Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 23:40
Behavioral task
behavioral1
Sample
367117f951c191f84db704c267e23b09f40bc9f28650a699113ce5b4d8c1be5fN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
367117f951c191f84db704c267e23b09f40bc9f28650a699113ce5b4d8c1be5fN.exe
-
Size
86KB
-
MD5
b36805db661243afe925d94ae9c76630
-
SHA1
3bcaae0542055fb95892764c8647d4d80da1292f
-
SHA256
367117f951c191f84db704c267e23b09f40bc9f28650a699113ce5b4d8c1be5f
-
SHA512
6539481703ebadc63c19d2f60135b45e64455f72fbe3d8ff20c920c8115cadc84e04e56f90b8271565db8da39518a4526e30f0f2c1993f9b524d5c8ffe18bf16
-
SSDEEP
1536:0vQBeOGtrYS3srx93UBWfwC6Ggnouy8CUYj7pcKN5Wy78uHDpFO:0hOmTsF93UYfwC6GIoutXZKmCXH9FO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3876-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3960-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2984-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4152-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1160-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1600-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2304-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1868-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4024-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1716-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3760-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1004-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/940-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/868-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2476-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1904-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3004-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1540-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2904-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3484-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1044-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1008-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1756-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3320-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4260-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1596-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3832-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2340-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2380-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1648-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3732-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3272-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1808-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2904-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2752-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1228-464-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1164-492-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-508-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-515-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/380-525-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1128-569-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3852-616-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3412-653-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/548-657-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1368-785-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-1354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1756-1484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2372-1552-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1276-2070-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3960 nnhbnn.exe 2984 hntnhb.exe 1600 vvdpj.exe 1160 xlflflx.exe 4152 3hnbnn.exe 2304 nhnhbb.exe 1868 rfrfffl.exe 4024 nbhbtt.exe 4424 vddjd.exe 1716 1pvvj.exe 3760 xfxlrrf.exe 2252 tttnbb.exe 1004 hhhbnh.exe 2512 dpjvj.exe 5056 7djdj.exe 4664 flfxllf.exe 940 9hhhbt.exe 868 jvpjv.exe 2476 ffxrxrr.exe 1904 ntbhhh.exe 3004 pvddp.exe 1540 rlxlxrl.exe 3240 3nhtnh.exe 2664 btbtnn.exe 2904 7dvjd.exe 4876 vjpjd.exe 3596 frxrffx.exe 3484 bntnhb.exe 1044 jvvvp.exe 4548 fffxlfx.exe 1008 rlffxxr.exe 1756 bhnnhh.exe 3320 djvdv.exe 4420 dvjjv.exe 4260 7rfxxxf.exe 1596 rrxxfff.exe 3832 nnttnn.exe 4600 5ntttt.exe 440 bttnhb.exe 2340 1djdv.exe 5044 dpdvd.exe 2040 flllxxx.exe 2688 xlrxrxr.exe 3604 tnnnnn.exe 1652 vvjdv.exe 3220 dppjj.exe 2352 llxxrfl.exe 2380 fxffxxx.exe 4320 hhttnn.exe 4300 nnnnbb.exe 3876 ddjdd.exe 1936 xrrlxfl.exe 4468 llxxflx.exe 1796 nhhhhh.exe 1400 tntttt.exe 1160 vjppd.exe 4484 fxrlfff.exe 1564 vppvp.exe 1432 xlxxxrr.exe 4768 9jjjj.exe 532 xrrlxxr.exe 400 flrxrxr.exe 4424 pjjjj.exe 4408 lrfxrrr.exe -
resource yara_rule behavioral2/memory/3876-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023c5f-3.dat upx behavioral2/memory/3960-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3876-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023cc6-11.dat upx behavioral2/memory/3960-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cca-14.dat upx behavioral2/memory/2984-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccc-30.dat upx behavioral2/files/0x0007000000023ccd-35.dat upx behavioral2/memory/4152-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1160-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1600-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccb-24.dat upx behavioral2/files/0x0007000000023cce-40.dat upx behavioral2/memory/2304-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccf-46.dat upx behavioral2/memory/1868-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd0-51.dat upx behavioral2/memory/4024-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd1-58.dat upx behavioral2/memory/4424-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd2-62.dat upx behavioral2/memory/1716-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd3-68.dat upx behavioral2/memory/3760-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd4-74.dat upx behavioral2/memory/1004-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd5-81.dat upx behavioral2/files/0x0007000000023cd6-85.dat upx behavioral2/files/0x0007000000023cd8-90.dat upx behavioral2/files/0x0007000000023cd9-95.dat upx behavioral2/memory/4664-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cda-101.dat upx behavioral2/memory/940-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cdb-109.dat upx behavioral2/memory/868-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cdc-113.dat upx behavioral2/memory/2476-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1904-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cdd-121.dat upx behavioral2/memory/3004-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cde-128.dat upx behavioral2/files/0x0007000000023cdf-132.dat upx behavioral2/memory/1540-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3240-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce0-139.dat upx behavioral2/memory/2664-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce1-143.dat upx behavioral2/files/0x0007000000023ce3-155.dat upx behavioral2/files/0x0007000000023ce2-152.dat upx behavioral2/memory/2904-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce4-160.dat upx behavioral2/files/0x0008000000023cc7-165.dat upx behavioral2/memory/3484-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce5-173.dat upx behavioral2/memory/1044-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce7-177.dat upx behavioral2/files/0x0007000000023ce8-182.dat upx behavioral2/memory/1008-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1756-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3320-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3320-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4420-197-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3876 wrote to memory of 3960 3876 367117f951c191f84db704c267e23b09f40bc9f28650a699113ce5b4d8c1be5fN.exe 83 PID 3876 wrote to memory of 3960 3876 367117f951c191f84db704c267e23b09f40bc9f28650a699113ce5b4d8c1be5fN.exe 83 PID 3876 wrote to memory of 3960 3876 367117f951c191f84db704c267e23b09f40bc9f28650a699113ce5b4d8c1be5fN.exe 83 PID 3960 wrote to memory of 2984 3960 nnhbnn.exe 84 PID 3960 wrote to memory of 2984 3960 nnhbnn.exe 84 PID 3960 wrote to memory of 2984 3960 nnhbnn.exe 84 PID 2984 wrote to memory of 1600 2984 hntnhb.exe 85 PID 2984 wrote to memory of 1600 2984 hntnhb.exe 85 PID 2984 wrote to memory of 1600 2984 hntnhb.exe 85 PID 1600 wrote to memory of 1160 1600 vvdpj.exe 86 PID 1600 wrote to memory of 1160 1600 vvdpj.exe 86 PID 1600 wrote to memory of 1160 1600 vvdpj.exe 86 PID 1160 wrote to memory of 4152 1160 xlflflx.exe 87 PID 1160 wrote to memory of 4152 1160 xlflflx.exe 87 PID 1160 wrote to memory of 4152 1160 xlflflx.exe 87 PID 4152 wrote to memory of 2304 4152 3hnbnn.exe 88 PID 4152 wrote to memory of 2304 4152 3hnbnn.exe 88 PID 4152 wrote to memory of 2304 4152 3hnbnn.exe 88 PID 2304 wrote to memory of 1868 2304 nhnhbb.exe 89 PID 2304 wrote to memory of 1868 2304 nhnhbb.exe 89 PID 2304 wrote to memory of 1868 2304 nhnhbb.exe 89 PID 1868 wrote to memory of 4024 1868 rfrfffl.exe 90 PID 1868 wrote to memory of 4024 1868 rfrfffl.exe 90 PID 1868 wrote to memory of 4024 1868 rfrfffl.exe 90 PID 4024 wrote to memory of 4424 4024 nbhbtt.exe 91 PID 4024 wrote to memory of 4424 4024 nbhbtt.exe 91 PID 4024 wrote to memory of 4424 4024 nbhbtt.exe 91 PID 4424 wrote to memory of 1716 4424 vddjd.exe 92 PID 4424 wrote to memory of 1716 4424 vddjd.exe 92 PID 4424 wrote to memory of 1716 4424 vddjd.exe 92 PID 1716 wrote to memory of 3760 1716 1pvvj.exe 93 PID 1716 wrote to memory of 3760 1716 1pvvj.exe 93 PID 1716 wrote to memory of 3760 1716 1pvvj.exe 93 PID 3760 wrote to memory of 2252 3760 xfxlrrf.exe 94 PID 3760 wrote to memory of 2252 3760 xfxlrrf.exe 94 PID 3760 wrote to memory of 2252 3760 xfxlrrf.exe 94 PID 2252 wrote to memory of 1004 2252 tttnbb.exe 95 PID 2252 wrote to memory of 1004 2252 tttnbb.exe 95 PID 2252 wrote to memory of 1004 2252 tttnbb.exe 95 PID 1004 wrote to memory of 2512 1004 hhhbnh.exe 96 PID 1004 wrote to memory of 2512 1004 hhhbnh.exe 96 PID 1004 wrote to memory of 2512 1004 hhhbnh.exe 96 PID 2512 wrote to memory of 5056 2512 dpjvj.exe 97 PID 2512 wrote to memory of 5056 2512 dpjvj.exe 97 PID 2512 wrote to memory of 5056 2512 dpjvj.exe 97 PID 5056 wrote to memory of 4664 5056 7djdj.exe 98 PID 5056 wrote to memory of 4664 5056 7djdj.exe 98 PID 5056 wrote to memory of 4664 5056 7djdj.exe 98 PID 4664 wrote to memory of 940 4664 flfxllf.exe 99 PID 4664 wrote to memory of 940 4664 flfxllf.exe 99 PID 4664 wrote to memory of 940 4664 flfxllf.exe 99 PID 940 wrote to memory of 868 940 9hhhbt.exe 100 PID 940 wrote to memory of 868 940 9hhhbt.exe 100 PID 940 wrote to memory of 868 940 9hhhbt.exe 100 PID 868 wrote to memory of 2476 868 jvpjv.exe 101 PID 868 wrote to memory of 2476 868 jvpjv.exe 101 PID 868 wrote to memory of 2476 868 jvpjv.exe 101 PID 2476 wrote to memory of 1904 2476 ffxrxrr.exe 102 PID 2476 wrote to memory of 1904 2476 ffxrxrr.exe 102 PID 2476 wrote to memory of 1904 2476 ffxrxrr.exe 102 PID 1904 wrote to memory of 3004 1904 ntbhhh.exe 103 PID 1904 wrote to memory of 3004 1904 ntbhhh.exe 103 PID 1904 wrote to memory of 3004 1904 ntbhhh.exe 103 PID 3004 wrote to memory of 1540 3004 pvddp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\367117f951c191f84db704c267e23b09f40bc9f28650a699113ce5b4d8c1be5fN.exe"C:\Users\Admin\AppData\Local\Temp\367117f951c191f84db704c267e23b09f40bc9f28650a699113ce5b4d8c1be5fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\nnhbnn.exec:\nnhbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\hntnhb.exec:\hntnhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\vvdpj.exec:\vvdpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\xlflflx.exec:\xlflflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\3hnbnn.exec:\3hnbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\nhnhbb.exec:\nhnhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\rfrfffl.exec:\rfrfffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\nbhbtt.exec:\nbhbtt.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\vddjd.exec:\vddjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\1pvvj.exec:\1pvvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\xfxlrrf.exec:\xfxlrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\tttnbb.exec:\tttnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\hhhbnh.exec:\hhhbnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\dpjvj.exec:\dpjvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\7djdj.exec:\7djdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\flfxllf.exec:\flfxllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\9hhhbt.exec:\9hhhbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\jvpjv.exec:\jvpjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\ffxrxrr.exec:\ffxrxrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\ntbhhh.exec:\ntbhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\pvddp.exec:\pvddp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\rlxlxrl.exec:\rlxlxrl.exe23⤵
- Executes dropped EXE
PID:1540 -
\??\c:\3nhtnh.exec:\3nhtnh.exe24⤵
- Executes dropped EXE
PID:3240 -
\??\c:\btbtnn.exec:\btbtnn.exe25⤵
- Executes dropped EXE
PID:2664 -
\??\c:\7dvjd.exec:\7dvjd.exe26⤵
- Executes dropped EXE
PID:2904 -
\??\c:\vjpjd.exec:\vjpjd.exe27⤵
- Executes dropped EXE
PID:4876 -
\??\c:\frxrffx.exec:\frxrffx.exe28⤵
- Executes dropped EXE
PID:3596 -
\??\c:\bntnhb.exec:\bntnhb.exe29⤵
- Executes dropped EXE
PID:3484 -
\??\c:\jvvvp.exec:\jvvvp.exe30⤵
- Executes dropped EXE
PID:1044 -
\??\c:\fffxlfx.exec:\fffxlfx.exe31⤵
- Executes dropped EXE
PID:4548 -
\??\c:\rlffxxr.exec:\rlffxxr.exe32⤵
- Executes dropped EXE
PID:1008 -
\??\c:\bhnnhh.exec:\bhnnhh.exe33⤵
- Executes dropped EXE
PID:1756 -
\??\c:\djvdv.exec:\djvdv.exe34⤵
- Executes dropped EXE
PID:3320 -
\??\c:\dvjjv.exec:\dvjjv.exe35⤵
- Executes dropped EXE
PID:4420 -
\??\c:\7rfxxxf.exec:\7rfxxxf.exe36⤵
- Executes dropped EXE
PID:4260 -
\??\c:\rrxxfff.exec:\rrxxfff.exe37⤵
- Executes dropped EXE
PID:1596 -
\??\c:\nnttnn.exec:\nnttnn.exe38⤵
- Executes dropped EXE
PID:3832 -
\??\c:\5ntttt.exec:\5ntttt.exe39⤵
- Executes dropped EXE
PID:4600 -
\??\c:\bttnhb.exec:\bttnhb.exe40⤵
- Executes dropped EXE
PID:440 -
\??\c:\1djdv.exec:\1djdv.exe41⤵
- Executes dropped EXE
PID:2340 -
\??\c:\dpdvd.exec:\dpdvd.exe42⤵
- Executes dropped EXE
PID:5044 -
\??\c:\flllxxx.exec:\flllxxx.exe43⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xlrxrxr.exec:\xlrxrxr.exe44⤵
- Executes dropped EXE
PID:2688 -
\??\c:\tnnnnn.exec:\tnnnnn.exe45⤵
- Executes dropped EXE
PID:3604 -
\??\c:\vvjdv.exec:\vvjdv.exe46⤵
- Executes dropped EXE
PID:1652 -
\??\c:\dppjj.exec:\dppjj.exe47⤵
- Executes dropped EXE
PID:3220 -
\??\c:\llxxrfl.exec:\llxxrfl.exe48⤵
- Executes dropped EXE
PID:2352 -
\??\c:\fxffxxx.exec:\fxffxxx.exe49⤵
- Executes dropped EXE
PID:2380 -
\??\c:\hhttnn.exec:\hhttnn.exe50⤵
- Executes dropped EXE
PID:4320 -
\??\c:\nnnnbb.exec:\nnnnbb.exe51⤵
- Executes dropped EXE
PID:4300 -
\??\c:\ddjdd.exec:\ddjdd.exe52⤵
- Executes dropped EXE
PID:3876 -
\??\c:\xrrlxfl.exec:\xrrlxfl.exe53⤵
- Executes dropped EXE
PID:1936 -
\??\c:\llxxflx.exec:\llxxflx.exe54⤵
- Executes dropped EXE
PID:4468 -
\??\c:\nhhhhh.exec:\nhhhhh.exe55⤵
- Executes dropped EXE
PID:1796 -
\??\c:\tntttt.exec:\tntttt.exe56⤵
- Executes dropped EXE
PID:1400 -
\??\c:\vjppd.exec:\vjppd.exe57⤵
- Executes dropped EXE
PID:1160 -
\??\c:\fxrlfff.exec:\fxrlfff.exe58⤵
- Executes dropped EXE
PID:4484 -
\??\c:\vppvp.exec:\vppvp.exe59⤵
- Executes dropped EXE
PID:1564 -
\??\c:\xlxxxrr.exec:\xlxxxrr.exe60⤵
- Executes dropped EXE
PID:1432 -
\??\c:\9jjjj.exec:\9jjjj.exe61⤵
- Executes dropped EXE
PID:4768 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:532 -
\??\c:\flrxrxr.exec:\flrxrxr.exe63⤵
- Executes dropped EXE
PID:400 -
\??\c:\pjjjj.exec:\pjjjj.exe64⤵
- Executes dropped EXE
PID:4424 -
\??\c:\lrfxrrr.exec:\lrfxrrr.exe65⤵
- Executes dropped EXE
PID:4408 -
\??\c:\vjjjj.exec:\vjjjj.exe66⤵PID:3100
-
\??\c:\3ppjd.exec:\3ppjd.exe67⤵PID:2432
-
\??\c:\fffxrrl.exec:\fffxrrl.exe68⤵PID:2872
-
\??\c:\hnnhhh.exec:\hnnhhh.exe69⤵PID:4492
-
\??\c:\pvddv.exec:\pvddv.exe70⤵PID:1648
-
\??\c:\vdjpp.exec:\vdjpp.exe71⤵PID:3732
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe72⤵PID:3460
-
\??\c:\lflffll.exec:\lflffll.exe73⤵PID:2560
-
\??\c:\hntnhh.exec:\hntnhh.exe74⤵PID:3272
-
\??\c:\jppjd.exec:\jppjd.exe75⤵PID:940
-
\??\c:\lrffrrr.exec:\lrffrrr.exe76⤵PID:3840
-
\??\c:\7bntnn.exec:\7bntnn.exe77⤵PID:2820
-
\??\c:\9btthh.exec:\9btthh.exe78⤵PID:1916
-
\??\c:\pvvpp.exec:\pvvpp.exe79⤵PID:1808
-
\??\c:\jvjdv.exec:\jvjdv.exe80⤵PID:2800
-
\??\c:\rxlfrrr.exec:\rxlfrrr.exe81⤵PID:3720
-
\??\c:\ffrrllf.exec:\ffrrllf.exe82⤵PID:1060
-
\??\c:\hbnnbb.exec:\hbnnbb.exe83⤵PID:1348
-
\??\c:\hnttnn.exec:\hnttnn.exe84⤵PID:2184
-
\??\c:\jjdpj.exec:\jjdpj.exe85⤵PID:2676
-
\??\c:\frxrrrr.exec:\frxrrrr.exe86⤵PID:3224
-
\??\c:\frxrlfx.exec:\frxrlfx.exe87⤵PID:2904
-
\??\c:\thhbtt.exec:\thhbtt.exe88⤵PID:872
-
\??\c:\btbtnt.exec:\btbtnt.exe89⤵PID:4132
-
\??\c:\dvppp.exec:\dvppp.exe90⤵PID:1464
-
\??\c:\vpvvp.exec:\vpvvp.exe91⤵PID:4028
-
\??\c:\llllfff.exec:\llllfff.exe92⤵PID:3064
-
\??\c:\xxxfxxx.exec:\xxxfxxx.exe93⤵PID:1256
-
\??\c:\3bhbhb.exec:\3bhbhb.exe94⤵PID:404
-
\??\c:\hntnhh.exec:\hntnhh.exe95⤵PID:4432
-
\??\c:\vpppp.exec:\vpppp.exe96⤵PID:4724
-
\??\c:\llrrxfl.exec:\llrrxfl.exe97⤵PID:644
-
\??\c:\flrrlll.exec:\flrrlll.exe98⤵PID:2752
-
\??\c:\btbbbh.exec:\btbbbh.exe99⤵PID:4260
-
\??\c:\btbhhh.exec:\btbhhh.exe100⤵PID:2860
-
\??\c:\1vpjd.exec:\1vpjd.exe101⤵PID:3852
-
\??\c:\djppj.exec:\djppj.exe102⤵PID:5032
-
\??\c:\rrlllll.exec:\rrlllll.exe103⤵PID:3300
-
\??\c:\3frllll.exec:\3frllll.exe104⤵PID:2856
-
\??\c:\hhbnhh.exec:\hhbnhh.exe105⤵PID:3872
-
\??\c:\ttbhnt.exec:\ttbhnt.exe106⤵PID:4532
-
\??\c:\dvdvj.exec:\dvdvj.exe107⤵PID:3636
-
\??\c:\vvdvd.exec:\vvdvd.exe108⤵PID:3744
-
\??\c:\lxxrlrl.exec:\lxxrlrl.exe109⤵PID:1696
-
\??\c:\frffffx.exec:\frffffx.exe110⤵PID:3012
-
\??\c:\nhhhbb.exec:\nhhhbb.exe111⤵PID:5024
-
\??\c:\jdjjd.exec:\jdjjd.exe112⤵
- System Location Discovery: System Language Discovery
PID:4556 -
\??\c:\rrfxrxx.exec:\rrfxrxx.exe113⤵PID:4320
-
\??\c:\xlrrlrr.exec:\xlrrlrr.exe114⤵PID:4300
-
\??\c:\hhhhnb.exec:\hhhhnb.exe115⤵PID:4560
-
\??\c:\nhbbnn.exec:\nhbbnn.exe116⤵PID:3704
-
\??\c:\jdpjj.exec:\jdpjj.exe117⤵PID:1228
-
\??\c:\1lxrrxx.exec:\1lxrrxx.exe118⤵PID:1796
-
\??\c:\rrxxrrf.exec:\rrxxrrf.exe119⤵PID:1420
-
\??\c:\hbbbth.exec:\hbbbth.exe120⤵PID:3076
-
\??\c:\nbhbnh.exec:\nbhbnh.exe121⤵PID:2304
-
\??\c:\vppjv.exec:\vppjv.exe122⤵PID:692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-