Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 23:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3300cc7823aed5036615ce13d1fd6a7ad86a2a4b850bb18681253d26f27d0385N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
3300cc7823aed5036615ce13d1fd6a7ad86a2a4b850bb18681253d26f27d0385N.exe
-
Size
452KB
-
MD5
3011ffcb62e3ef912582799da6fe10a0
-
SHA1
90b32f284407ae7e224d1b87cc7bb446c9621c77
-
SHA256
3300cc7823aed5036615ce13d1fd6a7ad86a2a4b850bb18681253d26f27d0385
-
SHA512
fdbcb8eda628826dcd9d96a3ee07dee1162d43f562d8dd566a3f9cb871a18dfdb6675be8799c1cbeba52de47cd64f43f214c631bc70d19b43677f292895a78a0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe2:q7Tc2NYHUrAwfMp3CD2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1340-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3848-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/352-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4208-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/712-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/828-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2196-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2668-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-655-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-725-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-778-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-782-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-810-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-880-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-941-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-1529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 868 nhbtnt.exe 432 tnttbb.exe 3612 bbttnn.exe 4824 lffffll.exe 4088 1ttttb.exe 464 hbhhbb.exe 2204 nnhnht.exe 2544 tnnttn.exe 3848 xlrrrxf.exe 2176 xfxrlff.exe 352 nhtnbh.exe 1400 fllfflx.exe 3208 htthbn.exe 5016 bntttt.exe 4436 9nnbtb.exe 2872 lxffrrr.exe 3588 thtbnh.exe 3740 lxxxfll.exe 4208 vjjdv.exe 1528 jppdv.exe 4712 pjdpj.exe 4128 9rxxxff.exe 1396 bthnnt.exe 3640 djpdv.exe 4668 hhnhth.exe 4988 pppvp.exe 2808 ttttnh.exe 1208 thnhbb.exe 4108 jvddv.exe 4676 ddpvd.exe 412 nbnnnb.exe 1652 thtttb.exe 1480 jdppp.exe 1848 ddppv.exe 3092 rllffxx.exe 4760 jjppv.exe 3184 bttnhh.exe 4132 djpdd.exe 712 hhnnnt.exe 728 1vjjj.exe 4332 lxflrrr.exe 1896 flrxxfl.exe 2816 tbtttb.exe 4640 rfxllff.exe 4920 7tnnbn.exe 3408 ppddj.exe 3768 ddppp.exe 1512 tbbthn.exe 4536 jjpvv.exe 2864 rxxrffx.exe 3292 nntthh.exe 3476 jjjdj.exe 3228 tbtbht.exe 3576 dvdpj.exe 3612 llrrfxx.exe 2196 hnhhhb.exe 4824 dpdjv.exe 224 fffrrrl.exe 2788 3thhbb.exe 3140 tbnntb.exe 3656 ddjjj.exe 3400 5rxxrrl.exe 3528 nbnntn.exe 4820 vvddd.exe -
resource yara_rule behavioral2/memory/1340-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3848-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/352-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4208-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/712-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/828-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2668-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-768-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-782-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-810-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-880-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnttbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1340 wrote to memory of 868 1340 3300cc7823aed5036615ce13d1fd6a7ad86a2a4b850bb18681253d26f27d0385N.exe 82 PID 1340 wrote to memory of 868 1340 3300cc7823aed5036615ce13d1fd6a7ad86a2a4b850bb18681253d26f27d0385N.exe 82 PID 1340 wrote to memory of 868 1340 3300cc7823aed5036615ce13d1fd6a7ad86a2a4b850bb18681253d26f27d0385N.exe 82 PID 868 wrote to memory of 432 868 nhbtnt.exe 83 PID 868 wrote to memory of 432 868 nhbtnt.exe 83 PID 868 wrote to memory of 432 868 nhbtnt.exe 83 PID 432 wrote to memory of 3612 432 tnttbb.exe 84 PID 432 wrote to memory of 3612 432 tnttbb.exe 84 PID 432 wrote to memory of 3612 432 tnttbb.exe 84 PID 3612 wrote to memory of 4824 3612 bbttnn.exe 85 PID 3612 wrote to memory of 4824 3612 bbttnn.exe 85 PID 3612 wrote to memory of 4824 3612 bbttnn.exe 85 PID 4824 wrote to memory of 4088 4824 lffffll.exe 86 PID 4824 wrote to memory of 4088 4824 lffffll.exe 86 PID 4824 wrote to memory of 4088 4824 lffffll.exe 86 PID 4088 wrote to memory of 464 4088 1ttttb.exe 87 PID 4088 wrote to memory of 464 4088 1ttttb.exe 87 PID 4088 wrote to memory of 464 4088 1ttttb.exe 87 PID 464 wrote to memory of 2204 464 hbhhbb.exe 88 PID 464 wrote to memory of 2204 464 hbhhbb.exe 88 PID 464 wrote to memory of 2204 464 hbhhbb.exe 88 PID 2204 wrote to memory of 2544 2204 nnhnht.exe 89 PID 2204 wrote to memory of 2544 2204 nnhnht.exe 89 PID 2204 wrote to memory of 2544 2204 nnhnht.exe 89 PID 2544 wrote to memory of 3848 2544 tnnttn.exe 90 PID 2544 wrote to memory of 3848 2544 tnnttn.exe 90 PID 2544 wrote to memory of 3848 2544 tnnttn.exe 90 PID 3848 wrote to memory of 2176 3848 xlrrrxf.exe 91 PID 3848 wrote to memory of 2176 3848 xlrrrxf.exe 91 PID 3848 wrote to memory of 2176 3848 xlrrrxf.exe 91 PID 2176 wrote to memory of 352 2176 xfxrlff.exe 92 PID 2176 wrote to memory of 352 2176 xfxrlff.exe 92 PID 2176 wrote to memory of 352 2176 xfxrlff.exe 92 PID 352 wrote to memory of 1400 352 nhtnbh.exe 93 PID 352 wrote to memory of 1400 352 nhtnbh.exe 93 PID 352 wrote to memory of 1400 352 nhtnbh.exe 93 PID 1400 wrote to memory of 3208 1400 fllfflx.exe 94 PID 1400 wrote to memory of 3208 1400 fllfflx.exe 94 PID 1400 wrote to memory of 3208 1400 fllfflx.exe 94 PID 3208 wrote to memory of 5016 3208 htthbn.exe 95 PID 3208 wrote to memory of 5016 3208 htthbn.exe 95 PID 3208 wrote to memory of 5016 3208 htthbn.exe 95 PID 5016 wrote to memory of 4436 5016 bntttt.exe 96 PID 5016 wrote to memory of 4436 5016 bntttt.exe 96 PID 5016 wrote to memory of 4436 5016 bntttt.exe 96 PID 4436 wrote to memory of 2872 4436 9nnbtb.exe 97 PID 4436 wrote to memory of 2872 4436 9nnbtb.exe 97 PID 4436 wrote to memory of 2872 4436 9nnbtb.exe 97 PID 2872 wrote to memory of 3588 2872 lxffrrr.exe 98 PID 2872 wrote to memory of 3588 2872 lxffrrr.exe 98 PID 2872 wrote to memory of 3588 2872 lxffrrr.exe 98 PID 3588 wrote to memory of 3740 3588 thtbnh.exe 99 PID 3588 wrote to memory of 3740 3588 thtbnh.exe 99 PID 3588 wrote to memory of 3740 3588 thtbnh.exe 99 PID 3740 wrote to memory of 4208 3740 lxxxfll.exe 100 PID 3740 wrote to memory of 4208 3740 lxxxfll.exe 100 PID 3740 wrote to memory of 4208 3740 lxxxfll.exe 100 PID 4208 wrote to memory of 1528 4208 vjjdv.exe 101 PID 4208 wrote to memory of 1528 4208 vjjdv.exe 101 PID 4208 wrote to memory of 1528 4208 vjjdv.exe 101 PID 1528 wrote to memory of 4712 1528 jppdv.exe 102 PID 1528 wrote to memory of 4712 1528 jppdv.exe 102 PID 1528 wrote to memory of 4712 1528 jppdv.exe 102 PID 4712 wrote to memory of 4128 4712 pjdpj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\3300cc7823aed5036615ce13d1fd6a7ad86a2a4b850bb18681253d26f27d0385N.exe"C:\Users\Admin\AppData\Local\Temp\3300cc7823aed5036615ce13d1fd6a7ad86a2a4b850bb18681253d26f27d0385N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\nhbtnt.exec:\nhbtnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\tnttbb.exec:\tnttbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\bbttnn.exec:\bbttnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\lffffll.exec:\lffffll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\1ttttb.exec:\1ttttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\hbhhbb.exec:\hbhhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\nnhnht.exec:\nnhnht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\tnnttn.exec:\tnnttn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\xlrrrxf.exec:\xlrrrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\xfxrlff.exec:\xfxrlff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\nhtnbh.exec:\nhtnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\fllfflx.exec:\fllfflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\htthbn.exec:\htthbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\bntttt.exec:\bntttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\9nnbtb.exec:\9nnbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\lxffrrr.exec:\lxffrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\thtbnh.exec:\thtbnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\lxxxfll.exec:\lxxxfll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\vjjdv.exec:\vjjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\jppdv.exec:\jppdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\pjdpj.exec:\pjdpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\9rxxxff.exec:\9rxxxff.exe23⤵
- Executes dropped EXE
PID:4128 -
\??\c:\bthnnt.exec:\bthnnt.exe24⤵
- Executes dropped EXE
PID:1396 -
\??\c:\djpdv.exec:\djpdv.exe25⤵
- Executes dropped EXE
PID:3640 -
\??\c:\hhnhth.exec:\hhnhth.exe26⤵
- Executes dropped EXE
PID:4668 -
\??\c:\pppvp.exec:\pppvp.exe27⤵
- Executes dropped EXE
PID:4988 -
\??\c:\ttttnh.exec:\ttttnh.exe28⤵
- Executes dropped EXE
PID:2808 -
\??\c:\thnhbb.exec:\thnhbb.exe29⤵
- Executes dropped EXE
PID:1208 -
\??\c:\jvddv.exec:\jvddv.exe30⤵
- Executes dropped EXE
PID:4108 -
\??\c:\ddpvd.exec:\ddpvd.exe31⤵
- Executes dropped EXE
PID:4676 -
\??\c:\nbnnnb.exec:\nbnnnb.exe32⤵
- Executes dropped EXE
PID:412 -
\??\c:\thtttb.exec:\thtttb.exe33⤵
- Executes dropped EXE
PID:1652 -
\??\c:\jdppp.exec:\jdppp.exe34⤵
- Executes dropped EXE
PID:1480 -
\??\c:\ddppv.exec:\ddppv.exe35⤵
- Executes dropped EXE
PID:1848 -
\??\c:\rllffxx.exec:\rllffxx.exe36⤵
- Executes dropped EXE
PID:3092 -
\??\c:\jjppv.exec:\jjppv.exe37⤵
- Executes dropped EXE
PID:4760 -
\??\c:\bttnhh.exec:\bttnhh.exe38⤵
- Executes dropped EXE
PID:3184 -
\??\c:\djpdd.exec:\djpdd.exe39⤵
- Executes dropped EXE
PID:4132 -
\??\c:\hhnnnt.exec:\hhnnnt.exe40⤵
- Executes dropped EXE
PID:712 -
\??\c:\1vjjj.exec:\1vjjj.exe41⤵
- Executes dropped EXE
PID:728 -
\??\c:\lxflrrr.exec:\lxflrrr.exe42⤵
- Executes dropped EXE
PID:4332 -
\??\c:\flrxxfl.exec:\flrxxfl.exe43⤵
- Executes dropped EXE
PID:1896 -
\??\c:\tbtttb.exec:\tbtttb.exe44⤵
- Executes dropped EXE
PID:2816 -
\??\c:\rfxllff.exec:\rfxllff.exe45⤵
- Executes dropped EXE
PID:4640 -
\??\c:\7tnnbn.exec:\7tnnbn.exe46⤵
- Executes dropped EXE
PID:4920 -
\??\c:\ppddj.exec:\ppddj.exe47⤵
- Executes dropped EXE
PID:3408 -
\??\c:\ddppp.exec:\ddppp.exe48⤵
- Executes dropped EXE
PID:3768 -
\??\c:\tbbthn.exec:\tbbthn.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1512 -
\??\c:\jjpvv.exec:\jjpvv.exe50⤵
- Executes dropped EXE
PID:4536 -
\??\c:\rxxrffx.exec:\rxxrffx.exe51⤵
- Executes dropped EXE
PID:2864 -
\??\c:\nntthh.exec:\nntthh.exe52⤵
- Executes dropped EXE
PID:3292 -
\??\c:\jjjdj.exec:\jjjdj.exe53⤵
- Executes dropped EXE
PID:3476 -
\??\c:\tbtbht.exec:\tbtbht.exe54⤵
- Executes dropped EXE
PID:3228 -
\??\c:\dvdpj.exec:\dvdpj.exe55⤵
- Executes dropped EXE
PID:3576 -
\??\c:\llrrfxx.exec:\llrrfxx.exe56⤵
- Executes dropped EXE
PID:3612 -
\??\c:\hnhhhb.exec:\hnhhhb.exe57⤵
- Executes dropped EXE
PID:2196 -
\??\c:\dpdjv.exec:\dpdjv.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4824 -
\??\c:\fffrrrl.exec:\fffrrrl.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:224 -
\??\c:\3thhbb.exec:\3thhbb.exe60⤵
- Executes dropped EXE
PID:2788 -
\??\c:\tbnntb.exec:\tbnntb.exe61⤵
- Executes dropped EXE
PID:3140 -
\??\c:\ddjjj.exec:\ddjjj.exe62⤵
- Executes dropped EXE
PID:3656 -
\??\c:\5rxxrrl.exec:\5rxxrrl.exe63⤵
- Executes dropped EXE
PID:3400 -
\??\c:\nbnntn.exec:\nbnntn.exe64⤵
- Executes dropped EXE
PID:3528 -
\??\c:\vvddd.exec:\vvddd.exe65⤵
- Executes dropped EXE
PID:4820 -
\??\c:\9pddv.exec:\9pddv.exe66⤵PID:3452
-
\??\c:\rxfrxxf.exec:\rxfrxxf.exe67⤵PID:1720
-
\??\c:\jjvdj.exec:\jjvdj.exe68⤵PID:2036
-
\??\c:\9llfrxr.exec:\9llfrxr.exe69⤵PID:5112
-
\??\c:\hhbthh.exec:\hhbthh.exe70⤵PID:2680
-
\??\c:\jvdjp.exec:\jvdjp.exe71⤵PID:3208
-
\??\c:\llrlxrx.exec:\llrlxrx.exe72⤵PID:2768
-
\??\c:\1rlffff.exec:\1rlffff.exe73⤵PID:4436
-
\??\c:\tnhhbh.exec:\tnhhbh.exe74⤵PID:4900
-
\??\c:\jvdvp.exec:\jvdvp.exe75⤵PID:4664
-
\??\c:\rfrxfxr.exec:\rfrxfxr.exe76⤵PID:5104
-
\??\c:\tnnhtt.exec:\tnnhtt.exe77⤵PID:3740
-
\??\c:\vdppp.exec:\vdppp.exe78⤵PID:1880
-
\??\c:\rrrrllf.exec:\rrrrllf.exe79⤵PID:1388
-
\??\c:\7jjdp.exec:\7jjdp.exe80⤵PID:3064
-
\??\c:\rflfffr.exec:\rflfffr.exe81⤵PID:5084
-
\??\c:\fxffxff.exec:\fxffxff.exe82⤵PID:4012
-
\??\c:\pdvdd.exec:\pdvdd.exe83⤵PID:2996
-
\??\c:\vdjpp.exec:\vdjpp.exe84⤵PID:3936
-
\??\c:\fflffff.exec:\fflffff.exe85⤵PID:540
-
\??\c:\bbbbhn.exec:\bbbbhn.exe86⤵PID:3976
-
\??\c:\llffrll.exec:\llffrll.exe87⤵PID:404
-
\??\c:\rrlllrr.exec:\rrlllrr.exe88⤵PID:4064
-
\??\c:\bntnbt.exec:\bntnbt.exe89⤵PID:1048
-
\??\c:\pdddd.exec:\pdddd.exe90⤵PID:1960
-
\??\c:\rfrfflr.exec:\rfrfflr.exe91⤵
- System Location Discovery: System Language Discovery
PID:4280 -
\??\c:\bhbnht.exec:\bhbnht.exe92⤵PID:1776
-
\??\c:\jjddd.exec:\jjddd.exe93⤵PID:880
-
\??\c:\jppvv.exec:\jppvv.exe94⤵PID:3644
-
\??\c:\hhnhnb.exec:\hhnhnb.exe95⤵PID:3152
-
\??\c:\jpdjj.exec:\jpdjj.exe96⤵PID:4620
-
\??\c:\xxxxxll.exec:\xxxxxll.exe97⤵PID:828
-
\??\c:\ttbhhn.exec:\ttbhhn.exe98⤵PID:2024
-
\??\c:\vvjjj.exec:\vvjjj.exe99⤵PID:3112
-
\??\c:\rlxxxff.exec:\rlxxxff.exe100⤵PID:3132
-
\??\c:\rrflrrl.exec:\rrflrrl.exe101⤵PID:4448
-
\??\c:\jddpj.exec:\jddpj.exe102⤵PID:4864
-
\??\c:\ddppv.exec:\ddppv.exe103⤵PID:3632
-
\??\c:\rrlfxff.exec:\rrlfxff.exe104⤵PID:712
-
\??\c:\7nnnnb.exec:\7nnnnb.exe105⤵PID:728
-
\??\c:\5pjdd.exec:\5pjdd.exe106⤵PID:1660
-
\??\c:\djppj.exec:\djppj.exe107⤵PID:448
-
\??\c:\lffffrr.exec:\lffffrr.exe108⤵PID:1076
-
\??\c:\bbthhh.exec:\bbthhh.exe109⤵PID:1540
-
\??\c:\pjpjj.exec:\pjpjj.exe110⤵PID:3432
-
\??\c:\frffflr.exec:\frffflr.exe111⤵PID:1656
-
\??\c:\llffrrl.exec:\llffrrl.exe112⤵PID:4996
-
\??\c:\thhnnt.exec:\thhnnt.exe113⤵PID:4392
-
\??\c:\dvjjj.exec:\dvjjj.exe114⤵PID:468
-
\??\c:\rxffrrx.exec:\rxffrrx.exe115⤵PID:4828
-
\??\c:\5bbbbb.exec:\5bbbbb.exe116⤵PID:4232
-
\??\c:\vvdvp.exec:\vvdvp.exe117⤵PID:4580
-
\??\c:\jjpjd.exec:\jjpjd.exe118⤵PID:3728
-
\??\c:\xfxrrrx.exec:\xfxrrrx.exe119⤵PID:5032
-
\??\c:\jjvpv.exec:\jjvpv.exe120⤵PID:3576
-
\??\c:\dvpjp.exec:\dvpjp.exe121⤵
- System Location Discovery: System Language Discovery
PID:4540 -
\??\c:\tbbnhh.exec:\tbbnhh.exe122⤵PID:2196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-