Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 10:54
Behavioral task
behavioral1
Sample
3cae756ae1851ad6aba300be01231c3313905d1366ac3543c23417ba0681ca3cN.exe
Resource
win7-20241023-en
7 signatures
120 seconds
General
-
Target
3cae756ae1851ad6aba300be01231c3313905d1366ac3543c23417ba0681ca3cN.exe
-
Size
334KB
-
MD5
fbd581bd9a79232f40fd35cbf76e44a0
-
SHA1
6639c2dae176054b12085a390beb544c61f71004
-
SHA256
3cae756ae1851ad6aba300be01231c3313905d1366ac3543c23417ba0681ca3c
-
SHA512
39e61c762b7505b34055ef0d361ba671ba6ca4c588052f035bcc53a1919af2b8aa32d07947bbd7eba17e9d0910b3e5ea860db01ff17aeaaa5b46ba5a1bd1b7b1
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeR+:R4wFHoSHYHUrAwfMp3CDR+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2228-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4340-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1144-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3896-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/516-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/560-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2940-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1000-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1196-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/916-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1400-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/812-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3324-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/764-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4572-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2468-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3272-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1084-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2124-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3440-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2164-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4348-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2228-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2396-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1256-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2072-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1984-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3296-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3804-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3792-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3528-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2244-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3888-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2592-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/676-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3564-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4212-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-740-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3736-806-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-887-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-1026-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3344-1364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3584 nhtnnn.exe 4340 lxxxxrr.exe 1144 9vjvd.exe 1896 1thhhh.exe 3896 bhhbhn.exe 4904 xfxffrr.exe 2348 hbhbhn.exe 516 7xfxrxx.exe 1604 tbnnhh.exe 560 rxfxxxr.exe 1724 thnntb.exe 2940 rrrlrfl.exe 2064 nntttn.exe 1000 jdvjv.exe 2272 rrfllrx.exe 1196 bbtnhh.exe 4452 ppjdv.exe 2568 hnbnbb.exe 1136 dpvvp.exe 4872 lfxxxff.exe 916 hbhttt.exe 2984 vjdvv.exe 3064 5pppj.exe 1400 rrxxrxx.exe 5056 thbtnh.exe 4824 rfxrflr.exe 212 tntbtn.exe 812 nhnnhb.exe 4156 pvddd.exe 3324 pvpvd.exe 2436 1rfxfff.exe 764 jjdvp.exe 2280 nhhhht.exe 4572 jvdvv.exe 2468 pdjjj.exe 3596 rfxlfrl.exe 3272 5lllfff.exe 1084 btntnt.exe 1512 ddvvd.exe 1068 flrrlrf.exe 2056 hnbbbb.exe 3984 7pvjd.exe 2124 5lxrfff.exe 3440 nhtnhb.exe 2688 ddjdp.exe 3244 dvdpj.exe 4988 frlfrlf.exe 3812 htnhnh.exe 2452 tbbbtt.exe 2164 dvddd.exe 4348 lfrlrrf.exe 3432 tnbbtb.exe 2228 jdddv.exe 5024 fxffflf.exe 2396 5fxrrxx.exe 1256 htnhbt.exe 860 9pjdp.exe 1480 fxlfffx.exe 2072 bththb.exe 4552 nnhbnn.exe 4288 pjdvv.exe 4844 xllfrxr.exe 1984 5hhhtt.exe 4404 jvpdp.exe -
resource yara_rule behavioral2/memory/2228-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b19-3.dat upx behavioral2/memory/2228-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3584-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b69-8.dat upx behavioral2/files/0x000a000000023b6e-11.dat upx behavioral2/memory/4340-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b6f-18.dat upx behavioral2/memory/1144-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b70-23.dat upx behavioral2/files/0x000a000000023b71-27.dat upx behavioral2/memory/3896-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4904-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b72-32.dat upx behavioral2/files/0x0031000000023b73-37.dat upx behavioral2/memory/2348-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b74-42.dat upx behavioral2/memory/516-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b75-48.dat upx behavioral2/files/0x000a000000023b76-51.dat upx behavioral2/memory/560-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b77-56.dat upx behavioral2/memory/1724-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b78-61.dat upx behavioral2/memory/2940-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b79-66.dat upx behavioral2/files/0x000a000000023b7b-70.dat upx behavioral2/memory/1000-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b6a-77.dat upx behavioral2/memory/2272-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1196-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7c-82.dat upx behavioral2/files/0x000a000000023b7d-86.dat upx behavioral2/memory/2568-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7e-90.dat upx behavioral2/files/0x000a000000023b7f-94.dat upx behavioral2/memory/4872-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b80-98.dat upx behavioral2/files/0x000a000000023b81-104.dat upx behavioral2/memory/916-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b82-108.dat upx behavioral2/memory/3064-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b83-113.dat upx behavioral2/files/0x000a000000023b84-118.dat upx behavioral2/memory/1400-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b85-122.dat upx behavioral2/memory/4824-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b86-126.dat upx behavioral2/memory/212-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b87-131.dat upx behavioral2/files/0x000a000000023b88-136.dat upx behavioral2/memory/812-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b89-141.dat upx behavioral2/files/0x000a000000023b8a-146.dat upx behavioral2/memory/3324-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8b-151.dat upx behavioral2/memory/764-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2280-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4572-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2468-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3272-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1084-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3984-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2124-183-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flfxfx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2228 wrote to memory of 3584 2228 3cae756ae1851ad6aba300be01231c3313905d1366ac3543c23417ba0681ca3cN.exe 82 PID 2228 wrote to memory of 3584 2228 3cae756ae1851ad6aba300be01231c3313905d1366ac3543c23417ba0681ca3cN.exe 82 PID 2228 wrote to memory of 3584 2228 3cae756ae1851ad6aba300be01231c3313905d1366ac3543c23417ba0681ca3cN.exe 82 PID 3584 wrote to memory of 4340 3584 nhtnnn.exe 83 PID 3584 wrote to memory of 4340 3584 nhtnnn.exe 83 PID 3584 wrote to memory of 4340 3584 nhtnnn.exe 83 PID 4340 wrote to memory of 1144 4340 lxxxxrr.exe 84 PID 4340 wrote to memory of 1144 4340 lxxxxrr.exe 84 PID 4340 wrote to memory of 1144 4340 lxxxxrr.exe 84 PID 1144 wrote to memory of 1896 1144 9vjvd.exe 85 PID 1144 wrote to memory of 1896 1144 9vjvd.exe 85 PID 1144 wrote to memory of 1896 1144 9vjvd.exe 85 PID 1896 wrote to memory of 3896 1896 1thhhh.exe 86 PID 1896 wrote to memory of 3896 1896 1thhhh.exe 86 PID 1896 wrote to memory of 3896 1896 1thhhh.exe 86 PID 3896 wrote to memory of 4904 3896 bhhbhn.exe 87 PID 3896 wrote to memory of 4904 3896 bhhbhn.exe 87 PID 3896 wrote to memory of 4904 3896 bhhbhn.exe 87 PID 4904 wrote to memory of 2348 4904 xfxffrr.exe 88 PID 4904 wrote to memory of 2348 4904 xfxffrr.exe 88 PID 4904 wrote to memory of 2348 4904 xfxffrr.exe 88 PID 2348 wrote to memory of 516 2348 hbhbhn.exe 89 PID 2348 wrote to memory of 516 2348 hbhbhn.exe 89 PID 2348 wrote to memory of 516 2348 hbhbhn.exe 89 PID 516 wrote to memory of 1604 516 7xfxrxx.exe 90 PID 516 wrote to memory of 1604 516 7xfxrxx.exe 90 PID 516 wrote to memory of 1604 516 7xfxrxx.exe 90 PID 1604 wrote to memory of 560 1604 tbnnhh.exe 91 PID 1604 wrote to memory of 560 1604 tbnnhh.exe 91 PID 1604 wrote to memory of 560 1604 tbnnhh.exe 91 PID 560 wrote to memory of 1724 560 rxfxxxr.exe 92 PID 560 wrote to memory of 1724 560 rxfxxxr.exe 92 PID 560 wrote to memory of 1724 560 rxfxxxr.exe 92 PID 1724 wrote to memory of 2940 1724 thnntb.exe 93 PID 1724 wrote to memory of 2940 1724 thnntb.exe 93 PID 1724 wrote to memory of 2940 1724 thnntb.exe 93 PID 2940 wrote to memory of 2064 2940 rrrlrfl.exe 94 PID 2940 wrote to memory of 2064 2940 rrrlrfl.exe 94 PID 2940 wrote to memory of 2064 2940 rrrlrfl.exe 94 PID 2064 wrote to memory of 1000 2064 nntttn.exe 95 PID 2064 wrote to memory of 1000 2064 nntttn.exe 95 PID 2064 wrote to memory of 1000 2064 nntttn.exe 95 PID 1000 wrote to memory of 2272 1000 jdvjv.exe 96 PID 1000 wrote to memory of 2272 1000 jdvjv.exe 96 PID 1000 wrote to memory of 2272 1000 jdvjv.exe 96 PID 2272 wrote to memory of 1196 2272 rrfllrx.exe 97 PID 2272 wrote to memory of 1196 2272 rrfllrx.exe 97 PID 2272 wrote to memory of 1196 2272 rrfllrx.exe 97 PID 1196 wrote to memory of 4452 1196 bbtnhh.exe 98 PID 1196 wrote to memory of 4452 1196 bbtnhh.exe 98 PID 1196 wrote to memory of 4452 1196 bbtnhh.exe 98 PID 4452 wrote to memory of 2568 4452 ppjdv.exe 99 PID 4452 wrote to memory of 2568 4452 ppjdv.exe 99 PID 4452 wrote to memory of 2568 4452 ppjdv.exe 99 PID 2568 wrote to memory of 1136 2568 hnbnbb.exe 100 PID 2568 wrote to memory of 1136 2568 hnbnbb.exe 100 PID 2568 wrote to memory of 1136 2568 hnbnbb.exe 100 PID 1136 wrote to memory of 4872 1136 dpvvp.exe 101 PID 1136 wrote to memory of 4872 1136 dpvvp.exe 101 PID 1136 wrote to memory of 4872 1136 dpvvp.exe 101 PID 4872 wrote to memory of 916 4872 lfxxxff.exe 102 PID 4872 wrote to memory of 916 4872 lfxxxff.exe 102 PID 4872 wrote to memory of 916 4872 lfxxxff.exe 102 PID 916 wrote to memory of 2984 916 hbhttt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cae756ae1851ad6aba300be01231c3313905d1366ac3543c23417ba0681ca3cN.exe"C:\Users\Admin\AppData\Local\Temp\3cae756ae1851ad6aba300be01231c3313905d1366ac3543c23417ba0681ca3cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\nhtnnn.exec:\nhtnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\lxxxxrr.exec:\lxxxxrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\9vjvd.exec:\9vjvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\1thhhh.exec:\1thhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\bhhbhn.exec:\bhhbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\xfxffrr.exec:\xfxffrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\hbhbhn.exec:\hbhbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\7xfxrxx.exec:\7xfxrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\tbnnhh.exec:\tbnnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\rxfxxxr.exec:\rxfxxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\thnntb.exec:\thnntb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\rrrlrfl.exec:\rrrlrfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\nntttn.exec:\nntttn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\jdvjv.exec:\jdvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\rrfllrx.exec:\rrfllrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\bbtnhh.exec:\bbtnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\ppjdv.exec:\ppjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\hnbnbb.exec:\hnbnbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\dpvvp.exec:\dpvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\lfxxxff.exec:\lfxxxff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\hbhttt.exec:\hbhttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\vjdvv.exec:\vjdvv.exe23⤵
- Executes dropped EXE
PID:2984 -
\??\c:\5pppj.exec:\5pppj.exe24⤵
- Executes dropped EXE
PID:3064 -
\??\c:\rrxxrxx.exec:\rrxxrxx.exe25⤵
- Executes dropped EXE
PID:1400 -
\??\c:\thbtnh.exec:\thbtnh.exe26⤵
- Executes dropped EXE
PID:5056 -
\??\c:\rfxrflr.exec:\rfxrflr.exe27⤵
- Executes dropped EXE
PID:4824 -
\??\c:\tntbtn.exec:\tntbtn.exe28⤵
- Executes dropped EXE
PID:212 -
\??\c:\nhnnhb.exec:\nhnnhb.exe29⤵
- Executes dropped EXE
PID:812 -
\??\c:\pvddd.exec:\pvddd.exe30⤵
- Executes dropped EXE
PID:4156 -
\??\c:\pvpvd.exec:\pvpvd.exe31⤵
- Executes dropped EXE
PID:3324 -
\??\c:\1rfxfff.exec:\1rfxfff.exe32⤵
- Executes dropped EXE
PID:2436 -
\??\c:\jjdvp.exec:\jjdvp.exe33⤵
- Executes dropped EXE
PID:764 -
\??\c:\nhhhht.exec:\nhhhht.exe34⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jvdvv.exec:\jvdvv.exe35⤵
- Executes dropped EXE
PID:4572 -
\??\c:\pdjjj.exec:\pdjjj.exe36⤵
- Executes dropped EXE
PID:2468 -
\??\c:\rfxlfrl.exec:\rfxlfrl.exe37⤵
- Executes dropped EXE
PID:3596 -
\??\c:\5lllfff.exec:\5lllfff.exe38⤵
- Executes dropped EXE
PID:3272 -
\??\c:\btntnt.exec:\btntnt.exe39⤵
- Executes dropped EXE
PID:1084 -
\??\c:\ddvvd.exec:\ddvvd.exe40⤵
- Executes dropped EXE
PID:1512 -
\??\c:\flrrlrf.exec:\flrrlrf.exe41⤵
- Executes dropped EXE
PID:1068 -
\??\c:\hnbbbb.exec:\hnbbbb.exe42⤵
- Executes dropped EXE
PID:2056 -
\??\c:\7pvjd.exec:\7pvjd.exe43⤵
- Executes dropped EXE
PID:3984 -
\??\c:\5lxrfff.exec:\5lxrfff.exe44⤵
- Executes dropped EXE
PID:2124 -
\??\c:\nhtnhb.exec:\nhtnhb.exe45⤵
- Executes dropped EXE
PID:3440 -
\??\c:\ddjdp.exec:\ddjdp.exe46⤵
- Executes dropped EXE
PID:2688 -
\??\c:\dvdpj.exec:\dvdpj.exe47⤵
- Executes dropped EXE
PID:3244 -
\??\c:\frlfrlf.exec:\frlfrlf.exe48⤵
- Executes dropped EXE
PID:4988 -
\??\c:\htnhnh.exec:\htnhnh.exe49⤵
- Executes dropped EXE
PID:3812 -
\??\c:\tbbbtt.exec:\tbbbtt.exe50⤵
- Executes dropped EXE
PID:2452 -
\??\c:\dvddd.exec:\dvddd.exe51⤵
- Executes dropped EXE
PID:2164 -
\??\c:\lfrlrrf.exec:\lfrlrrf.exe52⤵
- Executes dropped EXE
PID:4348 -
\??\c:\tnbbtb.exec:\tnbbtb.exe53⤵
- Executes dropped EXE
PID:3432 -
\??\c:\jdddv.exec:\jdddv.exe54⤵
- Executes dropped EXE
PID:2228 -
\??\c:\fxffflf.exec:\fxffflf.exe55⤵
- Executes dropped EXE
PID:5024 -
\??\c:\5fxrrxx.exec:\5fxrrxx.exe56⤵
- Executes dropped EXE
PID:2396 -
\??\c:\htnhbt.exec:\htnhbt.exe57⤵
- Executes dropped EXE
PID:1256 -
\??\c:\9pjdp.exec:\9pjdp.exe58⤵
- Executes dropped EXE
PID:860 -
\??\c:\fxlfffx.exec:\fxlfffx.exe59⤵
- Executes dropped EXE
PID:1480 -
\??\c:\bththb.exec:\bththb.exe60⤵
- Executes dropped EXE
PID:2072 -
\??\c:\nnhbnn.exec:\nnhbnn.exe61⤵
- Executes dropped EXE
PID:4552 -
\??\c:\pjdvv.exec:\pjdvv.exe62⤵
- Executes dropped EXE
PID:4288 -
\??\c:\xllfrxr.exec:\xllfrxr.exe63⤵
- Executes dropped EXE
PID:4844 -
\??\c:\5hhhtt.exec:\5hhhtt.exe64⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jvpdp.exec:\jvpdp.exe65⤵
- Executes dropped EXE
PID:4404 -
\??\c:\lrrlxrl.exec:\lrrlxrl.exe66⤵PID:3296
-
\??\c:\xxrfxlf.exec:\xxrfxlf.exe67⤵PID:1604
-
\??\c:\tnbbtn.exec:\tnbbtn.exe68⤵PID:3736
-
\??\c:\vpjdd.exec:\vpjdd.exe69⤵PID:604
-
\??\c:\rrxxllx.exec:\rrxxllx.exe70⤵PID:3804
-
\??\c:\fxlfxlf.exec:\fxlfxlf.exe71⤵PID:4236
-
\??\c:\bhtthh.exec:\bhtthh.exe72⤵PID:3792
-
\??\c:\pjvvd.exec:\pjvvd.exe73⤵PID:1608
-
\??\c:\9rrlfxl.exec:\9rrlfxl.exe74⤵PID:3204
-
\??\c:\nhbtnn.exec:\nhbtnn.exe75⤵PID:1900
-
\??\c:\nhbnbt.exec:\nhbnbt.exe76⤵PID:1088
-
\??\c:\1pvdj.exec:\1pvdj.exe77⤵PID:2776
-
\??\c:\ffrlxxr.exec:\ffrlxxr.exe78⤵PID:2416
-
\??\c:\tnnhbt.exec:\tnnhbt.exe79⤵PID:4452
-
\??\c:\jvdpd.exec:\jvdpd.exe80⤵PID:4056
-
\??\c:\vppjv.exec:\vppjv.exe81⤵PID:3928
-
\??\c:\fxlfxfx.exec:\fxlfxfx.exe82⤵PID:1980
-
\??\c:\9ntnhh.exec:\9ntnhh.exe83⤵PID:4872
-
\??\c:\dpvdd.exec:\dpvdd.exe84⤵PID:3528
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe85⤵PID:2628
-
\??\c:\hbhhhb.exec:\hbhhhb.exe86⤵PID:2800
-
\??\c:\nntnnn.exec:\nntnnn.exe87⤵PID:3064
-
\??\c:\jjjjp.exec:\jjjjp.exe88⤵PID:3460
-
\??\c:\7xxlffx.exec:\7xxlffx.exe89⤵PID:1260
-
\??\c:\rxrlllf.exec:\rxrlllf.exe90⤵PID:5056
-
\??\c:\1bhbtt.exec:\1bhbtt.exe91⤵PID:1488
-
\??\c:\vvvjj.exec:\vvvjj.exe92⤵PID:2844
-
\??\c:\frxlfrf.exec:\frxlfrf.exe93⤵PID:4764
-
\??\c:\9llfxrr.exec:\9llfxrr.exe94⤵PID:3400
-
\??\c:\nnhttb.exec:\nnhttb.exe95⤵PID:2244
-
\??\c:\jvjdv.exec:\jvjdv.exe96⤵PID:4156
-
\??\c:\dvjpp.exec:\dvjpp.exe97⤵PID:4520
-
\??\c:\9frfxfx.exec:\9frfxfx.exe98⤵PID:372
-
\??\c:\tbttnn.exec:\tbttnn.exe99⤵PID:3968
-
\??\c:\jpdvj.exec:\jpdvj.exe100⤵PID:1720
-
\??\c:\7flfxrf.exec:\7flfxrf.exe101⤵PID:1080
-
\??\c:\rlfxrrf.exec:\rlfxrrf.exe102⤵PID:3344
-
\??\c:\5ntnnb.exec:\5ntnnb.exe103⤵PID:2136
-
\??\c:\dpppp.exec:\dpppp.exe104⤵PID:4320
-
\??\c:\vdjvv.exec:\vdjvv.exe105⤵PID:3252
-
\??\c:\lfrlllx.exec:\lfrlllx.exe106⤵PID:3888
-
\??\c:\5ntnnb.exec:\5ntnnb.exe107⤵PID:3956
-
\??\c:\vvvvv.exec:\vvvvv.exe108⤵PID:4568
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe109⤵PID:2592
-
\??\c:\fflrlrx.exec:\fflrlrx.exe110⤵
- System Location Discovery: System Language Discovery
PID:676 -
\??\c:\bbbtnh.exec:\bbbtnh.exe111⤵PID:3984
-
\??\c:\thhtnn.exec:\thhtnn.exe112⤵PID:4892
-
\??\c:\vdvvp.exec:\vdvvp.exe113⤵PID:4748
-
\??\c:\lrrfxrf.exec:\lrrfxrf.exe114⤵PID:1744
-
\??\c:\nhhthn.exec:\nhhthn.exe115⤵PID:64
-
\??\c:\tbbtnn.exec:\tbbtnn.exe116⤵PID:2576
-
\??\c:\djdjp.exec:\djdjp.exe117⤵PID:648
-
\??\c:\rflfrrl.exec:\rflfrrl.exe118⤵PID:3564
-
\??\c:\ttnbtn.exec:\ttnbtn.exe119⤵PID:4364
-
\??\c:\jvvpd.exec:\jvvpd.exe120⤵PID:4420
-
\??\c:\flffrrl.exec:\flffrrl.exe121⤵PID:4036
-
\??\c:\xfxrllf.exec:\xfxrllf.exe122⤵PID:3504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-