llxlfr.exe 2004 jpdjj.exe 776 rffxllx.exe 3944 7hbhtn.exe 3220 bnnhnb.exe 1356 vvpjv.exe 1944 lxllrlx.exe 1212 3nnbbh.exe 2472 5vdvd.exe 2604 llfxrfx.exe 4860 btbntn.exe 4732 nbhhbh.exe 4924 xrxrrlr.exe 788 xffrfxl.exe 1788 hhnhtn.exe 4772 ppvjd.exe 2620 flrfrlx.exe 2536 7rfrfxl.exe 4508 hbnnhb.exe 724 nbhthn.exe 2676 jjpjv.exe 4316 xlxlxrl.exe 3320 rrlfrlx.exe 3268 5hhbtn.exe 2252 ppdjv.exe 3688 vjdpd.exe 980 xllrlxl.exe 4828 rxlxlfr.exe 4572 hnnhtn.exe 4000 jvjdp.exe 5044 vjdpd.exe 844 frxrlff.exe 644 xfffrrf.exe 1196 ntthhb.exe 2052 1jvjp.exe 2008 lxrlxrl.exe 3212 rxffrlf.exe 232 tbbnhn.exe 2140 tnnbtn.exe 3524 ppvjp.exe 4936 lrrlfxl.exe -
resource yara_rule behavioral2/memory/1692-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023c94-2.dat upx behavioral2/memory/1692-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c97-9.dat upx behavioral2/memory/364-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9b-13.dat upx behavioral2/memory/4180-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9c-21.dat upx behavioral2/memory/980-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9d-28.dat upx behavioral2/memory/3612-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9e-33.dat upx behavioral2/memory/556-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9f-39.dat upx behavioral2/memory/4004-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca0-45.dat upx behavioral2/memory/216-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1852-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca1-53.dat upx behavioral2/memory/1020-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca2-58.dat upx behavioral2/files/0x0007000000023ca4-62.dat upx behavioral2/memory/3552-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3260-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca5-70.dat upx behavioral2/files/0x0007000000023ca6-74.dat upx behavioral2/memory/4304-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca7-80.dat upx behavioral2/memory/4936-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca8-86.dat upx behavioral2/files/0x0007000000023ca9-91.dat upx behavioral2/memory/4876-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023caa-96.dat upx behavioral2/memory/4216-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cab-101.dat upx behavioral2/memory/4624-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cac-107.dat upx behavioral2/files/0x0007000000023cad-112.dat upx behavioral2/memory/4164-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4884-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cae-119.dat upx behavioral2/files/0x0007000000023caf-124.dat upx behavioral2/files/0x0008000000023c98-129.dat upx behavioral2/memory/460-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4212-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb0-135.dat upx behavioral2/files/0x0007000000023cb1-141.dat upx behavioral2/files/0x0007000000023cb2-146.dat upx behavioral2/memory/2004-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb3-152.dat upx behavioral2/files/0x0007000000023cb4-157.dat upx behavioral2/memory/3220-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb5-164.dat upx behavioral2/files/0x0007000000023cb6-168.dat upx behavioral2/files/0x0007000000023cb7-173.dat upx behavioral2/memory/1212-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb9-179.dat upx behavioral2/memory/2472-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4860-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2604-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4732-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4924-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1788-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4508-221-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpvp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1692 wrote to memory of 364 1692 9abf1dbb1400f9bd05a7bb046ec334862132a19e67d97f707268ae733b26d0c6.exe 82 PID 1692 wrote to memory of 364 1692 9abf1dbb1400f9bd05a7bb046ec334862132a19e67d97f707268ae733b26d0c6.exe 82 PID 1692 wrote to memory of 364 1692 9abf1dbb1400f9bd05a7bb046ec334862132a19e67d97f707268ae733b26d0c6.exe 82 PID 364 wrote to memory of 4180 364 tnhhnn.exe 83 PID 364 wrote to memory of 4180 364 tnhhnn.exe 83 PID 364 wrote to memory of 4180 364 tnhhnn.exe 83 PID 4180 wrote to memory of 980 4180 jvdvp.exe 84 PID 4180 wrote to memory of 980 4180 jvdvp.exe 84 PID 4180 wrote to memory of 980 4180 jvdvp.exe 84 PID 980 wrote to memory of 3612 980 fxlllfl.exe 85 PID 980 wrote to memory of 3612 980 fxlllfl.exe 85 PID 980 wrote to memory of 3612 980 fxlllfl.exe 85 PID 3612 wrote to memory of 556 3612 dpppv.exe 86 PID 3612 wrote to memory of 556 3612 dpppv.exe 86 PID 3612 wrote to memory of 556 3612 dpppv.exe 86 PID 556 wrote to memory of 4004 556 frfxfxl.exe 87 PID 556 wrote to memory of 4004 556 frfxfxl.exe 87 PID 556 wrote to memory of 4004 556 frfxfxl.exe 87 PID 4004 wrote to memory of 216 4004 ttbnhb.exe 88 PID 4004 wrote to memory of 216 4004 ttbnhb.exe 88 PID 4004 wrote to memory of 216 4004 ttbnhb.exe 88 PID 216 wrote to memory of 1852 216 9djdp.exe 89 PID 216 wrote to memory of 1852 216 9djdp.exe 89 PID 216 wrote to memory of 1852 216 9djdp.exe 89 PID 1852 wrote to memory of 1020 1852 nhttnn.exe 90 PID 1852 wrote to memory of 1020 1852 nhttnn.exe 90 PID 1852 wrote to memory of 1020 1852 nhttnn.exe 90 PID 1020 wrote to memory of 3552 1020 1jjvj.exe 91 PID 1020 wrote to memory of 3552 1020 1jjvj.exe 91 PID 1020 wrote to memory of 3552 1020 1jjvj.exe 91 PID 3552 wrote to memory of 3260 3552 lxrfrlf.exe 92 PID 3552 wrote to memory of 3260 3552 lxrfrlf.exe 92 PID 3552 wrote to memory of 3260 3552 lxrfrlf.exe 92 PID 3260 wrote to memory of 4304 3260 hbnnbh.exe 93 PID 3260 wrote to memory of 4304 3260 hbnnbh.exe 93 PID 3260 wrote to memory of 4304 3260 hbnnbh.exe 93 PID 4304 wrote to memory of 4936 4304 xrlxlfx.exe 94 PID 4304 wrote to memory of 4936 4304 xrlxlfx.exe 94 PID 4304 wrote to memory of 4936 4304 xrlxlfx.exe 94 PID 4936 wrote to memory of 3232 4936 1ffrlrl.exe 95 PID 4936 wrote to memory of 3232 4936 1ffrlrl.exe 95 PID 4936 wrote to memory of 3232 4936 1ffrlrl.exe 95 PID 3232 wrote to memory of 4876 3232 1hhbtn.exe 96 PID 3232 wrote to memory of 4876 3232 1hhbtn.exe 96 PID 3232 wrote to memory of 4876 3232 1hhbtn.exe 96 PID 4876 wrote to memory of 4216 4876 nbnhth.exe 97 PID 4876 wrote to memory of 4216 4876 nbnhth.exe 97 PID 4876 wrote to memory of 4216 4876 nbnhth.exe 97 PID 4216 wrote to memory of 4624 4216 9flxlfl.exe 98 PID 4216 wrote to memory of 4624 4216 9flxlfl.exe 98 PID 4216 wrote to memory of 4624 4216 9flxlfl.exe 98 PID 4624 wrote to memory of 1484 4624 1tthtn.exe 99 PID 4624 wrote to memory of 1484 4624 1tthtn.exe 99 PID 4624 wrote to memory of 1484 4624 1tthtn.exe 99 PID 1484 wrote to memory of 4164 1484 vvdpp.exe 100 PID 1484 wrote to memory of 4164 1484 vvdpp.exe 100 PID 1484 wrote to memory of 4164 1484 vvdpp.exe 100 PID 4164 wrote to memory of 4884 4164 vjdvj.exe 101 PID 4164 wrote to memory of 4884 4164 vjdvj.exe 101 PID 4164 wrote to memory of 4884 4164 vjdvj.exe 101 PID 4884 wrote to memory of 1056 4884 rxxrffx.exe 102 PID 4884 wrote to memory of 1056 4884 rxxrffx.exe 102 PID 4884 wrote to memory of 1056 4884 rxxrffx.exe 102 PID 1056 wrote to memory of 2804 1056 tnnhbt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9abf1dbb1400f9bd05a7bb046ec334862132a19e67d97f707268ae733b26d0c6.exe"C:\Users\Admin\AppData\Local\Temp\9abf1dbb1400f9bd05a7bb046ec334862132a19e67d97f707268ae733b26d0c6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\tnhhnn.exec:\tnhhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
\??\c:\jvdvp.exec:\jvdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\fxlllfl.exec:\fxlllfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\dpppv.exec:\dpppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\frfxfxl.exec:\frfxfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\ttbnhb.exec:\ttbnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\9djdp.exec:\9djdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\nhttnn.exec:\nhttnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\1jjvj.exec:\1jjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\lxrfrlf.exec:\lxrfrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\hbnnbh.exec:\hbnnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\xrlxlfx.exec:\xrlxlfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\1ffrlrl.exec:\1ffrlrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\1hhbtn.exec:\1hhbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\nbnhth.exec:\nbnhth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\9flxlfl.exec:\9flxlfl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\1tthtn.exec:\1tthtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\vvdpp.exec:\vvdpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\vjdvj.exec:\vjdvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\rxxrffx.exec:\rxxrffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\tnnhbt.exec:\tnnhbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\ddpdd.exec:\ddpdd.exe23⤵
- Executes dropped EXE
PID:2804 -
\??\c:\9jpjv.exec:\9jpjv.exe24⤵
- Executes dropped EXE
PID:460 -
\??\c:\3llxlfr.exec:\3llxlfr.exe25⤵
- Executes dropped EXE
PID:4212 -
\??\c:\jpdjj.exec:\jpdjj.exe26⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rffxllx.exec:\rffxllx.exe27⤵
- Executes dropped EXE
PID:776 -
\??\c:\7hbhtn.exec:\7hbhtn.exe28⤵
- Executes dropped EXE
PID:3944 -
\??\c:\bnnhnb.exec:\bnnhnb.exe29⤵
- Executes dropped EXE
PID:3220 -
\??\c:\vvpjv.exec:\vvpjv.exe30⤵
- Executes dropped EXE
PID:1356 -
\??\c:\lxllrlx.exec:\lxllrlx.exe31⤵
- Executes dropped EXE
PID:1944 -
\??\c:\3nnbbh.exec:\3nnbbh.exe32⤵
- Executes dropped EXE
PID:1212 -
\??\c:\5vdvd.exec:\5vdvd.exe33⤵
- Executes dropped EXE
PID:2472 -
\??\c:\llfxrfx.exec:\llfxrfx.exe34⤵
- Executes dropped EXE
PID:2604 -
\??\c:\btbntn.exec:\btbntn.exe35⤵
- Executes dropped EXE
PID:4860 -
\??\c:\nbhhbh.exec:\nbhhbh.exe36⤵
- Executes dropped EXE
PID:4732 -
\??\c:\xrxrrlr.exec:\xrxrrlr.exe37⤵
- Executes dropped EXE
PID:4924 -
\??\c:\xffrfxl.exec:\xffrfxl.exe38⤵
- Executes dropped EXE
PID:788 -
\??\c:\hhnhtn.exec:\hhnhtn.exe39⤵
- Executes dropped EXE
PID:1788 -
\??\c:\ppvjd.exec:\ppvjd.exe40⤵
- Executes dropped EXE
PID:4772 -
\??\c:\flrfrlx.exec:\flrfrlx.exe41⤵
- Executes dropped EXE
PID:2620 -
\??\c:\7rfrfxl.exec:\7rfrfxl.exe42⤵
- Executes dropped EXE
PID:2536 -
\??\c:\hbnnhb.exec:\hbnnhb.exe43⤵
- Executes dropped EXE
PID:4508 -
\??\c:\nbhthn.exec:\nbhthn.exe44⤵
- Executes dropped EXE
PID:724 -
\??\c:\jjpjv.exec:\jjpjv.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\xlxlxrl.exec:\xlxlxrl.exe46⤵
- Executes dropped EXE
PID:4316 -
\??\c:\rrlfrlx.exec:\rrlfrlx.exe47⤵
- Executes dropped EXE
PID:3320 -
\??\c:\5hhbtn.exec:\5hhbtn.exe48⤵
- Executes dropped EXE
PID:3268 -
\??\c:\ppdjv.exec:\ppdjv.exe49⤵
- Executes dropped EXE
PID:2252 -
\??\c:\vjdpd.exec:\vjdpd.exe50⤵
- Executes dropped EXE
PID:3688 -
\??\c:\xllrlxl.exec:\xllrlxl.exe51⤵
- Executes dropped EXE
PID:980 -
\??\c:\rxlxlfr.exec:\rxlxlfr.exe52⤵
- Executes dropped EXE
PID:4828 -
\??\c:\hnnhtn.exec:\hnnhtn.exe53⤵
- Executes dropped EXE
PID:4572 -
\??\c:\jvjdp.exec:\jvjdp.exe54⤵
- Executes dropped EXE
PID:4000 -
\??\c:\vjdpd.exec:\vjdpd.exe55⤵
- Executes dropped EXE
PID:5044 -
\??\c:\frxrlff.exec:\frxrlff.exe56⤵
- Executes dropped EXE
PID:844 -
\??\c:\xfffrrf.exec:\xfffrrf.exe57⤵
- Executes dropped EXE
PID:644 -
\??\c:\ntthhb.exec:\ntthhb.exe58⤵
- Executes dropped EXE
PID:1196 -
\??\c:\1jvjp.exec:\1jvjp.exe59⤵
- Executes dropped EXE
PID:2052 -
\??\c:\lxrlxrl.exec:\lxrlxrl.exe60⤵
- Executes dropped EXE
PID:2008 -
\??\c:\rxffrlf.exec:\rxffrlf.exe61⤵
- Executes dropped EXE
PID:3212 -
\??\c:\tbbnhn.exec:\tbbnhn.exe62⤵
- Executes dropped EXE
PID:232 -
\??\c:\tnnbtn.exec:\tnnbtn.exe63⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ppvjp.exec:\ppvjp.exe64⤵
- Executes dropped EXE
PID:3524 -
\??\c:\lrrlfxl.exec:\lrrlfxl.exe65⤵
- Executes dropped EXE
PID:4936 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe66⤵PID:1652
-
\??\c:\nbtnbn.exec:\nbtnbn.exe67⤵PID:1604
-
\??\c:\vdppj.exec:\vdppj.exe68⤵PID:3712
-
\??\c:\jjjvp.exec:\jjjvp.exe69⤵PID:4080
-
\??\c:\5fllxfx.exec:\5fllxfx.exe70⤵PID:544
-
\??\c:\dpdvv.exec:\dpdvv.exe71⤵PID:3032
-
\??\c:\dvvvj.exec:\dvvvj.exe72⤵PID:2720
-
\??\c:\frlxfxl.exec:\frlxfxl.exe73⤵PID:4996
-
\??\c:\9xxrlfx.exec:\9xxrlfx.exe74⤵PID:5000
-
\??\c:\bhbnbn.exec:\bhbnbn.exe75⤵PID:4724
-
\??\c:\7pdpd.exec:\7pdpd.exe76⤵PID:2500
-
\??\c:\vddvj.exec:\vddvj.exe77⤵PID:4416
-
\??\c:\jppjj.exec:\jppjj.exe78⤵PID:1240
-
\??\c:\frlxfxl.exec:\frlxfxl.exe79⤵PID:4808
-
\??\c:\tbtnbt.exec:\tbtnbt.exe80⤵PID:4544
-
\??\c:\9tthbt.exec:\9tthbt.exe81⤵PID:1784
-
\??\c:\dvddv.exec:\dvddv.exe82⤵PID:1052
-
\??\c:\xrlxlfr.exec:\xrlxlfr.exe83⤵PID:4644
-
\??\c:\rfxrfxf.exec:\rfxrfxf.exe84⤵PID:3216
-
\??\c:\1bbtnn.exec:\1bbtnn.exe85⤵PID:5016
-
\??\c:\nttnbt.exec:\nttnbt.exe86⤵PID:4832
-
\??\c:\9vpvp.exec:\9vpvp.exe87⤵
- System Location Discovery: System Language Discovery
PID:4356 -
\??\c:\5xrflfr.exec:\5xrflfr.exe88⤵PID:1944
-
\??\c:\rflxlll.exec:\rflxlll.exe89⤵PID:5076
-
\??\c:\hbtnbb.exec:\hbtnbb.exe90⤵PID:1276
-
\??\c:\dpvjv.exec:\dpvjv.exe91⤵PID:2576
-
\??\c:\9xrlrlx.exec:\9xrlrlx.exe92⤵PID:4864
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe93⤵PID:884
-
\??\c:\ntnnhb.exec:\ntnnhb.exe94⤵
- System Location Discovery: System Language Discovery
PID:2516 -
\??\c:\htnhnn.exec:\htnhnn.exe95⤵PID:2508
-
\??\c:\djjdp.exec:\djjdp.exe96⤵PID:4824
-
\??\c:\3lfxlfx.exec:\3lfxlfx.exe97⤵PID:2472
-
\??\c:\lflxxrx.exec:\lflxxrx.exe98⤵PID:3420
-
\??\c:\nbbnnh.exec:\nbbnnh.exe99⤵PID:4660
-
\??\c:\ttbthb.exec:\ttbthb.exe100⤵PID:3328
-
\??\c:\pdpvd.exec:\pdpvd.exe101⤵PID:2188
-
\??\c:\lrrlffx.exec:\lrrlffx.exe102⤵PID:2448
-
\??\c:\3xffffx.exec:\3xffffx.exe103⤵PID:3848
-
\??\c:\3bthth.exec:\3bthth.exe104⤵PID:2940
-
\??\c:\htthbn.exec:\htthbn.exe105⤵PID:4772
-
\??\c:\jpvvj.exec:\jpvvj.exe106⤵PID:2620
-
\??\c:\djpjv.exec:\djpjv.exe107⤵PID:1716
-
\??\c:\rlxlxxx.exec:\rlxlxxx.exe108⤵PID:4508
-
\??\c:\bthnbh.exec:\bthnbh.exe109⤵PID:4328
-
\??\c:\hbbnnh.exec:\hbbnnh.exe110⤵PID:4944
-
\??\c:\jvjvv.exec:\jvjvv.exe111⤵PID:4316
-
\??\c:\vdvpd.exec:\vdvpd.exe112⤵PID:4672
-
\??\c:\ffxxrrr.exec:\ffxxrrr.exe113⤵PID:384
-
\??\c:\tbbnhb.exec:\tbbnhb.exe114⤵PID:4180
-
\??\c:\tttntn.exec:\tttntn.exe115⤵PID:4988
-
\??\c:\vjpdd.exec:\vjpdd.exe116⤵PID:2316
-
\??\c:\flffxrx.exec:\flffxrx.exe117⤵PID:880
-
\??\c:\lxrlffx.exec:\lxrlffx.exe118⤵PID:876
-
\??\c:\thtnhb.exec:\thtnhb.exe119⤵PID:1300
-
\??\c:\bhhhtn.exec:\bhhhtn.exe120⤵PID:3704
-
\??\c:\jppdp.exec:\jppdp.exe121⤵PID:216
-
\??\c:\5rrffxr.exec:\5rrffxr.exe122⤵PID:1668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-