Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 01:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a9944bef710de88bc255442716f83fedafdecd36f919864c8c70c44f8ded8380N.exe
Resource
win7-20240708-en
7 signatures
120 seconds
General
-
Target
a9944bef710de88bc255442716f83fedafdecd36f919864c8c70c44f8ded8380N.exe
-
Size
453KB
-
MD5
07006e08519a485c0cc3806ed8cf22c0
-
SHA1
ba94749269edf7d112a066c0a5c89d3b7d9221e0
-
SHA256
a9944bef710de88bc255442716f83fedafdecd36f919864c8c70c44f8ded8380
-
SHA512
4abc9f48d12a8341d6f9e0d628003f6ad1a72c166e02ccbfa1cbe1fd6faf0f44193cfdd32648647fb3a4e9d45f775c00451d34be6141d5bdfc82ec31f97ebcf2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeN:q7Tc2NYHUrAwfMp3CDN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4888-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/700-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/932-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3752-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3140-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-729-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1028-745-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-848-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-1071-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-1099-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-1112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-1351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2084 rrlfrrf.exe 4824 bbbnnh.exe 700 fxlrxxx.exe 1004 tnnnnh.exe 4864 pvvpj.exe 1876 fxrlrxl.exe 1944 nbnbhb.exe 4112 xlrfxxl.exe 1948 bbnnhb.exe 3164 jdppp.exe 3284 fxrflrl.exe 4348 vjvvv.exe 4808 tbbhtb.exe 3992 dvvdd.exe 1828 fxxrlfr.exe 3220 hhhbtt.exe 5028 vdjjp.exe 1488 hbnntt.exe 3228 jdjjj.exe 4268 pjpjj.exe 3656 lrxxrrr.exe 2500 pdpjp.exe 932 rlllrrr.exe 1040 1nhbtt.exe 2224 5hnnhn.exe 5008 lfffxfx.exe 4500 pvvvp.exe 2336 jjvpp.exe 1772 nhtttt.exe 4560 ppvvp.exe 464 nnhhtb.exe 4504 bbnttb.exe 4248 ddvdp.exe 2576 7tnnhn.exe 3976 vdvvj.exe 3152 jdppp.exe 876 ffrrlff.exe 3788 thtttt.exe 4124 dvvpj.exe 1768 xxxxrrl.exe 3008 7thhnb.exe 1360 hbhhbb.exe 1096 pvvpd.exe 2212 nbhbbh.exe 2804 hntnhn.exe 4964 jdjdd.exe 536 xfrlffx.exe 1964 ttttth.exe 1836 7ppjj.exe 2220 fxxrrrr.exe 1564 5nnhbt.exe 1724 djjdv.exe 4824 lxfffff.exe 700 7bbtth.exe 2424 pjppd.exe 3492 tbthtt.exe 100 fxfxxxx.exe 1504 nbbnnh.exe 3376 dvvdd.exe 312 rrxxrrr.exe 4264 hnnhbt.exe 4452 jdjjd.exe 648 dpvpp.exe 2952 tttnhh.exe -
resource yara_rule behavioral2/memory/4888-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/700-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/932-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3140-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1028-745-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-848-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4888 wrote to memory of 2084 4888 a9944bef710de88bc255442716f83fedafdecd36f919864c8c70c44f8ded8380N.exe 83 PID 4888 wrote to memory of 2084 4888 a9944bef710de88bc255442716f83fedafdecd36f919864c8c70c44f8ded8380N.exe 83 PID 4888 wrote to memory of 2084 4888 a9944bef710de88bc255442716f83fedafdecd36f919864c8c70c44f8ded8380N.exe 83 PID 2084 wrote to memory of 4824 2084 rrlfrrf.exe 84 PID 2084 wrote to memory of 4824 2084 rrlfrrf.exe 84 PID 2084 wrote to memory of 4824 2084 rrlfrrf.exe 84 PID 4824 wrote to memory of 700 4824 bbbnnh.exe 85 PID 4824 wrote to memory of 700 4824 bbbnnh.exe 85 PID 4824 wrote to memory of 700 4824 bbbnnh.exe 85 PID 700 wrote to memory of 1004 700 fxlrxxx.exe 86 PID 700 wrote to memory of 1004 700 fxlrxxx.exe 86 PID 700 wrote to memory of 1004 700 fxlrxxx.exe 86 PID 1004 wrote to memory of 4864 1004 tnnnnh.exe 87 PID 1004 wrote to memory of 4864 1004 tnnnnh.exe 87 PID 1004 wrote to memory of 4864 1004 tnnnnh.exe 87 PID 4864 wrote to memory of 1876 4864 pvvpj.exe 88 PID 4864 wrote to memory of 1876 4864 pvvpj.exe 88 PID 4864 wrote to memory of 1876 4864 pvvpj.exe 88 PID 1876 wrote to memory of 1944 1876 fxrlrxl.exe 89 PID 1876 wrote to memory of 1944 1876 fxrlrxl.exe 89 PID 1876 wrote to memory of 1944 1876 fxrlrxl.exe 89 PID 1944 wrote to memory of 4112 1944 nbnbhb.exe 90 PID 1944 wrote to memory of 4112 1944 nbnbhb.exe 90 PID 1944 wrote to memory of 4112 1944 nbnbhb.exe 90 PID 4112 wrote to memory of 1948 4112 xlrfxxl.exe 91 PID 4112 wrote to memory of 1948 4112 xlrfxxl.exe 91 PID 4112 wrote to memory of 1948 4112 xlrfxxl.exe 91 PID 1948 wrote to memory of 3164 1948 bbnnhb.exe 92 PID 1948 wrote to memory of 3164 1948 bbnnhb.exe 92 PID 1948 wrote to memory of 3164 1948 bbnnhb.exe 92 PID 3164 wrote to memory of 3284 3164 jdppp.exe 93 PID 3164 wrote to memory of 3284 3164 jdppp.exe 93 PID 3164 wrote to memory of 3284 3164 jdppp.exe 93 PID 3284 wrote to memory of 4348 3284 fxrflrl.exe 94 PID 3284 wrote to memory of 4348 3284 fxrflrl.exe 94 PID 3284 wrote to memory of 4348 3284 fxrflrl.exe 94 PID 4348 wrote to memory of 4808 4348 vjvvv.exe 95 PID 4348 wrote to memory of 4808 4348 vjvvv.exe 95 PID 4348 wrote to memory of 4808 4348 vjvvv.exe 95 PID 4808 wrote to memory of 3992 4808 tbbhtb.exe 96 PID 4808 wrote to memory of 3992 4808 tbbhtb.exe 96 PID 4808 wrote to memory of 3992 4808 tbbhtb.exe 96 PID 3992 wrote to memory of 1828 3992 dvvdd.exe 97 PID 3992 wrote to memory of 1828 3992 dvvdd.exe 97 PID 3992 wrote to memory of 1828 3992 dvvdd.exe 97 PID 1828 wrote to memory of 3220 1828 fxxrlfr.exe 98 PID 1828 wrote to memory of 3220 1828 fxxrlfr.exe 98 PID 1828 wrote to memory of 3220 1828 fxxrlfr.exe 98 PID 3220 wrote to memory of 5028 3220 hhhbtt.exe 99 PID 3220 wrote to memory of 5028 3220 hhhbtt.exe 99 PID 3220 wrote to memory of 5028 3220 hhhbtt.exe 99 PID 5028 wrote to memory of 1488 5028 vdjjp.exe 100 PID 5028 wrote to memory of 1488 5028 vdjjp.exe 100 PID 5028 wrote to memory of 1488 5028 vdjjp.exe 100 PID 1488 wrote to memory of 3228 1488 hbnntt.exe 101 PID 1488 wrote to memory of 3228 1488 hbnntt.exe 101 PID 1488 wrote to memory of 3228 1488 hbnntt.exe 101 PID 3228 wrote to memory of 4268 3228 jdjjj.exe 102 PID 3228 wrote to memory of 4268 3228 jdjjj.exe 102 PID 3228 wrote to memory of 4268 3228 jdjjj.exe 102 PID 4268 wrote to memory of 3656 4268 pjpjj.exe 103 PID 4268 wrote to memory of 3656 4268 pjpjj.exe 103 PID 4268 wrote to memory of 3656 4268 pjpjj.exe 103 PID 3656 wrote to memory of 2500 3656 lrxxrrr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9944bef710de88bc255442716f83fedafdecd36f919864c8c70c44f8ded8380N.exe"C:\Users\Admin\AppData\Local\Temp\a9944bef710de88bc255442716f83fedafdecd36f919864c8c70c44f8ded8380N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\rrlfrrf.exec:\rrlfrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\bbbnnh.exec:\bbbnnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\fxlrxxx.exec:\fxlrxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\tnnnnh.exec:\tnnnnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\pvvpj.exec:\pvvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\fxrlrxl.exec:\fxrlrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\nbnbhb.exec:\nbnbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\xlrfxxl.exec:\xlrfxxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\bbnnhb.exec:\bbnnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\jdppp.exec:\jdppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\fxrflrl.exec:\fxrflrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\vjvvv.exec:\vjvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\tbbhtb.exec:\tbbhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\dvvdd.exec:\dvvdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\fxxrlfr.exec:\fxxrlfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\hhhbtt.exec:\hhhbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\vdjjp.exec:\vdjjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\hbnntt.exec:\hbnntt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\jdjjj.exec:\jdjjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\pjpjj.exec:\pjpjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\lrxxrrr.exec:\lrxxrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\pdpjp.exec:\pdpjp.exe23⤵
- Executes dropped EXE
PID:2500 -
\??\c:\rlllrrr.exec:\rlllrrr.exe24⤵
- Executes dropped EXE
PID:932 -
\??\c:\1nhbtt.exec:\1nhbtt.exe25⤵
- Executes dropped EXE
PID:1040 -
\??\c:\5hnnhn.exec:\5hnnhn.exe26⤵
- Executes dropped EXE
PID:2224 -
\??\c:\lfffxfx.exec:\lfffxfx.exe27⤵
- Executes dropped EXE
PID:5008 -
\??\c:\pvvvp.exec:\pvvvp.exe28⤵
- Executes dropped EXE
PID:4500 -
\??\c:\jjvpp.exec:\jjvpp.exe29⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nhtttt.exec:\nhtttt.exe30⤵
- Executes dropped EXE
PID:1772 -
\??\c:\ppvvp.exec:\ppvvp.exe31⤵
- Executes dropped EXE
PID:4560 -
\??\c:\nnhhtb.exec:\nnhhtb.exe32⤵
- Executes dropped EXE
PID:464 -
\??\c:\bbnttb.exec:\bbnttb.exe33⤵
- Executes dropped EXE
PID:4504 -
\??\c:\ddvdp.exec:\ddvdp.exe34⤵
- Executes dropped EXE
PID:4248 -
\??\c:\7tnnhn.exec:\7tnnhn.exe35⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vdvvj.exec:\vdvvj.exe36⤵
- Executes dropped EXE
PID:3976 -
\??\c:\jdppp.exec:\jdppp.exe37⤵
- Executes dropped EXE
PID:3152 -
\??\c:\ffrrlff.exec:\ffrrlff.exe38⤵
- Executes dropped EXE
PID:876 -
\??\c:\thtttt.exec:\thtttt.exe39⤵
- Executes dropped EXE
PID:3788 -
\??\c:\dvvpj.exec:\dvvpj.exe40⤵
- Executes dropped EXE
PID:4124 -
\??\c:\xxxxrrl.exec:\xxxxrrl.exe41⤵
- Executes dropped EXE
PID:1768 -
\??\c:\7thhnb.exec:\7thhnb.exe42⤵
- Executes dropped EXE
PID:3008 -
\??\c:\hbhhbb.exec:\hbhhbb.exe43⤵
- Executes dropped EXE
PID:1360 -
\??\c:\pvvpd.exec:\pvvpd.exe44⤵
- Executes dropped EXE
PID:1096 -
\??\c:\nbhbbh.exec:\nbhbbh.exe45⤵
- Executes dropped EXE
PID:2212 -
\??\c:\hntnhn.exec:\hntnhn.exe46⤵
- Executes dropped EXE
PID:2804 -
\??\c:\jdjdd.exec:\jdjdd.exe47⤵
- Executes dropped EXE
PID:4964 -
\??\c:\xfrlffx.exec:\xfrlffx.exe48⤵
- Executes dropped EXE
PID:536 -
\??\c:\ttttth.exec:\ttttth.exe49⤵
- Executes dropped EXE
PID:1964 -
\??\c:\7ppjj.exec:\7ppjj.exe50⤵
- Executes dropped EXE
PID:1836 -
\??\c:\fxxrrrr.exec:\fxxrrrr.exe51⤵
- Executes dropped EXE
PID:2220 -
\??\c:\5nnhbt.exec:\5nnhbt.exe52⤵
- Executes dropped EXE
PID:1564 -
\??\c:\djjdv.exec:\djjdv.exe53⤵
- Executes dropped EXE
PID:1724 -
\??\c:\lxfffff.exec:\lxfffff.exe54⤵
- Executes dropped EXE
PID:4824 -
\??\c:\7bbtth.exec:\7bbtth.exe55⤵
- Executes dropped EXE
PID:700 -
\??\c:\pjppd.exec:\pjppd.exe56⤵
- Executes dropped EXE
PID:2424 -
\??\c:\tbthtt.exec:\tbthtt.exe57⤵
- Executes dropped EXE
PID:3492 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe58⤵
- Executes dropped EXE
PID:100 -
\??\c:\nbbnnh.exec:\nbbnnh.exe59⤵
- Executes dropped EXE
PID:1504 -
\??\c:\dvvdd.exec:\dvvdd.exe60⤵
- Executes dropped EXE
PID:3376 -
\??\c:\rrxxrrr.exec:\rrxxrrr.exe61⤵
- Executes dropped EXE
PID:312 -
\??\c:\hnnhbt.exec:\hnnhbt.exe62⤵
- Executes dropped EXE
PID:4264 -
\??\c:\jdjjd.exec:\jdjjd.exe63⤵
- Executes dropped EXE
PID:4452 -
\??\c:\dpvpp.exec:\dpvpp.exe64⤵
- Executes dropped EXE
PID:648 -
\??\c:\tttnhh.exec:\tttnhh.exe65⤵
- Executes dropped EXE
PID:2952 -
\??\c:\vdvpp.exec:\vdvpp.exe66⤵PID:2812
-
\??\c:\3lllflf.exec:\3lllflf.exe67⤵PID:5020
-
\??\c:\rfrlllr.exec:\rfrlllr.exe68⤵PID:4548
-
\??\c:\tnbbbh.exec:\tnbbbh.exe69⤵PID:4776
-
\??\c:\dvjvj.exec:\dvjvj.exe70⤵PID:228
-
\??\c:\xlrxxfl.exec:\xlrxxfl.exe71⤵
- System Location Discovery: System Language Discovery
PID:1492 -
\??\c:\hbhbbb.exec:\hbhbbb.exe72⤵PID:4276
-
\??\c:\jjppp.exec:\jjppp.exe73⤵PID:1728
-
\??\c:\rfffxff.exec:\rfffxff.exe74⤵PID:1404
-
\??\c:\btbbhn.exec:\btbbhn.exe75⤵PID:4756
-
\??\c:\pjpvj.exec:\pjpvj.exe76⤵PID:3136
-
\??\c:\9lffxff.exec:\9lffxff.exe77⤵PID:3188
-
\??\c:\bthbbt.exec:\bthbbt.exe78⤵PID:1604
-
\??\c:\ddddv.exec:\ddddv.exe79⤵PID:4380
-
\??\c:\5fxlfxl.exec:\5fxlfxl.exe80⤵PID:4928
-
\??\c:\3htbbb.exec:\3htbbb.exe81⤵PID:940
-
\??\c:\hhhbbb.exec:\hhhbbb.exe82⤵PID:1864
-
\??\c:\3dvvv.exec:\3dvvv.exe83⤵PID:984
-
\??\c:\rrxxrxr.exec:\rrxxrxr.exe84⤵PID:2872
-
\??\c:\9thhhn.exec:\9thhhn.exe85⤵PID:3512
-
\??\c:\vjvpp.exec:\vjvpp.exe86⤵PID:3744
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe87⤵PID:724
-
\??\c:\ttnhbb.exec:\ttnhbb.exe88⤵PID:4804
-
\??\c:\tbhbbt.exec:\tbhbbt.exe89⤵PID:4516
-
\??\c:\7djpp.exec:\7djpp.exe90⤵PID:1772
-
\??\c:\ffxxxxx.exec:\ffxxxxx.exe91⤵PID:4496
-
\??\c:\nntbbh.exec:\nntbbh.exe92⤵PID:1972
-
\??\c:\ddjdd.exec:\ddjdd.exe93⤵PID:5040
-
\??\c:\jjddp.exec:\jjddp.exe94⤵PID:4868
-
\??\c:\fxrlllr.exec:\fxrlllr.exe95⤵PID:3156
-
\??\c:\bbtbhh.exec:\bbtbhh.exe96⤵
- System Location Discovery: System Language Discovery
PID:2108 -
\??\c:\xffrllr.exec:\xffrllr.exe97⤵PID:2724
-
\??\c:\xrflfll.exec:\xrflfll.exe98⤵PID:3944
-
\??\c:\bbhttt.exec:\bbhttt.exe99⤵PID:3532
-
\??\c:\3jddd.exec:\3jddd.exe100⤵PID:4292
-
\??\c:\7flxlff.exec:\7flxlff.exe101⤵PID:2720
-
\??\c:\bttnht.exec:\bttnht.exe102⤵PID:3752
-
\??\c:\vdvdv.exec:\vdvdv.exe103⤵PID:3140
-
\??\c:\xrxrlll.exec:\xrxrlll.exe104⤵PID:2924
-
\??\c:\nhbbhn.exec:\nhbbhn.exe105⤵PID:3216
-
\??\c:\pvddd.exec:\pvddd.exe106⤵PID:1716
-
\??\c:\xlxrlfx.exec:\xlxrlfx.exe107⤵PID:4792
-
\??\c:\nnttbh.exec:\nnttbh.exe108⤵PID:3592
-
\??\c:\7nhhhh.exec:\7nhhhh.exe109⤵PID:868
-
\??\c:\vdpjj.exec:\vdpjj.exe110⤵PID:536
-
\??\c:\fffffxx.exec:\fffffxx.exe111⤵
- System Location Discovery: System Language Discovery
PID:4360 -
\??\c:\nntbbh.exec:\nntbbh.exe112⤵PID:4736
-
\??\c:\jjpjd.exec:\jjpjd.exe113⤵PID:2220
-
\??\c:\llrllrr.exec:\llrllrr.exe114⤵PID:1916
-
\??\c:\7ntnnt.exec:\7ntnnt.exe115⤵PID:2760
-
\??\c:\jjppv.exec:\jjppv.exe116⤵PID:2616
-
\??\c:\rrrxfrx.exec:\rrrxfrx.exe117⤵PID:3732
-
\??\c:\nnbbtn.exec:\nnbbtn.exe118⤵PID:3044
-
\??\c:\5pvdj.exec:\5pvdj.exe119⤵PID:4540
-
\??\c:\vjvvp.exec:\vjvvp.exe120⤵PID:4456
-
\??\c:\xrxxxxl.exec:\xrxxxxl.exe121⤵PID:2040
-
\??\c:\9nnnnn.exec:\9nnnnn.exe122⤵PID:4748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-