Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 07:26
Behavioral task
behavioral1
Sample
c6021bf91649d7640b9798520f7982b5a0c0d20522625f20390999bfae7f3242N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c6021bf91649d7640b9798520f7982b5a0c0d20522625f20390999bfae7f3242N.exe
-
Size
332KB
-
MD5
0df4e141e383f2281c93a4c3132e1fa0
-
SHA1
8018a5bba361611c48c523254ff71e1b2e940f2f
-
SHA256
c6021bf91649d7640b9798520f7982b5a0c0d20522625f20390999bfae7f3242
-
SHA512
41c0a9b124e8344c4fda3235a2058f259ae27a74a44508aee2a9bd9db8d552e288b4b78d31fa27fa9b1427bcca70bbe4ff7030e05e6f37dc44005b9c4887e99a
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbee:R4wFHoSHYHUrAwfMp3CDe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4856-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3972-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/904-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2424-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1856-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1904-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/944-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1088-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5088-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1568-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2356-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4744-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3484-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1824-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4012-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/392-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1460-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1692-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1580-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2776-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3824-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1128-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1984-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1484-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3608-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1156-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1856-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/828-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1136-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2708-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/736-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/468-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1580-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1132-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3544-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1004-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-541-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3928-572-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4760-764-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3972 tnbnhh.exe 904 ddjjd.exe 2424 1nthth.exe 216 jpvvp.exe 4904 xxlfllr.exe 1856 ddjdd.exe 1904 hhtthn.exe 1404 pjpjd.exe 944 htnnnn.exe 1088 rfxrxrl.exe 5088 tnhnhb.exe 1568 vjjjj.exe 2356 hbthbh.exe 4976 1vddv.exe 2188 9lrrrxr.exe 4744 hbhbtn.exe 1456 jjpjd.exe 3484 lrffffr.exe 4012 nttthh.exe 1824 lfxfxlx.exe 4668 hbtbbn.exe 1460 djjjj.exe 392 rlxrrrr.exe 4780 nhtnnn.exe 872 fffflll.exe 1312 nnhhbh.exe 4752 5ttbbh.exe 3984 lxlllxx.exe 2232 hthtbt.exe 4968 ppdpj.exe 2300 ddjjj.exe 1692 nttnbn.exe 1580 jdppp.exe 2776 3xxrrxr.exe 3824 nbhtnh.exe 1128 1jdvp.exe 2876 9llfffl.exe 712 httnhh.exe 3216 9vvjd.exe 2368 rrrfxrl.exe 1396 frlxlrl.exe 2740 jddpj.exe 1984 xrxxxxx.exe 4756 5hbnbh.exe 1424 ppdvj.exe 2600 jjddp.exe 2096 1nnnnb.exe 4908 ntbbbh.exe 4536 vvdjj.exe 1124 rfxxflr.exe 4972 tnttnn.exe 5080 btbtnt.exe 1552 vdjdv.exe 2240 lxlllff.exe 2264 1ttntt.exe 4936 bbbbnn.exe 1364 ppjjv.exe 4564 3lffrlf.exe 1484 3lrrllf.exe 4856 7tbtnt.exe 3608 vvdvv.exe 1180 jvdpj.exe 1152 frrrrlf.exe 1924 bhbnbn.exe -
resource yara_rule behavioral2/memory/4856-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000d000000023b33-3.dat upx behavioral2/memory/4856-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023baa-8.dat upx behavioral2/memory/3972-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023bc8-13.dat upx behavioral2/memory/904-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2424-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023bc9-20.dat upx behavioral2/memory/216-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023bca-24.dat upx behavioral2/memory/216-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000e000000023bce-29.dat upx behavioral2/memory/4904-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bd0-34.dat upx behavioral2/memory/1856-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bd3-39.dat upx behavioral2/memory/1904-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bd4-44.dat upx behavioral2/files/0x0008000000023bd5-48.dat upx behavioral2/memory/944-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bd6-54.dat upx behavioral2/memory/1088-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5088-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c05-59.dat upx behavioral2/memory/1568-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c06-64.dat upx behavioral2/memory/2356-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c07-68.dat upx behavioral2/files/0x0008000000023c08-73.dat upx behavioral2/memory/4976-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023bab-78.dat upx behavioral2/memory/4744-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2188-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c0a-84.dat upx behavioral2/files/0x0008000000023c0f-89.dat upx behavioral2/memory/3484-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c10-93.dat upx behavioral2/files/0x0008000000023c11-98.dat upx behavioral2/memory/1824-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4012-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4668-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c23-104.dat upx behavioral2/memory/392-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c2b-119.dat upx behavioral2/files/0x0008000000023c2a-114.dat upx behavioral2/files/0x0008000000023c29-109.dat upx behavioral2/memory/1460-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c2c-122.dat upx behavioral2/files/0x0008000000023c2d-126.dat upx behavioral2/memory/872-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c2e-131.dat upx behavioral2/files/0x000b000000023c43-134.dat upx behavioral2/files/0x0016000000023c44-139.dat upx behavioral2/files/0x0008000000023c4a-143.dat upx behavioral2/files/0x0008000000023c4e-148.dat upx behavioral2/memory/4968-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c5a-152.dat upx behavioral2/memory/1692-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1692-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1580-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2776-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3824-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1128-169-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4856 wrote to memory of 3972 4856 c6021bf91649d7640b9798520f7982b5a0c0d20522625f20390999bfae7f3242N.exe 84 PID 4856 wrote to memory of 3972 4856 c6021bf91649d7640b9798520f7982b5a0c0d20522625f20390999bfae7f3242N.exe 84 PID 4856 wrote to memory of 3972 4856 c6021bf91649d7640b9798520f7982b5a0c0d20522625f20390999bfae7f3242N.exe 84 PID 3972 wrote to memory of 904 3972 tnbnhh.exe 85 PID 3972 wrote to memory of 904 3972 tnbnhh.exe 85 PID 3972 wrote to memory of 904 3972 tnbnhh.exe 85 PID 904 wrote to memory of 2424 904 ddjjd.exe 86 PID 904 wrote to memory of 2424 904 ddjjd.exe 86 PID 904 wrote to memory of 2424 904 ddjjd.exe 86 PID 2424 wrote to memory of 216 2424 1nthth.exe 87 PID 2424 wrote to memory of 216 2424 1nthth.exe 87 PID 2424 wrote to memory of 216 2424 1nthth.exe 87 PID 216 wrote to memory of 4904 216 jpvvp.exe 88 PID 216 wrote to memory of 4904 216 jpvvp.exe 88 PID 216 wrote to memory of 4904 216 jpvvp.exe 88 PID 4904 wrote to memory of 1856 4904 xxlfllr.exe 89 PID 4904 wrote to memory of 1856 4904 xxlfllr.exe 89 PID 4904 wrote to memory of 1856 4904 xxlfllr.exe 89 PID 1856 wrote to memory of 1904 1856 ddjdd.exe 90 PID 1856 wrote to memory of 1904 1856 ddjdd.exe 90 PID 1856 wrote to memory of 1904 1856 ddjdd.exe 90 PID 1904 wrote to memory of 1404 1904 hhtthn.exe 91 PID 1904 wrote to memory of 1404 1904 hhtthn.exe 91 PID 1904 wrote to memory of 1404 1904 hhtthn.exe 91 PID 1404 wrote to memory of 944 1404 pjpjd.exe 92 PID 1404 wrote to memory of 944 1404 pjpjd.exe 92 PID 1404 wrote to memory of 944 1404 pjpjd.exe 92 PID 944 wrote to memory of 1088 944 htnnnn.exe 93 PID 944 wrote to memory of 1088 944 htnnnn.exe 93 PID 944 wrote to memory of 1088 944 htnnnn.exe 93 PID 1088 wrote to memory of 5088 1088 rfxrxrl.exe 94 PID 1088 wrote to memory of 5088 1088 rfxrxrl.exe 94 PID 1088 wrote to memory of 5088 1088 rfxrxrl.exe 94 PID 5088 wrote to memory of 1568 5088 tnhnhb.exe 95 PID 5088 wrote to memory of 1568 5088 tnhnhb.exe 95 PID 5088 wrote to memory of 1568 5088 tnhnhb.exe 95 PID 1568 wrote to memory of 2356 1568 vjjjj.exe 96 PID 1568 wrote to memory of 2356 1568 vjjjj.exe 96 PID 1568 wrote to memory of 2356 1568 vjjjj.exe 96 PID 2356 wrote to memory of 4976 2356 hbthbh.exe 97 PID 2356 wrote to memory of 4976 2356 hbthbh.exe 97 PID 2356 wrote to memory of 4976 2356 hbthbh.exe 97 PID 4976 wrote to memory of 2188 4976 1vddv.exe 98 PID 4976 wrote to memory of 2188 4976 1vddv.exe 98 PID 4976 wrote to memory of 2188 4976 1vddv.exe 98 PID 2188 wrote to memory of 4744 2188 9lrrrxr.exe 99 PID 2188 wrote to memory of 4744 2188 9lrrrxr.exe 99 PID 2188 wrote to memory of 4744 2188 9lrrrxr.exe 99 PID 4744 wrote to memory of 1456 4744 hbhbtn.exe 100 PID 4744 wrote to memory of 1456 4744 hbhbtn.exe 100 PID 4744 wrote to memory of 1456 4744 hbhbtn.exe 100 PID 1456 wrote to memory of 3484 1456 jjpjd.exe 101 PID 1456 wrote to memory of 3484 1456 jjpjd.exe 101 PID 1456 wrote to memory of 3484 1456 jjpjd.exe 101 PID 3484 wrote to memory of 4012 3484 lrffffr.exe 102 PID 3484 wrote to memory of 4012 3484 lrffffr.exe 102 PID 3484 wrote to memory of 4012 3484 lrffffr.exe 102 PID 4012 wrote to memory of 1824 4012 nttthh.exe 103 PID 4012 wrote to memory of 1824 4012 nttthh.exe 103 PID 4012 wrote to memory of 1824 4012 nttthh.exe 103 PID 1824 wrote to memory of 4668 1824 lfxfxlx.exe 104 PID 1824 wrote to memory of 4668 1824 lfxfxlx.exe 104 PID 1824 wrote to memory of 4668 1824 lfxfxlx.exe 104 PID 4668 wrote to memory of 1460 4668 hbtbbn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6021bf91649d7640b9798520f7982b5a0c0d20522625f20390999bfae7f3242N.exe"C:\Users\Admin\AppData\Local\Temp\c6021bf91649d7640b9798520f7982b5a0c0d20522625f20390999bfae7f3242N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\tnbnhh.exec:\tnbnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\ddjjd.exec:\ddjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
\??\c:\1nthth.exec:\1nthth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\jpvvp.exec:\jpvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\xxlfllr.exec:\xxlfllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\ddjdd.exec:\ddjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\hhtthn.exec:\hhtthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\pjpjd.exec:\pjpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\htnnnn.exec:\htnnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\rfxrxrl.exec:\rfxrxrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\tnhnhb.exec:\tnhnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\vjjjj.exec:\vjjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\hbthbh.exec:\hbthbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\1vddv.exec:\1vddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\9lrrrxr.exec:\9lrrrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\hbhbtn.exec:\hbhbtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\jjpjd.exec:\jjpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\lrffffr.exec:\lrffffr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\nttthh.exec:\nttthh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\lfxfxlx.exec:\lfxfxlx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\hbtbbn.exec:\hbtbbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\djjjj.exec:\djjjj.exe23⤵
- Executes dropped EXE
PID:1460 -
\??\c:\rlxrrrr.exec:\rlxrrrr.exe24⤵
- Executes dropped EXE
PID:392 -
\??\c:\nhtnnn.exec:\nhtnnn.exe25⤵
- Executes dropped EXE
PID:4780 -
\??\c:\fffflll.exec:\fffflll.exe26⤵
- Executes dropped EXE
PID:872 -
\??\c:\nnhhbh.exec:\nnhhbh.exe27⤵
- Executes dropped EXE
PID:1312 -
\??\c:\5ttbbh.exec:\5ttbbh.exe28⤵
- Executes dropped EXE
PID:4752 -
\??\c:\lxlllxx.exec:\lxlllxx.exe29⤵
- Executes dropped EXE
PID:3984 -
\??\c:\hthtbt.exec:\hthtbt.exe30⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ppdpj.exec:\ppdpj.exe31⤵
- Executes dropped EXE
PID:4968 -
\??\c:\ddjjj.exec:\ddjjj.exe32⤵
- Executes dropped EXE
PID:2300 -
\??\c:\nttnbn.exec:\nttnbn.exe33⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jdppp.exec:\jdppp.exe34⤵
- Executes dropped EXE
PID:1580 -
\??\c:\3xxrrxr.exec:\3xxrrxr.exe35⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nbhtnh.exec:\nbhtnh.exe36⤵
- Executes dropped EXE
PID:3824 -
\??\c:\1jdvp.exec:\1jdvp.exe37⤵
- Executes dropped EXE
PID:1128 -
\??\c:\9llfffl.exec:\9llfffl.exe38⤵
- Executes dropped EXE
PID:2876 -
\??\c:\httnhh.exec:\httnhh.exe39⤵
- Executes dropped EXE
PID:712 -
\??\c:\9vvjd.exec:\9vvjd.exe40⤵
- Executes dropped EXE
PID:3216 -
\??\c:\rrrfxrl.exec:\rrrfxrl.exe41⤵
- Executes dropped EXE
PID:2368 -
\??\c:\frlxlrl.exec:\frlxlrl.exe42⤵
- Executes dropped EXE
PID:1396 -
\??\c:\jddpj.exec:\jddpj.exe43⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe44⤵
- Executes dropped EXE
PID:1984 -
\??\c:\5hbnbh.exec:\5hbnbh.exe45⤵
- Executes dropped EXE
PID:4756 -
\??\c:\ppdvj.exec:\ppdvj.exe46⤵
- Executes dropped EXE
PID:1424 -
\??\c:\jjddp.exec:\jjddp.exe47⤵
- Executes dropped EXE
PID:2600 -
\??\c:\1nnnnb.exec:\1nnnnb.exe48⤵
- Executes dropped EXE
PID:2096 -
\??\c:\ntbbbh.exec:\ntbbbh.exe49⤵
- Executes dropped EXE
PID:4908 -
\??\c:\vvdjj.exec:\vvdjj.exe50⤵
- Executes dropped EXE
PID:4536 -
\??\c:\rfxxflr.exec:\rfxxflr.exe51⤵
- Executes dropped EXE
PID:1124 -
\??\c:\tnttnn.exec:\tnttnn.exe52⤵
- Executes dropped EXE
PID:4972 -
\??\c:\btbtnt.exec:\btbtnt.exe53⤵
- Executes dropped EXE
PID:5080 -
\??\c:\vdjdv.exec:\vdjdv.exe54⤵
- Executes dropped EXE
PID:1552 -
\??\c:\lxlllff.exec:\lxlllff.exe55⤵
- Executes dropped EXE
PID:2240 -
\??\c:\1ttntt.exec:\1ttntt.exe56⤵
- Executes dropped EXE
PID:2264 -
\??\c:\bbbbnn.exec:\bbbbnn.exe57⤵
- Executes dropped EXE
PID:4936 -
\??\c:\ppjjv.exec:\ppjjv.exe58⤵
- Executes dropped EXE
PID:1364 -
\??\c:\3lffrlf.exec:\3lffrlf.exe59⤵
- Executes dropped EXE
PID:4564 -
\??\c:\3lrrllf.exec:\3lrrllf.exe60⤵
- Executes dropped EXE
PID:1484 -
\??\c:\7tbtnt.exec:\7tbtnt.exe61⤵
- Executes dropped EXE
PID:4856 -
\??\c:\vvdvv.exec:\vvdvv.exe62⤵
- Executes dropped EXE
PID:3608 -
\??\c:\jvdpj.exec:\jvdpj.exe63⤵
- Executes dropped EXE
PID:1180 -
\??\c:\frrrrlf.exec:\frrrrlf.exe64⤵
- Executes dropped EXE
PID:1152 -
\??\c:\bhbnbn.exec:\bhbnbn.exe65⤵
- Executes dropped EXE
PID:1924 -
\??\c:\vdpjp.exec:\vdpjp.exe66⤵PID:1156
-
\??\c:\fffrrfr.exec:\fffrrfr.exe67⤵PID:2088
-
\??\c:\htbtnn.exec:\htbtnn.exe68⤵PID:3004
-
\??\c:\1pvvv.exec:\1pvvv.exe69⤵PID:1856
-
\??\c:\dpdvv.exec:\dpdvv.exe70⤵PID:828
-
\??\c:\frfxrxr.exec:\frfxrxr.exe71⤵PID:5028
-
\??\c:\bbttnt.exec:\bbttnt.exe72⤵PID:3636
-
\??\c:\vvvdd.exec:\vvvdd.exe73⤵PID:3620
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe74⤵PID:2924
-
\??\c:\xrlfrlf.exec:\xrlfrlf.exe75⤵PID:2904
-
\??\c:\hhttbt.exec:\hhttbt.exe76⤵PID:3192
-
\??\c:\vpppd.exec:\vpppd.exe77⤵PID:2432
-
\??\c:\frllllr.exec:\frllllr.exe78⤵PID:2396
-
\??\c:\ntthtn.exec:\ntthtn.exe79⤵PID:1988
-
\??\c:\hbttnn.exec:\hbttnn.exe80⤵PID:980
-
\??\c:\1pddp.exec:\1pddp.exe81⤵PID:4060
-
\??\c:\rrfllrr.exec:\rrfllrr.exe82⤵PID:4976
-
\??\c:\rrxxxff.exec:\rrxxxff.exe83⤵PID:4032
-
\??\c:\3hbbtt.exec:\3hbbtt.exe84⤵PID:4512
-
\??\c:\jdjjd.exec:\jdjjd.exe85⤵PID:1136
-
\??\c:\lxfffff.exec:\lxfffff.exe86⤵PID:4252
-
\??\c:\nhnnhn.exec:\nhnnhn.exe87⤵PID:2604
-
\??\c:\jvvpv.exec:\jvvpv.exe88⤵PID:1844
-
\??\c:\lllffff.exec:\lllffff.exe89⤵PID:2708
-
\??\c:\thnhhn.exec:\thnhhn.exe90⤵PID:2120
-
\??\c:\tnnhbh.exec:\tnnhbh.exe91⤵PID:1740
-
\??\c:\vpjdv.exec:\vpjdv.exe92⤵PID:3656
-
\??\c:\lllfffx.exec:\lllfffx.exe93⤵PID:4640
-
\??\c:\nhnhbb.exec:\nhnhbb.exe94⤵PID:5032
-
\??\c:\pjjpj.exec:\pjjpj.exe95⤵PID:736
-
\??\c:\5rflrff.exec:\5rflrff.exe96⤵PID:468
-
\??\c:\rxxlxxx.exec:\rxxlxxx.exe97⤵PID:1216
-
\??\c:\bbbnth.exec:\bbbnth.exe98⤵PID:2552
-
\??\c:\jvvvv.exec:\jvvvv.exe99⤵PID:4600
-
\??\c:\ddjjv.exec:\ddjjv.exe100⤵PID:3744
-
\??\c:\3lllfll.exec:\3lllfll.exe101⤵PID:4360
-
\??\c:\bbtnhh.exec:\bbtnhh.exe102⤵PID:2464
-
\??\c:\btbbbb.exec:\btbbbb.exe103⤵PID:3540
-
\??\c:\jpppj.exec:\jpppj.exe104⤵PID:4116
-
\??\c:\3rfxxlf.exec:\3rfxxlf.exe105⤵PID:2300
-
\??\c:\bhhbnn.exec:\bhhbnn.exe106⤵PID:2856
-
\??\c:\thhhhn.exec:\thhhhn.exe107⤵PID:1936
-
\??\c:\vpddv.exec:\vpddv.exe108⤵PID:1580
-
\??\c:\lffffll.exec:\lffffll.exe109⤵PID:1320
-
\??\c:\hbthht.exec:\hbthht.exe110⤵PID:224
-
\??\c:\nttttt.exec:\nttttt.exe111⤵PID:1128
-
\??\c:\djjvj.exec:\djjvj.exe112⤵PID:1760
-
\??\c:\llrrrxx.exec:\llrrrxx.exe113⤵PID:1204
-
\??\c:\nttntn.exec:\nttntn.exe114⤵PID:3936
-
\??\c:\vdvjv.exec:\vdvjv.exe115⤵PID:1636
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe116⤵PID:1132
-
\??\c:\ttntht.exec:\ttntht.exe117⤵PID:4624
-
\??\c:\hnhnhb.exec:\hnhnhb.exe118⤵PID:208
-
\??\c:\vdvjv.exec:\vdvjv.exe119⤵PID:3468
-
\??\c:\fflrlrx.exec:\fflrlrx.exe120⤵PID:2884
-
\??\c:\btbnnn.exec:\btbnnn.exe121⤵PID:4764
-
\??\c:\vdvjv.exec:\vdvjv.exe122⤵PID:3100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-