Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 03:05
Behavioral task
behavioral1
Sample
817d4e7c8ab56c64f9cd8ccd9159effc098ae5432cd7c8e99f04b00dc255d2acN.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
817d4e7c8ab56c64f9cd8ccd9159effc098ae5432cd7c8e99f04b00dc255d2acN.exe
-
Size
348KB
-
MD5
d6a5f7b36fca128574eacfed6fe9c3f0
-
SHA1
4fe78074d65c853b01e82f3deb00c265947c9801
-
SHA256
817d4e7c8ab56c64f9cd8ccd9159effc098ae5432cd7c8e99f04b00dc255d2ac
-
SHA512
32e15d05123e87e4123a39a730169348a861829c9e4c9b4edcab0059920a4bb55480ad1d2c12486184a60249184c7618774c1c9888721f0188f584c592296639
-
SSDEEP
6144:Lcm4FmowdHoSEYW5fNZWB5hFfci3Add4kGYA4P:R4wFHoS3WXZshJX2VGd4P
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3084-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3060-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2816-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3744-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4288-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1172-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3296-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2660-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3728-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3164-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3944-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3852-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3336-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1400-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4588-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2512-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1740-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/376-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/448-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3272-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4136-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3896-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1280-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/868-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2776-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1500-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4760-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2956-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4768-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2388-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2112-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3332-551-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1036-594-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-794-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-1137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3060 hhhntb.exe 2816 pvjdv.exe 4968 9xxrlll.exe 3548 hbnhnn.exe 2692 rlrrxfr.exe 3744 7nnhnn.exe 4288 lfrlfff.exe 1172 hbtnhb.exe 876 1frlfrr.exe 3296 tnnhhb.exe 2660 rxffrrl.exe 3728 3htnhh.exe 2180 xrrxxxr.exe 1608 thnnhn.exe 3164 bnbttt.exe 3944 xrxrrll.exe 3852 pdpdp.exe 3292 9xfrrlf.exe 4056 tnnbnh.exe 2996 pjpjv.exe 3336 xlfrfxl.exe 4212 5hnbbt.exe 3064 5ppdp.exe 1400 xrrffxx.exe 4816 bbhttn.exe 4516 vjppp.exe 4588 xrxxrfr.exe 4996 3nhbtn.exe 2512 xlllxrl.exe 1548 xxxlrlf.exe 1168 pdvjv.exe 1740 1flxllx.exe 376 rfllxlf.exe 1584 jdvjj.exe 724 lxllxfl.exe 448 xlrfrlf.exe 3272 nnthtn.exe 3080 djjdd.exe 3264 3rxrlrx.exe 920 5nnhbt.exe 2056 pvvjj.exe 452 xrxrxxl.exe 3456 frlfrlx.exe 2336 hnhbtn.exe 4912 3vpdj.exe 4136 frrfrlx.exe 4956 nnnnhh.exe 2608 thbtbt.exe 2596 7ppdp.exe 4360 fxlffrr.exe 4420 rrxrxrr.exe 5024 1ntnhb.exe 4836 pjvpp.exe 2396 lfxlrlf.exe 1396 nbhbbb.exe 4984 5bbbnn.exe 1896 jdvjd.exe 3896 xrfxlxx.exe 2072 ttthth.exe 4500 ttthtn.exe 1204 jvdvd.exe 1280 fxllfff.exe 1452 nhbnbt.exe 464 1dvjj.exe -
resource yara_rule behavioral2/memory/3084-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b19-3.dat upx behavioral2/memory/3084-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b6c-9.dat upx behavioral2/memory/3060-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2816-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b6d-12.dat upx behavioral2/files/0x000a000000023b6e-19.dat upx behavioral2/memory/3548-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4968-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b6f-24.dat upx behavioral2/memory/3548-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b70-29.dat upx behavioral2/memory/2692-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b71-34.dat upx behavioral2/memory/3744-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b72-39.dat upx behavioral2/memory/4288-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1172-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b73-44.dat upx behavioral2/files/0x0031000000023b75-49.dat upx behavioral2/memory/876-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3296-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b76-55.dat upx behavioral2/files/0x000a000000023b77-59.dat upx behavioral2/memory/2660-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b78-64.dat upx behavioral2/memory/3728-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b79-69.dat upx behavioral2/memory/2180-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1608-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7a-74.dat upx behavioral2/memory/3164-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7b-79.dat upx behavioral2/files/0x000b000000023b6a-84.dat upx behavioral2/memory/3944-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7c-89.dat upx behavioral2/memory/3852-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7d-94.dat upx behavioral2/files/0x000a000000023b7e-98.dat upx behavioral2/memory/2996-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7f-104.dat upx behavioral2/files/0x000a000000023b80-107.dat upx behavioral2/memory/3336-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b81-112.dat upx behavioral2/memory/3064-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b82-118.dat upx behavioral2/memory/1400-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b83-122.dat upx behavioral2/memory/4816-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b84-126.dat upx behavioral2/files/0x000a000000023b85-131.dat upx behavioral2/memory/4588-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b86-135.dat upx behavioral2/files/0x000a000000023b87-140.dat upx behavioral2/files/0x000a000000023b89-144.dat upx behavioral2/memory/2512-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8a-150.dat upx behavioral2/memory/1548-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1168-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8b-156.dat upx behavioral2/memory/1740-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1168-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/376-163-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxlrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvjv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3084 wrote to memory of 3060 3084 817d4e7c8ab56c64f9cd8ccd9159effc098ae5432cd7c8e99f04b00dc255d2acN.exe 82 PID 3084 wrote to memory of 3060 3084 817d4e7c8ab56c64f9cd8ccd9159effc098ae5432cd7c8e99f04b00dc255d2acN.exe 82 PID 3084 wrote to memory of 3060 3084 817d4e7c8ab56c64f9cd8ccd9159effc098ae5432cd7c8e99f04b00dc255d2acN.exe 82 PID 3060 wrote to memory of 2816 3060 hhhntb.exe 83 PID 3060 wrote to memory of 2816 3060 hhhntb.exe 83 PID 3060 wrote to memory of 2816 3060 hhhntb.exe 83 PID 2816 wrote to memory of 4968 2816 pvjdv.exe 84 PID 2816 wrote to memory of 4968 2816 pvjdv.exe 84 PID 2816 wrote to memory of 4968 2816 pvjdv.exe 84 PID 4968 wrote to memory of 3548 4968 9xxrlll.exe 85 PID 4968 wrote to memory of 3548 4968 9xxrlll.exe 85 PID 4968 wrote to memory of 3548 4968 9xxrlll.exe 85 PID 3548 wrote to memory of 2692 3548 hbnhnn.exe 86 PID 3548 wrote to memory of 2692 3548 hbnhnn.exe 86 PID 3548 wrote to memory of 2692 3548 hbnhnn.exe 86 PID 2692 wrote to memory of 3744 2692 rlrrxfr.exe 87 PID 2692 wrote to memory of 3744 2692 rlrrxfr.exe 87 PID 2692 wrote to memory of 3744 2692 rlrrxfr.exe 87 PID 3744 wrote to memory of 4288 3744 7nnhnn.exe 88 PID 3744 wrote to memory of 4288 3744 7nnhnn.exe 88 PID 3744 wrote to memory of 4288 3744 7nnhnn.exe 88 PID 4288 wrote to memory of 1172 4288 lfrlfff.exe 89 PID 4288 wrote to memory of 1172 4288 lfrlfff.exe 89 PID 4288 wrote to memory of 1172 4288 lfrlfff.exe 89 PID 1172 wrote to memory of 876 1172 hbtnhb.exe 90 PID 1172 wrote to memory of 876 1172 hbtnhb.exe 90 PID 1172 wrote to memory of 876 1172 hbtnhb.exe 90 PID 876 wrote to memory of 3296 876 1frlfrr.exe 91 PID 876 wrote to memory of 3296 876 1frlfrr.exe 91 PID 876 wrote to memory of 3296 876 1frlfrr.exe 91 PID 3296 wrote to memory of 2660 3296 tnnhhb.exe 92 PID 3296 wrote to memory of 2660 3296 tnnhhb.exe 92 PID 3296 wrote to memory of 2660 3296 tnnhhb.exe 92 PID 2660 wrote to memory of 3728 2660 rxffrrl.exe 93 PID 2660 wrote to memory of 3728 2660 rxffrrl.exe 93 PID 2660 wrote to memory of 3728 2660 rxffrrl.exe 93 PID 3728 wrote to memory of 2180 3728 3htnhh.exe 94 PID 3728 wrote to memory of 2180 3728 3htnhh.exe 94 PID 3728 wrote to memory of 2180 3728 3htnhh.exe 94 PID 2180 wrote to memory of 1608 2180 xrrxxxr.exe 95 PID 2180 wrote to memory of 1608 2180 xrrxxxr.exe 95 PID 2180 wrote to memory of 1608 2180 xrrxxxr.exe 95 PID 1608 wrote to memory of 3164 1608 thnnhn.exe 96 PID 1608 wrote to memory of 3164 1608 thnnhn.exe 96 PID 1608 wrote to memory of 3164 1608 thnnhn.exe 96 PID 3164 wrote to memory of 3944 3164 bnbttt.exe 97 PID 3164 wrote to memory of 3944 3164 bnbttt.exe 97 PID 3164 wrote to memory of 3944 3164 bnbttt.exe 97 PID 3944 wrote to memory of 3852 3944 xrxrrll.exe 98 PID 3944 wrote to memory of 3852 3944 xrxrrll.exe 98 PID 3944 wrote to memory of 3852 3944 xrxrrll.exe 98 PID 3852 wrote to memory of 3292 3852 pdpdp.exe 99 PID 3852 wrote to memory of 3292 3852 pdpdp.exe 99 PID 3852 wrote to memory of 3292 3852 pdpdp.exe 99 PID 3292 wrote to memory of 4056 3292 9xfrrlf.exe 100 PID 3292 wrote to memory of 4056 3292 9xfrrlf.exe 100 PID 3292 wrote to memory of 4056 3292 9xfrrlf.exe 100 PID 4056 wrote to memory of 2996 4056 tnnbnh.exe 101 PID 4056 wrote to memory of 2996 4056 tnnbnh.exe 101 PID 4056 wrote to memory of 2996 4056 tnnbnh.exe 101 PID 2996 wrote to memory of 3336 2996 pjpjv.exe 102 PID 2996 wrote to memory of 3336 2996 pjpjv.exe 102 PID 2996 wrote to memory of 3336 2996 pjpjv.exe 102 PID 3336 wrote to memory of 4212 3336 xlfrfxl.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\817d4e7c8ab56c64f9cd8ccd9159effc098ae5432cd7c8e99f04b00dc255d2acN.exe"C:\Users\Admin\AppData\Local\Temp\817d4e7c8ab56c64f9cd8ccd9159effc098ae5432cd7c8e99f04b00dc255d2acN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\hhhntb.exec:\hhhntb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\pvjdv.exec:\pvjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\9xxrlll.exec:\9xxrlll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\hbnhnn.exec:\hbnhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\rlrrxfr.exec:\rlrrxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\7nnhnn.exec:\7nnhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\lfrlfff.exec:\lfrlfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\hbtnhb.exec:\hbtnhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\1frlfrr.exec:\1frlfrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\tnnhhb.exec:\tnnhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\rxffrrl.exec:\rxffrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\3htnhh.exec:\3htnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\xrrxxxr.exec:\xrrxxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\thnnhn.exec:\thnnhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\bnbttt.exec:\bnbttt.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\xrxrrll.exec:\xrxrrll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\pdpdp.exec:\pdpdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\9xfrrlf.exec:\9xfrrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\tnnbnh.exec:\tnnbnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\pjpjv.exec:\pjpjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\xlfrfxl.exec:\xlfrfxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\5hnbbt.exec:\5hnbbt.exe23⤵
- Executes dropped EXE
PID:4212 -
\??\c:\5ppdp.exec:\5ppdp.exe24⤵
- Executes dropped EXE
PID:3064 -
\??\c:\xrrffxx.exec:\xrrffxx.exe25⤵
- Executes dropped EXE
PID:1400 -
\??\c:\bbhttn.exec:\bbhttn.exe26⤵
- Executes dropped EXE
PID:4816 -
\??\c:\vjppp.exec:\vjppp.exe27⤵
- Executes dropped EXE
PID:4516 -
\??\c:\xrxxrfr.exec:\xrxxrfr.exe28⤵
- Executes dropped EXE
PID:4588 -
\??\c:\3nhbtn.exec:\3nhbtn.exe29⤵
- Executes dropped EXE
PID:4996 -
\??\c:\xlllxrl.exec:\xlllxrl.exe30⤵
- Executes dropped EXE
PID:2512 -
\??\c:\xxxlrlf.exec:\xxxlrlf.exe31⤵
- Executes dropped EXE
PID:1548 -
\??\c:\pdvjv.exec:\pdvjv.exe32⤵
- Executes dropped EXE
PID:1168 -
\??\c:\1flxllx.exec:\1flxllx.exe33⤵
- Executes dropped EXE
PID:1740 -
\??\c:\rfllxlf.exec:\rfllxlf.exe34⤵
- Executes dropped EXE
PID:376 -
\??\c:\jdvjj.exec:\jdvjj.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\lxllxfl.exec:\lxllxfl.exe36⤵
- Executes dropped EXE
PID:724 -
\??\c:\xlrfrlf.exec:\xlrfrlf.exe37⤵
- Executes dropped EXE
PID:448 -
\??\c:\nnthtn.exec:\nnthtn.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3272 -
\??\c:\djjdd.exec:\djjdd.exe39⤵
- Executes dropped EXE
PID:3080 -
\??\c:\3rxrlrx.exec:\3rxrlrx.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3264 -
\??\c:\5nnhbt.exec:\5nnhbt.exe41⤵
- Executes dropped EXE
PID:920 -
\??\c:\pvvjj.exec:\pvvjj.exe42⤵
- Executes dropped EXE
PID:2056 -
\??\c:\xrxrxxl.exec:\xrxrxxl.exe43⤵
- Executes dropped EXE
PID:452 -
\??\c:\frlfrlx.exec:\frlfrlx.exe44⤵
- Executes dropped EXE
PID:3456 -
\??\c:\hnhbtn.exec:\hnhbtn.exe45⤵
- Executes dropped EXE
PID:2336 -
\??\c:\3vpdj.exec:\3vpdj.exe46⤵
- Executes dropped EXE
PID:4912 -
\??\c:\frrfrlx.exec:\frrfrlx.exe47⤵
- Executes dropped EXE
PID:4136 -
\??\c:\nnnnhh.exec:\nnnnhh.exe48⤵
- Executes dropped EXE
PID:4956 -
\??\c:\thbtbt.exec:\thbtbt.exe49⤵
- Executes dropped EXE
PID:2608 -
\??\c:\7ppdp.exec:\7ppdp.exe50⤵
- Executes dropped EXE
PID:2596 -
\??\c:\fxlffrr.exec:\fxlffrr.exe51⤵
- Executes dropped EXE
PID:4360 -
\??\c:\rrxrxrr.exec:\rrxrxrr.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4420 -
\??\c:\1ntnhb.exec:\1ntnhb.exe53⤵
- Executes dropped EXE
PID:5024 -
\??\c:\pjvpp.exec:\pjvpp.exe54⤵
- Executes dropped EXE
PID:4836 -
\??\c:\lfxlrlf.exec:\lfxlrlf.exe55⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nbhbbb.exec:\nbhbbb.exe56⤵
- Executes dropped EXE
PID:1396 -
\??\c:\5bbbnn.exec:\5bbbnn.exe57⤵
- Executes dropped EXE
PID:4984 -
\??\c:\jdvjd.exec:\jdvjd.exe58⤵
- Executes dropped EXE
PID:1896 -
\??\c:\xrfxlxx.exec:\xrfxlxx.exe59⤵
- Executes dropped EXE
PID:3896 -
\??\c:\ttthth.exec:\ttthth.exe60⤵
- Executes dropped EXE
PID:2072 -
\??\c:\ttthtn.exec:\ttthtn.exe61⤵
- Executes dropped EXE
PID:4500 -
\??\c:\jvdvd.exec:\jvdvd.exe62⤵
- Executes dropped EXE
PID:1204 -
\??\c:\fxllfff.exec:\fxllfff.exe63⤵
- Executes dropped EXE
PID:1280 -
\??\c:\nhbnbt.exec:\nhbnbt.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1452 -
\??\c:\1dvjj.exec:\1dvjj.exe65⤵
- Executes dropped EXE
PID:464 -
\??\c:\3xflffx.exec:\3xflffx.exe66⤵PID:4404
-
\??\c:\lfxrllf.exec:\lfxrllf.exe67⤵PID:1724
-
\??\c:\btnhbt.exec:\btnhbt.exe68⤵PID:1668
-
\??\c:\vvvpj.exec:\vvvpj.exe69⤵PID:2940
-
\??\c:\ppjvj.exec:\ppjvj.exe70⤵PID:2740
-
\??\c:\lxrflfr.exec:\lxrflfr.exe71⤵PID:2140
-
\??\c:\1btnhb.exec:\1btnhb.exe72⤵PID:868
-
\??\c:\bnbtnn.exec:\bnbtnn.exe73⤵PID:2528
-
\??\c:\ddjvp.exec:\ddjvp.exe74⤵PID:2352
-
\??\c:\3rxlrrl.exec:\3rxlrrl.exe75⤵
- System Location Discovery: System Language Discovery
PID:4268 -
\??\c:\bnnbnh.exec:\bnnbnh.exe76⤵PID:2776
-
\??\c:\5vvpj.exec:\5vvpj.exe77⤵PID:3208
-
\??\c:\lxlfxrf.exec:\lxlfxrf.exe78⤵PID:924
-
\??\c:\hnntbh.exec:\hnntbh.exe79⤵PID:2936
-
\??\c:\1hhhbh.exec:\1hhhbh.exe80⤵PID:320
-
\??\c:\pppjv.exec:\pppjv.exe81⤵PID:8
-
\??\c:\fxrlxrr.exec:\fxrlxrr.exe82⤵PID:1156
-
\??\c:\hnnhtn.exec:\hnnhtn.exe83⤵PID:4944
-
\??\c:\nhbnnb.exec:\nhbnnb.exe84⤵PID:3588
-
\??\c:\1jpjv.exec:\1jpjv.exe85⤵PID:2984
-
\??\c:\frrflfx.exec:\frrflfx.exe86⤵PID:1436
-
\??\c:\7hhbbb.exec:\7hhbbb.exe87⤵PID:2516
-
\??\c:\jjjvj.exec:\jjjvj.exe88⤵PID:1260
-
\??\c:\7vpjv.exec:\7vpjv.exe89⤵PID:3604
-
\??\c:\frfrrfr.exec:\frfrrfr.exe90⤵PID:4804
-
\??\c:\hbnntt.exec:\hbnntt.exe91⤵PID:2844
-
\??\c:\vvdvj.exec:\vvdvj.exe92⤵PID:4764
-
\??\c:\pvpdv.exec:\pvpdv.exe93⤵PID:1488
-
\??\c:\lrllfxr.exec:\lrllfxr.exe94⤵PID:2792
-
\??\c:\ththhn.exec:\ththhn.exe95⤵PID:2244
-
\??\c:\ppvpp.exec:\ppvpp.exe96⤵PID:3324
-
\??\c:\frxrflf.exec:\frxrflf.exe97⤵PID:808
-
\??\c:\rxxrllr.exec:\rxxrllr.exe98⤵PID:3784
-
\??\c:\5hhhtn.exec:\5hhhtn.exe99⤵PID:764
-
\??\c:\1ddpv.exec:\1ddpv.exe100⤵PID:1500
-
\??\c:\jjjjv.exec:\jjjjv.exe101⤵PID:4080
-
\??\c:\7frfxrf.exec:\7frfxrf.exe102⤵PID:2700
-
\??\c:\9hbthb.exec:\9hbthb.exe103⤵PID:3316
-
\??\c:\dpddj.exec:\dpddj.exe104⤵PID:4088
-
\??\c:\xfllffx.exec:\xfllffx.exe105⤵PID:3888
-
\??\c:\nnntbt.exec:\nnntbt.exe106⤵PID:1696
-
\??\c:\5ppjd.exec:\5ppjd.exe107⤵PID:5000
-
\??\c:\jjjjv.exec:\jjjjv.exe108⤵PID:4740
-
\??\c:\fxxlfff.exec:\fxxlfff.exe109⤵PID:4668
-
\??\c:\7nbnbb.exec:\7nbnbb.exe110⤵PID:4760
-
\??\c:\ttnbnh.exec:\ttnbnh.exe111⤵PID:5040
-
\??\c:\dppjd.exec:\dppjd.exe112⤵PID:4988
-
\??\c:\lflxlxl.exec:\lflxlxl.exe113⤵PID:1836
-
\??\c:\ntthtn.exec:\ntthtn.exe114⤵PID:4912
-
\??\c:\ddpjv.exec:\ddpjv.exe115⤵PID:4136
-
\??\c:\pddvj.exec:\pddvj.exe116⤵PID:4956
-
\??\c:\xxlfrlx.exec:\xxlfrlx.exe117⤵PID:1708
-
\??\c:\btttnn.exec:\btttnn.exe118⤵PID:1380
-
\??\c:\tthbnh.exec:\tthbnh.exe119⤵PID:4360
-
\??\c:\jpvpd.exec:\jpvpd.exe120⤵PID:3504
-
\??\c:\rffxllf.exec:\rffxllf.exe121⤵PID:2420
-
\??\c:\lfrfrfx.exec:\lfrfrfx.exe122⤵PID:3552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-