Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 23:41
Behavioral task
behavioral1
Sample
793476a92cde3a6c1e090d175961fa8c6eb77d87047dc62a675c494d05035f12N.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
120 seconds
General
-
Target
793476a92cde3a6c1e090d175961fa8c6eb77d87047dc62a675c494d05035f12N.exe
-
Size
345KB
-
MD5
12c8264dcad70c360e85b595f0eacdb0
-
SHA1
ec9f700846c98b8ff0887b51fd72f8e853733746
-
SHA256
793476a92cde3a6c1e090d175961fa8c6eb77d87047dc62a675c494d05035f12
-
SHA512
f677805ba0ee473024763331a7e075e1c0a6b0e98e08afd8a51e51210a009c26deeeb43ae4c28168a36f38d4d5ee3dbf662e3bc191cf9bbb8043e2ca1bb1046c
-
SSDEEP
6144:Lcm4FmowdHoSEYW5fNZWB5hFfci3Add4kGYAb:R4wFHoS3WXZshJX2VGdb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2240-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/644-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1432-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3964-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4152-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2444-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1128-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4756-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4116-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1708-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2816-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/392-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3744-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1212-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3632-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1636-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2176-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4184-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2032-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3920-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2648-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1936-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4760-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3348-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2260-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3440-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1932-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3964-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1720-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-513-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-598-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3396-1001-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2040-1390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2240 fxllfll.exe 4780 nbbtnn.exe 1928 btttnn.exe 4304 9vvpd.exe 4888 rrxxrxr.exe 644 bbnhhh.exe 1432 hhbtbb.exe 5032 lfxlfxr.exe 5064 nbbbhh.exe 4956 lfrrrll.exe 3964 hbtttn.exe 3652 lrxlxxr.exe 3456 tnnbbt.exe 4152 djjdv.exe 2444 pvpdd.exe 8 nhbbtt.exe 3584 7xrlllf.exe 5040 thnhhn.exe 1128 pvppp.exe 4756 bbhbtn.exe 3516 jjjjj.exe 2828 bbnhhn.exe 4116 ddpvp.exe 3348 bbbhhn.exe 1708 1hhhbh.exe 872 ddjjj.exe 3376 rrrxxxl.exe 2816 tbttnn.exe 2920 pdjpv.exe 4976 hthnnb.exe 392 7lfflrr.exe 3744 pvdvd.exe 5012 1xfllrr.exe 748 bbnhhh.exe 4668 ddjdd.exe 2160 fxxxxfx.exe 1440 rfxxrfl.exe 4824 ttttnn.exe 1212 jpvvp.exe 3632 5rxxxrl.exe 1636 3nbbhn.exe 2176 dpjvj.exe 4432 lxlrffr.exe 3020 xlfxrrr.exe 2948 3vdpd.exe 2088 ffllflf.exe 2776 tntnhn.exe 4184 djppj.exe 4580 rlxxrrl.exe 2032 nbhbtt.exe 464 jvdvp.exe 3920 rxffxxx.exe 3944 tnnhhb.exe 2536 jdvvp.exe 2648 nntthh.exe 380 jpddp.exe 4512 nntnbb.exe 2412 nhtbbb.exe 2588 jjjdv.exe 2492 xrxrllf.exe 552 nhbbtt.exe 2664 hnbbbh.exe 1336 vjjjd.exe 4304 rrlrrrl.exe -
resource yara_rule behavioral2/memory/2756-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023bc7-3.dat upx behavioral2/memory/2240-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2756-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023caf-9.dat upx behavioral2/memory/4780-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbd-12.dat upx behavioral2/memory/4780-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1928-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbf-20.dat upx behavioral2/files/0x0007000000023cc0-24.dat upx behavioral2/memory/4888-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc1-30.dat upx behavioral2/memory/644-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc2-34.dat upx behavioral2/files/0x0007000000023cc3-38.dat upx behavioral2/memory/1432-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc4-43.dat upx behavioral2/memory/5032-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc5-48.dat upx behavioral2/memory/5064-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4956-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3964-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc6-53.dat upx behavioral2/files/0x0007000000023cc7-59.dat upx behavioral2/memory/3652-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3964-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc8-66.dat upx behavioral2/memory/3652-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc9-71.dat upx behavioral2/memory/4152-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cca-76.dat upx behavioral2/memory/4152-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023cba-82.dat upx behavioral2/memory/3456-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccc-86.dat upx behavioral2/memory/2444-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccd-90.dat upx behavioral2/memory/3584-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5040-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cce-96.dat upx behavioral2/files/0x0007000000023ccf-100.dat upx behavioral2/memory/1128-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4756-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd0-106.dat upx behavioral2/files/0x0007000000023cd1-110.dat upx behavioral2/memory/3516-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd2-115.dat upx behavioral2/files/0x0007000000023cd3-119.dat upx behavioral2/memory/4116-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd4-124.dat upx behavioral2/memory/1708-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd5-129.dat upx behavioral2/files/0x0007000000023cd6-133.dat upx behavioral2/memory/872-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd7-138.dat upx behavioral2/memory/2816-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd8-144.dat upx behavioral2/files/0x0007000000023cd9-147.dat upx behavioral2/files/0x0007000000023cda-150.dat upx behavioral2/memory/4976-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/392-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cdb-157.dat upx behavioral2/memory/3744-161-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3flllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxrxr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2240 2756 793476a92cde3a6c1e090d175961fa8c6eb77d87047dc62a675c494d05035f12N.exe 83 PID 2756 wrote to memory of 2240 2756 793476a92cde3a6c1e090d175961fa8c6eb77d87047dc62a675c494d05035f12N.exe 83 PID 2756 wrote to memory of 2240 2756 793476a92cde3a6c1e090d175961fa8c6eb77d87047dc62a675c494d05035f12N.exe 83 PID 2240 wrote to memory of 4780 2240 fxllfll.exe 84 PID 2240 wrote to memory of 4780 2240 fxllfll.exe 84 PID 2240 wrote to memory of 4780 2240 fxllfll.exe 84 PID 4780 wrote to memory of 1928 4780 nbbtnn.exe 85 PID 4780 wrote to memory of 1928 4780 nbbtnn.exe 85 PID 4780 wrote to memory of 1928 4780 nbbtnn.exe 85 PID 1928 wrote to memory of 4304 1928 btttnn.exe 86 PID 1928 wrote to memory of 4304 1928 btttnn.exe 86 PID 1928 wrote to memory of 4304 1928 btttnn.exe 86 PID 4304 wrote to memory of 4888 4304 9vvpd.exe 87 PID 4304 wrote to memory of 4888 4304 9vvpd.exe 87 PID 4304 wrote to memory of 4888 4304 9vvpd.exe 87 PID 4888 wrote to memory of 644 4888 rrxxrxr.exe 88 PID 4888 wrote to memory of 644 4888 rrxxrxr.exe 88 PID 4888 wrote to memory of 644 4888 rrxxrxr.exe 88 PID 644 wrote to memory of 1432 644 bbnhhh.exe 89 PID 644 wrote to memory of 1432 644 bbnhhh.exe 89 PID 644 wrote to memory of 1432 644 bbnhhh.exe 89 PID 1432 wrote to memory of 5032 1432 hhbtbb.exe 90 PID 1432 wrote to memory of 5032 1432 hhbtbb.exe 90 PID 1432 wrote to memory of 5032 1432 hhbtbb.exe 90 PID 5032 wrote to memory of 5064 5032 lfxlfxr.exe 91 PID 5032 wrote to memory of 5064 5032 lfxlfxr.exe 91 PID 5032 wrote to memory of 5064 5032 lfxlfxr.exe 91 PID 5064 wrote to memory of 4956 5064 nbbbhh.exe 92 PID 5064 wrote to memory of 4956 5064 nbbbhh.exe 92 PID 5064 wrote to memory of 4956 5064 nbbbhh.exe 92 PID 4956 wrote to memory of 3964 4956 lfrrrll.exe 93 PID 4956 wrote to memory of 3964 4956 lfrrrll.exe 93 PID 4956 wrote to memory of 3964 4956 lfrrrll.exe 93 PID 3964 wrote to memory of 3652 3964 hbtttn.exe 94 PID 3964 wrote to memory of 3652 3964 hbtttn.exe 94 PID 3964 wrote to memory of 3652 3964 hbtttn.exe 94 PID 3652 wrote to memory of 3456 3652 lrxlxxr.exe 95 PID 3652 wrote to memory of 3456 3652 lrxlxxr.exe 95 PID 3652 wrote to memory of 3456 3652 lrxlxxr.exe 95 PID 3456 wrote to memory of 4152 3456 tnnbbt.exe 96 PID 3456 wrote to memory of 4152 3456 tnnbbt.exe 96 PID 3456 wrote to memory of 4152 3456 tnnbbt.exe 96 PID 4152 wrote to memory of 2444 4152 djjdv.exe 97 PID 4152 wrote to memory of 2444 4152 djjdv.exe 97 PID 4152 wrote to memory of 2444 4152 djjdv.exe 97 PID 2444 wrote to memory of 8 2444 pvpdd.exe 98 PID 2444 wrote to memory of 8 2444 pvpdd.exe 98 PID 2444 wrote to memory of 8 2444 pvpdd.exe 98 PID 8 wrote to memory of 3584 8 nhbbtt.exe 99 PID 8 wrote to memory of 3584 8 nhbbtt.exe 99 PID 8 wrote to memory of 3584 8 nhbbtt.exe 99 PID 3584 wrote to memory of 5040 3584 7xrlllf.exe 100 PID 3584 wrote to memory of 5040 3584 7xrlllf.exe 100 PID 3584 wrote to memory of 5040 3584 7xrlllf.exe 100 PID 5040 wrote to memory of 1128 5040 thnhhn.exe 101 PID 5040 wrote to memory of 1128 5040 thnhhn.exe 101 PID 5040 wrote to memory of 1128 5040 thnhhn.exe 101 PID 1128 wrote to memory of 4756 1128 pvppp.exe 102 PID 1128 wrote to memory of 4756 1128 pvppp.exe 102 PID 1128 wrote to memory of 4756 1128 pvppp.exe 102 PID 4756 wrote to memory of 3516 4756 bbhbtn.exe 103 PID 4756 wrote to memory of 3516 4756 bbhbtn.exe 103 PID 4756 wrote to memory of 3516 4756 bbhbtn.exe 103 PID 3516 wrote to memory of 2828 3516 jjjjj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\793476a92cde3a6c1e090d175961fa8c6eb77d87047dc62a675c494d05035f12N.exe"C:\Users\Admin\AppData\Local\Temp\793476a92cde3a6c1e090d175961fa8c6eb77d87047dc62a675c494d05035f12N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\fxllfll.exec:\fxllfll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\nbbtnn.exec:\nbbtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\btttnn.exec:\btttnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\9vvpd.exec:\9vvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\rrxxrxr.exec:\rrxxrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\bbnhhh.exec:\bbnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\hhbtbb.exec:\hhbtbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\lfxlfxr.exec:\lfxlfxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\nbbbhh.exec:\nbbbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\lfrrrll.exec:\lfrrrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\hbtttn.exec:\hbtttn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\lrxlxxr.exec:\lrxlxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\tnnbbt.exec:\tnnbbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\djjdv.exec:\djjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\pvpdd.exec:\pvpdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\nhbbtt.exec:\nhbbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\7xrlllf.exec:\7xrlllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\thnhhn.exec:\thnhhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\pvppp.exec:\pvppp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\bbhbtn.exec:\bbhbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\jjjjj.exec:\jjjjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\bbnhhn.exec:\bbnhhn.exe23⤵
- Executes dropped EXE
PID:2828 -
\??\c:\ddpvp.exec:\ddpvp.exe24⤵
- Executes dropped EXE
PID:4116 -
\??\c:\bbbhhn.exec:\bbbhhn.exe25⤵
- Executes dropped EXE
PID:3348 -
\??\c:\1hhhbh.exec:\1hhhbh.exe26⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ddjjj.exec:\ddjjj.exe27⤵
- Executes dropped EXE
PID:872 -
\??\c:\rrrxxxl.exec:\rrrxxxl.exe28⤵
- Executes dropped EXE
PID:3376 -
\??\c:\tbttnn.exec:\tbttnn.exe29⤵
- Executes dropped EXE
PID:2816 -
\??\c:\pdjpv.exec:\pdjpv.exe30⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hthnnb.exec:\hthnnb.exe31⤵
- Executes dropped EXE
PID:4976 -
\??\c:\7lfflrr.exec:\7lfflrr.exe32⤵
- Executes dropped EXE
PID:392 -
\??\c:\pvdvd.exec:\pvdvd.exe33⤵
- Executes dropped EXE
PID:3744 -
\??\c:\1xfllrr.exec:\1xfllrr.exe34⤵
- Executes dropped EXE
PID:5012 -
\??\c:\bbnhhh.exec:\bbnhhh.exe35⤵
- Executes dropped EXE
PID:748 -
\??\c:\ddjdd.exec:\ddjdd.exe36⤵
- Executes dropped EXE
PID:4668 -
\??\c:\fxxxxfx.exec:\fxxxxfx.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2160 -
\??\c:\rfxxrfl.exec:\rfxxrfl.exe38⤵
- Executes dropped EXE
PID:1440 -
\??\c:\ttttnn.exec:\ttttnn.exe39⤵
- Executes dropped EXE
PID:4824 -
\??\c:\jpvvp.exec:\jpvvp.exe40⤵
- Executes dropped EXE
PID:1212 -
\??\c:\5rxxxrl.exec:\5rxxxrl.exe41⤵
- Executes dropped EXE
PID:3632 -
\??\c:\3nbbhn.exec:\3nbbhn.exe42⤵
- Executes dropped EXE
PID:1636 -
\??\c:\dpjvj.exec:\dpjvj.exe43⤵
- Executes dropped EXE
PID:2176 -
\??\c:\lxlrffr.exec:\lxlrffr.exe44⤵
- Executes dropped EXE
PID:4432 -
\??\c:\xlfxrrr.exec:\xlfxrrr.exe45⤵
- Executes dropped EXE
PID:3020 -
\??\c:\3vdpd.exec:\3vdpd.exe46⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ffllflf.exec:\ffllflf.exe47⤵
- Executes dropped EXE
PID:2088 -
\??\c:\tntnhn.exec:\tntnhn.exe48⤵
- Executes dropped EXE
PID:2776 -
\??\c:\djppj.exec:\djppj.exe49⤵
- Executes dropped EXE
PID:4184 -
\??\c:\rlxxrrl.exec:\rlxxrrl.exe50⤵
- Executes dropped EXE
PID:4580 -
\??\c:\nbhbtt.exec:\nbhbtt.exe51⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jvdvp.exec:\jvdvp.exe52⤵
- Executes dropped EXE
PID:464 -
\??\c:\rxffxxx.exec:\rxffxxx.exe53⤵
- Executes dropped EXE
PID:3920 -
\??\c:\tnnhhb.exec:\tnnhhb.exe54⤵
- Executes dropped EXE
PID:3944 -
\??\c:\jdvvp.exec:\jdvvp.exe55⤵
- Executes dropped EXE
PID:2536 -
\??\c:\nntthh.exec:\nntthh.exe56⤵
- Executes dropped EXE
PID:2648 -
\??\c:\jpddp.exec:\jpddp.exe57⤵
- Executes dropped EXE
PID:380 -
\??\c:\nntnbb.exec:\nntnbb.exe58⤵
- Executes dropped EXE
PID:4512 -
\??\c:\nhtbbb.exec:\nhtbbb.exe59⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jjjdv.exec:\jjjdv.exe60⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xrxrllf.exec:\xrxrllf.exe61⤵
- Executes dropped EXE
PID:2492 -
\??\c:\nhbbtt.exec:\nhbbtt.exe62⤵
- Executes dropped EXE
PID:552 -
\??\c:\hnbbbh.exec:\hnbbbh.exe63⤵
- Executes dropped EXE
PID:2664 -
\??\c:\vjjjd.exec:\vjjjd.exe64⤵
- Executes dropped EXE
PID:1336 -
\??\c:\rrlrrrl.exec:\rrlrrrl.exe65⤵
- Executes dropped EXE
PID:4304 -
\??\c:\nhnhhh.exec:\nhnhhh.exe66⤵PID:4888
-
\??\c:\vvvpj.exec:\vvvpj.exe67⤵PID:3948
-
\??\c:\ddppj.exec:\ddppj.exe68⤵PID:588
-
\??\c:\3ttnnt.exec:\3ttnnt.exe69⤵PID:116
-
\??\c:\tnhbbb.exec:\tnhbbb.exe70⤵PID:1696
-
\??\c:\vjjdp.exec:\vjjdp.exe71⤵PID:1936
-
\??\c:\lfrrflx.exec:\lfrrflx.exe72⤵PID:4968
-
\??\c:\ntbhbn.exec:\ntbhbn.exe73⤵PID:5064
-
\??\c:\ppjdj.exec:\ppjdj.exe74⤵PID:4936
-
\??\c:\rfrrrxf.exec:\rfrrrxf.exe75⤵PID:3360
-
\??\c:\nnnnnn.exec:\nnnnnn.exe76⤵PID:3668
-
\??\c:\dddjv.exec:\dddjv.exe77⤵PID:4880
-
\??\c:\pvvvv.exec:\pvvvv.exe78⤵PID:4344
-
\??\c:\xrfxxll.exec:\xrfxxll.exe79⤵PID:5056
-
\??\c:\tbntbh.exec:\tbntbh.exe80⤵PID:3100
-
\??\c:\pjpjd.exec:\pjpjd.exe81⤵PID:4760
-
\??\c:\xrfxfff.exec:\xrfxfff.exe82⤵PID:880
-
\??\c:\flfxrlf.exec:\flfxrlf.exe83⤵PID:3308
-
\??\c:\hbnnhh.exec:\hbnnhh.exe84⤵PID:3616
-
\??\c:\jvdvp.exec:\jvdvp.exe85⤵PID:3152
-
\??\c:\rxlrlfx.exec:\rxlrlfx.exe86⤵PID:3584
-
\??\c:\htbbbb.exec:\htbbbb.exe87⤵PID:2224
-
\??\c:\bttnnh.exec:\bttnnh.exe88⤵PID:4616
-
\??\c:\3pvvv.exec:\3pvvv.exe89⤵PID:3812
-
\??\c:\rflfxxx.exec:\rflfxxx.exe90⤵PID:4756
-
\??\c:\nbhbbb.exec:\nbhbbb.exe91⤵PID:2392
-
\??\c:\9nttnn.exec:\9nttnn.exe92⤵PID:3860
-
\??\c:\jvvjv.exec:\jvvjv.exe93⤵PID:4952
-
\??\c:\xlrlllf.exec:\xlrlllf.exe94⤵PID:4124
-
\??\c:\5tnhhn.exec:\5tnhhn.exe95⤵PID:3852
-
\??\c:\3bttnn.exec:\3bttnn.exe96⤵PID:3348
-
\??\c:\vppvv.exec:\vppvv.exe97⤵PID:2260
-
\??\c:\lflffll.exec:\lflffll.exe98⤵PID:4000
-
\??\c:\nbhhhn.exec:\nbhhhn.exe99⤵PID:3564
-
\??\c:\ddjpp.exec:\ddjpp.exe100⤵PID:1752
-
\??\c:\xfxxrrl.exec:\xfxxrrl.exe101⤵PID:3440
-
\??\c:\xfffxxx.exec:\xfffxxx.exe102⤵PID:4008
-
\??\c:\ntttnn.exec:\ntttnn.exe103⤵PID:1932
-
\??\c:\dvjvj.exec:\dvjvj.exe104⤵PID:4664
-
\??\c:\rrlrrrr.exec:\rrlrrrr.exe105⤵PID:2108
-
\??\c:\thnnhn.exec:\thnnhn.exe106⤵PID:2668
-
\??\c:\jpvpj.exec:\jpvpj.exe107⤵PID:3744
-
\??\c:\llffxxx.exec:\llffxxx.exe108⤵PID:3940
-
\??\c:\thhhhb.exec:\thhhhb.exe109⤵PID:2016
-
\??\c:\pjvvd.exec:\pjvvd.exe110⤵PID:1912
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe111⤵PID:1124
-
\??\c:\ffllfff.exec:\ffllfff.exe112⤵PID:4796
-
\??\c:\7tbbbb.exec:\7tbbbb.exe113⤵PID:3824
-
\??\c:\3djjv.exec:\3djjv.exe114⤵PID:208
-
\??\c:\9rfxllx.exec:\9rfxllx.exe115⤵PID:3916
-
\??\c:\tttttt.exec:\tttttt.exe116⤵PID:3892
-
\??\c:\1dpjd.exec:\1dpjd.exe117⤵PID:1636
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe118⤵PID:1992
-
\??\c:\flxrffl.exec:\flxrffl.exe119⤵PID:4836
-
\??\c:\hnnhtt.exec:\hnnhtt.exe120⤵PID:2308
-
\??\c:\ppddd.exec:\ppddd.exe121⤵PID:3600
-
\??\c:\rlxrrff.exec:\rlxrrff.exe122⤵PID:3008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-