Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 03:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c393a403acaa1bb42b6a4c2f41340953603124bb97a863d1a59907400413efb7.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
c393a403acaa1bb42b6a4c2f41340953603124bb97a863d1a59907400413efb7.exe
-
Size
454KB
-
MD5
de5c08d30ffc3d71b3f752517686fd50
-
SHA1
2dda48bc45bde07e993fbcf51ec71405b74588fc
-
SHA256
c393a403acaa1bb42b6a4c2f41340953603124bb97a863d1a59907400413efb7
-
SHA512
9e25ab1e3a03cf77d1fc72a29c23d3f0466358721467ec5b7064bf0f878ad540f77cd861147527795b7784e51378c337f3824e78f24b770b038eeaec5112a518
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet:q7Tc2NYHUrAwfMp3CDt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4856-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3544-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/904-674-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-781-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-896-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-918-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-925-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-1423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1484 lfxrxxx.exe 4100 nhtnnn.exe 2620 dvjdj.exe 216 lrrrfxx.exe 232 ffrlllf.exe 1308 hbbbtb.exe 1588 xxfrxrl.exe 2208 dppjj.exe 2872 rrrlffx.exe 3612 nhbttn.exe 4420 9djdd.exe 2040 5ddvp.exe 4612 7dvpd.exe 5064 7fxrflf.exe 3168 hthhhn.exe 4736 vvdpv.exe 4348 jddvp.exe 4852 dvdjv.exe 2260 7rlxrrf.exe 4640 pdjjd.exe 3656 pddvv.exe 5052 5lrflxf.exe 1556 3nnnhn.exe 3084 xxlfxxl.exe 2552 ddjdd.exe 4568 7jjjd.exe 1768 rlfxxrl.exe 2728 thhbbb.exe 4008 ppjdd.exe 4396 xrrlfxr.exe 1472 lxfrlll.exe 3532 bbhhnh.exe 1128 7ffxrrr.exe 4472 9hnbtt.exe 3020 dpvpj.exe 2844 fxffllf.exe 3588 7rlrlll.exe 1396 hbbbtt.exe 2136 vddvj.exe 3468 rlxrxxf.exe 2884 rffxlfx.exe 552 nbbttt.exe 2236 vpvpp.exe 4680 rllffxx.exe 4024 lxfxlfx.exe 4644 5hbthh.exe 3064 3hhbhh.exe 1964 djvjv.exe 5016 rrflrfl.exe 5044 bhbnnb.exe 440 bntnnh.exe 4860 5pjdp.exe 3596 lxlrrrx.exe 4120 flrlxrf.exe 1976 htbbbb.exe 5060 5nhtnn.exe 2392 vppvp.exe 1628 lrlxfxf.exe 4524 bhtttt.exe 1504 1bbnhh.exe 2164 lrrrfxr.exe 3620 hntnht.exe 2208 jddvv.exe 2184 lffrllf.exe -
resource yara_rule behavioral2/memory/4856-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2604-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3544-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/904-674-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4856 wrote to memory of 1484 4856 c393a403acaa1bb42b6a4c2f41340953603124bb97a863d1a59907400413efb7.exe 84 PID 4856 wrote to memory of 1484 4856 c393a403acaa1bb42b6a4c2f41340953603124bb97a863d1a59907400413efb7.exe 84 PID 4856 wrote to memory of 1484 4856 c393a403acaa1bb42b6a4c2f41340953603124bb97a863d1a59907400413efb7.exe 84 PID 1484 wrote to memory of 4100 1484 lfxrxxx.exe 85 PID 1484 wrote to memory of 4100 1484 lfxrxxx.exe 85 PID 1484 wrote to memory of 4100 1484 lfxrxxx.exe 85 PID 4100 wrote to memory of 2620 4100 nhtnnn.exe 86 PID 4100 wrote to memory of 2620 4100 nhtnnn.exe 86 PID 4100 wrote to memory of 2620 4100 nhtnnn.exe 86 PID 2620 wrote to memory of 216 2620 dvjdj.exe 87 PID 2620 wrote to memory of 216 2620 dvjdj.exe 87 PID 2620 wrote to memory of 216 2620 dvjdj.exe 87 PID 216 wrote to memory of 232 216 lrrrfxx.exe 88 PID 216 wrote to memory of 232 216 lrrrfxx.exe 88 PID 216 wrote to memory of 232 216 lrrrfxx.exe 88 PID 232 wrote to memory of 1308 232 ffrlllf.exe 89 PID 232 wrote to memory of 1308 232 ffrlllf.exe 89 PID 232 wrote to memory of 1308 232 ffrlllf.exe 89 PID 1308 wrote to memory of 1588 1308 hbbbtb.exe 90 PID 1308 wrote to memory of 1588 1308 hbbbtb.exe 90 PID 1308 wrote to memory of 1588 1308 hbbbtb.exe 90 PID 1588 wrote to memory of 2208 1588 xxfrxrl.exe 146 PID 1588 wrote to memory of 2208 1588 xxfrxrl.exe 146 PID 1588 wrote to memory of 2208 1588 xxfrxrl.exe 146 PID 2208 wrote to memory of 2872 2208 dppjj.exe 92 PID 2208 wrote to memory of 2872 2208 dppjj.exe 92 PID 2208 wrote to memory of 2872 2208 dppjj.exe 92 PID 2872 wrote to memory of 3612 2872 rrrlffx.exe 93 PID 2872 wrote to memory of 3612 2872 rrrlffx.exe 93 PID 2872 wrote to memory of 3612 2872 rrrlffx.exe 93 PID 3612 wrote to memory of 4420 3612 nhbttn.exe 94 PID 3612 wrote to memory of 4420 3612 nhbttn.exe 94 PID 3612 wrote to memory of 4420 3612 nhbttn.exe 94 PID 4420 wrote to memory of 2040 4420 9djdd.exe 95 PID 4420 wrote to memory of 2040 4420 9djdd.exe 95 PID 4420 wrote to memory of 2040 4420 9djdd.exe 95 PID 2040 wrote to memory of 4612 2040 5ddvp.exe 96 PID 2040 wrote to memory of 4612 2040 5ddvp.exe 96 PID 2040 wrote to memory of 4612 2040 5ddvp.exe 96 PID 4612 wrote to memory of 5064 4612 7dvpd.exe 97 PID 4612 wrote to memory of 5064 4612 7dvpd.exe 97 PID 4612 wrote to memory of 5064 4612 7dvpd.exe 97 PID 5064 wrote to memory of 3168 5064 7fxrflf.exe 98 PID 5064 wrote to memory of 3168 5064 7fxrflf.exe 98 PID 5064 wrote to memory of 3168 5064 7fxrflf.exe 98 PID 3168 wrote to memory of 4736 3168 hthhhn.exe 99 PID 3168 wrote to memory of 4736 3168 hthhhn.exe 99 PID 3168 wrote to memory of 4736 3168 hthhhn.exe 99 PID 4736 wrote to memory of 4348 4736 vvdpv.exe 100 PID 4736 wrote to memory of 4348 4736 vvdpv.exe 100 PID 4736 wrote to memory of 4348 4736 vvdpv.exe 100 PID 4348 wrote to memory of 4852 4348 jddvp.exe 101 PID 4348 wrote to memory of 4852 4348 jddvp.exe 101 PID 4348 wrote to memory of 4852 4348 jddvp.exe 101 PID 4852 wrote to memory of 2260 4852 dvdjv.exe 102 PID 4852 wrote to memory of 2260 4852 dvdjv.exe 102 PID 4852 wrote to memory of 2260 4852 dvdjv.exe 102 PID 2260 wrote to memory of 4640 2260 7rlxrrf.exe 103 PID 2260 wrote to memory of 4640 2260 7rlxrrf.exe 103 PID 2260 wrote to memory of 4640 2260 7rlxrrf.exe 103 PID 4640 wrote to memory of 3656 4640 pdjjd.exe 104 PID 4640 wrote to memory of 3656 4640 pdjjd.exe 104 PID 4640 wrote to memory of 3656 4640 pdjjd.exe 104 PID 3656 wrote to memory of 5052 3656 pddvv.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\c393a403acaa1bb42b6a4c2f41340953603124bb97a863d1a59907400413efb7.exe"C:\Users\Admin\AppData\Local\Temp\c393a403acaa1bb42b6a4c2f41340953603124bb97a863d1a59907400413efb7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\lfxrxxx.exec:\lfxrxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\nhtnnn.exec:\nhtnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\dvjdj.exec:\dvjdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\lrrrfxx.exec:\lrrrfxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\ffrlllf.exec:\ffrlllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\hbbbtb.exec:\hbbbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\xxfrxrl.exec:\xxfrxrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\dppjj.exec:\dppjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\rrrlffx.exec:\rrrlffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\nhbttn.exec:\nhbttn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\9djdd.exec:\9djdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\5ddvp.exec:\5ddvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\7dvpd.exec:\7dvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\7fxrflf.exec:\7fxrflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\hthhhn.exec:\hthhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\vvdpv.exec:\vvdpv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\jddvp.exec:\jddvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\dvdjv.exec:\dvdjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\7rlxrrf.exec:\7rlxrrf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\pdjjd.exec:\pdjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\pddvv.exec:\pddvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\5lrflxf.exec:\5lrflxf.exe23⤵
- Executes dropped EXE
PID:5052 -
\??\c:\3nnnhn.exec:\3nnnhn.exe24⤵
- Executes dropped EXE
PID:1556 -
\??\c:\xxlfxxl.exec:\xxlfxxl.exe25⤵
- Executes dropped EXE
PID:3084 -
\??\c:\ddjdd.exec:\ddjdd.exe26⤵
- Executes dropped EXE
PID:2552 -
\??\c:\7jjjd.exec:\7jjjd.exe27⤵
- Executes dropped EXE
PID:4568 -
\??\c:\rlfxxrl.exec:\rlfxxrl.exe28⤵
- Executes dropped EXE
PID:1768 -
\??\c:\thhbbb.exec:\thhbbb.exe29⤵
- Executes dropped EXE
PID:2728 -
\??\c:\ppjdd.exec:\ppjdd.exe30⤵
- Executes dropped EXE
PID:4008 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe31⤵
- Executes dropped EXE
PID:4396 -
\??\c:\lxfrlll.exec:\lxfrlll.exe32⤵
- Executes dropped EXE
PID:1472 -
\??\c:\bbhhnh.exec:\bbhhnh.exe33⤵
- Executes dropped EXE
PID:3532 -
\??\c:\7ffxrrr.exec:\7ffxrrr.exe34⤵
- Executes dropped EXE
PID:1128 -
\??\c:\9hnbtt.exec:\9hnbtt.exe35⤵
- Executes dropped EXE
PID:4472 -
\??\c:\dpvpj.exec:\dpvpj.exe36⤵
- Executes dropped EXE
PID:3020 -
\??\c:\fxffllf.exec:\fxffllf.exe37⤵
- Executes dropped EXE
PID:2844 -
\??\c:\7rlrlll.exec:\7rlrlll.exe38⤵
- Executes dropped EXE
PID:3588 -
\??\c:\hbbbtt.exec:\hbbbtt.exe39⤵
- Executes dropped EXE
PID:1396 -
\??\c:\vddvj.exec:\vddvj.exe40⤵
- Executes dropped EXE
PID:2136 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe41⤵
- Executes dropped EXE
PID:3468 -
\??\c:\rffxlfx.exec:\rffxlfx.exe42⤵
- Executes dropped EXE
PID:2884 -
\??\c:\nbbttt.exec:\nbbttt.exe43⤵
- Executes dropped EXE
PID:552 -
\??\c:\vpvpp.exec:\vpvpp.exe44⤵
- Executes dropped EXE
PID:2236 -
\??\c:\rllffxx.exec:\rllffxx.exe45⤵
- Executes dropped EXE
PID:4680 -
\??\c:\lxfxlfx.exec:\lxfxlfx.exe46⤵
- Executes dropped EXE
PID:4024 -
\??\c:\5hbthh.exec:\5hbthh.exe47⤵
- Executes dropped EXE
PID:4644 -
\??\c:\3hhbhh.exec:\3hhbhh.exe48⤵
- Executes dropped EXE
PID:3064 -
\??\c:\djvjv.exec:\djvjv.exe49⤵
- Executes dropped EXE
PID:1964 -
\??\c:\rrflrfl.exec:\rrflrfl.exe50⤵
- Executes dropped EXE
PID:5016 -
\??\c:\bhbnnb.exec:\bhbnnb.exe51⤵
- Executes dropped EXE
PID:5044 -
\??\c:\bntnnh.exec:\bntnnh.exe52⤵
- Executes dropped EXE
PID:440 -
\??\c:\5pjdp.exec:\5pjdp.exe53⤵
- Executes dropped EXE
PID:4860 -
\??\c:\lxlrrrx.exec:\lxlrrrx.exe54⤵
- Executes dropped EXE
PID:3596 -
\??\c:\flrlxrf.exec:\flrlxrf.exe55⤵
- Executes dropped EXE
PID:4120 -
\??\c:\htbbbb.exec:\htbbbb.exe56⤵
- Executes dropped EXE
PID:1976 -
\??\c:\5nhtnn.exec:\5nhtnn.exe57⤵
- Executes dropped EXE
PID:5060 -
\??\c:\vppvp.exec:\vppvp.exe58⤵
- Executes dropped EXE
PID:2392 -
\??\c:\lrlxfxf.exec:\lrlxfxf.exe59⤵
- Executes dropped EXE
PID:1628 -
\??\c:\bhtttt.exec:\bhtttt.exe60⤵
- Executes dropped EXE
PID:4524 -
\??\c:\1bbnhh.exec:\1bbnhh.exe61⤵
- Executes dropped EXE
PID:1504 -
\??\c:\lrrrfxr.exec:\lrrrfxr.exe62⤵
- Executes dropped EXE
PID:2164 -
\??\c:\hntnht.exec:\hntnht.exe63⤵
- Executes dropped EXE
PID:3620 -
\??\c:\jddvv.exec:\jddvv.exe64⤵
- Executes dropped EXE
PID:2208 -
\??\c:\lffrllf.exec:\lffrllf.exe65⤵
- Executes dropped EXE
PID:2184 -
\??\c:\tnnnbt.exec:\tnnnbt.exe66⤵PID:4848
-
\??\c:\frlxlrl.exec:\frlxlrl.exe67⤵PID:2388
-
\??\c:\ntnhtn.exec:\ntnhtn.exe68⤵PID:452
-
\??\c:\pdpjd.exec:\pdpjd.exe69⤵PID:4060
-
\??\c:\ttbttt.exec:\ttbttt.exe70⤵PID:4460
-
\??\c:\3nhbtn.exec:\3nhbtn.exe71⤵PID:372
-
\??\c:\jdddj.exec:\jdddj.exe72⤵PID:4032
-
\??\c:\pppjd.exec:\pppjd.exe73⤵PID:4696
-
\??\c:\xffrffx.exec:\xffrffx.exe74⤵PID:1548
-
\??\c:\httnhb.exec:\httnhb.exe75⤵PID:2604
-
\??\c:\thnnhb.exec:\thnnhb.exe76⤵PID:4348
-
\??\c:\7ppjd.exec:\7ppjd.exe77⤵PID:3464
-
\??\c:\xxxrllf.exec:\xxxrllf.exe78⤵PID:1680
-
\??\c:\vpjvp.exec:\vpjvp.exe79⤵PID:1740
-
\??\c:\lxrllfr.exec:\lxrllfr.exe80⤵PID:3488
-
\??\c:\jvjvd.exec:\jvjvd.exe81⤵PID:5032
-
\??\c:\xlrrlxr.exec:\xlrrlxr.exe82⤵PID:4780
-
\??\c:\9flxlff.exec:\9flxlff.exe83⤵PID:1216
-
\??\c:\hbbtnh.exec:\hbbtnh.exe84⤵PID:736
-
\??\c:\jppjd.exec:\jppjd.exe85⤵PID:3720
-
\??\c:\vjjdp.exec:\vjjdp.exe86⤵PID:5112
-
\??\c:\llfxrlx.exec:\llfxrlx.exe87⤵PID:3404
-
\??\c:\tnhtnn.exec:\tnhtnn.exe88⤵PID:2232
-
\??\c:\vjvpj.exec:\vjvpj.exe89⤵PID:3308
-
\??\c:\vpvjp.exec:\vpvjp.exe90⤵PID:3540
-
\??\c:\xfxrfrf.exec:\xfxrfrf.exe91⤵PID:4116
-
\??\c:\tnthtn.exec:\tnthtn.exe92⤵PID:2812
-
\??\c:\hnhtnh.exec:\hnhtnh.exe93⤵PID:2944
-
\??\c:\vddvd.exec:\vddvd.exe94⤵PID:2176
-
\??\c:\flrfxfr.exec:\flrfxfr.exe95⤵PID:2856
-
\??\c:\3nnhtn.exec:\3nnhtn.exe96⤵PID:3976
-
\??\c:\bnhbnh.exec:\bnhbnh.exe97⤵PID:1760
-
\??\c:\djdvp.exec:\djdvp.exe98⤵PID:4212
-
\??\c:\ffrfxrf.exec:\ffrfxrf.exe99⤵PID:2368
-
\??\c:\tttnhh.exec:\tttnhh.exe100⤵PID:4356
-
\??\c:\hhbhnb.exec:\hhbhnb.exe101⤵PID:1304
-
\??\c:\9vdvj.exec:\9vdvj.exe102⤵PID:1396
-
\??\c:\rrxrllf.exec:\rrxrllf.exe103⤵PID:2112
-
\??\c:\htthbb.exec:\htthbb.exe104⤵PID:3052
-
\??\c:\9tnbth.exec:\9tnbth.exe105⤵PID:2948
-
\??\c:\5ppdv.exec:\5ppdv.exe106⤵PID:1860
-
\??\c:\frxrlfx.exec:\frxrlfx.exe107⤵PID:1264
-
\??\c:\hthnth.exec:\hthnth.exe108⤵PID:1124
-
\??\c:\vppdd.exec:\vppdd.exe109⤵PID:5080
-
\??\c:\jdjdp.exec:\jdjdp.exe110⤵PID:4644
-
\??\c:\xlxlxxr.exec:\xlxlxxr.exe111⤵PID:3868
-
\??\c:\hbnhhh.exec:\hbnhhh.exe112⤵PID:1004
-
\??\c:\ppjpp.exec:\ppjpp.exe113⤵PID:3544
-
\??\c:\3vdpp.exec:\3vdpp.exe114⤵PID:4576
-
\??\c:\flrrlll.exec:\flrrlll.exe115⤵PID:4740
-
\??\c:\bttnhh.exec:\bttnhh.exe116⤵PID:3092
-
\??\c:\7vvpp.exec:\7vvpp.exe117⤵PID:3944
-
\??\c:\vjdvp.exec:\vjdvp.exe118⤵PID:3776
-
\??\c:\lxxrrlx.exec:\lxxrrlx.exe119⤵PID:2620
-
\??\c:\1tnhth.exec:\1tnhth.exe120⤵PID:4188
-
\??\c:\vjpjd.exec:\vjpjd.exe121⤵PID:1904
-
\??\c:\rfxrfxx.exec:\rfxrfxx.exe122⤵PID:4856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-