Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 02:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c7d67aae121c0b77235edf46b2c476f990ef258a99c5e10ce908d4e4eb65c491.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
c7d67aae121c0b77235edf46b2c476f990ef258a99c5e10ce908d4e4eb65c491.exe
-
Size
454KB
-
MD5
73eef3b57f280f6b61d189312e466169
-
SHA1
4f987f4a6cdf32c3bca3b21a495c693cffe7440f
-
SHA256
c7d67aae121c0b77235edf46b2c476f990ef258a99c5e10ce908d4e4eb65c491
-
SHA512
32ab99fb682ec4e8d8af6021f83699702b1d312163fe5ff828e9176eaaaa61ac6bfed5e2dbb04081b2549a3ba9a38b55b140c2f4c77482c8a021275ad7f24ee9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe+:q7Tc2NYHUrAwfMp3CD+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3308-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2100-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1084-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/184-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/844-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-700-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-780-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-830-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-905-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-942-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-1445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-1922-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1424 nhnhnh.exe 2420 fxfrlfx.exe 4084 9bthbb.exe 2308 1pjdp.exe 2396 7rlxllf.exe 2816 3flfxrl.exe 2100 hntnbb.exe 4156 vdjvp.exe 2132 5lxrxxr.exe 1084 tnnbtn.exe 224 htnhbt.exe 2484 lxfxlff.exe 5024 httnnn.exe 5052 rfxrfxr.exe 3508 lllrlrl.exe 3468 vppjj.exe 2848 xflxrlr.exe 184 djpjd.exe 212 jjppj.exe 2264 fxrrllf.exe 880 3pvvj.exe 3204 7xxlfrx.exe 1108 btnhbb.exe 1552 7fxxrfx.exe 4004 pjpjd.exe 4508 1ppdp.exe 2912 lrlfxlf.exe 4216 bhhbtt.exe 4668 5pjvd.exe 3456 9pjvp.exe 1384 vjppj.exe 4368 httnbt.exe 4408 lxxlfxr.exe 1664 bnbtnh.exe 1876 pvdpj.exe 1880 fffxrrf.exe 536 1fxxrll.exe 3332 hbhtbt.exe 1736 vdpvj.exe 2700 xxrfxlx.exe 3452 rfrllff.exe 208 nhhthb.exe 4612 jvdpd.exe 1216 xrrfrlf.exe 1644 htthbt.exe 1444 htbtnn.exe 4904 vdjdj.exe 1608 7xxlfxr.exe 4500 bbbhbb.exe 3640 nbbthb.exe 624 pdjvp.exe 736 lxxrffr.exe 3308 nhbthh.exe 720 pddvp.exe 2420 xffffxr.exe 4084 frxrlfx.exe 2260 3nttbb.exe 1072 9djdj.exe 3912 rxlfrrr.exe 2816 rlrrlxx.exe 4684 5ntnhn.exe 4924 jppjd.exe 3276 fxxlfrl.exe 1372 1tbttb.exe -
resource yara_rule behavioral2/memory/3308-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/184-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/844-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-710-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3308 wrote to memory of 1424 3308 c7d67aae121c0b77235edf46b2c476f990ef258a99c5e10ce908d4e4eb65c491.exe 84 PID 3308 wrote to memory of 1424 3308 c7d67aae121c0b77235edf46b2c476f990ef258a99c5e10ce908d4e4eb65c491.exe 84 PID 3308 wrote to memory of 1424 3308 c7d67aae121c0b77235edf46b2c476f990ef258a99c5e10ce908d4e4eb65c491.exe 84 PID 1424 wrote to memory of 2420 1424 nhnhnh.exe 85 PID 1424 wrote to memory of 2420 1424 nhnhnh.exe 85 PID 1424 wrote to memory of 2420 1424 nhnhnh.exe 85 PID 2420 wrote to memory of 4084 2420 fxfrlfx.exe 86 PID 2420 wrote to memory of 4084 2420 fxfrlfx.exe 86 PID 2420 wrote to memory of 4084 2420 fxfrlfx.exe 86 PID 4084 wrote to memory of 2308 4084 9bthbb.exe 87 PID 4084 wrote to memory of 2308 4084 9bthbb.exe 87 PID 4084 wrote to memory of 2308 4084 9bthbb.exe 87 PID 2308 wrote to memory of 2396 2308 1pjdp.exe 88 PID 2308 wrote to memory of 2396 2308 1pjdp.exe 88 PID 2308 wrote to memory of 2396 2308 1pjdp.exe 88 PID 2396 wrote to memory of 2816 2396 7rlxllf.exe 89 PID 2396 wrote to memory of 2816 2396 7rlxllf.exe 89 PID 2396 wrote to memory of 2816 2396 7rlxllf.exe 89 PID 2816 wrote to memory of 2100 2816 3flfxrl.exe 90 PID 2816 wrote to memory of 2100 2816 3flfxrl.exe 90 PID 2816 wrote to memory of 2100 2816 3flfxrl.exe 90 PID 2100 wrote to memory of 4156 2100 hntnbb.exe 91 PID 2100 wrote to memory of 4156 2100 hntnbb.exe 91 PID 2100 wrote to memory of 4156 2100 hntnbb.exe 91 PID 4156 wrote to memory of 2132 4156 vdjvp.exe 92 PID 4156 wrote to memory of 2132 4156 vdjvp.exe 92 PID 4156 wrote to memory of 2132 4156 vdjvp.exe 92 PID 2132 wrote to memory of 1084 2132 5lxrxxr.exe 93 PID 2132 wrote to memory of 1084 2132 5lxrxxr.exe 93 PID 2132 wrote to memory of 1084 2132 5lxrxxr.exe 93 PID 1084 wrote to memory of 224 1084 tnnbtn.exe 94 PID 1084 wrote to memory of 224 1084 tnnbtn.exe 94 PID 1084 wrote to memory of 224 1084 tnnbtn.exe 94 PID 224 wrote to memory of 2484 224 htnhbt.exe 95 PID 224 wrote to memory of 2484 224 htnhbt.exe 95 PID 224 wrote to memory of 2484 224 htnhbt.exe 95 PID 2484 wrote to memory of 5024 2484 lxfxlff.exe 96 PID 2484 wrote to memory of 5024 2484 lxfxlff.exe 96 PID 2484 wrote to memory of 5024 2484 lxfxlff.exe 96 PID 5024 wrote to memory of 5052 5024 httnnn.exe 97 PID 5024 wrote to memory of 5052 5024 httnnn.exe 97 PID 5024 wrote to memory of 5052 5024 httnnn.exe 97 PID 5052 wrote to memory of 3508 5052 rfxrfxr.exe 98 PID 5052 wrote to memory of 3508 5052 rfxrfxr.exe 98 PID 5052 wrote to memory of 3508 5052 rfxrfxr.exe 98 PID 3508 wrote to memory of 3468 3508 lllrlrl.exe 99 PID 3508 wrote to memory of 3468 3508 lllrlrl.exe 99 PID 3508 wrote to memory of 3468 3508 lllrlrl.exe 99 PID 3468 wrote to memory of 2848 3468 vppjj.exe 100 PID 3468 wrote to memory of 2848 3468 vppjj.exe 100 PID 3468 wrote to memory of 2848 3468 vppjj.exe 100 PID 2848 wrote to memory of 184 2848 xflxrlr.exe 101 PID 2848 wrote to memory of 184 2848 xflxrlr.exe 101 PID 2848 wrote to memory of 184 2848 xflxrlr.exe 101 PID 184 wrote to memory of 212 184 djpjd.exe 102 PID 184 wrote to memory of 212 184 djpjd.exe 102 PID 184 wrote to memory of 212 184 djpjd.exe 102 PID 212 wrote to memory of 2264 212 jjppj.exe 103 PID 212 wrote to memory of 2264 212 jjppj.exe 103 PID 212 wrote to memory of 2264 212 jjppj.exe 103 PID 2264 wrote to memory of 880 2264 fxrrllf.exe 104 PID 2264 wrote to memory of 880 2264 fxrrllf.exe 104 PID 2264 wrote to memory of 880 2264 fxrrllf.exe 104 PID 880 wrote to memory of 3204 880 3pvvj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7d67aae121c0b77235edf46b2c476f990ef258a99c5e10ce908d4e4eb65c491.exe"C:\Users\Admin\AppData\Local\Temp\c7d67aae121c0b77235edf46b2c476f990ef258a99c5e10ce908d4e4eb65c491.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\nhnhnh.exec:\nhnhnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\fxfrlfx.exec:\fxfrlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\9bthbb.exec:\9bthbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\1pjdp.exec:\1pjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\7rlxllf.exec:\7rlxllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\3flfxrl.exec:\3flfxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\hntnbb.exec:\hntnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\vdjvp.exec:\vdjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\5lxrxxr.exec:\5lxrxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\tnnbtn.exec:\tnnbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\htnhbt.exec:\htnhbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\lxfxlff.exec:\lxfxlff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\httnnn.exec:\httnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\rfxrfxr.exec:\rfxrfxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\lllrlrl.exec:\lllrlrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\vppjj.exec:\vppjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\xflxrlr.exec:\xflxrlr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\djpjd.exec:\djpjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:184 -
\??\c:\jjppj.exec:\jjppj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\fxrrllf.exec:\fxrrllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\3pvvj.exec:\3pvvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\7xxlfrx.exec:\7xxlfrx.exe23⤵
- Executes dropped EXE
PID:3204 -
\??\c:\btnhbb.exec:\btnhbb.exe24⤵
- Executes dropped EXE
PID:1108 -
\??\c:\7fxxrfx.exec:\7fxxrfx.exe25⤵
- Executes dropped EXE
PID:1552 -
\??\c:\pjpjd.exec:\pjpjd.exe26⤵
- Executes dropped EXE
PID:4004 -
\??\c:\1ppdp.exec:\1ppdp.exe27⤵
- Executes dropped EXE
PID:4508 -
\??\c:\lrlfxlf.exec:\lrlfxlf.exe28⤵
- Executes dropped EXE
PID:2912 -
\??\c:\bhhbtt.exec:\bhhbtt.exe29⤵
- Executes dropped EXE
PID:4216 -
\??\c:\5pjvd.exec:\5pjvd.exe30⤵
- Executes dropped EXE
PID:4668 -
\??\c:\9pjvp.exec:\9pjvp.exe31⤵
- Executes dropped EXE
PID:3456 -
\??\c:\vjppj.exec:\vjppj.exe32⤵
- Executes dropped EXE
PID:1384 -
\??\c:\httnbt.exec:\httnbt.exe33⤵
- Executes dropped EXE
PID:4368 -
\??\c:\lxxlfxr.exec:\lxxlfxr.exe34⤵
- Executes dropped EXE
PID:4408 -
\??\c:\bnbtnh.exec:\bnbtnh.exe35⤵
- Executes dropped EXE
PID:1664 -
\??\c:\pvdpj.exec:\pvdpj.exe36⤵
- Executes dropped EXE
PID:1876 -
\??\c:\fffxrrf.exec:\fffxrrf.exe37⤵
- Executes dropped EXE
PID:1880 -
\??\c:\1fxxrll.exec:\1fxxrll.exe38⤵
- Executes dropped EXE
PID:536 -
\??\c:\hbhtbt.exec:\hbhtbt.exe39⤵
- Executes dropped EXE
PID:3332 -
\??\c:\vdpvj.exec:\vdpvj.exe40⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xxrfxlx.exec:\xxrfxlx.exe41⤵
- Executes dropped EXE
PID:2700 -
\??\c:\rfrllff.exec:\rfrllff.exe42⤵
- Executes dropped EXE
PID:3452 -
\??\c:\nhhthb.exec:\nhhthb.exe43⤵
- Executes dropped EXE
PID:208 -
\??\c:\jvdpd.exec:\jvdpd.exe44⤵
- Executes dropped EXE
PID:4612 -
\??\c:\xrrfrlf.exec:\xrrfrlf.exe45⤵
- Executes dropped EXE
PID:1216 -
\??\c:\htthbt.exec:\htthbt.exe46⤵
- Executes dropped EXE
PID:1644 -
\??\c:\htbtnn.exec:\htbtnn.exe47⤵
- Executes dropped EXE
PID:1444 -
\??\c:\vdjdj.exec:\vdjdj.exe48⤵
- Executes dropped EXE
PID:4904 -
\??\c:\7xxlfxr.exec:\7xxlfxr.exe49⤵
- Executes dropped EXE
PID:1608 -
\??\c:\bbbhbb.exec:\bbbhbb.exe50⤵
- Executes dropped EXE
PID:4500 -
\??\c:\nbbthb.exec:\nbbthb.exe51⤵
- Executes dropped EXE
PID:3640 -
\??\c:\pdjvp.exec:\pdjvp.exe52⤵
- Executes dropped EXE
PID:624 -
\??\c:\lxxrffr.exec:\lxxrffr.exe53⤵
- Executes dropped EXE
PID:736 -
\??\c:\nhbthh.exec:\nhbthh.exe54⤵
- Executes dropped EXE
PID:3308 -
\??\c:\pddvp.exec:\pddvp.exe55⤵
- Executes dropped EXE
PID:720 -
\??\c:\xffffxr.exec:\xffffxr.exe56⤵
- Executes dropped EXE
PID:2420 -
\??\c:\frxrlfx.exec:\frxrlfx.exe57⤵
- Executes dropped EXE
PID:4084 -
\??\c:\3nttbb.exec:\3nttbb.exe58⤵
- Executes dropped EXE
PID:2260 -
\??\c:\9djdj.exec:\9djdj.exe59⤵
- Executes dropped EXE
PID:1072 -
\??\c:\rxlfrrr.exec:\rxlfrrr.exe60⤵
- Executes dropped EXE
PID:3912 -
\??\c:\rlrrlxx.exec:\rlrrlxx.exe61⤵
- Executes dropped EXE
PID:2816 -
\??\c:\5ntnhn.exec:\5ntnhn.exe62⤵
- Executes dropped EXE
PID:4684 -
\??\c:\jppjd.exec:\jppjd.exe63⤵
- Executes dropped EXE
PID:4924 -
\??\c:\fxxlfrl.exec:\fxxlfrl.exe64⤵
- Executes dropped EXE
PID:3276 -
\??\c:\1tbttb.exec:\1tbttb.exe65⤵
- Executes dropped EXE
PID:1372 -
\??\c:\vpvpj.exec:\vpvpj.exe66⤵PID:4128
-
\??\c:\ddpdv.exec:\ddpdv.exe67⤵PID:2620
-
\??\c:\bbhbbt.exec:\bbhbbt.exe68⤵PID:116
-
\??\c:\5vjdp.exec:\5vjdp.exe69⤵PID:2144
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe70⤵PID:4600
-
\??\c:\nnnbtn.exec:\nnnbtn.exe71⤵PID:2776
-
\??\c:\djpdv.exec:\djpdv.exe72⤵PID:3040
-
\??\c:\pvjdj.exec:\pvjdj.exe73⤵PID:3932
-
\??\c:\rlrlfff.exec:\rlrlfff.exe74⤵PID:1928
-
\??\c:\thhtnb.exec:\thhtnb.exe75⤵PID:3236
-
\??\c:\pvdvp.exec:\pvdvp.exe76⤵PID:844
-
\??\c:\rffxrlf.exec:\rffxrlf.exe77⤵PID:5060
-
\??\c:\ffffffx.exec:\ffffffx.exe78⤵PID:4504
-
\??\c:\tnnhhh.exec:\tnnhhh.exe79⤵PID:5104
-
\??\c:\pdvpp.exec:\pdvpp.exe80⤵PID:1628
-
\??\c:\frlxrlf.exec:\frlxrlf.exe81⤵PID:3512
-
\??\c:\9hhtnh.exec:\9hhtnh.exe82⤵PID:2208
-
\??\c:\hnnhbb.exec:\hnnhbb.exe83⤵
- System Location Discovery: System Language Discovery
PID:1476 -
\??\c:\dvjdp.exec:\dvjdp.exe84⤵PID:3652
-
\??\c:\lxrrllf.exec:\lxrrllf.exe85⤵PID:1332
-
\??\c:\bnnhnn.exec:\bnnhnn.exe86⤵PID:1744
-
\??\c:\nhhhbb.exec:\nhhhbb.exe87⤵PID:448
-
\??\c:\frfxrxr.exec:\frfxrxr.exe88⤵PID:3076
-
\??\c:\fxfxfxr.exec:\fxfxfxr.exe89⤵PID:2688
-
\??\c:\1tbthh.exec:\1tbthh.exe90⤵PID:3600
-
\??\c:\vvvvv.exec:\vvvvv.exe91⤵PID:4092
-
\??\c:\fffrlfx.exec:\fffrlfx.exe92⤵PID:3568
-
\??\c:\tnbnbt.exec:\tnbnbt.exe93⤵PID:840
-
\??\c:\pjjdd.exec:\pjjdd.exe94⤵PID:1188
-
\??\c:\jvdvv.exec:\jvdvv.exe95⤵PID:1788
-
\??\c:\rlrlllr.exec:\rlrlllr.exe96⤵PID:1152
-
\??\c:\xxrlfrl.exec:\xxrlfrl.exe97⤵PID:1012
-
\??\c:\tbhbnn.exec:\tbhbnn.exe98⤵PID:4116
-
\??\c:\vpvpv.exec:\vpvpv.exe99⤵PID:408
-
\??\c:\llllffx.exec:\llllffx.exe100⤵PID:4724
-
\??\c:\bhnhtt.exec:\bhnhtt.exe101⤵PID:1876
-
\??\c:\vjpjd.exec:\vjpjd.exe102⤵PID:1880
-
\??\c:\pdjvp.exec:\pdjvp.exe103⤵PID:536
-
\??\c:\7xrlxrl.exec:\7xrlxrl.exe104⤵PID:4280
-
\??\c:\nhhbtn.exec:\nhhbtn.exe105⤵PID:1736
-
\??\c:\nhthnt.exec:\nhthnt.exe106⤵PID:1864
-
\??\c:\vpppj.exec:\vpppj.exe107⤵PID:3188
-
\??\c:\rllflfl.exec:\rllflfl.exe108⤵PID:1544
-
\??\c:\tbhbnn.exec:\tbhbnn.exe109⤵
- System Location Discovery: System Language Discovery
PID:4712 -
\??\c:\ppddp.exec:\ppddp.exe110⤵PID:1904
-
\??\c:\lffrfrr.exec:\lffrfrr.exe111⤵
- System Location Discovery: System Language Discovery
PID:2660 -
\??\c:\9ttnbb.exec:\9ttnbb.exe112⤵PID:2996
-
\??\c:\thtbtb.exec:\thtbtb.exe113⤵PID:3252
-
\??\c:\jvjpv.exec:\jvjpv.exe114⤵PID:2068
-
\??\c:\xrrffxr.exec:\xrrffxr.exe115⤵PID:1884
-
\??\c:\bttnbb.exec:\bttnbb.exe116⤵PID:4284
-
\??\c:\7bthhb.exec:\7bthhb.exe117⤵PID:4536
-
\??\c:\dvdvd.exec:\dvdvd.exe118⤵PID:2708
-
\??\c:\1xrrllf.exec:\1xrrllf.exe119⤵PID:1080
-
\??\c:\nbhbnh.exec:\nbhbnh.exe120⤵PID:3572
-
\??\c:\jjjdd.exec:\jjjdd.exe121⤵PID:2360
-
\??\c:\dpjvd.exec:\dpjvd.exe122⤵PID:1872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-