Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 02:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d4684fd2a758c019470a7ab0304d1c95fd7d46ad2835999ddfd73512005b080b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
d4684fd2a758c019470a7ab0304d1c95fd7d46ad2835999ddfd73512005b080b.exe
-
Size
454KB
-
MD5
dceda32400d74a54b38b53f27a6f6c7d
-
SHA1
88036c9f9540e57d5122e5e5a061e30469fd9485
-
SHA256
d4684fd2a758c019470a7ab0304d1c95fd7d46ad2835999ddfd73512005b080b
-
SHA512
3f9d4c9d00d9a270bfbf968506dda101c4697a961cd40dd52a700799a6b859acadfcafe7a0e389c4ad2b1da6240498f6352fbd57550af5dcecd09607236cd78d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1780-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1856-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2672-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-664-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-743-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-783-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-1010-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-1115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-1291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-1301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-1494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-1634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4536 thttnt.exe 4916 nhnnnn.exe 3768 ddjjp.exe 1780 fxllfll.exe 2672 ttbbtb.exe 1856 nbhnnt.exe 5076 bbbbtn.exe 3412 ppvvv.exe 1240 dvdvd.exe 3836 nhhbtt.exe 2844 djvjv.exe 400 lfrlffl.exe 3332 nbnnnn.exe 2888 7djjp.exe 636 hnbtbb.exe 4276 jjdvj.exe 748 nttttt.exe 1516 rrlrxfl.exe 4020 bbhhnt.exe 4360 frfflrx.exe 3232 thnnnt.exe 3716 dvjjd.exe 2468 9llxxfx.exe 5020 nnbttt.exe 1112 jjvvv.exe 1000 1jppj.exe 976 llllrrr.exe 1340 ppppp.exe 1848 fxlrrxx.exe 4912 xxlrlrr.exe 4924 flffrxr.exe 1156 btnnnn.exe 3404 httnhh.exe 1464 nhnbnb.exe 4724 jvjpd.exe 2272 jjppv.exe 4528 pjpjj.exe 1912 nhbbbb.exe 4992 btbbhh.exe 3608 ddpvj.exe 4220 rlllfll.exe 3452 hbbttn.exe 3104 flrlxxr.exe 3952 tthhhn.exe 4352 vpjdp.exe 4456 7dppj.exe 3480 fxxxrlf.exe 1332 5bhtnn.exe 2392 pvvdd.exe 1780 1rrrrxx.exe 4628 ttbbhh.exe 2672 pjvvj.exe 3832 vvjdv.exe 3956 lllfffx.exe 912 nbhbtn.exe 1184 vpvjp.exe 3652 pvdvp.exe 4804 lfrllxr.exe 3884 xlrfxxx.exe 4792 hbbhbb.exe 2956 lxrxfrx.exe 2964 fxxrllf.exe 2124 nthhht.exe 1408 pvpdv.exe -
resource yara_rule behavioral2/memory/4536-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1856-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2272-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2672-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1164-783-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-1010-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5040 wrote to memory of 4536 5040 d4684fd2a758c019470a7ab0304d1c95fd7d46ad2835999ddfd73512005b080b.exe 82 PID 5040 wrote to memory of 4536 5040 d4684fd2a758c019470a7ab0304d1c95fd7d46ad2835999ddfd73512005b080b.exe 82 PID 5040 wrote to memory of 4536 5040 d4684fd2a758c019470a7ab0304d1c95fd7d46ad2835999ddfd73512005b080b.exe 82 PID 4536 wrote to memory of 4916 4536 thttnt.exe 83 PID 4536 wrote to memory of 4916 4536 thttnt.exe 83 PID 4536 wrote to memory of 4916 4536 thttnt.exe 83 PID 4916 wrote to memory of 3768 4916 nhnnnn.exe 84 PID 4916 wrote to memory of 3768 4916 nhnnnn.exe 84 PID 4916 wrote to memory of 3768 4916 nhnnnn.exe 84 PID 3768 wrote to memory of 1780 3768 ddjjp.exe 85 PID 3768 wrote to memory of 1780 3768 ddjjp.exe 85 PID 3768 wrote to memory of 1780 3768 ddjjp.exe 85 PID 1780 wrote to memory of 2672 1780 fxllfll.exe 86 PID 1780 wrote to memory of 2672 1780 fxllfll.exe 86 PID 1780 wrote to memory of 2672 1780 fxllfll.exe 86 PID 2672 wrote to memory of 1856 2672 ttbbtb.exe 87 PID 2672 wrote to memory of 1856 2672 ttbbtb.exe 87 PID 2672 wrote to memory of 1856 2672 ttbbtb.exe 87 PID 1856 wrote to memory of 5076 1856 nbhnnt.exe 88 PID 1856 wrote to memory of 5076 1856 nbhnnt.exe 88 PID 1856 wrote to memory of 5076 1856 nbhnnt.exe 88 PID 5076 wrote to memory of 3412 5076 bbbbtn.exe 89 PID 5076 wrote to memory of 3412 5076 bbbbtn.exe 89 PID 5076 wrote to memory of 3412 5076 bbbbtn.exe 89 PID 3412 wrote to memory of 1240 3412 ppvvv.exe 90 PID 3412 wrote to memory of 1240 3412 ppvvv.exe 90 PID 3412 wrote to memory of 1240 3412 ppvvv.exe 90 PID 1240 wrote to memory of 3836 1240 dvdvd.exe 91 PID 1240 wrote to memory of 3836 1240 dvdvd.exe 91 PID 1240 wrote to memory of 3836 1240 dvdvd.exe 91 PID 3836 wrote to memory of 2844 3836 nhhbtt.exe 92 PID 3836 wrote to memory of 2844 3836 nhhbtt.exe 92 PID 3836 wrote to memory of 2844 3836 nhhbtt.exe 92 PID 2844 wrote to memory of 400 2844 djvjv.exe 93 PID 2844 wrote to memory of 400 2844 djvjv.exe 93 PID 2844 wrote to memory of 400 2844 djvjv.exe 93 PID 400 wrote to memory of 3332 400 lfrlffl.exe 94 PID 400 wrote to memory of 3332 400 lfrlffl.exe 94 PID 400 wrote to memory of 3332 400 lfrlffl.exe 94 PID 3332 wrote to memory of 2888 3332 nbnnnn.exe 95 PID 3332 wrote to memory of 2888 3332 nbnnnn.exe 95 PID 3332 wrote to memory of 2888 3332 nbnnnn.exe 95 PID 2888 wrote to memory of 636 2888 7djjp.exe 96 PID 2888 wrote to memory of 636 2888 7djjp.exe 96 PID 2888 wrote to memory of 636 2888 7djjp.exe 96 PID 636 wrote to memory of 4276 636 hnbtbb.exe 97 PID 636 wrote to memory of 4276 636 hnbtbb.exe 97 PID 636 wrote to memory of 4276 636 hnbtbb.exe 97 PID 4276 wrote to memory of 748 4276 jjdvj.exe 98 PID 4276 wrote to memory of 748 4276 jjdvj.exe 98 PID 4276 wrote to memory of 748 4276 jjdvj.exe 98 PID 748 wrote to memory of 1516 748 nttttt.exe 99 PID 748 wrote to memory of 1516 748 nttttt.exe 99 PID 748 wrote to memory of 1516 748 nttttt.exe 99 PID 1516 wrote to memory of 4020 1516 rrlrxfl.exe 100 PID 1516 wrote to memory of 4020 1516 rrlrxfl.exe 100 PID 1516 wrote to memory of 4020 1516 rrlrxfl.exe 100 PID 4020 wrote to memory of 4360 4020 bbhhnt.exe 101 PID 4020 wrote to memory of 4360 4020 bbhhnt.exe 101 PID 4020 wrote to memory of 4360 4020 bbhhnt.exe 101 PID 4360 wrote to memory of 3232 4360 frfflrx.exe 102 PID 4360 wrote to memory of 3232 4360 frfflrx.exe 102 PID 4360 wrote to memory of 3232 4360 frfflrx.exe 102 PID 3232 wrote to memory of 3716 3232 thnnnt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4684fd2a758c019470a7ab0304d1c95fd7d46ad2835999ddfd73512005b080b.exe"C:\Users\Admin\AppData\Local\Temp\d4684fd2a758c019470a7ab0304d1c95fd7d46ad2835999ddfd73512005b080b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\thttnt.exec:\thttnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\nhnnnn.exec:\nhnnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\ddjjp.exec:\ddjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\fxllfll.exec:\fxllfll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\ttbbtb.exec:\ttbbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\nbhnnt.exec:\nbhnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\bbbbtn.exec:\bbbbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\ppvvv.exec:\ppvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\dvdvd.exec:\dvdvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\nhhbtt.exec:\nhhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\djvjv.exec:\djvjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\lfrlffl.exec:\lfrlffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\nbnnnn.exec:\nbnnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\7djjp.exec:\7djjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\hnbtbb.exec:\hnbtbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\jjdvj.exec:\jjdvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\nttttt.exec:\nttttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\rrlrxfl.exec:\rrlrxfl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\bbhhnt.exec:\bbhhnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\frfflrx.exec:\frfflrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\thnnnt.exec:\thnnnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\dvjjd.exec:\dvjjd.exe23⤵
- Executes dropped EXE
PID:3716 -
\??\c:\9llxxfx.exec:\9llxxfx.exe24⤵
- Executes dropped EXE
PID:2468 -
\??\c:\nnbttt.exec:\nnbttt.exe25⤵
- Executes dropped EXE
PID:5020 -
\??\c:\jjvvv.exec:\jjvvv.exe26⤵
- Executes dropped EXE
PID:1112 -
\??\c:\1jppj.exec:\1jppj.exe27⤵
- Executes dropped EXE
PID:1000 -
\??\c:\llllrrr.exec:\llllrrr.exe28⤵
- Executes dropped EXE
PID:976 -
\??\c:\ppppp.exec:\ppppp.exe29⤵
- Executes dropped EXE
PID:1340 -
\??\c:\fxlrrxx.exec:\fxlrrxx.exe30⤵
- Executes dropped EXE
PID:1848 -
\??\c:\xxlrlrr.exec:\xxlrlrr.exe31⤵
- Executes dropped EXE
PID:4912 -
\??\c:\flffrxr.exec:\flffrxr.exe32⤵
- Executes dropped EXE
PID:4924 -
\??\c:\btnnnn.exec:\btnnnn.exe33⤵
- Executes dropped EXE
PID:1156 -
\??\c:\httnhh.exec:\httnhh.exe34⤵
- Executes dropped EXE
PID:3404 -
\??\c:\nhnbnb.exec:\nhnbnb.exe35⤵
- Executes dropped EXE
PID:1464 -
\??\c:\jvjpd.exec:\jvjpd.exe36⤵
- Executes dropped EXE
PID:4724 -
\??\c:\jjppv.exec:\jjppv.exe37⤵
- Executes dropped EXE
PID:2272 -
\??\c:\pjpjj.exec:\pjpjj.exe38⤵
- Executes dropped EXE
PID:4528 -
\??\c:\nhbbbb.exec:\nhbbbb.exe39⤵
- Executes dropped EXE
PID:1912 -
\??\c:\btbbhh.exec:\btbbhh.exe40⤵
- Executes dropped EXE
PID:4992 -
\??\c:\ddpvj.exec:\ddpvj.exe41⤵
- Executes dropped EXE
PID:3608 -
\??\c:\rlllfll.exec:\rlllfll.exe42⤵
- Executes dropped EXE
PID:4220 -
\??\c:\hbbttn.exec:\hbbttn.exe43⤵
- Executes dropped EXE
PID:3452 -
\??\c:\flrlxxr.exec:\flrlxxr.exe44⤵
- Executes dropped EXE
PID:3104 -
\??\c:\tthhhn.exec:\tthhhn.exe45⤵
- Executes dropped EXE
PID:3952 -
\??\c:\vpjdp.exec:\vpjdp.exe46⤵
- Executes dropped EXE
PID:4352 -
\??\c:\7dppj.exec:\7dppj.exe47⤵
- Executes dropped EXE
PID:4456 -
\??\c:\fxxxrlf.exec:\fxxxrlf.exe48⤵
- Executes dropped EXE
PID:3480 -
\??\c:\5bhtnn.exec:\5bhtnn.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1332 -
\??\c:\pvvdd.exec:\pvvdd.exe50⤵
- Executes dropped EXE
PID:2392 -
\??\c:\1rrrrxx.exec:\1rrrrxx.exe51⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ttbbhh.exec:\ttbbhh.exe52⤵
- Executes dropped EXE
PID:4628 -
\??\c:\pjvvj.exec:\pjvvj.exe53⤵
- Executes dropped EXE
PID:2672 -
\??\c:\vvjdv.exec:\vvjdv.exe54⤵
- Executes dropped EXE
PID:3832 -
\??\c:\lllfffx.exec:\lllfffx.exe55⤵
- Executes dropped EXE
PID:3956 -
\??\c:\nbhbtn.exec:\nbhbtn.exe56⤵
- Executes dropped EXE
PID:912 -
\??\c:\vpvjp.exec:\vpvjp.exe57⤵
- Executes dropped EXE
PID:1184 -
\??\c:\pvdvp.exec:\pvdvp.exe58⤵
- Executes dropped EXE
PID:3652 -
\??\c:\lfrllxr.exec:\lfrllxr.exe59⤵
- Executes dropped EXE
PID:4804 -
\??\c:\xlrfxxx.exec:\xlrfxxx.exe60⤵
- Executes dropped EXE
PID:3884 -
\??\c:\hbbhbb.exec:\hbbhbb.exe61⤵
- Executes dropped EXE
PID:4792 -
\??\c:\lxrxfrx.exec:\lxrxfrx.exe62⤵
- Executes dropped EXE
PID:2956 -
\??\c:\fxxrllf.exec:\fxxrllf.exe63⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nthhht.exec:\nthhht.exe64⤵
- Executes dropped EXE
PID:2124 -
\??\c:\pvpdv.exec:\pvpdv.exe65⤵
- Executes dropped EXE
PID:1408 -
\??\c:\rfrlfff.exec:\rfrlfff.exe66⤵PID:2588
-
\??\c:\3tthbt.exec:\3tthbt.exe67⤵PID:4952
-
\??\c:\vdjjv.exec:\vdjjv.exe68⤵PID:3932
-
\??\c:\xfxxffl.exec:\xfxxffl.exe69⤵PID:1668
-
\??\c:\bttthh.exec:\bttthh.exe70⤵PID:3968
-
\??\c:\pdjdv.exec:\pdjdv.exe71⤵PID:3092
-
\??\c:\llxxxxx.exec:\llxxxxx.exe72⤵PID:4152
-
\??\c:\nhnnbb.exec:\nhnnbb.exe73⤵PID:3368
-
\??\c:\bbnntb.exec:\bbnntb.exe74⤵PID:4248
-
\??\c:\vpdvv.exec:\vpdvv.exe75⤵PID:4020
-
\??\c:\1xfllrl.exec:\1xfllrl.exe76⤵PID:4308
-
\??\c:\lfxffff.exec:\lfxffff.exe77⤵PID:4076
-
\??\c:\tthhhn.exec:\tthhhn.exe78⤵PID:3100
-
\??\c:\jpdpd.exec:\jpdpd.exe79⤵PID:1480
-
\??\c:\llxxrlx.exec:\llxxrlx.exe80⤵PID:3084
-
\??\c:\thhhhh.exec:\thhhhh.exe81⤵
- System Location Discovery: System Language Discovery
PID:368 -
\??\c:\dvpdp.exec:\dvpdp.exe82⤵PID:1604
-
\??\c:\lfrrrff.exec:\lfrrrff.exe83⤵PID:1956
-
\??\c:\hbnhhh.exec:\hbnhhh.exe84⤵PID:4984
-
\??\c:\hhttbh.exec:\hhttbh.exe85⤵PID:928
-
\??\c:\3vjdd.exec:\3vjdd.exe86⤵PID:1948
-
\??\c:\lfllxxx.exec:\lfllxxx.exe87⤵PID:4836
-
\??\c:\bntttb.exec:\bntttb.exe88⤵PID:3948
-
\??\c:\7jdvp.exec:\7jdvp.exe89⤵PID:3872
-
\??\c:\xrrrlll.exec:\xrrrlll.exe90⤵PID:3864
-
\??\c:\1hhnbt.exec:\1hhnbt.exe91⤵PID:1632
-
\??\c:\ppvvp.exec:\ppvvp.exe92⤵PID:2820
-
\??\c:\lxfxrfx.exec:\lxfxrfx.exe93⤵PID:432
-
\??\c:\rrrrxff.exec:\rrrrxff.exe94⤵PID:4504
-
\??\c:\nbhbnn.exec:\nbhbnn.exe95⤵PID:4688
-
\??\c:\jjvvv.exec:\jjvvv.exe96⤵PID:4724
-
\??\c:\lrrxxxx.exec:\lrrxxxx.exe97⤵PID:4424
-
\??\c:\xxffllr.exec:\xxffllr.exe98⤵PID:1924
-
\??\c:\hnnhhh.exec:\hnnhhh.exe99⤵PID:5036
-
\??\c:\vpddd.exec:\vpddd.exe100⤵PID:1816
-
\??\c:\9fffxff.exec:\9fffxff.exe101⤵PID:5072
-
\??\c:\bhtbbh.exec:\bhtbbh.exe102⤵PID:1844
-
\??\c:\btnhbb.exec:\btnhbb.exe103⤵PID:3508
-
\??\c:\jddpj.exec:\jddpj.exe104⤵PID:2140
-
\??\c:\xxrfrrx.exec:\xxrfrrx.exe105⤵PID:4448
-
\??\c:\bbnbbh.exec:\bbnbbh.exe106⤵PID:3824
-
\??\c:\ddjjd.exec:\ddjjd.exe107⤵PID:2032
-
\??\c:\pdjdd.exec:\pdjdd.exe108⤵PID:4916
-
\??\c:\fflflll.exec:\fflflll.exe109⤵PID:3768
-
\??\c:\7bbtnh.exec:\7bbtnh.exe110⤵PID:1016
-
\??\c:\pdpdv.exec:\pdpdv.exe111⤵PID:4564
-
\??\c:\lxxrrfx.exec:\lxxrrfx.exe112⤵PID:4888
-
\??\c:\nhtttt.exec:\nhtttt.exe113⤵PID:4620
-
\??\c:\btnnhh.exec:\btnnhh.exe114⤵PID:4460
-
\??\c:\ddjjv.exec:\ddjjv.exe115⤵PID:1032
-
\??\c:\rxfxlxx.exec:\rxfxlxx.exe116⤵PID:2492
-
\??\c:\nthbbb.exec:\nthbbb.exe117⤵PID:2176
-
\??\c:\vjvpd.exec:\vjvpd.exe118⤵PID:1472
-
\??\c:\fxfxrxl.exec:\fxfxrxl.exe119⤵PID:2704
-
\??\c:\xlxrlll.exec:\xlxrlll.exe120⤵
- System Location Discovery: System Language Discovery
PID:4240 -
\??\c:\thtnnn.exec:\thtnnn.exe121⤵PID:3500
-
\??\c:\pdjdv.exec:\pdjdv.exe122⤵PID:4800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-