Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 06:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f56274e74842b3f6a9947bf64949732ae10fa3c86f35d2efdb090987d2b258ecN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
f56274e74842b3f6a9947bf64949732ae10fa3c86f35d2efdb090987d2b258ecN.exe
-
Size
453KB
-
MD5
e3ecfdfad104fc27ca37a31300fba590
-
SHA1
1920d9ed1335c73429db3e0d35802fdfd0dddbee
-
SHA256
f56274e74842b3f6a9947bf64949732ae10fa3c86f35d2efdb090987d2b258ec
-
SHA512
463e03319c572ef25c173b20833bb5783b96ade013e491882b76c95e7f09f9a455730ee711dd15bdea207ae116118555faf9b0a71e3d4955544f7426b7a100ab
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeh:q7Tc2NYHUrAwfMp3CDh
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3156-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3344-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3272-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3544-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1280-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1316-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1300-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-923-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-1011-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-1021-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-1046-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-1092-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-1096-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-1142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4452 ntbnhh.exe 3344 jppjd.exe 3904 xffrlfx.exe 3916 7rrlfll.exe 3508 9hbhnn.exe 3012 xrrxlfx.exe 1640 7jvjd.exe 1620 5fxrrrr.exe 2776 vvppd.exe 3988 lflllrl.exe 2636 dvvpp.exe 2620 hnnhtt.exe 220 jvdvp.exe 4972 htbtnn.exe 2856 9ppjj.exe 2596 5ffxrlf.exe 2148 bbhbtb.exe 2452 1vvpj.exe 4964 tntnhh.exe 4856 xfxxxff.exe 5032 bthbtn.exe 3272 vvpjd.exe 224 lfxfrxf.exe 1484 bbhbhh.exe 4500 rlfrllx.exe 2604 nbhbnh.exe 3544 lllllll.exe 4432 bttnbb.exe 3260 djdvj.exe 3188 pdjdv.exe 3796 rrrrffx.exe 2752 nntttb.exe 2108 ffffllf.exe 4924 vppdv.exe 2408 xrrrllf.exe 2728 dvvpj.exe 2492 lffrffx.exe 1476 tntnhb.exe 1148 1jpdd.exe 1464 1vpdd.exe 3616 llllfxx.exe 1280 tbbtnn.exe 556 vvdvj.exe 3640 rrrllxl.exe 1696 nnnnhh.exe 4408 tthbhh.exe 2228 pvpdv.exe 2300 xlxxlff.exe 3028 3hnhbb.exe 4852 jpdpj.exe 2796 9frlxlf.exe 4260 7xrlxrl.exe 3776 jvdjp.exe 1812 rxrxxrf.exe 3916 hntnhh.exe 4256 vvjdv.exe 672 rxxrlfr.exe 5072 tnbbbb.exe 408 9pppp.exe 3636 lflxlfr.exe 2448 bhtntt.exe 4008 jdjdv.exe 2500 xxrffxr.exe 2236 hthhht.exe -
resource yara_rule behavioral2/memory/3156-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3344-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3272-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3544-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1280-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1316-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1300-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-923-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-1011-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-1021-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3flfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rrlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3156 wrote to memory of 4452 3156 f56274e74842b3f6a9947bf64949732ae10fa3c86f35d2efdb090987d2b258ecN.exe 82 PID 3156 wrote to memory of 4452 3156 f56274e74842b3f6a9947bf64949732ae10fa3c86f35d2efdb090987d2b258ecN.exe 82 PID 3156 wrote to memory of 4452 3156 f56274e74842b3f6a9947bf64949732ae10fa3c86f35d2efdb090987d2b258ecN.exe 82 PID 4452 wrote to memory of 3344 4452 ntbnhh.exe 83 PID 4452 wrote to memory of 3344 4452 ntbnhh.exe 83 PID 4452 wrote to memory of 3344 4452 ntbnhh.exe 83 PID 3344 wrote to memory of 3904 3344 jppjd.exe 84 PID 3344 wrote to memory of 3904 3344 jppjd.exe 84 PID 3344 wrote to memory of 3904 3344 jppjd.exe 84 PID 3904 wrote to memory of 3916 3904 xffrlfx.exe 85 PID 3904 wrote to memory of 3916 3904 xffrlfx.exe 85 PID 3904 wrote to memory of 3916 3904 xffrlfx.exe 85 PID 3916 wrote to memory of 3508 3916 7rrlfll.exe 86 PID 3916 wrote to memory of 3508 3916 7rrlfll.exe 86 PID 3916 wrote to memory of 3508 3916 7rrlfll.exe 86 PID 3508 wrote to memory of 3012 3508 9hbhnn.exe 87 PID 3508 wrote to memory of 3012 3508 9hbhnn.exe 87 PID 3508 wrote to memory of 3012 3508 9hbhnn.exe 87 PID 3012 wrote to memory of 1640 3012 xrrxlfx.exe 88 PID 3012 wrote to memory of 1640 3012 xrrxlfx.exe 88 PID 3012 wrote to memory of 1640 3012 xrrxlfx.exe 88 PID 1640 wrote to memory of 1620 1640 7jvjd.exe 89 PID 1640 wrote to memory of 1620 1640 7jvjd.exe 89 PID 1640 wrote to memory of 1620 1640 7jvjd.exe 89 PID 1620 wrote to memory of 2776 1620 5fxrrrr.exe 90 PID 1620 wrote to memory of 2776 1620 5fxrrrr.exe 90 PID 1620 wrote to memory of 2776 1620 5fxrrrr.exe 90 PID 2776 wrote to memory of 3988 2776 vvppd.exe 91 PID 2776 wrote to memory of 3988 2776 vvppd.exe 91 PID 2776 wrote to memory of 3988 2776 vvppd.exe 91 PID 3988 wrote to memory of 2636 3988 lflllrl.exe 92 PID 3988 wrote to memory of 2636 3988 lflllrl.exe 92 PID 3988 wrote to memory of 2636 3988 lflllrl.exe 92 PID 2636 wrote to memory of 2620 2636 dvvpp.exe 93 PID 2636 wrote to memory of 2620 2636 dvvpp.exe 93 PID 2636 wrote to memory of 2620 2636 dvvpp.exe 93 PID 2620 wrote to memory of 220 2620 hnnhtt.exe 94 PID 2620 wrote to memory of 220 2620 hnnhtt.exe 94 PID 2620 wrote to memory of 220 2620 hnnhtt.exe 94 PID 220 wrote to memory of 4972 220 jvdvp.exe 95 PID 220 wrote to memory of 4972 220 jvdvp.exe 95 PID 220 wrote to memory of 4972 220 jvdvp.exe 95 PID 4972 wrote to memory of 2856 4972 htbtnn.exe 96 PID 4972 wrote to memory of 2856 4972 htbtnn.exe 96 PID 4972 wrote to memory of 2856 4972 htbtnn.exe 96 PID 2856 wrote to memory of 2596 2856 9ppjj.exe 97 PID 2856 wrote to memory of 2596 2856 9ppjj.exe 97 PID 2856 wrote to memory of 2596 2856 9ppjj.exe 97 PID 2596 wrote to memory of 2148 2596 5ffxrlf.exe 98 PID 2596 wrote to memory of 2148 2596 5ffxrlf.exe 98 PID 2596 wrote to memory of 2148 2596 5ffxrlf.exe 98 PID 2148 wrote to memory of 2452 2148 bbhbtb.exe 99 PID 2148 wrote to memory of 2452 2148 bbhbtb.exe 99 PID 2148 wrote to memory of 2452 2148 bbhbtb.exe 99 PID 2452 wrote to memory of 4964 2452 1vvpj.exe 100 PID 2452 wrote to memory of 4964 2452 1vvpj.exe 100 PID 2452 wrote to memory of 4964 2452 1vvpj.exe 100 PID 4964 wrote to memory of 4856 4964 tntnhh.exe 101 PID 4964 wrote to memory of 4856 4964 tntnhh.exe 101 PID 4964 wrote to memory of 4856 4964 tntnhh.exe 101 PID 4856 wrote to memory of 5032 4856 xfxxxff.exe 102 PID 4856 wrote to memory of 5032 4856 xfxxxff.exe 102 PID 4856 wrote to memory of 5032 4856 xfxxxff.exe 102 PID 5032 wrote to memory of 3272 5032 bthbtn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\f56274e74842b3f6a9947bf64949732ae10fa3c86f35d2efdb090987d2b258ecN.exe"C:\Users\Admin\AppData\Local\Temp\f56274e74842b3f6a9947bf64949732ae10fa3c86f35d2efdb090987d2b258ecN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\ntbnhh.exec:\ntbnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\jppjd.exec:\jppjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\xffrlfx.exec:\xffrlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\7rrlfll.exec:\7rrlfll.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\9hbhnn.exec:\9hbhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\xrrxlfx.exec:\xrrxlfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\7jvjd.exec:\7jvjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\5fxrrrr.exec:\5fxrrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\vvppd.exec:\vvppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\lflllrl.exec:\lflllrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\dvvpp.exec:\dvvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\hnnhtt.exec:\hnnhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\jvdvp.exec:\jvdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\htbtnn.exec:\htbtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\9ppjj.exec:\9ppjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\5ffxrlf.exec:\5ffxrlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\bbhbtb.exec:\bbhbtb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\1vvpj.exec:\1vvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\tntnhh.exec:\tntnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\xfxxxff.exec:\xfxxxff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\bthbtn.exec:\bthbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\vvpjd.exec:\vvpjd.exe23⤵
- Executes dropped EXE
PID:3272 -
\??\c:\lfxfrxf.exec:\lfxfrxf.exe24⤵
- Executes dropped EXE
PID:224 -
\??\c:\bbhbhh.exec:\bbhbhh.exe25⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rlfrllx.exec:\rlfrllx.exe26⤵
- Executes dropped EXE
PID:4500 -
\??\c:\nbhbnh.exec:\nbhbnh.exe27⤵
- Executes dropped EXE
PID:2604 -
\??\c:\lllllll.exec:\lllllll.exe28⤵
- Executes dropped EXE
PID:3544 -
\??\c:\bttnbb.exec:\bttnbb.exe29⤵
- Executes dropped EXE
PID:4432 -
\??\c:\djdvj.exec:\djdvj.exe30⤵
- Executes dropped EXE
PID:3260 -
\??\c:\pdjdv.exec:\pdjdv.exe31⤵
- Executes dropped EXE
PID:3188 -
\??\c:\rrrrffx.exec:\rrrrffx.exe32⤵
- Executes dropped EXE
PID:3796 -
\??\c:\nntttb.exec:\nntttb.exe33⤵
- Executes dropped EXE
PID:2752 -
\??\c:\ffffllf.exec:\ffffllf.exe34⤵
- Executes dropped EXE
PID:2108 -
\??\c:\vppdv.exec:\vppdv.exe35⤵
- Executes dropped EXE
PID:4924 -
\??\c:\xrrrllf.exec:\xrrrllf.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2408 -
\??\c:\dvvpj.exec:\dvvpj.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2728 -
\??\c:\lffrffx.exec:\lffrffx.exe38⤵
- Executes dropped EXE
PID:2492 -
\??\c:\tntnhb.exec:\tntnhb.exe39⤵
- Executes dropped EXE
PID:1476 -
\??\c:\1jpdd.exec:\1jpdd.exe40⤵
- Executes dropped EXE
PID:1148 -
\??\c:\1vpdd.exec:\1vpdd.exe41⤵
- Executes dropped EXE
PID:1464 -
\??\c:\llllfxx.exec:\llllfxx.exe42⤵
- Executes dropped EXE
PID:3616 -
\??\c:\tbbtnn.exec:\tbbtnn.exe43⤵
- Executes dropped EXE
PID:1280 -
\??\c:\vvdvj.exec:\vvdvj.exe44⤵
- Executes dropped EXE
PID:556 -
\??\c:\rrrllxl.exec:\rrrllxl.exe45⤵
- Executes dropped EXE
PID:3640 -
\??\c:\nnnnhh.exec:\nnnnhh.exe46⤵
- Executes dropped EXE
PID:1696 -
\??\c:\tthbhh.exec:\tthbhh.exe47⤵
- Executes dropped EXE
PID:4408 -
\??\c:\pvpdv.exec:\pvpdv.exe48⤵
- Executes dropped EXE
PID:2228 -
\??\c:\xlxxlff.exec:\xlxxlff.exe49⤵
- Executes dropped EXE
PID:2300 -
\??\c:\3hnhbb.exec:\3hnhbb.exe50⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jpdpj.exec:\jpdpj.exe51⤵
- Executes dropped EXE
PID:4852 -
\??\c:\9frlxlf.exec:\9frlxlf.exe52⤵
- Executes dropped EXE
PID:2796 -
\??\c:\7xrlxrl.exec:\7xrlxrl.exe53⤵
- Executes dropped EXE
PID:4260 -
\??\c:\jvdjp.exec:\jvdjp.exe54⤵
- Executes dropped EXE
PID:3776 -
\??\c:\rxrxxrf.exec:\rxrxxrf.exe55⤵
- Executes dropped EXE
PID:1812 -
\??\c:\hntnhh.exec:\hntnhh.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3916 -
\??\c:\vvjdv.exec:\vvjdv.exe57⤵
- Executes dropped EXE
PID:4256 -
\??\c:\rxxrlfr.exec:\rxxrlfr.exe58⤵
- Executes dropped EXE
PID:672 -
\??\c:\tnbbbb.exec:\tnbbbb.exe59⤵
- Executes dropped EXE
PID:5072 -
\??\c:\9pppp.exec:\9pppp.exe60⤵
- Executes dropped EXE
PID:408 -
\??\c:\lflxlfr.exec:\lflxlfr.exe61⤵
- Executes dropped EXE
PID:3636 -
\??\c:\bhtntt.exec:\bhtntt.exe62⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jdjdv.exec:\jdjdv.exe63⤵
- Executes dropped EXE
PID:4008 -
\??\c:\xxrffxr.exec:\xxrffxr.exe64⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hthhht.exec:\hthhht.exe65⤵
- Executes dropped EXE
PID:2236 -
\??\c:\pjpjd.exec:\pjpjd.exe66⤵PID:4704
-
\??\c:\pdvpv.exec:\pdvpv.exe67⤵PID:2896
-
\??\c:\llxrrrr.exec:\llxrrrr.exe68⤵PID:4904
-
\??\c:\vpvpj.exec:\vpvpj.exe69⤵PID:2556
-
\??\c:\llxxxxx.exec:\llxxxxx.exe70⤵PID:1316
-
\??\c:\hbthht.exec:\hbthht.exe71⤵PID:4296
-
\??\c:\5ppjj.exec:\5ppjj.exe72⤵PID:2276
-
\??\c:\jjjjd.exec:\jjjjd.exe73⤵PID:448
-
\??\c:\9nhthb.exec:\9nhthb.exe74⤵PID:3036
-
\??\c:\pjvpp.exec:\pjvpp.exe75⤵PID:2596
-
\??\c:\lxfxrfr.exec:\lxfxrfr.exe76⤵PID:3836
-
\??\c:\hbhbbh.exec:\hbhbbh.exe77⤵PID:4952
-
\??\c:\dvjjd.exec:\dvjjd.exe78⤵PID:1948
-
\??\c:\fxfllll.exec:\fxfllll.exe79⤵PID:744
-
\??\c:\1tnhbb.exec:\1tnhbb.exe80⤵PID:824
-
\??\c:\9ddvv.exec:\9ddvv.exe81⤵PID:3932
-
\??\c:\xfxxrrr.exec:\xfxxrrr.exe82⤵PID:4888
-
\??\c:\llxxrxx.exec:\llxxrxx.exe83⤵PID:1188
-
\??\c:\7tbtnt.exec:\7tbtnt.exe84⤵PID:1440
-
\??\c:\jjddv.exec:\jjddv.exe85⤵PID:3716
-
\??\c:\fflrfrr.exec:\fflrfrr.exe86⤵PID:4568
-
\??\c:\bnnhtt.exec:\bnnhtt.exe87⤵PID:1308
-
\??\c:\pdjdj.exec:\pdjdj.exe88⤵PID:2056
-
\??\c:\xxxrllf.exec:\xxxrllf.exe89⤵PID:4084
-
\??\c:\rrrlflf.exec:\rrrlflf.exe90⤵PID:756
-
\??\c:\bnbnbn.exec:\bnbnbn.exe91⤵PID:2604
-
\??\c:\vvjvd.exec:\vvjvd.exe92⤵PID:4332
-
\??\c:\lfxrxrf.exec:\lfxrxrf.exe93⤵PID:4900
-
\??\c:\7hnnhn.exec:\7hnnhn.exe94⤵PID:1364
-
\??\c:\ddjvv.exec:\ddjvv.exe95⤵PID:4340
-
\??\c:\xxxxxff.exec:\xxxxxff.exe96⤵PID:3964
-
\??\c:\nhbbht.exec:\nhbbht.exe97⤵PID:5020
-
\??\c:\rrlxxrl.exec:\rrlxxrl.exe98⤵PID:1528
-
\??\c:\hthbtt.exec:\hthbtt.exe99⤵PID:916
-
\??\c:\pvjpp.exec:\pvjpp.exe100⤵PID:3680
-
\??\c:\5xffxff.exec:\5xffxff.exe101⤵PID:3812
-
\??\c:\5nhtnn.exec:\5nhtnn.exe102⤵PID:4924
-
\??\c:\ppddj.exec:\ppddj.exe103⤵PID:2540
-
\??\c:\lrrrrxx.exec:\lrrrrxx.exe104⤵PID:2476
-
\??\c:\ntnhnn.exec:\ntnhnn.exe105⤵PID:1448
-
\??\c:\9dddv.exec:\9dddv.exe106⤵PID:1452
-
\??\c:\rfrllll.exec:\rfrllll.exe107⤵PID:724
-
\??\c:\nbbthb.exec:\nbbthb.exe108⤵PID:1408
-
\??\c:\vvjjp.exec:\vvjjp.exe109⤵PID:3616
-
\??\c:\5llffff.exec:\5llffff.exe110⤵PID:3624
-
\??\c:\rrrlrxf.exec:\rrrlrxf.exe111⤵PID:1372
-
\??\c:\hbtnbb.exec:\hbtnbb.exe112⤵PID:4912
-
\??\c:\pdjjd.exec:\pdjjd.exe113⤵PID:3044
-
\??\c:\rlxlrlx.exec:\rlxlrlx.exe114⤵PID:4320
-
\??\c:\hhbbth.exec:\hhbbth.exe115⤵PID:2640
-
\??\c:\vvpjd.exec:\vvpjd.exe116⤵PID:4848
-
\??\c:\1xxxxfl.exec:\1xxxxfl.exe117⤵PID:3388
-
\??\c:\nnhnnn.exec:\nnhnnn.exe118⤵PID:1784
-
\??\c:\ddjjd.exec:\ddjjd.exe119⤵PID:4872
-
\??\c:\3dddj.exec:\3dddj.exe120⤵PID:2796
-
\??\c:\lfrrrff.exec:\lfrrrff.exe121⤵PID:3904
-
\??\c:\tnttbt.exec:\tnttbt.exe122⤵PID:1300
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-