Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 03:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
958146141e654e267c92f490970eb07a05a77a6b6d1fb9e73f34034f44b81390N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
958146141e654e267c92f490970eb07a05a77a6b6d1fb9e73f34034f44b81390N.exe
-
Size
452KB
-
MD5
25f55d23a782a51ea429791c3a2964e0
-
SHA1
a8ec6e093f718f78db0cc8b9ba32618a3664da01
-
SHA256
958146141e654e267c92f490970eb07a05a77a6b6d1fb9e73f34034f44b81390
-
SHA512
e28772ae9c415ced18555845f0169bc12f9e0befa074899b82f601148dfa87f47e436b3e4e7e4f2d44ee415ecc10732f1a6448cfb1dd88eac51e1f9236616047
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT:q7Tc2NYHUrAwfMp3CDT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/3980-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/348-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1412-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/608-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/668-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3788-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-658-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-674-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-868-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-924-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2504-1048-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-1223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-1377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4816 9nhthn.exe 3156 7dpdp.exe 5036 7xlrfxl.exe 2448 3btnbb.exe 1908 ddppj.exe 556 ttbtbb.exe 2516 7pjvp.exe 3496 ffrrlxx.exe 4484 3jpdp.exe 1960 bttnbn.exe 972 dvjdp.exe 3132 tbnhht.exe 1632 3jpdp.exe 3056 3jjdd.exe 2592 fflxrfx.exe 4312 jjjvj.exe 4920 3xrrrxr.exe 4500 7tthnh.exe 1084 5jdpj.exe 820 hntbnh.exe 3260 nbnhbh.exe 2192 pdppd.exe 1752 hbbthh.exe 2744 9vpdv.exe 1020 rxrxlfr.exe 2392 hnhbtt.exe 3552 rfxfrfr.exe 5100 5fxlrlx.exe 348 vdvdp.exe 1448 hbtnnn.exe 4396 5djdd.exe 2984 1ffxrrx.exe 4912 ntbtnt.exe 3644 hhbbtt.exe 4496 bthnbb.exe 5028 5djdp.exe 2120 rxfxlll.exe 1568 bbhbtb.exe 5020 hhhbtn.exe 2068 vvjpp.exe 4392 xrrlxxx.exe 1380 nbhbtt.exe 4964 5bbttt.exe 4984 dpjdv.exe 1932 lxxxxxx.exe 4764 jvdvv.exe 2476 ddvvd.exe 4408 fxxrlrr.exe 3252 nnnhbb.exe 5088 jdpjj.exe 3436 1xxrrrr.exe 544 bbthth.exe 5036 jdpdp.exe 4768 ffflxrf.exe 4068 bhnhtt.exe 3372 hbtnhh.exe 4784 dpjvj.exe 1348 frxfxrl.exe 740 lrxrxxr.exe 3976 nbbthh.exe 184 pdpjv.exe 3228 rffrlfx.exe 1624 rxrfrlx.exe 3960 nbtnhb.exe -
resource yara_rule behavioral2/memory/3980-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/348-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1412-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/608-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/668-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3788-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-868-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1llxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3980 wrote to memory of 4816 3980 958146141e654e267c92f490970eb07a05a77a6b6d1fb9e73f34034f44b81390N.exe 82 PID 3980 wrote to memory of 4816 3980 958146141e654e267c92f490970eb07a05a77a6b6d1fb9e73f34034f44b81390N.exe 82 PID 3980 wrote to memory of 4816 3980 958146141e654e267c92f490970eb07a05a77a6b6d1fb9e73f34034f44b81390N.exe 82 PID 4816 wrote to memory of 3156 4816 9nhthn.exe 83 PID 4816 wrote to memory of 3156 4816 9nhthn.exe 83 PID 4816 wrote to memory of 3156 4816 9nhthn.exe 83 PID 3156 wrote to memory of 5036 3156 7dpdp.exe 84 PID 3156 wrote to memory of 5036 3156 7dpdp.exe 84 PID 3156 wrote to memory of 5036 3156 7dpdp.exe 84 PID 5036 wrote to memory of 2448 5036 7xlrfxl.exe 85 PID 5036 wrote to memory of 2448 5036 7xlrfxl.exe 85 PID 5036 wrote to memory of 2448 5036 7xlrfxl.exe 85 PID 2448 wrote to memory of 1908 2448 3btnbb.exe 86 PID 2448 wrote to memory of 1908 2448 3btnbb.exe 86 PID 2448 wrote to memory of 1908 2448 3btnbb.exe 86 PID 1908 wrote to memory of 556 1908 ddppj.exe 87 PID 1908 wrote to memory of 556 1908 ddppj.exe 87 PID 1908 wrote to memory of 556 1908 ddppj.exe 87 PID 556 wrote to memory of 2516 556 ttbtbb.exe 88 PID 556 wrote to memory of 2516 556 ttbtbb.exe 88 PID 556 wrote to memory of 2516 556 ttbtbb.exe 88 PID 2516 wrote to memory of 3496 2516 7pjvp.exe 89 PID 2516 wrote to memory of 3496 2516 7pjvp.exe 89 PID 2516 wrote to memory of 3496 2516 7pjvp.exe 89 PID 3496 wrote to memory of 4484 3496 ffrrlxx.exe 90 PID 3496 wrote to memory of 4484 3496 ffrrlxx.exe 90 PID 3496 wrote to memory of 4484 3496 ffrrlxx.exe 90 PID 4484 wrote to memory of 1960 4484 3jpdp.exe 91 PID 4484 wrote to memory of 1960 4484 3jpdp.exe 91 PID 4484 wrote to memory of 1960 4484 3jpdp.exe 91 PID 1960 wrote to memory of 972 1960 bttnbn.exe 92 PID 1960 wrote to memory of 972 1960 bttnbn.exe 92 PID 1960 wrote to memory of 972 1960 bttnbn.exe 92 PID 972 wrote to memory of 3132 972 dvjdp.exe 93 PID 972 wrote to memory of 3132 972 dvjdp.exe 93 PID 972 wrote to memory of 3132 972 dvjdp.exe 93 PID 3132 wrote to memory of 1632 3132 tbnhht.exe 94 PID 3132 wrote to memory of 1632 3132 tbnhht.exe 94 PID 3132 wrote to memory of 1632 3132 tbnhht.exe 94 PID 1632 wrote to memory of 3056 1632 3jpdp.exe 95 PID 1632 wrote to memory of 3056 1632 3jpdp.exe 95 PID 1632 wrote to memory of 3056 1632 3jpdp.exe 95 PID 3056 wrote to memory of 2592 3056 3jjdd.exe 96 PID 3056 wrote to memory of 2592 3056 3jjdd.exe 96 PID 3056 wrote to memory of 2592 3056 3jjdd.exe 96 PID 2592 wrote to memory of 4312 2592 fflxrfx.exe 97 PID 2592 wrote to memory of 4312 2592 fflxrfx.exe 97 PID 2592 wrote to memory of 4312 2592 fflxrfx.exe 97 PID 4312 wrote to memory of 4920 4312 jjjvj.exe 98 PID 4312 wrote to memory of 4920 4312 jjjvj.exe 98 PID 4312 wrote to memory of 4920 4312 jjjvj.exe 98 PID 4920 wrote to memory of 4500 4920 3xrrrxr.exe 99 PID 4920 wrote to memory of 4500 4920 3xrrrxr.exe 99 PID 4920 wrote to memory of 4500 4920 3xrrrxr.exe 99 PID 4500 wrote to memory of 1084 4500 7tthnh.exe 100 PID 4500 wrote to memory of 1084 4500 7tthnh.exe 100 PID 4500 wrote to memory of 1084 4500 7tthnh.exe 100 PID 1084 wrote to memory of 820 1084 5jdpj.exe 101 PID 1084 wrote to memory of 820 1084 5jdpj.exe 101 PID 1084 wrote to memory of 820 1084 5jdpj.exe 101 PID 820 wrote to memory of 3260 820 hntbnh.exe 102 PID 820 wrote to memory of 3260 820 hntbnh.exe 102 PID 820 wrote to memory of 3260 820 hntbnh.exe 102 PID 3260 wrote to memory of 2192 3260 nbnhbh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\958146141e654e267c92f490970eb07a05a77a6b6d1fb9e73f34034f44b81390N.exe"C:\Users\Admin\AppData\Local\Temp\958146141e654e267c92f490970eb07a05a77a6b6d1fb9e73f34034f44b81390N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\9nhthn.exec:\9nhthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\7dpdp.exec:\7dpdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\7xlrfxl.exec:\7xlrfxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\3btnbb.exec:\3btnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\ddppj.exec:\ddppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\ttbtbb.exec:\ttbtbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\7pjvp.exec:\7pjvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\ffrrlxx.exec:\ffrrlxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\3jpdp.exec:\3jpdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\bttnbn.exec:\bttnbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\dvjdp.exec:\dvjdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\tbnhht.exec:\tbnhht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\3jpdp.exec:\3jpdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\3jjdd.exec:\3jjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\fflxrfx.exec:\fflxrfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\jjjvj.exec:\jjjvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\3xrrrxr.exec:\3xrrrxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\7tthnh.exec:\7tthnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\5jdpj.exec:\5jdpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\hntbnh.exec:\hntbnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\nbnhbh.exec:\nbnhbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\pdppd.exec:\pdppd.exe23⤵
- Executes dropped EXE
PID:2192 -
\??\c:\hbbthh.exec:\hbbthh.exe24⤵
- Executes dropped EXE
PID:1752 -
\??\c:\9vpdv.exec:\9vpdv.exe25⤵
- Executes dropped EXE
PID:2744 -
\??\c:\rxrxlfr.exec:\rxrxlfr.exe26⤵
- Executes dropped EXE
PID:1020 -
\??\c:\hnhbtt.exec:\hnhbtt.exe27⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rfxfrfr.exec:\rfxfrfr.exe28⤵
- Executes dropped EXE
PID:3552 -
\??\c:\5fxlrlx.exec:\5fxlrlx.exe29⤵
- Executes dropped EXE
PID:5100 -
\??\c:\vdvdp.exec:\vdvdp.exe30⤵
- Executes dropped EXE
PID:348 -
\??\c:\hbtnnn.exec:\hbtnnn.exe31⤵
- Executes dropped EXE
PID:1448 -
\??\c:\5djdd.exec:\5djdd.exe32⤵
- Executes dropped EXE
PID:4396 -
\??\c:\1ffxrrx.exec:\1ffxrrx.exe33⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ntbtnt.exec:\ntbtnt.exe34⤵
- Executes dropped EXE
PID:4912 -
\??\c:\hhbbtt.exec:\hhbbtt.exe35⤵
- Executes dropped EXE
PID:3644 -
\??\c:\bthnbb.exec:\bthnbb.exe36⤵
- Executes dropped EXE
PID:4496 -
\??\c:\5djdp.exec:\5djdp.exe37⤵
- Executes dropped EXE
PID:5028 -
\??\c:\rxfxlll.exec:\rxfxlll.exe38⤵
- Executes dropped EXE
PID:2120 -
\??\c:\bbhbtb.exec:\bbhbtb.exe39⤵
- Executes dropped EXE
PID:1568 -
\??\c:\hhhbtn.exec:\hhhbtn.exe40⤵
- Executes dropped EXE
PID:5020 -
\??\c:\vvjpp.exec:\vvjpp.exe41⤵
- Executes dropped EXE
PID:2068 -
\??\c:\xrrlxxx.exec:\xrrlxxx.exe42⤵
- Executes dropped EXE
PID:4392 -
\??\c:\nbhbtt.exec:\nbhbtt.exe43⤵
- Executes dropped EXE
PID:1380 -
\??\c:\5bbttt.exec:\5bbttt.exe44⤵
- Executes dropped EXE
PID:4964 -
\??\c:\dpjdv.exec:\dpjdv.exe45⤵
- Executes dropped EXE
PID:4984 -
\??\c:\lxxxxxx.exec:\lxxxxxx.exe46⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jvdvv.exec:\jvdvv.exe47⤵
- Executes dropped EXE
PID:4764 -
\??\c:\ddvvd.exec:\ddvvd.exe48⤵
- Executes dropped EXE
PID:2476 -
\??\c:\fxxrlrr.exec:\fxxrlrr.exe49⤵
- Executes dropped EXE
PID:4408 -
\??\c:\nnnhbb.exec:\nnnhbb.exe50⤵
- Executes dropped EXE
PID:3252 -
\??\c:\jdpjj.exec:\jdpjj.exe51⤵
- Executes dropped EXE
PID:5088 -
\??\c:\1xxrrrr.exec:\1xxrrrr.exe52⤵
- Executes dropped EXE
PID:3436 -
\??\c:\bbthth.exec:\bbthth.exe53⤵
- Executes dropped EXE
PID:544 -
\??\c:\jdpdp.exec:\jdpdp.exe54⤵
- Executes dropped EXE
PID:5036 -
\??\c:\ffflxrf.exec:\ffflxrf.exe55⤵
- Executes dropped EXE
PID:4768 -
\??\c:\bhnhtt.exec:\bhnhtt.exe56⤵
- Executes dropped EXE
PID:4068 -
\??\c:\hbtnhh.exec:\hbtnhh.exe57⤵
- Executes dropped EXE
PID:3372 -
\??\c:\dpjvj.exec:\dpjvj.exe58⤵
- Executes dropped EXE
PID:4784 -
\??\c:\frxfxrl.exec:\frxfxrl.exe59⤵
- Executes dropped EXE
PID:1348 -
\??\c:\lrxrxxr.exec:\lrxrxxr.exe60⤵
- Executes dropped EXE
PID:740 -
\??\c:\nbbthh.exec:\nbbthh.exe61⤵
- Executes dropped EXE
PID:3976 -
\??\c:\pdpjv.exec:\pdpjv.exe62⤵
- Executes dropped EXE
PID:184 -
\??\c:\rffrlfx.exec:\rffrlfx.exe63⤵
- Executes dropped EXE
PID:3228 -
\??\c:\rxrfrlx.exec:\rxrfrlx.exe64⤵
- Executes dropped EXE
PID:1624 -
\??\c:\nbtnhb.exec:\nbtnhb.exe65⤵
- Executes dropped EXE
PID:3960 -
\??\c:\3dpjd.exec:\3dpjd.exe66⤵PID:1236
-
\??\c:\1xxlxrl.exec:\1xxlxrl.exe67⤵PID:2288
-
\??\c:\1bbnht.exec:\1bbnht.exe68⤵PID:1816
-
\??\c:\pppjd.exec:\pppjd.exe69⤵PID:1632
-
\??\c:\xxlfffl.exec:\xxlfffl.exe70⤵PID:3056
-
\??\c:\xfxrxxl.exec:\xfxrxxl.exe71⤵PID:2204
-
\??\c:\nhnntt.exec:\nhnntt.exe72⤵PID:3592
-
\??\c:\dvppp.exec:\dvppp.exe73⤵PID:4312
-
\??\c:\3ffrfxr.exec:\3ffrfxr.exe74⤵PID:4920
-
\??\c:\nnntht.exec:\nnntht.exe75⤵PID:1412
-
\??\c:\7pvpj.exec:\7pvpj.exe76⤵PID:908
-
\??\c:\rrrrlfx.exec:\rrrrlfx.exe77⤵PID:2892
-
\??\c:\frxrlfx.exec:\frxrlfx.exe78⤵PID:748
-
\??\c:\5ntnnh.exec:\5ntnnh.exe79⤵PID:1996
-
\??\c:\vvddj.exec:\vvddj.exe80⤵PID:3880
-
\??\c:\xflfxxx.exec:\xflfxxx.exe81⤵PID:2192
-
\??\c:\rrlllxr.exec:\rrlllxr.exe82⤵PID:5040
-
\??\c:\nbhbtt.exec:\nbhbtt.exe83⤵PID:4956
-
\??\c:\3dpjd.exec:\3dpjd.exe84⤵PID:5076
-
\??\c:\rfxfrxf.exec:\rfxfrxf.exe85⤵PID:640
-
\??\c:\bbhthb.exec:\bbhthb.exe86⤵PID:3300
-
\??\c:\dvdpd.exec:\dvdpd.exe87⤵
- System Location Discovery: System Language Discovery
PID:608 -
\??\c:\pdjdp.exec:\pdjdp.exe88⤵PID:1172
-
\??\c:\xrfxlfx.exec:\xrfxlfx.exe89⤵PID:1224
-
\??\c:\nnhbbb.exec:\nnhbbb.exe90⤵PID:2408
-
\??\c:\vjpjv.exec:\vjpjv.exe91⤵PID:3208
-
\??\c:\xlflxrl.exec:\xlflxrl.exe92⤵PID:4296
-
\??\c:\httnhh.exec:\httnhh.exe93⤵PID:1440
-
\??\c:\dpvpd.exec:\dpvpd.exe94⤵PID:772
-
\??\c:\vpdvp.exec:\vpdvp.exe95⤵PID:2296
-
\??\c:\xrlxlxl.exec:\xrlxlxl.exe96⤵PID:3316
-
\??\c:\nbnttn.exec:\nbnttn.exe97⤵PID:2032
-
\??\c:\dppdp.exec:\dppdp.exe98⤵PID:1556
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe99⤵PID:4280
-
\??\c:\ttnbnh.exec:\ttnbnh.exe100⤵PID:668
-
\??\c:\thnntn.exec:\thnntn.exe101⤵PID:2776
-
\??\c:\9vpjp.exec:\9vpjp.exe102⤵PID:2200
-
\??\c:\xrlxlxl.exec:\xrlxlxl.exe103⤵PID:656
-
\??\c:\5hthnh.exec:\5hthnh.exe104⤵PID:5116
-
\??\c:\vjjdp.exec:\vjjdp.exe105⤵PID:3224
-
\??\c:\vjpjj.exec:\vjpjj.exe106⤵PID:2052
-
\??\c:\frrlffx.exec:\frrlffx.exe107⤵PID:1668
-
\??\c:\nbbnhb.exec:\nbbnhb.exe108⤵PID:4348
-
\??\c:\vvjdp.exec:\vvjdp.exe109⤵PID:1068
-
\??\c:\pdpdj.exec:\pdpdj.exe110⤵PID:32
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe111⤵PID:4652
-
\??\c:\hbbtnn.exec:\hbbtnn.exe112⤵PID:2572
-
\??\c:\thtnbb.exec:\thtnbb.exe113⤵PID:5088
-
\??\c:\5pvpd.exec:\5pvpd.exe114⤵PID:756
-
\??\c:\fxxrfrf.exec:\fxxrfrf.exe115⤵PID:4596
-
\??\c:\hthhnt.exec:\hthhnt.exe116⤵PID:5036
-
\??\c:\vddvd.exec:\vddvd.exe117⤵PID:960
-
\??\c:\frfrxrf.exec:\frfrxrf.exe118⤵PID:4068
-
\??\c:\frrxrxr.exec:\frrxrxr.exe119⤵PID:3372
-
\??\c:\nhhbtn.exec:\nhhbtn.exe120⤵PID:4784
-
\??\c:\dpvpp.exec:\dpvpp.exe121⤵PID:4264
-
\??\c:\dpjdp.exec:\dpjdp.exe122⤵PID:740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-