Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 02:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c665faee6f58ecab516b0558c608a51c53de81c085dba3cb88145802118a9678.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
General
-
Target
c665faee6f58ecab516b0558c608a51c53de81c085dba3cb88145802118a9678.exe
-
Size
454KB
-
MD5
3fb5a98edeadf8ebe864ffb15eb38127
-
SHA1
90cd09ff227538ecf13bfb81584ee945f0a6072f
-
SHA256
c665faee6f58ecab516b0558c608a51c53de81c085dba3cb88145802118a9678
-
SHA512
5bac707f6fe5a6deaaa2e0388bf24c4338536323878ff45d16ca96a4aaed64dc04eeba4ef4006c3555edcd87e184408906bbaed7d6c352cc6076731503e7139d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeS:q7Tc2NYHUrAwfMp3CDS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3636-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3880-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1732-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/936-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2864-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-640-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-674-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-792-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-817-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-845-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-852-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-1012-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-1040-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4280 jdpdp.exe 1240 1tntnt.exe 3880 nbbhnb.exe 1872 dvvdv.exe 4380 3tnhtn.exe 3280 jvdjp.exe 3996 9nhbnn.exe 1752 jdddd.exe 1936 frrlrfr.exe 4308 5htntb.exe 2304 jjpjp.exe 1440 rrxlfrl.exe 2768 vvpvp.exe 4832 nhhbnn.exe 3164 jddvj.exe 3668 thnhtt.exe 1556 djpjd.exe 3456 rfffxrr.exe 1528 thhhbb.exe 2544 9lrlrrx.exe 3228 fxfrlfx.exe 4232 nbbtnn.exe 2780 7lfxllf.exe 2956 fllxrlf.exe 1732 bhnhbb.exe 4148 pvvjp.exe 3720 xrxrrrr.exe 1384 tnntht.exe 1688 5vvjv.exe 2348 rxfxlff.exe 4436 bnbttn.exe 4364 xlrffxx.exe 1072 nbhbtt.exe 1692 dpjjv.exe 776 tbhtht.exe 1728 bbhtbt.exe 4464 jpvjv.exe 4964 rrrfxrf.exe 4228 hhhthn.exe 1776 7jpdp.exe 3144 hntnnh.exe 1784 thnhbb.exe 3528 pppjp.exe 936 lllxrlf.exe 4372 7lrrfrf.exe 1224 5bbnbh.exe 4256 pdpjv.exe 3112 rlxrlfx.exe 4092 nttnhb.exe 4628 nhbntn.exe 4196 jppjj.exe 1492 xrfrrrx.exe 2448 xlfrlfx.exe 3116 htnbnt.exe 2440 dpvjv.exe 4908 xlrlxxr.exe 1872 tbnnbh.exe 1464 httnbt.exe 4384 1vpdp.exe 3800 xrrfrlf.exe 756 9nbbnh.exe 2192 vjdpv.exe 1552 pddpv.exe 3576 fffrrlr.exe -
resource yara_rule behavioral2/memory/3636-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1732-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/936-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2864-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-792-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-817-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3636 wrote to memory of 4280 3636 c665faee6f58ecab516b0558c608a51c53de81c085dba3cb88145802118a9678.exe 83 PID 3636 wrote to memory of 4280 3636 c665faee6f58ecab516b0558c608a51c53de81c085dba3cb88145802118a9678.exe 83 PID 3636 wrote to memory of 4280 3636 c665faee6f58ecab516b0558c608a51c53de81c085dba3cb88145802118a9678.exe 83 PID 4280 wrote to memory of 1240 4280 jdpdp.exe 84 PID 4280 wrote to memory of 1240 4280 jdpdp.exe 84 PID 4280 wrote to memory of 1240 4280 jdpdp.exe 84 PID 1240 wrote to memory of 3880 1240 1tntnt.exe 85 PID 1240 wrote to memory of 3880 1240 1tntnt.exe 85 PID 1240 wrote to memory of 3880 1240 1tntnt.exe 85 PID 3880 wrote to memory of 1872 3880 nbbhnb.exe 86 PID 3880 wrote to memory of 1872 3880 nbbhnb.exe 86 PID 3880 wrote to memory of 1872 3880 nbbhnb.exe 86 PID 1872 wrote to memory of 4380 1872 dvvdv.exe 87 PID 1872 wrote to memory of 4380 1872 dvvdv.exe 87 PID 1872 wrote to memory of 4380 1872 dvvdv.exe 87 PID 4380 wrote to memory of 3280 4380 3tnhtn.exe 88 PID 4380 wrote to memory of 3280 4380 3tnhtn.exe 88 PID 4380 wrote to memory of 3280 4380 3tnhtn.exe 88 PID 3280 wrote to memory of 3996 3280 jvdjp.exe 89 PID 3280 wrote to memory of 3996 3280 jvdjp.exe 89 PID 3280 wrote to memory of 3996 3280 jvdjp.exe 89 PID 3996 wrote to memory of 1752 3996 9nhbnn.exe 90 PID 3996 wrote to memory of 1752 3996 9nhbnn.exe 90 PID 3996 wrote to memory of 1752 3996 9nhbnn.exe 90 PID 1752 wrote to memory of 1936 1752 jdddd.exe 91 PID 1752 wrote to memory of 1936 1752 jdddd.exe 91 PID 1752 wrote to memory of 1936 1752 jdddd.exe 91 PID 1936 wrote to memory of 4308 1936 frrlrfr.exe 92 PID 1936 wrote to memory of 4308 1936 frrlrfr.exe 92 PID 1936 wrote to memory of 4308 1936 frrlrfr.exe 92 PID 4308 wrote to memory of 2304 4308 5htntb.exe 93 PID 4308 wrote to memory of 2304 4308 5htntb.exe 93 PID 4308 wrote to memory of 2304 4308 5htntb.exe 93 PID 2304 wrote to memory of 1440 2304 jjpjp.exe 94 PID 2304 wrote to memory of 1440 2304 jjpjp.exe 94 PID 2304 wrote to memory of 1440 2304 jjpjp.exe 94 PID 1440 wrote to memory of 2768 1440 rrxlfrl.exe 95 PID 1440 wrote to memory of 2768 1440 rrxlfrl.exe 95 PID 1440 wrote to memory of 2768 1440 rrxlfrl.exe 95 PID 2768 wrote to memory of 4832 2768 vvpvp.exe 96 PID 2768 wrote to memory of 4832 2768 vvpvp.exe 96 PID 2768 wrote to memory of 4832 2768 vvpvp.exe 96 PID 4832 wrote to memory of 3164 4832 nhhbnn.exe 97 PID 4832 wrote to memory of 3164 4832 nhhbnn.exe 97 PID 4832 wrote to memory of 3164 4832 nhhbnn.exe 97 PID 3164 wrote to memory of 3668 3164 jddvj.exe 98 PID 3164 wrote to memory of 3668 3164 jddvj.exe 98 PID 3164 wrote to memory of 3668 3164 jddvj.exe 98 PID 3668 wrote to memory of 1556 3668 thnhtt.exe 99 PID 3668 wrote to memory of 1556 3668 thnhtt.exe 99 PID 3668 wrote to memory of 1556 3668 thnhtt.exe 99 PID 1556 wrote to memory of 3456 1556 djpjd.exe 100 PID 1556 wrote to memory of 3456 1556 djpjd.exe 100 PID 1556 wrote to memory of 3456 1556 djpjd.exe 100 PID 3456 wrote to memory of 1528 3456 rfffxrr.exe 101 PID 3456 wrote to memory of 1528 3456 rfffxrr.exe 101 PID 3456 wrote to memory of 1528 3456 rfffxrr.exe 101 PID 1528 wrote to memory of 2544 1528 thhhbb.exe 102 PID 1528 wrote to memory of 2544 1528 thhhbb.exe 102 PID 1528 wrote to memory of 2544 1528 thhhbb.exe 102 PID 2544 wrote to memory of 3228 2544 9lrlrrx.exe 103 PID 2544 wrote to memory of 3228 2544 9lrlrrx.exe 103 PID 2544 wrote to memory of 3228 2544 9lrlrrx.exe 103 PID 3228 wrote to memory of 4232 3228 fxfrlfx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\c665faee6f58ecab516b0558c608a51c53de81c085dba3cb88145802118a9678.exe"C:\Users\Admin\AppData\Local\Temp\c665faee6f58ecab516b0558c608a51c53de81c085dba3cb88145802118a9678.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\jdpdp.exec:\jdpdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\1tntnt.exec:\1tntnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\nbbhnb.exec:\nbbhnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\dvvdv.exec:\dvvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\3tnhtn.exec:\3tnhtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\jvdjp.exec:\jvdjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\9nhbnn.exec:\9nhbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\jdddd.exec:\jdddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\frrlrfr.exec:\frrlrfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\5htntb.exec:\5htntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\jjpjp.exec:\jjpjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\rrxlfrl.exec:\rrxlfrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\vvpvp.exec:\vvpvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\nhhbnn.exec:\nhhbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\jddvj.exec:\jddvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\thnhtt.exec:\thnhtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\djpjd.exec:\djpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\rfffxrr.exec:\rfffxrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\thhhbb.exec:\thhhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\9lrlrrx.exec:\9lrlrrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\fxfrlfx.exec:\fxfrlfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\nbbtnn.exec:\nbbtnn.exe23⤵
- Executes dropped EXE
PID:4232 -
\??\c:\7lfxllf.exec:\7lfxllf.exe24⤵
- Executes dropped EXE
PID:2780 -
\??\c:\fllxrlf.exec:\fllxrlf.exe25⤵
- Executes dropped EXE
PID:2956 -
\??\c:\bhnhbb.exec:\bhnhbb.exe26⤵
- Executes dropped EXE
PID:1732 -
\??\c:\pvvjp.exec:\pvvjp.exe27⤵
- Executes dropped EXE
PID:4148 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe28⤵
- Executes dropped EXE
PID:3720 -
\??\c:\tnntht.exec:\tnntht.exe29⤵
- Executes dropped EXE
PID:1384 -
\??\c:\5vvjv.exec:\5vvjv.exe30⤵
- Executes dropped EXE
PID:1688 -
\??\c:\rxfxlff.exec:\rxfxlff.exe31⤵
- Executes dropped EXE
PID:2348 -
\??\c:\bnbttn.exec:\bnbttn.exe32⤵
- Executes dropped EXE
PID:4436 -
\??\c:\xlrffxx.exec:\xlrffxx.exe33⤵
- Executes dropped EXE
PID:4364 -
\??\c:\nbhbtt.exec:\nbhbtt.exe34⤵
- Executes dropped EXE
PID:1072 -
\??\c:\dpjjv.exec:\dpjjv.exe35⤵
- Executes dropped EXE
PID:1692 -
\??\c:\tbhtht.exec:\tbhtht.exe36⤵
- Executes dropped EXE
PID:776 -
\??\c:\bbhtbt.exec:\bbhtbt.exe37⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jpvjv.exec:\jpvjv.exe38⤵
- Executes dropped EXE
PID:4464 -
\??\c:\rrrfxrf.exec:\rrrfxrf.exe39⤵
- Executes dropped EXE
PID:4964 -
\??\c:\hhhthn.exec:\hhhthn.exe40⤵
- Executes dropped EXE
PID:4228 -
\??\c:\7jpdp.exec:\7jpdp.exe41⤵
- Executes dropped EXE
PID:1776 -
\??\c:\hntnnh.exec:\hntnnh.exe42⤵
- Executes dropped EXE
PID:3144 -
\??\c:\thnhbb.exec:\thnhbb.exe43⤵
- Executes dropped EXE
PID:1784 -
\??\c:\pppjp.exec:\pppjp.exe44⤵
- Executes dropped EXE
PID:3528 -
\??\c:\lllxrlf.exec:\lllxrlf.exe45⤵
- Executes dropped EXE
PID:936 -
\??\c:\7lrrfrf.exec:\7lrrfrf.exe46⤵
- Executes dropped EXE
PID:4372 -
\??\c:\5bbnbh.exec:\5bbnbh.exe47⤵
- Executes dropped EXE
PID:1224 -
\??\c:\pdpjv.exec:\pdpjv.exe48⤵
- Executes dropped EXE
PID:4256 -
\??\c:\rlxrlfx.exec:\rlxrlfx.exe49⤵
- Executes dropped EXE
PID:3112 -
\??\c:\nttnhb.exec:\nttnhb.exe50⤵
- Executes dropped EXE
PID:4092 -
\??\c:\nhbntn.exec:\nhbntn.exe51⤵
- Executes dropped EXE
PID:4628 -
\??\c:\jppjj.exec:\jppjj.exe52⤵
- Executes dropped EXE
PID:4196 -
\??\c:\xrfrrrx.exec:\xrfrrrx.exe53⤵
- Executes dropped EXE
PID:1492 -
\??\c:\xlfrlfx.exec:\xlfrlfx.exe54⤵
- Executes dropped EXE
PID:2448 -
\??\c:\htnbnt.exec:\htnbnt.exe55⤵
- Executes dropped EXE
PID:3116 -
\??\c:\dpvjv.exec:\dpvjv.exe56⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xlrlxxr.exec:\xlrlxxr.exe57⤵
- Executes dropped EXE
PID:4908 -
\??\c:\tbnnbh.exec:\tbnnbh.exe58⤵
- Executes dropped EXE
PID:1872 -
\??\c:\httnbt.exec:\httnbt.exe59⤵
- Executes dropped EXE
PID:1464 -
\??\c:\1vpdp.exec:\1vpdp.exe60⤵
- Executes dropped EXE
PID:4384 -
\??\c:\xrrfrlf.exec:\xrrfrlf.exe61⤵
- Executes dropped EXE
PID:3800 -
\??\c:\9nbbnh.exec:\9nbbnh.exe62⤵
- Executes dropped EXE
PID:756 -
\??\c:\vjdpv.exec:\vjdpv.exe63⤵
- Executes dropped EXE
PID:2192 -
\??\c:\pddpv.exec:\pddpv.exe64⤵
- Executes dropped EXE
PID:1552 -
\??\c:\fffrrlr.exec:\fffrrlr.exe65⤵
- Executes dropped EXE
PID:3576 -
\??\c:\rflfffr.exec:\rflfffr.exe66⤵PID:1540
-
\??\c:\3tnhth.exec:\3tnhth.exe67⤵PID:4308
-
\??\c:\pvvjv.exec:\pvvjv.exe68⤵PID:4724
-
\??\c:\fflxlxr.exec:\fflxlxr.exe69⤵PID:1804
-
\??\c:\xrfrlxl.exec:\xrfrlxl.exe70⤵PID:2380
-
\??\c:\jvdpv.exec:\jvdpv.exe71⤵PID:5024
-
\??\c:\pdjdp.exec:\pdjdp.exe72⤵PID:2360
-
\??\c:\1lxlrrf.exec:\1lxlrrf.exe73⤵PID:3364
-
\??\c:\nhthnh.exec:\nhthnh.exe74⤵PID:1420
-
\??\c:\9djdp.exec:\9djdp.exe75⤵PID:2512
-
\??\c:\frlxlfr.exec:\frlxlfr.exe76⤵
- System Location Discovery: System Language Discovery
PID:3896 -
\??\c:\7tnbtn.exec:\7tnbtn.exe77⤵PID:1556
-
\??\c:\1nnnbt.exec:\1nnnbt.exe78⤵PID:4572
-
\??\c:\pjjvj.exec:\pjjvj.exe79⤵PID:1528
-
\??\c:\7rxrffx.exec:\7rxrffx.exe80⤵PID:2844
-
\??\c:\hhhtht.exec:\hhhtht.exe81⤵PID:2544
-
\??\c:\9nnbtn.exec:\9nnbtn.exe82⤵PID:964
-
\??\c:\5vpjj.exec:\5vpjj.exe83⤵PID:4016
-
\??\c:\fxfxxrr.exec:\fxfxxrr.exe84⤵PID:2384
-
\??\c:\7tnbnb.exec:\7tnbnb.exe85⤵PID:4696
-
\??\c:\hnhbhh.exec:\hnhbhh.exe86⤵PID:3088
-
\??\c:\7vjvj.exec:\7vjvj.exe87⤵PID:2848
-
\??\c:\xllxrlf.exec:\xllxrlf.exe88⤵PID:4000
-
\??\c:\9tnbnn.exec:\9tnbnn.exe89⤵PID:3564
-
\??\c:\ddpjv.exec:\ddpjv.exe90⤵PID:4712
-
\??\c:\rffxfxl.exec:\rffxfxl.exe91⤵PID:4520
-
\??\c:\hhhtnb.exec:\hhhtnb.exe92⤵PID:4824
-
\??\c:\vddpd.exec:\vddpd.exe93⤵PID:2864
-
\??\c:\1vvjd.exec:\1vvjd.exe94⤵PID:1992
-
\??\c:\5bbhht.exec:\5bbhht.exe95⤵PID:3640
-
\??\c:\bnthtn.exec:\bnthtn.exe96⤵PID:4880
-
\??\c:\vddpv.exec:\vddpv.exe97⤵PID:3964
-
\??\c:\5ppdj.exec:\5ppdj.exe98⤵PID:4984
-
\??\c:\lrrrfxr.exec:\lrrrfxr.exe99⤵PID:4672
-
\??\c:\7tnbnn.exec:\7tnbnn.exe100⤵PID:3332
-
\??\c:\7djvp.exec:\7djvp.exe101⤵PID:2808
-
\??\c:\jdpdv.exec:\jdpdv.exe102⤵PID:4804
-
\??\c:\xlfrfrl.exec:\xlfrfrl.exe103⤵PID:3556
-
\??\c:\hbhthb.exec:\hbhthb.exe104⤵PID:4228
-
\??\c:\1tthth.exec:\1tthth.exe105⤵PID:3504
-
\??\c:\pjjvv.exec:\pjjvv.exe106⤵PID:1704
-
\??\c:\rrfxllr.exec:\rrfxllr.exe107⤵PID:2736
-
\??\c:\hbnnhh.exec:\hbnnhh.exe108⤵PID:3120
-
\??\c:\djpdp.exec:\djpdp.exe109⤵PID:5092
-
\??\c:\lrrfrfr.exec:\lrrfrfr.exe110⤵PID:2796
-
\??\c:\xfxrfxr.exec:\xfxrfxr.exe111⤵PID:2820
-
\??\c:\httbnn.exec:\httbnn.exe112⤵PID:1856
-
\??\c:\pddvp.exec:\pddvp.exe113⤵PID:5080
-
\??\c:\1xfrfxl.exec:\1xfrfxl.exe114⤵PID:4508
-
\??\c:\bhthbt.exec:\bhthbt.exe115⤵PID:4540
-
\??\c:\djjvj.exec:\djjvj.exe116⤵PID:4280
-
\??\c:\rrflrfr.exec:\rrflrfr.exe117⤵PID:1240
-
\??\c:\ttbthh.exec:\ttbthh.exe118⤵PID:2448
-
\??\c:\vppdp.exec:\vppdp.exe119⤵PID:1488
-
\??\c:\ddjvj.exec:\ddjvj.exe120⤵PID:1180
-
\??\c:\lllrxrl.exec:\lllrxrl.exe121⤵PID:4908
-
\??\c:\hbhtnb.exec:\hbhtnb.exe122⤵PID:1872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-