Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 03:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
db19bf2fbdefa3906ce1c0f5e163d96db101e0116d42032f1febe79f450fa61c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
db19bf2fbdefa3906ce1c0f5e163d96db101e0116d42032f1febe79f450fa61c.exe
-
Size
454KB
-
MD5
22de0ac9b93345e4b13913035fe0b3cf
-
SHA1
2129c6e6a5fc00548b6a4e19e95b35a0f08b2427
-
SHA256
db19bf2fbdefa3906ce1c0f5e163d96db101e0116d42032f1febe79f450fa61c
-
SHA512
04e34c950fc1fce9717018eb2d0edbbdbc9cb502984e3ba028bff3b8de19c3a9366e8e219e88d62a340f1c0eb1e566b12398813899a3d58fc2fd7f45b106bc8d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeToD:q7Tc2NYHUrAwfMp3CDcD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3168-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2804-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3752-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/620-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/840-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/244-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/648-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-690-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-751-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-789-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-1340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-1653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1016 nbnnhn.exe 1144 ntnhbh.exe 876 llrffll.exe 4720 hnttbn.exe 4528 hnnhbb.exe 2544 djvpj.exe 1636 3hbbtb.exe 2804 vdjdv.exe 2764 vdppj.exe 3752 rlfxrlx.exe 1792 rxffxfl.exe 620 tnnhhb.exe 60 djjjp.exe 5108 fxfrlrx.exe 3540 ffxxrrr.exe 2836 llfxrrl.exe 4212 bbbttb.exe 2024 xffffff.exe 220 xrrrrrr.exe 3940 hhnhhh.exe 4800 vpvpp.exe 4160 xfxrlll.exe 4864 rrxrrrr.exe 1692 xlrllfl.exe 4052 1llfrrl.exe 4824 ffrrllf.exe 4760 nttnhh.exe 912 rxrrrrr.exe 1480 flrlrrr.exe 924 jddvv.exe 1892 frxlfxr.exe 2200 jvpdp.exe 4408 nnhbtn.exe 1172 pvpjd.exe 3512 rlflrrf.exe 2924 ppjdj.exe 2176 xxxrrlf.exe 840 hhhhhh.exe 2828 dvddd.exe 4588 rlllffx.exe 3744 bttnhb.exe 4684 1jdvp.exe 244 5djdp.exe 3004 fxfxrlf.exe 3860 nbhbtb.exe 3536 7pdpj.exe 2232 7jdvj.exe 2576 rrrrlrl.exe 4372 tttnhh.exe 644 3dpjd.exe 2616 rffxlfx.exe 4848 nbbbbb.exe 1356 5jdvd.exe 392 rrxrxxl.exe 2444 flxrlfx.exe 448 bhhtnh.exe 2136 vvpdv.exe 1660 xfxrlfx.exe 4392 hhbbtn.exe 2056 vpdvv.exe 1484 1ffxlfr.exe 3144 7hnntt.exe 4168 jppjp.exe 1416 9lfrllf.exe -
resource yara_rule behavioral2/memory/3168-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2804-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/620-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/840-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/244-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/648-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-758-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3168 wrote to memory of 1016 3168 db19bf2fbdefa3906ce1c0f5e163d96db101e0116d42032f1febe79f450fa61c.exe 83 PID 3168 wrote to memory of 1016 3168 db19bf2fbdefa3906ce1c0f5e163d96db101e0116d42032f1febe79f450fa61c.exe 83 PID 3168 wrote to memory of 1016 3168 db19bf2fbdefa3906ce1c0f5e163d96db101e0116d42032f1febe79f450fa61c.exe 83 PID 1016 wrote to memory of 1144 1016 nbnnhn.exe 84 PID 1016 wrote to memory of 1144 1016 nbnnhn.exe 84 PID 1016 wrote to memory of 1144 1016 nbnnhn.exe 84 PID 1144 wrote to memory of 876 1144 ntnhbh.exe 85 PID 1144 wrote to memory of 876 1144 ntnhbh.exe 85 PID 1144 wrote to memory of 876 1144 ntnhbh.exe 85 PID 876 wrote to memory of 4720 876 llrffll.exe 86 PID 876 wrote to memory of 4720 876 llrffll.exe 86 PID 876 wrote to memory of 4720 876 llrffll.exe 86 PID 4720 wrote to memory of 4528 4720 hnttbn.exe 87 PID 4720 wrote to memory of 4528 4720 hnttbn.exe 87 PID 4720 wrote to memory of 4528 4720 hnttbn.exe 87 PID 4528 wrote to memory of 2544 4528 hnnhbb.exe 88 PID 4528 wrote to memory of 2544 4528 hnnhbb.exe 88 PID 4528 wrote to memory of 2544 4528 hnnhbb.exe 88 PID 2544 wrote to memory of 1636 2544 djvpj.exe 89 PID 2544 wrote to memory of 1636 2544 djvpj.exe 89 PID 2544 wrote to memory of 1636 2544 djvpj.exe 89 PID 1636 wrote to memory of 2804 1636 3hbbtb.exe 90 PID 1636 wrote to memory of 2804 1636 3hbbtb.exe 90 PID 1636 wrote to memory of 2804 1636 3hbbtb.exe 90 PID 2804 wrote to memory of 2764 2804 vdjdv.exe 91 PID 2804 wrote to memory of 2764 2804 vdjdv.exe 91 PID 2804 wrote to memory of 2764 2804 vdjdv.exe 91 PID 2764 wrote to memory of 3752 2764 vdppj.exe 92 PID 2764 wrote to memory of 3752 2764 vdppj.exe 92 PID 2764 wrote to memory of 3752 2764 vdppj.exe 92 PID 3752 wrote to memory of 1792 3752 rlfxrlx.exe 93 PID 3752 wrote to memory of 1792 3752 rlfxrlx.exe 93 PID 3752 wrote to memory of 1792 3752 rlfxrlx.exe 93 PID 1792 wrote to memory of 620 1792 rxffxfl.exe 94 PID 1792 wrote to memory of 620 1792 rxffxfl.exe 94 PID 1792 wrote to memory of 620 1792 rxffxfl.exe 94 PID 620 wrote to memory of 60 620 tnnhhb.exe 95 PID 620 wrote to memory of 60 620 tnnhhb.exe 95 PID 620 wrote to memory of 60 620 tnnhhb.exe 95 PID 60 wrote to memory of 5108 60 djjjp.exe 96 PID 60 wrote to memory of 5108 60 djjjp.exe 96 PID 60 wrote to memory of 5108 60 djjjp.exe 96 PID 5108 wrote to memory of 3540 5108 fxfrlrx.exe 97 PID 5108 wrote to memory of 3540 5108 fxfrlrx.exe 97 PID 5108 wrote to memory of 3540 5108 fxfrlrx.exe 97 PID 3540 wrote to memory of 2836 3540 ffxxrrr.exe 98 PID 3540 wrote to memory of 2836 3540 ffxxrrr.exe 98 PID 3540 wrote to memory of 2836 3540 ffxxrrr.exe 98 PID 2836 wrote to memory of 4212 2836 llfxrrl.exe 99 PID 2836 wrote to memory of 4212 2836 llfxrrl.exe 99 PID 2836 wrote to memory of 4212 2836 llfxrrl.exe 99 PID 4212 wrote to memory of 2024 4212 bbbttb.exe 100 PID 4212 wrote to memory of 2024 4212 bbbttb.exe 100 PID 4212 wrote to memory of 2024 4212 bbbttb.exe 100 PID 2024 wrote to memory of 220 2024 xffffff.exe 101 PID 2024 wrote to memory of 220 2024 xffffff.exe 101 PID 2024 wrote to memory of 220 2024 xffffff.exe 101 PID 220 wrote to memory of 3940 220 xrrrrrr.exe 102 PID 220 wrote to memory of 3940 220 xrrrrrr.exe 102 PID 220 wrote to memory of 3940 220 xrrrrrr.exe 102 PID 3940 wrote to memory of 4800 3940 hhnhhh.exe 103 PID 3940 wrote to memory of 4800 3940 hhnhhh.exe 103 PID 3940 wrote to memory of 4800 3940 hhnhhh.exe 103 PID 4800 wrote to memory of 4160 4800 vpvpp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\db19bf2fbdefa3906ce1c0f5e163d96db101e0116d42032f1febe79f450fa61c.exe"C:\Users\Admin\AppData\Local\Temp\db19bf2fbdefa3906ce1c0f5e163d96db101e0116d42032f1febe79f450fa61c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\nbnnhn.exec:\nbnnhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\ntnhbh.exec:\ntnhbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\llrffll.exec:\llrffll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\hnttbn.exec:\hnttbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\hnnhbb.exec:\hnnhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\djvpj.exec:\djvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\3hbbtb.exec:\3hbbtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\vdjdv.exec:\vdjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\vdppj.exec:\vdppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\rlfxrlx.exec:\rlfxrlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\rxffxfl.exec:\rxffxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\tnnhhb.exec:\tnnhhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\djjjp.exec:\djjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\fxfrlrx.exec:\fxfrlrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\ffxxrrr.exec:\ffxxrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\llfxrrl.exec:\llfxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\bbbttb.exec:\bbbttb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\xffffff.exec:\xffffff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\hhnhhh.exec:\hhnhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\vpvpp.exec:\vpvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\xfxrlll.exec:\xfxrlll.exe23⤵
- Executes dropped EXE
PID:4160 -
\??\c:\rrxrrrr.exec:\rrxrrrr.exe24⤵
- Executes dropped EXE
PID:4864 -
\??\c:\xlrllfl.exec:\xlrllfl.exe25⤵
- Executes dropped EXE
PID:1692 -
\??\c:\1llfrrl.exec:\1llfrrl.exe26⤵
- Executes dropped EXE
PID:4052 -
\??\c:\ffrrllf.exec:\ffrrllf.exe27⤵
- Executes dropped EXE
PID:4824 -
\??\c:\nttnhh.exec:\nttnhh.exe28⤵
- Executes dropped EXE
PID:4760 -
\??\c:\rxrrrrr.exec:\rxrrrrr.exe29⤵
- Executes dropped EXE
PID:912 -
\??\c:\flrlrrr.exec:\flrlrrr.exe30⤵
- Executes dropped EXE
PID:1480 -
\??\c:\jddvv.exec:\jddvv.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:924 -
\??\c:\frxlfxr.exec:\frxlfxr.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1892 -
\??\c:\jvpdp.exec:\jvpdp.exe33⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nnhbtn.exec:\nnhbtn.exe34⤵
- Executes dropped EXE
PID:4408 -
\??\c:\pvpjd.exec:\pvpjd.exe35⤵
- Executes dropped EXE
PID:1172 -
\??\c:\rlflrrf.exec:\rlflrrf.exe36⤵
- Executes dropped EXE
PID:3512 -
\??\c:\ppjdj.exec:\ppjdj.exe37⤵
- Executes dropped EXE
PID:2924 -
\??\c:\xxxrrlf.exec:\xxxrrlf.exe38⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hhhhhh.exec:\hhhhhh.exe39⤵
- Executes dropped EXE
PID:840 -
\??\c:\dvddd.exec:\dvddd.exe40⤵
- Executes dropped EXE
PID:2828 -
\??\c:\rlllffx.exec:\rlllffx.exe41⤵
- Executes dropped EXE
PID:4588 -
\??\c:\bttnhb.exec:\bttnhb.exe42⤵
- Executes dropped EXE
PID:3744 -
\??\c:\1jdvp.exec:\1jdvp.exe43⤵
- Executes dropped EXE
PID:4684 -
\??\c:\5djdp.exec:\5djdp.exe44⤵
- Executes dropped EXE
PID:244 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe45⤵
- Executes dropped EXE
PID:3004 -
\??\c:\nbhbtb.exec:\nbhbtb.exe46⤵
- Executes dropped EXE
PID:3860 -
\??\c:\7pdpj.exec:\7pdpj.exe47⤵
- Executes dropped EXE
PID:3536 -
\??\c:\7jdvj.exec:\7jdvj.exe48⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rrrrlrl.exec:\rrrrlrl.exe49⤵
- Executes dropped EXE
PID:2576 -
\??\c:\tttnhh.exec:\tttnhh.exe50⤵
- Executes dropped EXE
PID:4372 -
\??\c:\3dpjd.exec:\3dpjd.exe51⤵
- Executes dropped EXE
PID:644 -
\??\c:\rffxlfx.exec:\rffxlfx.exe52⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nbbbbb.exec:\nbbbbb.exe53⤵
- Executes dropped EXE
PID:4848 -
\??\c:\5jdvd.exec:\5jdvd.exe54⤵
- Executes dropped EXE
PID:1356 -
\??\c:\rrxrxxl.exec:\rrxrxxl.exe55⤵
- Executes dropped EXE
PID:392 -
\??\c:\flxrlfx.exec:\flxrlfx.exe56⤵
- Executes dropped EXE
PID:2444 -
\??\c:\bhhtnh.exec:\bhhtnh.exe57⤵
- Executes dropped EXE
PID:448 -
\??\c:\vvpdv.exec:\vvpdv.exe58⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xfxrlfx.exec:\xfxrlfx.exe59⤵
- Executes dropped EXE
PID:1660 -
\??\c:\hhbbtn.exec:\hhbbtn.exe60⤵
- Executes dropped EXE
PID:4392 -
\??\c:\vpdvv.exec:\vpdvv.exe61⤵
- Executes dropped EXE
PID:2056 -
\??\c:\1ffxlfr.exec:\1ffxlfr.exe62⤵
- Executes dropped EXE
PID:1484 -
\??\c:\7hnntt.exec:\7hnntt.exe63⤵
- Executes dropped EXE
PID:3144 -
\??\c:\jppjp.exec:\jppjp.exe64⤵
- Executes dropped EXE
PID:4168 -
\??\c:\9lfrllf.exec:\9lfrllf.exe65⤵
- Executes dropped EXE
PID:1416 -
\??\c:\bnhbtn.exec:\bnhbtn.exe66⤵PID:3688
-
\??\c:\bnbnth.exec:\bnbnth.exe67⤵PID:1620
-
\??\c:\vvppp.exec:\vvppp.exe68⤵PID:544
-
\??\c:\3frrrrr.exec:\3frrrrr.exe69⤵PID:648
-
\??\c:\rllxxlf.exec:\rllxxlf.exe70⤵PID:1260
-
\??\c:\jpdvp.exec:\jpdvp.exe71⤵PID:4044
-
\??\c:\lffxrrr.exec:\lffxrrr.exe72⤵PID:1988
-
\??\c:\rxffllr.exec:\rxffllr.exe73⤵PID:1968
-
\??\c:\bbnnbb.exec:\bbnnbb.exe74⤵PID:5008
-
\??\c:\btbbnn.exec:\btbbnn.exe75⤵PID:2464
-
\??\c:\vdjdd.exec:\vdjdd.exe76⤵PID:2224
-
\??\c:\rffxflr.exec:\rffxflr.exe77⤵PID:1448
-
\??\c:\1httnt.exec:\1httnt.exe78⤵PID:3704
-
\??\c:\vpvpj.exec:\vpvpj.exe79⤵PID:3460
-
\??\c:\3lrrxxf.exec:\3lrrxxf.exe80⤵
- System Location Discovery: System Language Discovery
PID:4732 -
\??\c:\nnnttt.exec:\nnnttt.exe81⤵PID:4696
-
\??\c:\5jdvp.exec:\5jdvp.exe82⤵PID:3248
-
\??\c:\9fffxxx.exec:\9fffxxx.exe83⤵PID:2776
-
\??\c:\hnnhbt.exec:\hnnhbt.exe84⤵PID:1692
-
\??\c:\vvddj.exec:\vvddj.exe85⤵PID:1992
-
\??\c:\flxxlrx.exec:\flxxlrx.exe86⤵PID:4052
-
\??\c:\lxffxff.exec:\lxffxff.exe87⤵PID:4824
-
\??\c:\tbnhnn.exec:\tbnhnn.exe88⤵PID:3188
-
\??\c:\vvvpp.exec:\vvvpp.exe89⤵PID:1032
-
\??\c:\vdjdd.exec:\vdjdd.exe90⤵PID:3276
-
\??\c:\flrfxfx.exec:\flrfxfx.exe91⤵PID:4972
-
\??\c:\7nhbnn.exec:\7nhbnn.exe92⤵PID:3740
-
\??\c:\jvdvv.exec:\jvdvv.exe93⤵PID:3776
-
\??\c:\frrrrrl.exec:\frrrrrl.exe94⤵PID:3432
-
\??\c:\bhnnnn.exec:\bhnnnn.exe95⤵PID:3820
-
\??\c:\jpdpj.exec:\jpdpj.exe96⤵PID:632
-
\??\c:\rllfrlf.exec:\rllfrlf.exe97⤵PID:1176
-
\??\c:\fflfxxr.exec:\fflfxxr.exe98⤵PID:3492
-
\??\c:\9nbtnt.exec:\9nbtnt.exe99⤵PID:4208
-
\??\c:\vvpjv.exec:\vvpjv.exe100⤵PID:512
-
\??\c:\frfrflr.exec:\frfrflr.exe101⤵PID:8
-
\??\c:\hbnhtt.exec:\hbnhtt.exe102⤵
- System Location Discovery: System Language Discovery
PID:4040 -
\??\c:\5btnnb.exec:\5btnnb.exe103⤵PID:2280
-
\??\c:\vjvvv.exec:\vjvvv.exe104⤵PID:5024
-
\??\c:\lllxxxx.exec:\lllxxxx.exe105⤵PID:3988
-
\??\c:\5httnn.exec:\5httnn.exe106⤵PID:2468
-
\??\c:\vvdvp.exec:\vvdvp.exe107⤵PID:1036
-
\??\c:\vvdvd.exec:\vvdvd.exe108⤵PID:4888
-
\??\c:\5flfxxr.exec:\5flfxxr.exe109⤵PID:4912
-
\??\c:\hnnhnb.exec:\hnnhnb.exe110⤵PID:3560
-
\??\c:\hhhttt.exec:\hhhttt.exe111⤵PID:4348
-
\??\c:\vvjjp.exec:\vvjjp.exe112⤵PID:4288
-
\??\c:\1xrrlrf.exec:\1xrrlrf.exe113⤵PID:3148
-
\??\c:\nntbnn.exec:\nntbnn.exe114⤵PID:5100
-
\??\c:\vdvpj.exec:\vdvpj.exe115⤵PID:4860
-
\??\c:\jppvp.exec:\jppvp.exe116⤵PID:1440
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe117⤵PID:4820
-
\??\c:\btnbbb.exec:\btnbbb.exe118⤵PID:880
-
\??\c:\dddvv.exec:\dddvv.exe119⤵PID:4964
-
\??\c:\dpvvp.exec:\dpvvp.exe120⤵PID:4528
-
\??\c:\ffxrrrr.exec:\ffxrrrr.exe121⤵PID:1656
-
\??\c:\1nbttt.exec:\1nbttt.exe122⤵PID:1904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-