Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 06:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7e95e16014e20d1459c1f1bfc0f817c46413a9ae5c60e24c09cea0c24a2e23c9N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
7e95e16014e20d1459c1f1bfc0f817c46413a9ae5c60e24c09cea0c24a2e23c9N.exe
-
Size
256KB
-
MD5
73716db42870027a7e865708d9c49760
-
SHA1
e8a162607cc73d41c21ca3d751d7ac89206293d9
-
SHA256
7e95e16014e20d1459c1f1bfc0f817c46413a9ae5c60e24c09cea0c24a2e23c9
-
SHA512
a88795754a2a1fccb7531e3770dd1a27d104e51c96af1788fd2b73dd93f68b6699ce46c1063b8d2833273d3c2d89b416c6b53099610f4cbbef9838d54bd9f825
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYL:l7TcbWXZshJX2VG6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1616-5-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4772-20-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1296-19-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4892-12-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1776-30-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1728-36-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3388-42-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1592-48-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4840-53-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4840-54-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2376-61-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4344-65-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2988-72-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2804-77-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/556-89-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1304-94-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4560-112-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1952-118-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4756-125-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2816-131-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4456-145-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/640-150-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/964-162-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2340-156-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2152-186-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2244-193-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2424-197-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1864-201-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/708-204-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2564-208-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2896-212-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2520-216-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2560-223-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3748-227-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4884-243-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1388-247-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4304-251-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1300-264-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1292-268-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4144-277-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2196-293-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4840-297-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2376-301-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1480-317-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4052-321-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/320-331-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5016-335-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/740-339-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2496-358-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/400-362-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4580-402-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3036-421-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1288-431-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1468-438-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2412-442-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4776-449-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3872-487-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1960-536-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/740-546-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3452-634-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4432-656-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2884-666-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4076-786-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2860-998-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4892 nttnbt.exe 1296 xfxxlfr.exe 4772 nhhnhh.exe 1776 5ntntt.exe 1728 vjdvv.exe 3388 xlrllrx.exe 1592 pdvpp.exe 4840 ffxxffx.exe 2376 dpvdv.exe 4344 hthbtt.exe 2988 dvjdp.exe 2804 7lrrlll.exe 1340 3xxrllf.exe 556 hhnhnn.exe 1304 ffxflxl.exe 320 3bttnt.exe 4048 ffrrxfr.exe 4560 7hthht.exe 1952 rflfxxx.exe 4756 btnhnb.exe 2816 jdppp.exe 4608 llllllr.exe 2540 tbhbbh.exe 4456 5rllfff.exe 640 bbhnbb.exe 2340 jvdvv.exe 964 flxxlll.exe 2724 fflfllx.exe 3364 bttnnt.exe 4516 rffxxff.exe 2152 nthhbb.exe 4952 1jpdv.exe 2244 bbbtth.exe 2424 xxllrrf.exe 1864 ttttnn.exe 708 thnnnn.exe 2564 jdpjj.exe 2896 fflrffl.exe 2520 nnnnnb.exe 4388 jddpv.exe 2560 fflrxxr.exe 3748 nbhbbb.exe 3604 dpjdd.exe 4948 rrfxxlr.exe 4312 lflfxxr.exe 4776 htbbtt.exe 4884 lxxxffx.exe 1388 tnthnt.exe 4304 dddjd.exe 2216 ffxxxrr.exe 2884 1bbtbb.exe 1492 hbbbtt.exe 1300 5pddd.exe 1292 ffllfll.exe 3596 llxxfff.exe 4380 jpddd.exe 4144 1djjd.exe 2576 1fllrxf.exe 5068 hnnnhh.exe 216 jdjpp.exe 2292 rxxrlll.exe 2196 3rrlfff.exe 4840 httttt.exe 2376 vjvvp.exe -
resource yara_rule behavioral2/memory/1616-5-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1296-13-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4772-20-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1296-19-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4892-12-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1776-30-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1728-36-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3388-42-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1592-48-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4840-53-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4840-54-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2376-61-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4344-65-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2988-72-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2804-77-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/556-89-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1304-94-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4560-107-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4560-112-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1952-118-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4756-125-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2816-131-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4456-145-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/640-150-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/964-162-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2340-156-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2152-186-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2244-193-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2424-197-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1864-201-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/708-204-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2564-208-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2896-212-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2520-216-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2560-223-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3748-227-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4884-243-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1388-247-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4304-251-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1300-264-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1292-268-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4144-277-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2196-293-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4840-297-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2376-301-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1480-317-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4052-321-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/320-331-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5016-335-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/740-339-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2496-358-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/400-362-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4580-402-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3036-421-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1288-431-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1468-438-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2412-442-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4776-449-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3872-487-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1960-536-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/740-546-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3452-634-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4432-656-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2884-666-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1616 wrote to memory of 4892 1616 7e95e16014e20d1459c1f1bfc0f817c46413a9ae5c60e24c09cea0c24a2e23c9N.exe 83 PID 1616 wrote to memory of 4892 1616 7e95e16014e20d1459c1f1bfc0f817c46413a9ae5c60e24c09cea0c24a2e23c9N.exe 83 PID 1616 wrote to memory of 4892 1616 7e95e16014e20d1459c1f1bfc0f817c46413a9ae5c60e24c09cea0c24a2e23c9N.exe 83 PID 4892 wrote to memory of 1296 4892 nttnbt.exe 84 PID 4892 wrote to memory of 1296 4892 nttnbt.exe 84 PID 4892 wrote to memory of 1296 4892 nttnbt.exe 84 PID 1296 wrote to memory of 4772 1296 xfxxlfr.exe 85 PID 1296 wrote to memory of 4772 1296 xfxxlfr.exe 85 PID 1296 wrote to memory of 4772 1296 xfxxlfr.exe 85 PID 4772 wrote to memory of 1776 4772 nhhnhh.exe 86 PID 4772 wrote to memory of 1776 4772 nhhnhh.exe 86 PID 4772 wrote to memory of 1776 4772 nhhnhh.exe 86 PID 1776 wrote to memory of 1728 1776 5ntntt.exe 87 PID 1776 wrote to memory of 1728 1776 5ntntt.exe 87 PID 1776 wrote to memory of 1728 1776 5ntntt.exe 87 PID 1728 wrote to memory of 3388 1728 vjdvv.exe 88 PID 1728 wrote to memory of 3388 1728 vjdvv.exe 88 PID 1728 wrote to memory of 3388 1728 vjdvv.exe 88 PID 3388 wrote to memory of 1592 3388 xlrllrx.exe 89 PID 3388 wrote to memory of 1592 3388 xlrllrx.exe 89 PID 3388 wrote to memory of 1592 3388 xlrllrx.exe 89 PID 1592 wrote to memory of 4840 1592 pdvpp.exe 90 PID 1592 wrote to memory of 4840 1592 pdvpp.exe 90 PID 1592 wrote to memory of 4840 1592 pdvpp.exe 90 PID 4840 wrote to memory of 2376 4840 ffxxffx.exe 91 PID 4840 wrote to memory of 2376 4840 ffxxffx.exe 91 PID 4840 wrote to memory of 2376 4840 ffxxffx.exe 91 PID 2376 wrote to memory of 4344 2376 dpvdv.exe 92 PID 2376 wrote to memory of 4344 2376 dpvdv.exe 92 PID 2376 wrote to memory of 4344 2376 dpvdv.exe 92 PID 4344 wrote to memory of 2988 4344 hthbtt.exe 93 PID 4344 wrote to memory of 2988 4344 hthbtt.exe 93 PID 4344 wrote to memory of 2988 4344 hthbtt.exe 93 PID 2988 wrote to memory of 2804 2988 dvjdp.exe 94 PID 2988 wrote to memory of 2804 2988 dvjdp.exe 94 PID 2988 wrote to memory of 2804 2988 dvjdp.exe 94 PID 2804 wrote to memory of 1340 2804 7lrrlll.exe 95 PID 2804 wrote to memory of 1340 2804 7lrrlll.exe 95 PID 2804 wrote to memory of 1340 2804 7lrrlll.exe 95 PID 1340 wrote to memory of 556 1340 3xxrllf.exe 96 PID 1340 wrote to memory of 556 1340 3xxrllf.exe 96 PID 1340 wrote to memory of 556 1340 3xxrllf.exe 96 PID 556 wrote to memory of 1304 556 hhnhnn.exe 97 PID 556 wrote to memory of 1304 556 hhnhnn.exe 97 PID 556 wrote to memory of 1304 556 hhnhnn.exe 97 PID 1304 wrote to memory of 320 1304 ffxflxl.exe 98 PID 1304 wrote to memory of 320 1304 ffxflxl.exe 98 PID 1304 wrote to memory of 320 1304 ffxflxl.exe 98 PID 320 wrote to memory of 4048 320 3bttnt.exe 99 PID 320 wrote to memory of 4048 320 3bttnt.exe 99 PID 320 wrote to memory of 4048 320 3bttnt.exe 99 PID 4048 wrote to memory of 4560 4048 ffrrxfr.exe 100 PID 4048 wrote to memory of 4560 4048 ffrrxfr.exe 100 PID 4048 wrote to memory of 4560 4048 ffrrxfr.exe 100 PID 4560 wrote to memory of 1952 4560 7hthht.exe 101 PID 4560 wrote to memory of 1952 4560 7hthht.exe 101 PID 4560 wrote to memory of 1952 4560 7hthht.exe 101 PID 1952 wrote to memory of 4756 1952 rflfxxx.exe 102 PID 1952 wrote to memory of 4756 1952 rflfxxx.exe 102 PID 1952 wrote to memory of 4756 1952 rflfxxx.exe 102 PID 4756 wrote to memory of 2816 4756 btnhnb.exe 103 PID 4756 wrote to memory of 2816 4756 btnhnb.exe 103 PID 4756 wrote to memory of 2816 4756 btnhnb.exe 103 PID 2816 wrote to memory of 4608 2816 jdppp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e95e16014e20d1459c1f1bfc0f817c46413a9ae5c60e24c09cea0c24a2e23c9N.exe"C:\Users\Admin\AppData\Local\Temp\7e95e16014e20d1459c1f1bfc0f817c46413a9ae5c60e24c09cea0c24a2e23c9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\nttnbt.exec:\nttnbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\xfxxlfr.exec:\xfxxlfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\nhhnhh.exec:\nhhnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\5ntntt.exec:\5ntntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\vjdvv.exec:\vjdvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\xlrllrx.exec:\xlrllrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\pdvpp.exec:\pdvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\ffxxffx.exec:\ffxxffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\dpvdv.exec:\dpvdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\hthbtt.exec:\hthbtt.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\dvjdp.exec:\dvjdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\7lrrlll.exec:\7lrrlll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\3xxrllf.exec:\3xxrllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\hhnhnn.exec:\hhnhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\ffxflxl.exec:\ffxflxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\3bttnt.exec:\3bttnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\ffrrxfr.exec:\ffrrxfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\7hthht.exec:\7hthht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\rflfxxx.exec:\rflfxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\btnhnb.exec:\btnhnb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\jdppp.exec:\jdppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\llllllr.exec:\llllllr.exe23⤵
- Executes dropped EXE
PID:4608 -
\??\c:\tbhbbh.exec:\tbhbbh.exe24⤵
- Executes dropped EXE
PID:2540 -
\??\c:\5rllfff.exec:\5rllfff.exe25⤵
- Executes dropped EXE
PID:4456 -
\??\c:\bbhnbb.exec:\bbhnbb.exe26⤵
- Executes dropped EXE
PID:640 -
\??\c:\jvdvv.exec:\jvdvv.exe27⤵
- Executes dropped EXE
PID:2340 -
\??\c:\flxxlll.exec:\flxxlll.exe28⤵
- Executes dropped EXE
PID:964 -
\??\c:\fflfllx.exec:\fflfllx.exe29⤵
- Executes dropped EXE
PID:2724 -
\??\c:\bttnnt.exec:\bttnnt.exe30⤵
- Executes dropped EXE
PID:3364 -
\??\c:\rffxxff.exec:\rffxxff.exe31⤵
- Executes dropped EXE
PID:4516 -
\??\c:\nthhbb.exec:\nthhbb.exe32⤵
- Executes dropped EXE
PID:2152 -
\??\c:\1jpdv.exec:\1jpdv.exe33⤵
- Executes dropped EXE
PID:4952 -
\??\c:\bbbtth.exec:\bbbtth.exe34⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xxllrrf.exec:\xxllrrf.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2424 -
\??\c:\ttttnn.exec:\ttttnn.exe36⤵
- Executes dropped EXE
PID:1864 -
\??\c:\thnnnn.exec:\thnnnn.exe37⤵
- Executes dropped EXE
PID:708 -
\??\c:\jdpjj.exec:\jdpjj.exe38⤵
- Executes dropped EXE
PID:2564 -
\??\c:\fflrffl.exec:\fflrffl.exe39⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nnnnnb.exec:\nnnnnb.exe40⤵
- Executes dropped EXE
PID:2520 -
\??\c:\jddpv.exec:\jddpv.exe41⤵
- Executes dropped EXE
PID:4388 -
\??\c:\fflrxxr.exec:\fflrxxr.exe42⤵
- Executes dropped EXE
PID:2560 -
\??\c:\nbhbbb.exec:\nbhbbb.exe43⤵
- Executes dropped EXE
PID:3748 -
\??\c:\dpjdd.exec:\dpjdd.exe44⤵
- Executes dropped EXE
PID:3604 -
\??\c:\rrfxxlr.exec:\rrfxxlr.exe45⤵
- Executes dropped EXE
PID:4948 -
\??\c:\lflfxxr.exec:\lflfxxr.exe46⤵
- Executes dropped EXE
PID:4312 -
\??\c:\htbbtt.exec:\htbbtt.exe47⤵
- Executes dropped EXE
PID:4776 -
\??\c:\lxxxffx.exec:\lxxxffx.exe48⤵
- Executes dropped EXE
PID:4884 -
\??\c:\tnthnt.exec:\tnthnt.exe49⤵
- Executes dropped EXE
PID:1388 -
\??\c:\dddjd.exec:\dddjd.exe50⤵
- Executes dropped EXE
PID:4304 -
\??\c:\ffxxxrr.exec:\ffxxxrr.exe51⤵
- Executes dropped EXE
PID:2216 -
\??\c:\1bbtbb.exec:\1bbtbb.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2884 -
\??\c:\hbbbtt.exec:\hbbbtt.exe53⤵
- Executes dropped EXE
PID:1492 -
\??\c:\5pddd.exec:\5pddd.exe54⤵
- Executes dropped EXE
PID:1300 -
\??\c:\ffllfll.exec:\ffllfll.exe55⤵
- Executes dropped EXE
PID:1292 -
\??\c:\llxxfff.exec:\llxxfff.exe56⤵
- Executes dropped EXE
PID:3596 -
\??\c:\jpddd.exec:\jpddd.exe57⤵
- Executes dropped EXE
PID:4380 -
\??\c:\1djjd.exec:\1djjd.exe58⤵
- Executes dropped EXE
PID:4144 -
\??\c:\1fllrxf.exec:\1fllrxf.exe59⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hnnnhh.exec:\hnnnhh.exe60⤵
- Executes dropped EXE
PID:5068 -
\??\c:\jdjpp.exec:\jdjpp.exe61⤵
- Executes dropped EXE
PID:216 -
\??\c:\rxxrlll.exec:\rxxrlll.exe62⤵
- Executes dropped EXE
PID:2292 -
\??\c:\3rrlfff.exec:\3rrlfff.exe63⤵
- Executes dropped EXE
PID:2196 -
\??\c:\httttt.exec:\httttt.exe64⤵
- Executes dropped EXE
PID:4840 -
\??\c:\vjvvp.exec:\vjvvp.exe65⤵
- Executes dropped EXE
PID:2376 -
\??\c:\xxxxlrl.exec:\xxxxlrl.exe66⤵PID:1688
-
\??\c:\hbbbtb.exec:\hbbbtb.exe67⤵PID:5100
-
\??\c:\ppppv.exec:\ppppv.exe68⤵PID:2988
-
\??\c:\vpvpj.exec:\vpvpj.exe69⤵PID:1120
-
\??\c:\rffrfxf.exec:\rffrfxf.exe70⤵PID:1480
-
\??\c:\5bnhhn.exec:\5bnhhn.exe71⤵PID:4052
-
\??\c:\tthhtb.exec:\tthhtb.exe72⤵PID:4988
-
\??\c:\1rxxflr.exec:\1rxxflr.exe73⤵PID:1304
-
\??\c:\flfrlfx.exec:\flfrlfx.exe74⤵PID:320
-
\??\c:\btbbbb.exec:\btbbbb.exe75⤵PID:5016
-
\??\c:\7vppp.exec:\7vppp.exe76⤵PID:740
-
\??\c:\fllxrrf.exec:\fllxrrf.exe77⤵PID:4352
-
\??\c:\thtttt.exec:\thtttt.exe78⤵PID:2488
-
\??\c:\dvddv.exec:\dvddv.exe79⤵PID:2692
-
\??\c:\rxfxrrx.exec:\rxfxrrx.exe80⤵PID:3276
-
\??\c:\nhtnnn.exec:\nhtnnn.exe81⤵PID:4984
-
\??\c:\thnhhb.exec:\thnhhb.exe82⤵PID:2496
-
\??\c:\jjjjd.exec:\jjjjd.exe83⤵PID:400
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe84⤵PID:2752
-
\??\c:\nhnhnn.exec:\nhnhnn.exe85⤵PID:2516
-
\??\c:\dpddd.exec:\dpddd.exe86⤵PID:2040
-
\??\c:\vdjjd.exec:\vdjjd.exe87⤵PID:840
-
\??\c:\9flfxxr.exec:\9flfxxr.exe88⤵PID:2676
-
\??\c:\hbhbbh.exec:\hbhbbh.exe89⤵PID:2976
-
\??\c:\pjdvd.exec:\pjdvd.exe90⤵PID:4492
-
\??\c:\rfllrxl.exec:\rfllrxl.exe91⤵PID:900
-
\??\c:\5xxlffx.exec:\5xxlffx.exe92⤵PID:3672
-
\??\c:\1tbbbh.exec:\1tbbbh.exe93⤵PID:4340
-
\??\c:\dppjp.exec:\dppjp.exe94⤵
- System Location Discovery: System Language Discovery
PID:2484 -
\??\c:\pdddv.exec:\pdddv.exe95⤵PID:3964
-
\??\c:\9fllxfx.exec:\9fllxfx.exe96⤵PID:4580
-
\??\c:\nhhnhn.exec:\nhhnhn.exe97⤵PID:4496
-
\??\c:\jdjjj.exec:\jdjjj.exe98⤵PID:2436
-
\??\c:\ddpjj.exec:\ddpjj.exe99⤵PID:3924
-
\??\c:\xxffxll.exec:\xxffxll.exe100⤵PID:1596
-
\??\c:\bttttt.exec:\bttttt.exe101⤵PID:836
-
\??\c:\jdjdd.exec:\jdjdd.exe102⤵PID:3036
-
\??\c:\5vvpv.exec:\5vvpv.exe103⤵PID:1708
-
\??\c:\lrxrrxx.exec:\lrxrrxx.exe104⤵PID:2128
-
\??\c:\tbbbbb.exec:\tbbbbb.exe105⤵PID:1288
-
\??\c:\nhhnnn.exec:\nhhnnn.exe106⤵PID:3748
-
\??\c:\pdjdv.exec:\pdjdv.exe107⤵PID:1468
-
\??\c:\lxfllxx.exec:\lxfllxx.exe108⤵PID:2412
-
\??\c:\3htntb.exec:\3htntb.exe109⤵PID:4312
-
\??\c:\bntnnn.exec:\bntnnn.exe110⤵PID:4776
-
\??\c:\pjvpj.exec:\pjvpj.exe111⤵PID:3524
-
\??\c:\lfrfxlx.exec:\lfrfxlx.exe112⤵PID:4300
-
\??\c:\nttttt.exec:\nttttt.exe113⤵PID:916
-
\??\c:\htbttt.exec:\htbttt.exe114⤵PID:1172
-
\??\c:\ddjdj.exec:\ddjdj.exe115⤵PID:2848
-
\??\c:\7rffrxr.exec:\7rffrxr.exe116⤵PID:1296
-
\??\c:\btnhnb.exec:\btnhnb.exe117⤵PID:1152
-
\??\c:\9nbhhn.exec:\9nbhhn.exe118⤵PID:2572
-
\??\c:\ppvdj.exec:\ppvdj.exe119⤵PID:1292
-
\??\c:\9xfxxxx.exec:\9xfxxxx.exe120⤵PID:440
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe121⤵PID:1728
-
\??\c:\hhbttt.exec:\hhbttt.exe122⤵PID:4728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-