Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 23:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84a3b08624cd23e257d999cf1ef854447b458728d6b1984d3e941832842d0537N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
84a3b08624cd23e257d999cf1ef854447b458728d6b1984d3e941832842d0537N.exe
-
Size
454KB
-
MD5
afeb0480f3857e8707766b0c78481da0
-
SHA1
fa11e081176e054e6e35f88408418a1c25093135
-
SHA256
84a3b08624cd23e257d999cf1ef854447b458728d6b1984d3e941832842d0537
-
SHA512
f42990f8a0523977c8a8ba645b3af6d950691a8353038300f630238cecb11da461608817c9886a97525e6ed1eadee5ce0a7b4c227f5647de2160ae4c4d83d916
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeK:q7Tc2NYHUrAwfMp3CDK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/372-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/736-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2812-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-716-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-778-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-785-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-798-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-811-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-887-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-1910-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2604 fffxrll.exe 4940 tthnhh.exe 4764 bbhnbh.exe 1644 rlrxxff.exe 1792 dpppj.exe 2468 hhnhbb.exe 2836 xrfxlfr.exe 4856 vjjpp.exe 736 fxxrrrl.exe 4576 bnbtnn.exe 1004 rrflfxx.exe 1724 vpvvp.exe 4876 flrllff.exe 4444 vjvpp.exe 3176 lrrlxff.exe 4188 bnnbbb.exe 228 llrlxxf.exe 3356 xlxrlll.exe 1504 thnhbn.exe 3692 jdddv.exe 4988 nttntt.exe 440 vjppp.exe 2212 bnnnhh.exe 1016 fxfxfrl.exe 4264 dvpjv.exe 1496 rxffrxx.exe 2400 thhbbb.exe 1668 jpdvj.exe 3968 jvvjd.exe 3588 dvpjd.exe 1536 tnhhnh.exe 4524 jpdvv.exe 5092 bhhnhh.exe 1256 jvpjd.exe 1228 rxxrlfx.exe 3260 tnnnhh.exe 3368 pjdvv.exe 4320 xxrflfr.exe 2164 nhhhbt.exe 4848 thnnhb.exe 4948 jvvpj.exe 5100 xxrrlll.exe 3460 nhnhhb.exe 952 ppvpp.exe 1372 ttbttt.exe 1064 9vjpj.exe 3596 flxfxxr.exe 384 fflfxxr.exe 2192 tbnhhb.exe 4932 vppjj.exe 4388 lfffxxx.exe 4396 lfrlrrx.exe 3592 bhnnnn.exe 3532 pdjpj.exe 1096 llffffl.exe 3556 7rxxxll.exe 3876 bthhnn.exe 1824 nhhhbb.exe 1884 ppvpv.exe 3064 fffrllf.exe 2372 bbbbbb.exe 4748 1vvpj.exe 2760 lllllll.exe 4800 nnttnn.exe -
resource yara_rule behavioral2/memory/372-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2604-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/736-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-785-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 372 wrote to memory of 2604 372 84a3b08624cd23e257d999cf1ef854447b458728d6b1984d3e941832842d0537N.exe 82 PID 372 wrote to memory of 2604 372 84a3b08624cd23e257d999cf1ef854447b458728d6b1984d3e941832842d0537N.exe 82 PID 372 wrote to memory of 2604 372 84a3b08624cd23e257d999cf1ef854447b458728d6b1984d3e941832842d0537N.exe 82 PID 2604 wrote to memory of 4940 2604 fffxrll.exe 83 PID 2604 wrote to memory of 4940 2604 fffxrll.exe 83 PID 2604 wrote to memory of 4940 2604 fffxrll.exe 83 PID 4940 wrote to memory of 4764 4940 tthnhh.exe 84 PID 4940 wrote to memory of 4764 4940 tthnhh.exe 84 PID 4940 wrote to memory of 4764 4940 tthnhh.exe 84 PID 4764 wrote to memory of 1644 4764 bbhnbh.exe 85 PID 4764 wrote to memory of 1644 4764 bbhnbh.exe 85 PID 4764 wrote to memory of 1644 4764 bbhnbh.exe 85 PID 1644 wrote to memory of 1792 1644 rlrxxff.exe 86 PID 1644 wrote to memory of 1792 1644 rlrxxff.exe 86 PID 1644 wrote to memory of 1792 1644 rlrxxff.exe 86 PID 1792 wrote to memory of 2468 1792 dpppj.exe 87 PID 1792 wrote to memory of 2468 1792 dpppj.exe 87 PID 1792 wrote to memory of 2468 1792 dpppj.exe 87 PID 2468 wrote to memory of 2836 2468 hhnhbb.exe 88 PID 2468 wrote to memory of 2836 2468 hhnhbb.exe 88 PID 2468 wrote to memory of 2836 2468 hhnhbb.exe 88 PID 2836 wrote to memory of 4856 2836 xrfxlfr.exe 89 PID 2836 wrote to memory of 4856 2836 xrfxlfr.exe 89 PID 2836 wrote to memory of 4856 2836 xrfxlfr.exe 89 PID 4856 wrote to memory of 736 4856 vjjpp.exe 90 PID 4856 wrote to memory of 736 4856 vjjpp.exe 90 PID 4856 wrote to memory of 736 4856 vjjpp.exe 90 PID 736 wrote to memory of 4576 736 fxxrrrl.exe 91 PID 736 wrote to memory of 4576 736 fxxrrrl.exe 91 PID 736 wrote to memory of 4576 736 fxxrrrl.exe 91 PID 4576 wrote to memory of 1004 4576 bnbtnn.exe 92 PID 4576 wrote to memory of 1004 4576 bnbtnn.exe 92 PID 4576 wrote to memory of 1004 4576 bnbtnn.exe 92 PID 1004 wrote to memory of 1724 1004 rrflfxx.exe 93 PID 1004 wrote to memory of 1724 1004 rrflfxx.exe 93 PID 1004 wrote to memory of 1724 1004 rrflfxx.exe 93 PID 1724 wrote to memory of 4876 1724 vpvvp.exe 94 PID 1724 wrote to memory of 4876 1724 vpvvp.exe 94 PID 1724 wrote to memory of 4876 1724 vpvvp.exe 94 PID 4876 wrote to memory of 4444 4876 flrllff.exe 95 PID 4876 wrote to memory of 4444 4876 flrllff.exe 95 PID 4876 wrote to memory of 4444 4876 flrllff.exe 95 PID 4444 wrote to memory of 3176 4444 vjvpp.exe 96 PID 4444 wrote to memory of 3176 4444 vjvpp.exe 96 PID 4444 wrote to memory of 3176 4444 vjvpp.exe 96 PID 3176 wrote to memory of 4188 3176 lrrlxff.exe 97 PID 3176 wrote to memory of 4188 3176 lrrlxff.exe 97 PID 3176 wrote to memory of 4188 3176 lrrlxff.exe 97 PID 4188 wrote to memory of 228 4188 bnnbbb.exe 98 PID 4188 wrote to memory of 228 4188 bnnbbb.exe 98 PID 4188 wrote to memory of 228 4188 bnnbbb.exe 98 PID 228 wrote to memory of 3356 228 llrlxxf.exe 99 PID 228 wrote to memory of 3356 228 llrlxxf.exe 99 PID 228 wrote to memory of 3356 228 llrlxxf.exe 99 PID 3356 wrote to memory of 1504 3356 xlxrlll.exe 100 PID 3356 wrote to memory of 1504 3356 xlxrlll.exe 100 PID 3356 wrote to memory of 1504 3356 xlxrlll.exe 100 PID 1504 wrote to memory of 3692 1504 thnhbn.exe 101 PID 1504 wrote to memory of 3692 1504 thnhbn.exe 101 PID 1504 wrote to memory of 3692 1504 thnhbn.exe 101 PID 3692 wrote to memory of 4988 3692 jdddv.exe 102 PID 3692 wrote to memory of 4988 3692 jdddv.exe 102 PID 3692 wrote to memory of 4988 3692 jdddv.exe 102 PID 4988 wrote to memory of 440 4988 nttntt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\84a3b08624cd23e257d999cf1ef854447b458728d6b1984d3e941832842d0537N.exe"C:\Users\Admin\AppData\Local\Temp\84a3b08624cd23e257d999cf1ef854447b458728d6b1984d3e941832842d0537N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\fffxrll.exec:\fffxrll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\tthnhh.exec:\tthnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\bbhnbh.exec:\bbhnbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\rlrxxff.exec:\rlrxxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\dpppj.exec:\dpppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\hhnhbb.exec:\hhnhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\xrfxlfr.exec:\xrfxlfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\vjjpp.exec:\vjjpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\bnbtnn.exec:\bnbtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\rrflfxx.exec:\rrflfxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\vpvvp.exec:\vpvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\flrllff.exec:\flrllff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\vjvpp.exec:\vjvpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\lrrlxff.exec:\lrrlxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\bnnbbb.exec:\bnnbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\llrlxxf.exec:\llrlxxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\xlxrlll.exec:\xlxrlll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\thnhbn.exec:\thnhbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\jdddv.exec:\jdddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\nttntt.exec:\nttntt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\vjppp.exec:\vjppp.exe23⤵
- Executes dropped EXE
PID:440 -
\??\c:\bnnnhh.exec:\bnnnhh.exe24⤵
- Executes dropped EXE
PID:2212 -
\??\c:\fxfxfrl.exec:\fxfxfrl.exe25⤵
- Executes dropped EXE
PID:1016 -
\??\c:\dvpjv.exec:\dvpjv.exe26⤵
- Executes dropped EXE
PID:4264 -
\??\c:\rxffrxx.exec:\rxffrxx.exe27⤵
- Executes dropped EXE
PID:1496 -
\??\c:\thhbbb.exec:\thhbbb.exe28⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jpdvj.exec:\jpdvj.exe29⤵
- Executes dropped EXE
PID:1668 -
\??\c:\jvvjd.exec:\jvvjd.exe30⤵
- Executes dropped EXE
PID:3968 -
\??\c:\dvpjd.exec:\dvpjd.exe31⤵
- Executes dropped EXE
PID:3588 -
\??\c:\tnhhnh.exec:\tnhhnh.exe32⤵
- Executes dropped EXE
PID:1536 -
\??\c:\jpdvv.exec:\jpdvv.exe33⤵
- Executes dropped EXE
PID:4524 -
\??\c:\bhhnhh.exec:\bhhnhh.exe34⤵
- Executes dropped EXE
PID:5092 -
\??\c:\jvpjd.exec:\jvpjd.exe35⤵
- Executes dropped EXE
PID:1256 -
\??\c:\rxxrlfx.exec:\rxxrlfx.exe36⤵
- Executes dropped EXE
PID:1228 -
\??\c:\tnnnhh.exec:\tnnnhh.exe37⤵
- Executes dropped EXE
PID:3260 -
\??\c:\pjdvv.exec:\pjdvv.exe38⤵
- Executes dropped EXE
PID:3368 -
\??\c:\xxrflfr.exec:\xxrflfr.exe39⤵
- Executes dropped EXE
PID:4320 -
\??\c:\nhhhbt.exec:\nhhhbt.exe40⤵
- Executes dropped EXE
PID:2164 -
\??\c:\thnnhb.exec:\thnnhb.exe41⤵
- Executes dropped EXE
PID:4848 -
\??\c:\jvvpj.exec:\jvvpj.exe42⤵
- Executes dropped EXE
PID:4948 -
\??\c:\xxrrlll.exec:\xxrrlll.exe43⤵
- Executes dropped EXE
PID:5100 -
\??\c:\nhnhhb.exec:\nhnhhb.exe44⤵
- Executes dropped EXE
PID:3460 -
\??\c:\ppvpp.exec:\ppvpp.exe45⤵
- Executes dropped EXE
PID:952 -
\??\c:\ttbttt.exec:\ttbttt.exe46⤵
- Executes dropped EXE
PID:1372 -
\??\c:\9vjpj.exec:\9vjpj.exe47⤵
- Executes dropped EXE
PID:1064 -
\??\c:\flxfxxr.exec:\flxfxxr.exe48⤵
- Executes dropped EXE
PID:3596 -
\??\c:\fflfxxr.exec:\fflfxxr.exe49⤵
- Executes dropped EXE
PID:384 -
\??\c:\tbnhhb.exec:\tbnhhb.exe50⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vppjj.exec:\vppjj.exe51⤵
- Executes dropped EXE
PID:4932 -
\??\c:\lfffxxx.exec:\lfffxxx.exe52⤵
- Executes dropped EXE
PID:4388 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe53⤵
- Executes dropped EXE
PID:4396 -
\??\c:\bhnnnn.exec:\bhnnnn.exe54⤵
- Executes dropped EXE
PID:3592 -
\??\c:\pdjpj.exec:\pdjpj.exe55⤵
- Executes dropped EXE
PID:3532 -
\??\c:\llffffl.exec:\llffffl.exe56⤵
- Executes dropped EXE
PID:1096 -
\??\c:\7rxxxll.exec:\7rxxxll.exe57⤵
- Executes dropped EXE
PID:3556 -
\??\c:\bthhnn.exec:\bthhnn.exe58⤵
- Executes dropped EXE
PID:3876 -
\??\c:\nhhhbb.exec:\nhhhbb.exe59⤵
- Executes dropped EXE
PID:1824 -
\??\c:\ppvpv.exec:\ppvpv.exe60⤵
- Executes dropped EXE
PID:1884 -
\??\c:\fffrllf.exec:\fffrllf.exe61⤵
- Executes dropped EXE
PID:3064 -
\??\c:\bbbbbb.exec:\bbbbbb.exe62⤵
- Executes dropped EXE
PID:2372 -
\??\c:\1vvpj.exec:\1vvpj.exe63⤵
- Executes dropped EXE
PID:4748 -
\??\c:\lllllll.exec:\lllllll.exe64⤵
- Executes dropped EXE
PID:2760 -
\??\c:\nnttnn.exec:\nnttnn.exe65⤵
- Executes dropped EXE
PID:4800 -
\??\c:\nhtbtt.exec:\nhtbtt.exe66⤵
- System Location Discovery: System Language Discovery
PID:4900 -
\??\c:\ddvpp.exec:\ddvpp.exe67⤵PID:3896
-
\??\c:\flrrlll.exec:\flrrlll.exe68⤵PID:3316
-
\??\c:\hntnnh.exec:\hntnnh.exe69⤵PID:1732
-
\??\c:\dvdpj.exec:\dvdpj.exe70⤵PID:2064
-
\??\c:\jppjd.exec:\jppjd.exe71⤵PID:1076
-
\??\c:\rrxrlll.exec:\rrxrlll.exe72⤵PID:1624
-
\??\c:\bbbthh.exec:\bbbthh.exe73⤵PID:1632
-
\??\c:\dvppj.exec:\dvppj.exe74⤵PID:1316
-
\??\c:\pdjdd.exec:\pdjdd.exe75⤵PID:4832
-
\??\c:\rxrrxxl.exec:\rxrrxxl.exe76⤵PID:4444
-
\??\c:\hbtnhb.exec:\hbtnhb.exe77⤵PID:3176
-
\??\c:\pdvjv.exec:\pdvjv.exe78⤵PID:2676
-
\??\c:\frxrfxx.exec:\frxrfxx.exe79⤵PID:2032
-
\??\c:\hbnhth.exec:\hbnhth.exe80⤵PID:1832
-
\??\c:\tnnnhb.exec:\tnnnhb.exe81⤵PID:3720
-
\??\c:\jjvvp.exec:\jjvvp.exe82⤵PID:5016
-
\??\c:\1rffxxr.exec:\1rffxxr.exe83⤵PID:2820
-
\??\c:\nbhbbt.exec:\nbhbbt.exe84⤵PID:2052
-
\??\c:\pdjpj.exec:\pdjpj.exe85⤵PID:3692
-
\??\c:\rrflrfr.exec:\rrflrfr.exe86⤵PID:1460
-
\??\c:\jjjdv.exec:\jjjdv.exe87⤵PID:440
-
\??\c:\lrrrrrr.exec:\lrrrrrr.exe88⤵PID:5052
-
\??\c:\fllfxxr.exec:\fllfxxr.exe89⤵PID:2212
-
\??\c:\hbnnnn.exec:\hbnnnn.exe90⤵PID:4836
-
\??\c:\vdpvv.exec:\vdpvv.exe91⤵PID:4636
-
\??\c:\thnbbb.exec:\thnbbb.exe92⤵PID:2548
-
\??\c:\vdppj.exec:\vdppj.exe93⤵PID:3452
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe94⤵PID:3420
-
\??\c:\lxllffx.exec:\lxllffx.exe95⤵PID:4088
-
\??\c:\hthtnn.exec:\hthtnn.exe96⤵PID:1600
-
\??\c:\vvppp.exec:\vvppp.exe97⤵PID:4344
-
\??\c:\frffxxx.exec:\frffxxx.exe98⤵PID:1464
-
\??\c:\nhtnnn.exec:\nhtnnn.exe99⤵PID:3128
-
\??\c:\tnbbtt.exec:\tnbbtt.exe100⤵PID:3160
-
\??\c:\vpvpp.exec:\vpvpp.exe101⤵PID:5096
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe102⤵PID:2232
-
\??\c:\nnnbbb.exec:\nnnbbb.exe103⤵PID:3020
-
\??\c:\ddjvp.exec:\ddjvp.exe104⤵PID:892
-
\??\c:\1fllflf.exec:\1fllflf.exe105⤵PID:1688
-
\??\c:\rrrllrr.exec:\rrrllrr.exe106⤵PID:3600
-
\??\c:\bttnhh.exec:\bttnhh.exe107⤵PID:1860
-
\??\c:\jjjjp.exec:\jjjjp.exe108⤵PID:1756
-
\??\c:\frlllrr.exec:\frlllrr.exe109⤵PID:2288
-
\??\c:\nthhnn.exec:\nthhnn.exe110⤵PID:4848
-
\??\c:\bbhhht.exec:\bbhhht.exe111⤵PID:4948
-
\??\c:\pdjjj.exec:\pdjjj.exe112⤵PID:5116
-
\??\c:\lflrrxx.exec:\lflrrxx.exe113⤵PID:3932
-
\??\c:\tnnnhh.exec:\tnnnhh.exe114⤵PID:3536
-
\??\c:\jpvpd.exec:\jpvpd.exe115⤵PID:468
-
\??\c:\xrlxxxr.exec:\xrlxxxr.exe116⤵PID:3868
-
\??\c:\3tbthh.exec:\3tbthh.exe117⤵PID:4884
-
\??\c:\pvdjj.exec:\pvdjj.exe118⤵PID:4036
-
\??\c:\xfrrllf.exec:\xfrrllf.exe119⤵PID:4404
-
\??\c:\rllfxxx.exec:\rllfxxx.exe120⤵PID:4412
-
\??\c:\tnnhhb.exec:\tnnhhb.exe121⤵PID:2368
-
\??\c:\1jjdd.exec:\1jjdd.exe122⤵PID:372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-