Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 14:29
Behavioral task
behavioral1
Sample
0ea5c80877d2639b2f3d07c06122f694672c5d2bb28d9d927368e62b6d4bbc39.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
0ea5c80877d2639b2f3d07c06122f694672c5d2bb28d9d927368e62b6d4bbc39.exe
-
Size
66KB
-
MD5
80feb676fd7f318f1c77dedd9cdeccec
-
SHA1
846ab76503e1c53bd5fad4bb248916c45c444729
-
SHA256
0ea5c80877d2639b2f3d07c06122f694672c5d2bb28d9d927368e62b6d4bbc39
-
SHA512
3365ddd94aff10b2ecfd4da11d9a92ed6d1cbe858ed7cae5ad7bd2f40755738406e9b8df945032689f201f41c5a81300f190a56bdadb730b17eced407fcc0418
-
SSDEEP
1536:/vQBeOGtrYS3srx93UBWfwC6Ggnouy8jb5DiLKrb03:/hOmTsF93UYfwC6GIoutcKbW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3116-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1704-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3728-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3940-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2340-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2456-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4252-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1820-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4916-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5056-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3740-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/836-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4040-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3972-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4012-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3580-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2468-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3200-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1224-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3232-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/952-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4240-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1364-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3764-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/960-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/836-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/812-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3320-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1940-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1240-497-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1284-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1172-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3284-560-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1016-570-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1264-577-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2512-590-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4076-633-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2208-658-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2740-668-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1460-769-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-812-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1704 nhtbtt.exe 4088 pddvp.exe 4888 ppdjp.exe 4908 7frxrrr.exe 3036 xrxrxrx.exe 2552 hbhhbb.exe 3728 nnhbtn.exe 3940 lfxlfxr.exe 1216 3hbbtt.exe 2340 hnnbtt.exe 2456 3jppj.exe 5020 frlflll.exe 3904 nhnhbb.exe 2868 jvjvp.exe 5044 dpvpp.exe 4884 fflflfl.exe 4252 ntbbbb.exe 3548 ppjdj.exe 1820 fxxrllf.exe 4916 hbhtnt.exe 4780 1dddv.exe 5056 pvpjd.exe 3740 xxffffx.exe 2024 rrxxrrl.exe 1580 lrrlffx.exe 836 jvdvp.exe 4040 dvvjd.exe 344 rlfxrrx.exe 4144 thhhhb.exe 3996 ddjjv.exe 1336 jpjdv.exe 3192 rlfxrrl.exe 3972 xrxrrrx.exe 64 tttnnn.exe 4012 xrflfff.exe 3580 rffxllf.exe 3148 tbhnnt.exe 2468 dppjv.exe 4392 vdpjv.exe 2208 tnbthh.exe 2784 thbbbt.exe 4876 dvjdv.exe 852 djvpd.exe 3200 xrrxlll.exe 1224 btbbtt.exe 1600 jdjdd.exe 4212 bnbtnn.exe 4028 jjpjd.exe 3396 rflfxxr.exe 844 fxfflfl.exe 3356 tbnhbt.exe 1416 jvjdp.exe 4436 dvdvp.exe 3232 xrfxxxl.exe 3628 rlllrrx.exe 2200 hbnhnb.exe 1240 btbthh.exe 3672 vjdvp.exe 4888 fxlfrfx.exe 4408 xfffxxr.exe 4628 bnbttn.exe 4904 thhhbb.exe 2156 7dvjv.exe 3640 lflrfrl.exe -
resource yara_rule behavioral2/memory/3116-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023c4f-6.dat upx behavioral2/memory/3116-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ca8-9.dat upx behavioral2/memory/1704-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb5-13.dat upx behavioral2/memory/4088-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb7-24.dat upx behavioral2/memory/4908-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb8-28.dat upx behavioral2/memory/3036-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb9-34.dat upx behavioral2/memory/2552-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4888-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cba-40.dat upx behavioral2/memory/2552-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbb-46.dat upx behavioral2/memory/3728-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbc-52.dat upx behavioral2/memory/3940-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbd-60.dat upx behavioral2/memory/1216-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbe-64.dat upx behavioral2/memory/2340-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbf-70.dat upx behavioral2/memory/2456-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc0-75.dat upx behavioral2/memory/5020-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc1-81.dat upx behavioral2/files/0x0007000000023cc2-86.dat upx behavioral2/memory/2868-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc3-92.dat upx behavioral2/files/0x0007000000023cc4-97.dat upx behavioral2/memory/4884-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc5-103.dat upx behavioral2/memory/4252-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc6-109.dat upx behavioral2/memory/3548-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1820-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc7-117.dat upx behavioral2/files/0x0007000000023cc8-124.dat upx behavioral2/memory/4916-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc9-130.dat upx behavioral2/memory/5056-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4780-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cca-135.dat upx behavioral2/memory/5056-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccb-141.dat upx behavioral2/memory/3740-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccc-146.dat upx behavioral2/files/0x0007000000023ccd-151.dat upx behavioral2/files/0x0007000000023cce-157.dat upx behavioral2/memory/836-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4040-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccf-164.dat upx behavioral2/files/0x0009000000023cb2-169.dat upx behavioral2/files/0x0007000000023cd1-173.dat upx behavioral2/memory/4144-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3996-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1336-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd2-180.dat upx behavioral2/files/0x0007000000023cd3-186.dat upx behavioral2/memory/3192-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3972-193-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3116 wrote to memory of 1704 3116 0ea5c80877d2639b2f3d07c06122f694672c5d2bb28d9d927368e62b6d4bbc39.exe 82 PID 3116 wrote to memory of 1704 3116 0ea5c80877d2639b2f3d07c06122f694672c5d2bb28d9d927368e62b6d4bbc39.exe 82 PID 3116 wrote to memory of 1704 3116 0ea5c80877d2639b2f3d07c06122f694672c5d2bb28d9d927368e62b6d4bbc39.exe 82 PID 1704 wrote to memory of 4088 1704 nhtbtt.exe 83 PID 1704 wrote to memory of 4088 1704 nhtbtt.exe 83 PID 1704 wrote to memory of 4088 1704 nhtbtt.exe 83 PID 4088 wrote to memory of 4888 4088 pddvp.exe 84 PID 4088 wrote to memory of 4888 4088 pddvp.exe 84 PID 4088 wrote to memory of 4888 4088 pddvp.exe 84 PID 4888 wrote to memory of 4908 4888 ppdjp.exe 85 PID 4888 wrote to memory of 4908 4888 ppdjp.exe 85 PID 4888 wrote to memory of 4908 4888 ppdjp.exe 85 PID 4908 wrote to memory of 3036 4908 7frxrrr.exe 86 PID 4908 wrote to memory of 3036 4908 7frxrrr.exe 86 PID 4908 wrote to memory of 3036 4908 7frxrrr.exe 86 PID 3036 wrote to memory of 2552 3036 xrxrxrx.exe 87 PID 3036 wrote to memory of 2552 3036 xrxrxrx.exe 87 PID 3036 wrote to memory of 2552 3036 xrxrxrx.exe 87 PID 2552 wrote to memory of 3728 2552 hbhhbb.exe 88 PID 2552 wrote to memory of 3728 2552 hbhhbb.exe 88 PID 2552 wrote to memory of 3728 2552 hbhhbb.exe 88 PID 3728 wrote to memory of 3940 3728 nnhbtn.exe 89 PID 3728 wrote to memory of 3940 3728 nnhbtn.exe 89 PID 3728 wrote to memory of 3940 3728 nnhbtn.exe 89 PID 3940 wrote to memory of 1216 3940 lfxlfxr.exe 90 PID 3940 wrote to memory of 1216 3940 lfxlfxr.exe 90 PID 3940 wrote to memory of 1216 3940 lfxlfxr.exe 90 PID 1216 wrote to memory of 2340 1216 3hbbtt.exe 91 PID 1216 wrote to memory of 2340 1216 3hbbtt.exe 91 PID 1216 wrote to memory of 2340 1216 3hbbtt.exe 91 PID 2340 wrote to memory of 2456 2340 hnnbtt.exe 92 PID 2340 wrote to memory of 2456 2340 hnnbtt.exe 92 PID 2340 wrote to memory of 2456 2340 hnnbtt.exe 92 PID 2456 wrote to memory of 5020 2456 3jppj.exe 93 PID 2456 wrote to memory of 5020 2456 3jppj.exe 93 PID 2456 wrote to memory of 5020 2456 3jppj.exe 93 PID 5020 wrote to memory of 3904 5020 frlflll.exe 94 PID 5020 wrote to memory of 3904 5020 frlflll.exe 94 PID 5020 wrote to memory of 3904 5020 frlflll.exe 94 PID 3904 wrote to memory of 2868 3904 nhnhbb.exe 95 PID 3904 wrote to memory of 2868 3904 nhnhbb.exe 95 PID 3904 wrote to memory of 2868 3904 nhnhbb.exe 95 PID 2868 wrote to memory of 5044 2868 jvjvp.exe 96 PID 2868 wrote to memory of 5044 2868 jvjvp.exe 96 PID 2868 wrote to memory of 5044 2868 jvjvp.exe 96 PID 5044 wrote to memory of 4884 5044 dpvpp.exe 97 PID 5044 wrote to memory of 4884 5044 dpvpp.exe 97 PID 5044 wrote to memory of 4884 5044 dpvpp.exe 97 PID 4884 wrote to memory of 4252 4884 fflflfl.exe 98 PID 4884 wrote to memory of 4252 4884 fflflfl.exe 98 PID 4884 wrote to memory of 4252 4884 fflflfl.exe 98 PID 4252 wrote to memory of 3548 4252 ntbbbb.exe 99 PID 4252 wrote to memory of 3548 4252 ntbbbb.exe 99 PID 4252 wrote to memory of 3548 4252 ntbbbb.exe 99 PID 3548 wrote to memory of 1820 3548 ppjdj.exe 100 PID 3548 wrote to memory of 1820 3548 ppjdj.exe 100 PID 3548 wrote to memory of 1820 3548 ppjdj.exe 100 PID 1820 wrote to memory of 4916 1820 fxxrllf.exe 101 PID 1820 wrote to memory of 4916 1820 fxxrllf.exe 101 PID 1820 wrote to memory of 4916 1820 fxxrllf.exe 101 PID 4916 wrote to memory of 4780 4916 hbhtnt.exe 102 PID 4916 wrote to memory of 4780 4916 hbhtnt.exe 102 PID 4916 wrote to memory of 4780 4916 hbhtnt.exe 102 PID 4780 wrote to memory of 5056 4780 1dddv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ea5c80877d2639b2f3d07c06122f694672c5d2bb28d9d927368e62b6d4bbc39.exe"C:\Users\Admin\AppData\Local\Temp\0ea5c80877d2639b2f3d07c06122f694672c5d2bb28d9d927368e62b6d4bbc39.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\nhtbtt.exec:\nhtbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\pddvp.exec:\pddvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\ppdjp.exec:\ppdjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\7frxrrr.exec:\7frxrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\xrxrxrx.exec:\xrxrxrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\hbhhbb.exec:\hbhhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\nnhbtn.exec:\nnhbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\lfxlfxr.exec:\lfxlfxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\3hbbtt.exec:\3hbbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\hnnbtt.exec:\hnnbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\3jppj.exec:\3jppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\frlflll.exec:\frlflll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\nhnhbb.exec:\nhnhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\jvjvp.exec:\jvjvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\dpvpp.exec:\dpvpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\fflflfl.exec:\fflflfl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\ntbbbb.exec:\ntbbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\ppjdj.exec:\ppjdj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\fxxrllf.exec:\fxxrllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\hbhtnt.exec:\hbhtnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\1dddv.exec:\1dddv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\pvpjd.exec:\pvpjd.exe23⤵
- Executes dropped EXE
PID:5056 -
\??\c:\xxffffx.exec:\xxffffx.exe24⤵
- Executes dropped EXE
PID:3740 -
\??\c:\rrxxrrl.exec:\rrxxrrl.exe25⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lrrlffx.exec:\lrrlffx.exe26⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jvdvp.exec:\jvdvp.exe27⤵
- Executes dropped EXE
PID:836 -
\??\c:\dvvjd.exec:\dvvjd.exe28⤵
- Executes dropped EXE
PID:4040 -
\??\c:\rlfxrrx.exec:\rlfxrrx.exe29⤵
- Executes dropped EXE
PID:344 -
\??\c:\thhhhb.exec:\thhhhb.exe30⤵
- Executes dropped EXE
PID:4144 -
\??\c:\ddjjv.exec:\ddjjv.exe31⤵
- Executes dropped EXE
PID:3996 -
\??\c:\jpjdv.exec:\jpjdv.exe32⤵
- Executes dropped EXE
PID:1336 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe33⤵
- Executes dropped EXE
PID:3192 -
\??\c:\xrxrrrx.exec:\xrxrrrx.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3972 -
\??\c:\tttnnn.exec:\tttnnn.exe35⤵
- Executes dropped EXE
PID:64 -
\??\c:\xrflfff.exec:\xrflfff.exe36⤵
- Executes dropped EXE
PID:4012 -
\??\c:\rffxllf.exec:\rffxllf.exe37⤵
- Executes dropped EXE
PID:3580 -
\??\c:\tbhnnt.exec:\tbhnnt.exe38⤵
- Executes dropped EXE
PID:3148 -
\??\c:\dppjv.exec:\dppjv.exe39⤵
- Executes dropped EXE
PID:2468 -
\??\c:\vdpjv.exec:\vdpjv.exe40⤵
- Executes dropped EXE
PID:4392 -
\??\c:\tnbthh.exec:\tnbthh.exe41⤵
- Executes dropped EXE
PID:2208 -
\??\c:\thbbbt.exec:\thbbbt.exe42⤵
- Executes dropped EXE
PID:2784 -
\??\c:\dvjdv.exec:\dvjdv.exe43⤵
- Executes dropped EXE
PID:4876 -
\??\c:\djvpd.exec:\djvpd.exe44⤵
- Executes dropped EXE
PID:852 -
\??\c:\xrrxlll.exec:\xrrxlll.exe45⤵
- Executes dropped EXE
PID:3200 -
\??\c:\btbbtt.exec:\btbbtt.exe46⤵
- Executes dropped EXE
PID:1224 -
\??\c:\jdjdd.exec:\jdjdd.exe47⤵
- Executes dropped EXE
PID:1600 -
\??\c:\bnbtnn.exec:\bnbtnn.exe48⤵
- Executes dropped EXE
PID:4212 -
\??\c:\jjpjd.exec:\jjpjd.exe49⤵
- Executes dropped EXE
PID:4028 -
\??\c:\rflfxxr.exec:\rflfxxr.exe50⤵
- Executes dropped EXE
PID:3396 -
\??\c:\fxfflfl.exec:\fxfflfl.exe51⤵
- Executes dropped EXE
PID:844 -
\??\c:\tbnhbt.exec:\tbnhbt.exe52⤵
- Executes dropped EXE
PID:3356 -
\??\c:\jvjdp.exec:\jvjdp.exe53⤵
- Executes dropped EXE
PID:1416 -
\??\c:\dvdvp.exec:\dvdvp.exe54⤵
- Executes dropped EXE
PID:4436 -
\??\c:\xrfxxxl.exec:\xrfxxxl.exe55⤵
- Executes dropped EXE
PID:3232 -
\??\c:\rlllrrx.exec:\rlllrrx.exe56⤵
- Executes dropped EXE
PID:3628 -
\??\c:\hbnhnb.exec:\hbnhnb.exe57⤵
- Executes dropped EXE
PID:2200 -
\??\c:\btbthh.exec:\btbthh.exe58⤵
- Executes dropped EXE
PID:1240 -
\??\c:\vjdvp.exec:\vjdvp.exe59⤵
- Executes dropped EXE
PID:3672 -
\??\c:\fxlfrfx.exec:\fxlfrfx.exe60⤵
- Executes dropped EXE
PID:4888 -
\??\c:\xfffxxr.exec:\xfffxxr.exe61⤵
- Executes dropped EXE
PID:4408 -
\??\c:\bnbttn.exec:\bnbttn.exe62⤵
- Executes dropped EXE
PID:4628 -
\??\c:\thhhbb.exec:\thhhbb.exe63⤵
- Executes dropped EXE
PID:4904 -
\??\c:\7dvjv.exec:\7dvjv.exe64⤵
- Executes dropped EXE
PID:2156 -
\??\c:\lflrfrl.exec:\lflrfrl.exe65⤵
- Executes dropped EXE
PID:3640 -
\??\c:\rxffrrl.exec:\rxffrrl.exe66⤵PID:2440
-
\??\c:\bnhbtt.exec:\bnhbtt.exe67⤵PID:1280
-
\??\c:\jppjp.exec:\jppjp.exe68⤵PID:3212
-
\??\c:\pdjdp.exec:\pdjdp.exe69⤵PID:952
-
\??\c:\xrxxlll.exec:\xrxxlll.exe70⤵PID:4240
-
\??\c:\htbttb.exec:\htbttb.exe71⤵PID:212
-
\??\c:\bbnbnh.exec:\bbnbnh.exe72⤵PID:536
-
\??\c:\vvjjv.exec:\vvjjv.exe73⤵PID:320
-
\??\c:\xfrrfff.exec:\xfrrfff.exe74⤵PID:1364
-
\??\c:\bthhtn.exec:\bthhtn.exe75⤵PID:2756
-
\??\c:\dvvpd.exec:\dvvpd.exe76⤵PID:1884
-
\??\c:\vjpdj.exec:\vjpdj.exe77⤵PID:2616
-
\??\c:\rrxrrrx.exec:\rrxrrrx.exe78⤵PID:392
-
\??\c:\btnnnn.exec:\btnnnn.exe79⤵PID:3824
-
\??\c:\nntnhh.exec:\nntnhh.exe80⤵PID:5032
-
\??\c:\jvvjv.exec:\jvvjv.exe81⤵PID:1268
-
\??\c:\vjdvp.exec:\vjdvp.exe82⤵PID:4836
-
\??\c:\lfxfrxr.exec:\lfxfrxr.exe83⤵PID:4400
-
\??\c:\lxrlfxr.exec:\lxrlfxr.exe84⤵PID:3764
-
\??\c:\1tthtn.exec:\1tthtn.exe85⤵PID:1124
-
\??\c:\dpvpp.exec:\dpvpp.exe86⤵PID:960
-
\??\c:\fxlxlfx.exec:\fxlxlfx.exe87⤵PID:4432
-
\??\c:\htnbnb.exec:\htnbnb.exe88⤵PID:2184
-
\??\c:\hhtbtt.exec:\hhtbtt.exe89⤵
- System Location Discovery: System Language Discovery
PID:4620 -
\??\c:\nbnhbb.exec:\nbnhbb.exe90⤵PID:1944
-
\??\c:\pvvvp.exec:\pvvvp.exe91⤵PID:4140
-
\??\c:\xllffxl.exec:\xllffxl.exe92⤵PID:3324
-
\??\c:\rxxrffx.exec:\rxxrffx.exe93⤵PID:836
-
\??\c:\7bhbtt.exec:\7bhbtt.exe94⤵PID:2816
-
\??\c:\vjjdv.exec:\vjjdv.exe95⤵PID:812
-
\??\c:\vppdj.exec:\vppdj.exe96⤵PID:1056
-
\??\c:\9lxlrrl.exec:\9lxlrrl.exe97⤵PID:4480
-
\??\c:\thbtnn.exec:\thbtnn.exe98⤵PID:1220
-
\??\c:\hbbtnt.exec:\hbbtnt.exe99⤵PID:556
-
\??\c:\pdvjp.exec:\pdvjp.exe100⤵PID:3572
-
\??\c:\dvjdd.exec:\dvjdd.exe101⤵PID:4232
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe102⤵PID:3972
-
\??\c:\lfrlxrf.exec:\lfrlxrf.exe103⤵PID:4508
-
\??\c:\ntbtnn.exec:\ntbtnn.exe104⤵PID:4012
-
\??\c:\pvpjv.exec:\pvpjv.exe105⤵
- System Location Discovery: System Language Discovery
PID:4524 -
\??\c:\vdvjp.exec:\vdvjp.exe106⤵PID:3320
-
\??\c:\lfxrfxx.exec:\lfxrfxx.exe107⤵PID:2460
-
\??\c:\bthnhn.exec:\bthnhn.exe108⤵PID:2144
-
\??\c:\nthbtn.exec:\nthbtn.exe109⤵PID:2724
-
\??\c:\jvdjd.exec:\jvdjd.exe110⤵PID:4576
-
\??\c:\lfrlffr.exec:\lfrlffr.exe111⤵PID:2276
-
\??\c:\lfffllf.exec:\lfffllf.exe112⤵PID:3188
-
\??\c:\thttbt.exec:\thttbt.exe113⤵PID:1940
-
\??\c:\bttbnn.exec:\bttbnn.exe114⤵PID:4832
-
\??\c:\9jdpv.exec:\9jdpv.exe115⤵PID:2516
-
\??\c:\xrlxlfx.exec:\xrlxlfx.exe116⤵PID:2128
-
\??\c:\xlllffx.exec:\xlllffx.exe117⤵PID:3044
-
\??\c:\ttttnn.exec:\ttttnn.exe118⤵
- System Location Discovery: System Language Discovery
PID:4500 -
\??\c:\btnbtb.exec:\btnbtb.exe119⤵PID:4872
-
\??\c:\jpppd.exec:\jpppd.exe120⤵PID:4712
-
\??\c:\rflfrxr.exec:\rflfrxr.exe121⤵PID:3808
-
\??\c:\lffxllf.exec:\lffxllf.exe122⤵PID:4360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-