Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 06:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bc2a556e765c9b97c3024df604b8c306901e0a3c6958961170c7726298366833N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
bc2a556e765c9b97c3024df604b8c306901e0a3c6958961170c7726298366833N.exe
-
Size
347KB
-
MD5
3c6ac31bc159d0863334f967fdb8fb30
-
SHA1
942e8a7e4cddfd925d1d24f89aee5b4411ceacc4
-
SHA256
bc2a556e765c9b97c3024df604b8c306901e0a3c6958961170c7726298366833
-
SHA512
1a042eac48054f1580f66c6f8a0217870e262d9cd76a32d9c7a99c250bda5a321223739ceb2e3eeda663353d30c24ede385cc34fe0a48b5af8e513ddf85d0ed4
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAK:l7TcbWXZshJX2VGdK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/816-13-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4684-12-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3928-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4876-20-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3888-26-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2916-34-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3756-41-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1220-53-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2184-47-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2104-61-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4852-65-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4072-70-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2588-78-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4924-84-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1508-95-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3076-100-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4164-111-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/984-128-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1452-141-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2356-132-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/744-125-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3232-152-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1456-159-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5064-172-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1560-194-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2656-204-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1728-217-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1952-220-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4364-224-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3084-237-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1632-238-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1660-242-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3928-246-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/880-256-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3140-260-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1484-279-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3096-286-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4160-299-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1848-309-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/316-316-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1508-320-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1768-330-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1624-334-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/984-338-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/544-342-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1940-346-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2348-359-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2340-363-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4788-382-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1968-389-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2960-396-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3280-403-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1816-410-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4756-435-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4456-445-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3092-458-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3140-462-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2788-478-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4808-524-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1048-555-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4608-602-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4452-880-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4436-1163-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4720-1399-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4684 jjjjj.exe 816 xxxxxxx.exe 4876 3ppjj.exe 3888 lxxxffl.exe 2916 nbthht.exe 3756 ntbthh.exe 2184 xxffrxl.exe 1220 ffrrrxx.exe 2104 tbhhbb.exe 4852 lllrrrr.exe 4072 llrrrrr.exe 2588 1nnnbh.exe 4924 djvvv.exe 2224 bnttbb.exe 1508 frfffrr.exe 3076 bhbbbb.exe 4752 llxrllr.exe 4164 btbbbb.exe 2876 pvdpv.exe 744 ffflfll.exe 984 nhhbtt.exe 2356 jvjpp.exe 1012 rrfxxxr.exe 1452 3nttnt.exe 3232 bbnhbh.exe 1456 vvddv.exe 4588 fxxxxxr.exe 5064 vjvvv.exe 3868 rfffxfx.exe 4804 1xxxxxx.exe 2944 7bbbht.exe 4436 xxllrrx.exe 1560 ddppv.exe 1780 9fllflf.exe 4260 tbnbhn.exe 2656 fffffll.exe 1284 xflllxx.exe 4996 3hnttb.exe 1572 dvjjj.exe 1728 vpdpj.exe 1952 nhbbbb.exe 4364 pjjjj.exe 5088 7pjjp.exe 512 1frrrxf.exe 4756 tnttbh.exe 3084 jjvvv.exe 1632 rfrrrxx.exe 3928 nnbbbh.exe 4108 xfflfff.exe 4896 7rlllrl.exe 880 nnttbh.exe 3140 ttnnnt.exe 1332 djjjj.exe 4076 flllrrr.exe 4472 tbhhhn.exe 2380 hbhhtn.exe 2952 pppvv.exe 1484 1lllfff.exe 4148 xlrxrff.exe 3096 nhbbbh.exe 1404 vdjpp.exe 1556 jjvvj.exe 4380 rlfffxx.exe 4160 hhnttb.exe -
resource yara_rule behavioral2/memory/816-13-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4684-12-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3928-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4876-20-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3888-26-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2916-34-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3756-41-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1220-48-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1220-53-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2184-47-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2104-61-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4852-59-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4852-65-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4072-70-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4924-79-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2588-78-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4924-84-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1508-95-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3076-100-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4164-111-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/984-128-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1452-141-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3232-147-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2356-132-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/744-125-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3232-152-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1456-159-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5064-166-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5064-172-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1560-194-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2656-204-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1728-217-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1952-220-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4364-224-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3084-237-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1632-238-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1660-242-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3928-246-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/880-256-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3140-260-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1484-279-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3096-286-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4160-299-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1848-309-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/316-316-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1508-320-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1768-330-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1624-334-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/984-338-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/544-342-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1940-346-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2348-359-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2340-363-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4788-382-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1968-389-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2960-396-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3280-403-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1816-410-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4756-435-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4456-445-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3092-458-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3140-462-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2788-478-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4808-524-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfffrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3928 wrote to memory of 4684 3928 bc2a556e765c9b97c3024df604b8c306901e0a3c6958961170c7726298366833N.exe 83 PID 3928 wrote to memory of 4684 3928 bc2a556e765c9b97c3024df604b8c306901e0a3c6958961170c7726298366833N.exe 83 PID 3928 wrote to memory of 4684 3928 bc2a556e765c9b97c3024df604b8c306901e0a3c6958961170c7726298366833N.exe 83 PID 4684 wrote to memory of 816 4684 jjjjj.exe 84 PID 4684 wrote to memory of 816 4684 jjjjj.exe 84 PID 4684 wrote to memory of 816 4684 jjjjj.exe 84 PID 816 wrote to memory of 4876 816 xxxxxxx.exe 85 PID 816 wrote to memory of 4876 816 xxxxxxx.exe 85 PID 816 wrote to memory of 4876 816 xxxxxxx.exe 85 PID 4876 wrote to memory of 3888 4876 3ppjj.exe 86 PID 4876 wrote to memory of 3888 4876 3ppjj.exe 86 PID 4876 wrote to memory of 3888 4876 3ppjj.exe 86 PID 3888 wrote to memory of 2916 3888 lxxxffl.exe 87 PID 3888 wrote to memory of 2916 3888 lxxxffl.exe 87 PID 3888 wrote to memory of 2916 3888 lxxxffl.exe 87 PID 2916 wrote to memory of 3756 2916 nbthht.exe 88 PID 2916 wrote to memory of 3756 2916 nbthht.exe 88 PID 2916 wrote to memory of 3756 2916 nbthht.exe 88 PID 3756 wrote to memory of 2184 3756 ntbthh.exe 89 PID 3756 wrote to memory of 2184 3756 ntbthh.exe 89 PID 3756 wrote to memory of 2184 3756 ntbthh.exe 89 PID 2184 wrote to memory of 1220 2184 xxffrxl.exe 90 PID 2184 wrote to memory of 1220 2184 xxffrxl.exe 90 PID 2184 wrote to memory of 1220 2184 xxffrxl.exe 90 PID 1220 wrote to memory of 2104 1220 ffrrrxx.exe 91 PID 1220 wrote to memory of 2104 1220 ffrrrxx.exe 91 PID 1220 wrote to memory of 2104 1220 ffrrrxx.exe 91 PID 2104 wrote to memory of 4852 2104 tbhhbb.exe 92 PID 2104 wrote to memory of 4852 2104 tbhhbb.exe 92 PID 2104 wrote to memory of 4852 2104 tbhhbb.exe 92 PID 4852 wrote to memory of 4072 4852 lllrrrr.exe 93 PID 4852 wrote to memory of 4072 4852 lllrrrr.exe 93 PID 4852 wrote to memory of 4072 4852 lllrrrr.exe 93 PID 4072 wrote to memory of 2588 4072 llrrrrr.exe 94 PID 4072 wrote to memory of 2588 4072 llrrrrr.exe 94 PID 4072 wrote to memory of 2588 4072 llrrrrr.exe 94 PID 2588 wrote to memory of 4924 2588 1nnnbh.exe 95 PID 2588 wrote to memory of 4924 2588 1nnnbh.exe 95 PID 2588 wrote to memory of 4924 2588 1nnnbh.exe 95 PID 4924 wrote to memory of 2224 4924 djvvv.exe 96 PID 4924 wrote to memory of 2224 4924 djvvv.exe 96 PID 4924 wrote to memory of 2224 4924 djvvv.exe 96 PID 2224 wrote to memory of 1508 2224 bnttbb.exe 97 PID 2224 wrote to memory of 1508 2224 bnttbb.exe 97 PID 2224 wrote to memory of 1508 2224 bnttbb.exe 97 PID 1508 wrote to memory of 3076 1508 frfffrr.exe 98 PID 1508 wrote to memory of 3076 1508 frfffrr.exe 98 PID 1508 wrote to memory of 3076 1508 frfffrr.exe 98 PID 3076 wrote to memory of 4752 3076 bhbbbb.exe 99 PID 3076 wrote to memory of 4752 3076 bhbbbb.exe 99 PID 3076 wrote to memory of 4752 3076 bhbbbb.exe 99 PID 4752 wrote to memory of 4164 4752 llxrllr.exe 100 PID 4752 wrote to memory of 4164 4752 llxrllr.exe 100 PID 4752 wrote to memory of 4164 4752 llxrllr.exe 100 PID 4164 wrote to memory of 2876 4164 btbbbb.exe 101 PID 4164 wrote to memory of 2876 4164 btbbbb.exe 101 PID 4164 wrote to memory of 2876 4164 btbbbb.exe 101 PID 2876 wrote to memory of 744 2876 pvdpv.exe 102 PID 2876 wrote to memory of 744 2876 pvdpv.exe 102 PID 2876 wrote to memory of 744 2876 pvdpv.exe 102 PID 744 wrote to memory of 984 744 ffflfll.exe 103 PID 744 wrote to memory of 984 744 ffflfll.exe 103 PID 744 wrote to memory of 984 744 ffflfll.exe 103 PID 984 wrote to memory of 2356 984 nhhbtt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc2a556e765c9b97c3024df604b8c306901e0a3c6958961170c7726298366833N.exe"C:\Users\Admin\AppData\Local\Temp\bc2a556e765c9b97c3024df604b8c306901e0a3c6958961170c7726298366833N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\jjjjj.exec:\jjjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\xxxxxxx.exec:\xxxxxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\3ppjj.exec:\3ppjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\lxxxffl.exec:\lxxxffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\nbthht.exec:\nbthht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\ntbthh.exec:\ntbthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\xxffrxl.exec:\xxffrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\ffrrrxx.exec:\ffrrrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\tbhhbb.exec:\tbhhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\lllrrrr.exec:\lllrrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\llrrrrr.exec:\llrrrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\1nnnbh.exec:\1nnnbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\djvvv.exec:\djvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\bnttbb.exec:\bnttbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\frfffrr.exec:\frfffrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\bhbbbb.exec:\bhbbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\llxrllr.exec:\llxrllr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\btbbbb.exec:\btbbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\pvdpv.exec:\pvdpv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\ffflfll.exec:\ffflfll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\nhhbtt.exec:\nhhbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\jvjpp.exec:\jvjpp.exe23⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rrfxxxr.exec:\rrfxxxr.exe24⤵
- Executes dropped EXE
PID:1012 -
\??\c:\3nttnt.exec:\3nttnt.exe25⤵
- Executes dropped EXE
PID:1452 -
\??\c:\bbnhbh.exec:\bbnhbh.exe26⤵
- Executes dropped EXE
PID:3232 -
\??\c:\vvddv.exec:\vvddv.exe27⤵
- Executes dropped EXE
PID:1456 -
\??\c:\fxxxxxr.exec:\fxxxxxr.exe28⤵
- Executes dropped EXE
PID:4588 -
\??\c:\vjvvv.exec:\vjvvv.exe29⤵
- Executes dropped EXE
PID:5064 -
\??\c:\rfffxfx.exec:\rfffxfx.exe30⤵
- Executes dropped EXE
PID:3868 -
\??\c:\1xxxxxx.exec:\1xxxxxx.exe31⤵
- Executes dropped EXE
PID:4804 -
\??\c:\7bbbht.exec:\7bbbht.exe32⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xxllrrx.exec:\xxllrrx.exe33⤵
- Executes dropped EXE
PID:4436 -
\??\c:\ddppv.exec:\ddppv.exe34⤵
- Executes dropped EXE
PID:1560 -
\??\c:\9fllflf.exec:\9fllflf.exe35⤵
- Executes dropped EXE
PID:1780 -
\??\c:\tbnbhn.exec:\tbnbhn.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4260 -
\??\c:\fffffll.exec:\fffffll.exe37⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xflllxx.exec:\xflllxx.exe38⤵
- Executes dropped EXE
PID:1284 -
\??\c:\3hnttb.exec:\3hnttb.exe39⤵
- Executes dropped EXE
PID:4996 -
\??\c:\dvjjj.exec:\dvjjj.exe40⤵
- Executes dropped EXE
PID:1572 -
\??\c:\vpdpj.exec:\vpdpj.exe41⤵
- Executes dropped EXE
PID:1728 -
\??\c:\nhbbbb.exec:\nhbbbb.exe42⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pjjjj.exec:\pjjjj.exe43⤵
- Executes dropped EXE
PID:4364 -
\??\c:\7pjjp.exec:\7pjjp.exe44⤵
- Executes dropped EXE
PID:5088 -
\??\c:\1frrrxf.exec:\1frrrxf.exe45⤵
- Executes dropped EXE
PID:512 -
\??\c:\tnttbh.exec:\tnttbh.exe46⤵
- Executes dropped EXE
PID:4756 -
\??\c:\jjvvv.exec:\jjvvv.exe47⤵
- Executes dropped EXE
PID:3084 -
\??\c:\rfrrrxx.exec:\rfrrrxx.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1632 -
\??\c:\ttnnnt.exec:\ttnnnt.exe49⤵PID:1660
-
\??\c:\nnbbbh.exec:\nnbbbh.exe50⤵
- Executes dropped EXE
PID:3928 -
\??\c:\xfflfff.exec:\xfflfff.exe51⤵
- Executes dropped EXE
PID:4108 -
\??\c:\7rlllrl.exec:\7rlllrl.exe52⤵
- Executes dropped EXE
PID:4896 -
\??\c:\nnttbh.exec:\nnttbh.exe53⤵
- Executes dropped EXE
PID:880 -
\??\c:\ttnnnt.exec:\ttnnnt.exe54⤵
- Executes dropped EXE
PID:3140 -
\??\c:\djjjj.exec:\djjjj.exe55⤵
- Executes dropped EXE
PID:1332 -
\??\c:\flllrrr.exec:\flllrrr.exe56⤵
- Executes dropped EXE
PID:4076 -
\??\c:\tbhhhn.exec:\tbhhhn.exe57⤵
- Executes dropped EXE
PID:4472 -
\??\c:\hbhhtn.exec:\hbhhtn.exe58⤵
- Executes dropped EXE
PID:2380 -
\??\c:\pppvv.exec:\pppvv.exe59⤵
- Executes dropped EXE
PID:2952 -
\??\c:\1lllfff.exec:\1lllfff.exe60⤵
- Executes dropped EXE
PID:1484 -
\??\c:\xlrxrff.exec:\xlrxrff.exe61⤵
- Executes dropped EXE
PID:4148 -
\??\c:\nhbbbh.exec:\nhbbbh.exe62⤵
- Executes dropped EXE
PID:3096 -
\??\c:\vdjpp.exec:\vdjpp.exe63⤵
- Executes dropped EXE
PID:1404 -
\??\c:\jjvvj.exec:\jjvvj.exe64⤵
- Executes dropped EXE
PID:1556 -
\??\c:\rlfffxx.exec:\rlfffxx.exe65⤵
- Executes dropped EXE
PID:4380 -
\??\c:\hhnttb.exec:\hhnttb.exe66⤵
- Executes dropped EXE
PID:4160 -
\??\c:\nhnnnn.exec:\nhnnnn.exe67⤵PID:5072
-
\??\c:\jjpjd.exec:\jjpjd.exe68⤵PID:3924
-
\??\c:\rfrxxfr.exec:\rfrxxfr.exe69⤵PID:1848
-
\??\c:\nhttnt.exec:\nhttnt.exe70⤵PID:3416
-
\??\c:\pdpvv.exec:\pdpvv.exe71⤵PID:316
-
\??\c:\jjvvp.exec:\jjvvp.exe72⤵PID:1508
-
\??\c:\xlfflll.exec:\xlfflll.exe73⤵PID:4860
-
\??\c:\tntbbh.exec:\tntbbh.exe74⤵PID:1596
-
\??\c:\hbbttn.exec:\hbbttn.exe75⤵PID:1768
-
\??\c:\dvjdj.exec:\dvjdj.exe76⤵PID:1624
-
\??\c:\llrrrrr.exec:\llrrrrr.exe77⤵PID:984
-
\??\c:\9htnhn.exec:\9htnhn.exe78⤵PID:544
-
\??\c:\3dppd.exec:\3dppd.exe79⤵PID:1940
-
\??\c:\jjdpj.exec:\jjdpj.exe80⤵PID:1280
-
\??\c:\rrlrrxx.exec:\rrlrrxx.exe81⤵PID:688
-
\??\c:\7nhhhh.exec:\7nhhhh.exe82⤵PID:4792
-
\??\c:\vdddd.exec:\vdddd.exe83⤵PID:2348
-
\??\c:\7dddj.exec:\7dddj.exe84⤵PID:2340
-
\??\c:\xfrlxxx.exec:\xfrlxxx.exe85⤵PID:3444
-
\??\c:\nnttth.exec:\nnttth.exe86⤵PID:1552
-
\??\c:\vpvvp.exec:\vpvvp.exe87⤵PID:5084
-
\??\c:\vpvdd.exec:\vpvdd.exe88⤵PID:4716
-
\??\c:\3xxxrrr.exec:\3xxxrrr.exe89⤵PID:2236
-
\??\c:\nnnnhh.exec:\nnnnhh.exe90⤵PID:4788
-
\??\c:\jjjjj.exec:\jjjjj.exe91⤵PID:1756
-
\??\c:\jpjpp.exec:\jpjpp.exe92⤵PID:1968
-
\??\c:\rlrrrlx.exec:\rlrrrlx.exe93⤵PID:2776
-
\??\c:\jddvv.exec:\jddvv.exe94⤵PID:2960
-
\??\c:\1dddd.exec:\1dddd.exe95⤵PID:5024
-
\??\c:\lllllrf.exec:\lllllrf.exe96⤵PID:3280
-
\??\c:\thhhhh.exec:\thhhhh.exe97⤵PID:2552
-
\??\c:\1hnntb.exec:\1hnntb.exe98⤵PID:1816
-
\??\c:\jjppv.exec:\jjppv.exe99⤵PID:2244
-
\??\c:\1rllfff.exec:\1rllfff.exe100⤵PID:2192
-
\??\c:\5llllrx.exec:\5llllrx.exe101⤵PID:1236
-
\??\c:\tbhhth.exec:\tbhhth.exe102⤵PID:1892
-
\??\c:\jvdvv.exec:\jvdvv.exe103⤵PID:1080
-
\??\c:\xxllfff.exec:\xxllfff.exe104⤵PID:3024
-
\??\c:\ffrrffl.exec:\ffrrffl.exe105⤵PID:1296
-
\??\c:\thbbtt.exec:\thbbtt.exe106⤵PID:4756
-
\??\c:\ppdpv.exec:\ppdpv.exe107⤵PID:3084
-
\??\c:\1rxrrlf.exec:\1rxrrlf.exe108⤵PID:2232
-
\??\c:\hhhbth.exec:\hhhbth.exe109⤵PID:4456
-
\??\c:\thntnn.exec:\thntnn.exe110⤵PID:212
-
\??\c:\3dppj.exec:\3dppj.exe111⤵PID:3648
-
\??\c:\xrffxxx.exec:\xrffxxx.exe112⤵PID:4952
-
\??\c:\nhnnnh.exec:\nhnnnh.exe113⤵PID:3092
-
\??\c:\ppjdd.exec:\ppjdd.exe114⤵PID:3140
-
\??\c:\rfrrllf.exec:\rfrrllf.exe115⤵PID:1064
-
\??\c:\frxrrrr.exec:\frxrrrr.exe116⤵PID:2916
-
\??\c:\hnhhhn.exec:\hnhhhn.exe117⤵PID:4928
-
\??\c:\9bnhbh.exec:\9bnhbh.exe118⤵PID:184
-
\??\c:\jpppp.exec:\jpppp.exe119⤵PID:2788
-
\??\c:\rrxfrrl.exec:\rrxfrrl.exe120⤵
- System Location Discovery: System Language Discovery
PID:2564 -
\??\c:\bbnhhn.exec:\bbnhhn.exe121⤵PID:3360
-
\??\c:\ntnhhn.exec:\ntnhhn.exe122⤵PID:1688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-