Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 23:25
Static task
static1
Behavioral task
behavioral1
Sample
714099986857c572809f753782d66cf03cdf374514814c72d297bcd82a360087.exe
Resource
win7-20240903-en
General
-
Target
714099986857c572809f753782d66cf03cdf374514814c72d297bcd82a360087.exe
-
Size
337KB
-
MD5
a3192e9f1b5dd3cfd8cd7255e8b5850a
-
SHA1
07021ab656ef98a8d5d39346050c4b5084d6c217
-
SHA256
714099986857c572809f753782d66cf03cdf374514814c72d297bcd82a360087
-
SHA512
54ea232b7d04840298af2c5a1543ece6355f905cfc7042d89aaabe7de05bd2f1e2a036dbdf381fbf3008188431f21c7bad8c907cb00be1bc5ed4156ed98cc4f6
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhk:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1948-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/732-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4284-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/736-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/956-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/316-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2624-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2072-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4284-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-725-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-775-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1904-845-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-873-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-1739-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1004 nhhntt.exe 4456 frxxllx.exe 2232 tbnntb.exe 3404 vvvvj.exe 732 lfrrxff.exe 4584 vjvjv.exe 1268 bbnbbh.exe 2844 rxfflfl.exe 2872 xfrrxxf.exe 2532 ntnttb.exe 4144 pdppv.exe 1060 xxrrrxl.exe 5048 jdddd.exe 100 fxlllrx.exe 4852 ddjjj.exe 4892 vvdvv.exe 3652 1nbnbb.exe 4380 pppjj.exe 2028 thhhnn.exe 372 ppjpd.exe 4284 jjdjd.exe 1916 rflllrr.exe 5080 xxrrlfx.exe 736 hhnhhh.exe 3948 hhtnhb.exe 956 fxffxff.exe 3996 tntttn.exe 1700 vvvvv.exe 2484 lrffrlr.exe 412 fllxxxx.exe 316 ffrxrrf.exe 2352 hhhhhh.exe 436 nhtnnn.exe 1476 dvvvv.exe 4092 bthbbt.exe 4940 dvvpj.exe 1656 bbtnbh.exe 1612 tbtthh.exe 2024 jvdvv.exe 3668 9xfllll.exe 1648 djvvv.exe 3276 jdpjv.exe 1904 nbthbb.exe 1228 3ppdv.exe 5076 3xrxrxx.exe 4196 7bnthh.exe 4164 pjvpj.exe 2624 htttnh.exe 4428 dvpjd.exe 2072 5lfxrrl.exe 1992 btnnhn.exe 1004 5jdvv.exe 4536 jpjjd.exe 3852 fxxrlfx.exe 3080 nbnbhb.exe 1864 ppjjd.exe 1428 jvpdj.exe 4180 xflffxx.exe 452 1nbbtt.exe 4992 bhbnnb.exe 3876 1dvvp.exe 1268 1fllflf.exe 5032 bbhttn.exe 4784 djppv.exe -
resource yara_rule behavioral2/memory/1948-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/732-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4284-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/736-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/956-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/316-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2624-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2072-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4284-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-725-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1948 wrote to memory of 1004 1948 714099986857c572809f753782d66cf03cdf374514814c72d297bcd82a360087.exe 83 PID 1948 wrote to memory of 1004 1948 714099986857c572809f753782d66cf03cdf374514814c72d297bcd82a360087.exe 83 PID 1948 wrote to memory of 1004 1948 714099986857c572809f753782d66cf03cdf374514814c72d297bcd82a360087.exe 83 PID 1004 wrote to memory of 4456 1004 nhhntt.exe 84 PID 1004 wrote to memory of 4456 1004 nhhntt.exe 84 PID 1004 wrote to memory of 4456 1004 nhhntt.exe 84 PID 4456 wrote to memory of 2232 4456 frxxllx.exe 85 PID 4456 wrote to memory of 2232 4456 frxxllx.exe 85 PID 4456 wrote to memory of 2232 4456 frxxllx.exe 85 PID 2232 wrote to memory of 3404 2232 tbnntb.exe 86 PID 2232 wrote to memory of 3404 2232 tbnntb.exe 86 PID 2232 wrote to memory of 3404 2232 tbnntb.exe 86 PID 3404 wrote to memory of 732 3404 vvvvj.exe 87 PID 3404 wrote to memory of 732 3404 vvvvj.exe 87 PID 3404 wrote to memory of 732 3404 vvvvj.exe 87 PID 732 wrote to memory of 4584 732 lfrrxff.exe 88 PID 732 wrote to memory of 4584 732 lfrrxff.exe 88 PID 732 wrote to memory of 4584 732 lfrrxff.exe 88 PID 4584 wrote to memory of 1268 4584 vjvjv.exe 89 PID 4584 wrote to memory of 1268 4584 vjvjv.exe 89 PID 4584 wrote to memory of 1268 4584 vjvjv.exe 89 PID 1268 wrote to memory of 2844 1268 bbnbbh.exe 90 PID 1268 wrote to memory of 2844 1268 bbnbbh.exe 90 PID 1268 wrote to memory of 2844 1268 bbnbbh.exe 90 PID 2844 wrote to memory of 2872 2844 rxfflfl.exe 91 PID 2844 wrote to memory of 2872 2844 rxfflfl.exe 91 PID 2844 wrote to memory of 2872 2844 rxfflfl.exe 91 PID 2872 wrote to memory of 2532 2872 xfrrxxf.exe 92 PID 2872 wrote to memory of 2532 2872 xfrrxxf.exe 92 PID 2872 wrote to memory of 2532 2872 xfrrxxf.exe 92 PID 2532 wrote to memory of 4144 2532 ntnttb.exe 93 PID 2532 wrote to memory of 4144 2532 ntnttb.exe 93 PID 2532 wrote to memory of 4144 2532 ntnttb.exe 93 PID 4144 wrote to memory of 1060 4144 pdppv.exe 94 PID 4144 wrote to memory of 1060 4144 pdppv.exe 94 PID 4144 wrote to memory of 1060 4144 pdppv.exe 94 PID 1060 wrote to memory of 5048 1060 xxrrrxl.exe 95 PID 1060 wrote to memory of 5048 1060 xxrrrxl.exe 95 PID 1060 wrote to memory of 5048 1060 xxrrrxl.exe 95 PID 5048 wrote to memory of 100 5048 jdddd.exe 96 PID 5048 wrote to memory of 100 5048 jdddd.exe 96 PID 5048 wrote to memory of 100 5048 jdddd.exe 96 PID 100 wrote to memory of 4852 100 fxlllrx.exe 97 PID 100 wrote to memory of 4852 100 fxlllrx.exe 97 PID 100 wrote to memory of 4852 100 fxlllrx.exe 97 PID 4852 wrote to memory of 4892 4852 ddjjj.exe 98 PID 4852 wrote to memory of 4892 4852 ddjjj.exe 98 PID 4852 wrote to memory of 4892 4852 ddjjj.exe 98 PID 4892 wrote to memory of 3652 4892 vvdvv.exe 99 PID 4892 wrote to memory of 3652 4892 vvdvv.exe 99 PID 4892 wrote to memory of 3652 4892 vvdvv.exe 99 PID 3652 wrote to memory of 4380 3652 1nbnbb.exe 100 PID 3652 wrote to memory of 4380 3652 1nbnbb.exe 100 PID 3652 wrote to memory of 4380 3652 1nbnbb.exe 100 PID 4380 wrote to memory of 2028 4380 pppjj.exe 101 PID 4380 wrote to memory of 2028 4380 pppjj.exe 101 PID 4380 wrote to memory of 2028 4380 pppjj.exe 101 PID 2028 wrote to memory of 372 2028 thhhnn.exe 102 PID 2028 wrote to memory of 372 2028 thhhnn.exe 102 PID 2028 wrote to memory of 372 2028 thhhnn.exe 102 PID 372 wrote to memory of 4284 372 ppjpd.exe 103 PID 372 wrote to memory of 4284 372 ppjpd.exe 103 PID 372 wrote to memory of 4284 372 ppjpd.exe 103 PID 4284 wrote to memory of 1916 4284 jjdjd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\714099986857c572809f753782d66cf03cdf374514814c72d297bcd82a360087.exe"C:\Users\Admin\AppData\Local\Temp\714099986857c572809f753782d66cf03cdf374514814c72d297bcd82a360087.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\nhhntt.exec:\nhhntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\frxxllx.exec:\frxxllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\tbnntb.exec:\tbnntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\vvvvj.exec:\vvvvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\lfrrxff.exec:\lfrrxff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\vjvjv.exec:\vjvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\bbnbbh.exec:\bbnbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\rxfflfl.exec:\rxfflfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\xfrrxxf.exec:\xfrrxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\ntnttb.exec:\ntnttb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\pdppv.exec:\pdppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\xxrrrxl.exec:\xxrrrxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\jdddd.exec:\jdddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\fxlllrx.exec:\fxlllrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\ddjjj.exec:\ddjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\vvdvv.exec:\vvdvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\1nbnbb.exec:\1nbnbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\pppjj.exec:\pppjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\thhhnn.exec:\thhhnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\ppjpd.exec:\ppjpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\jjdjd.exec:\jjdjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\rflllrr.exec:\rflllrr.exe23⤵
- Executes dropped EXE
PID:1916 -
\??\c:\xxrrlfx.exec:\xxrrlfx.exe24⤵
- Executes dropped EXE
PID:5080 -
\??\c:\hhnhhh.exec:\hhnhhh.exe25⤵
- Executes dropped EXE
PID:736 -
\??\c:\hhtnhb.exec:\hhtnhb.exe26⤵
- Executes dropped EXE
PID:3948 -
\??\c:\fxffxff.exec:\fxffxff.exe27⤵
- Executes dropped EXE
PID:956 -
\??\c:\tntttn.exec:\tntttn.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3996 -
\??\c:\vvvvv.exec:\vvvvv.exe29⤵
- Executes dropped EXE
PID:1700 -
\??\c:\lrffrlr.exec:\lrffrlr.exe30⤵
- Executes dropped EXE
PID:2484 -
\??\c:\fllxxxx.exec:\fllxxxx.exe31⤵
- Executes dropped EXE
PID:412 -
\??\c:\ffrxrrf.exec:\ffrxrrf.exe32⤵
- Executes dropped EXE
PID:316 -
\??\c:\hhhhhh.exec:\hhhhhh.exe33⤵
- Executes dropped EXE
PID:2352 -
\??\c:\nhtnnn.exec:\nhtnnn.exe34⤵
- Executes dropped EXE
PID:436 -
\??\c:\dvvvv.exec:\dvvvv.exe35⤵
- Executes dropped EXE
PID:1476 -
\??\c:\bthbbt.exec:\bthbbt.exe36⤵
- Executes dropped EXE
PID:4092 -
\??\c:\dvvpj.exec:\dvvpj.exe37⤵
- Executes dropped EXE
PID:4940 -
\??\c:\bbtnbh.exec:\bbtnbh.exe38⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tbtthh.exec:\tbtthh.exe39⤵
- Executes dropped EXE
PID:1612 -
\??\c:\jvdvv.exec:\jvdvv.exe40⤵
- Executes dropped EXE
PID:2024 -
\??\c:\9xfllll.exec:\9xfllll.exe41⤵
- Executes dropped EXE
PID:3668 -
\??\c:\djvvv.exec:\djvvv.exe42⤵
- Executes dropped EXE
PID:1648 -
\??\c:\jdpjv.exec:\jdpjv.exe43⤵
- Executes dropped EXE
PID:3276 -
\??\c:\nbthbb.exec:\nbthbb.exe44⤵
- Executes dropped EXE
PID:1904 -
\??\c:\3ppdv.exec:\3ppdv.exe45⤵
- Executes dropped EXE
PID:1228 -
\??\c:\3xrxrxx.exec:\3xrxrxx.exe46⤵
- Executes dropped EXE
PID:5076 -
\??\c:\7bnthh.exec:\7bnthh.exe47⤵
- Executes dropped EXE
PID:4196 -
\??\c:\pjvpj.exec:\pjvpj.exe48⤵
- Executes dropped EXE
PID:4164 -
\??\c:\htttnh.exec:\htttnh.exe49⤵
- Executes dropped EXE
PID:2624 -
\??\c:\dvpjd.exec:\dvpjd.exe50⤵
- Executes dropped EXE
PID:4428 -
\??\c:\5lfxrrl.exec:\5lfxrrl.exe51⤵
- Executes dropped EXE
PID:2072 -
\??\c:\btnnhn.exec:\btnnhn.exe52⤵
- Executes dropped EXE
PID:1992 -
\??\c:\5jdvv.exec:\5jdvv.exe53⤵
- Executes dropped EXE
PID:1004 -
\??\c:\jpjjd.exec:\jpjjd.exe54⤵
- Executes dropped EXE
PID:4536 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe55⤵
- Executes dropped EXE
PID:3852 -
\??\c:\nbnbhb.exec:\nbnbhb.exe56⤵
- Executes dropped EXE
PID:3080 -
\??\c:\ppjjd.exec:\ppjjd.exe57⤵
- Executes dropped EXE
PID:1864 -
\??\c:\jvpdj.exec:\jvpdj.exe58⤵
- Executes dropped EXE
PID:1428 -
\??\c:\xflffxx.exec:\xflffxx.exe59⤵
- Executes dropped EXE
PID:4180 -
\??\c:\1nbbtt.exec:\1nbbtt.exe60⤵
- Executes dropped EXE
PID:452 -
\??\c:\bhbnnb.exec:\bhbnnb.exe61⤵
- Executes dropped EXE
PID:4992 -
\??\c:\1dvvp.exec:\1dvvp.exe62⤵
- Executes dropped EXE
PID:3876 -
\??\c:\1fllflf.exec:\1fllflf.exe63⤵
- Executes dropped EXE
PID:1268 -
\??\c:\bbhttn.exec:\bbhttn.exe64⤵
- Executes dropped EXE
PID:5032 -
\??\c:\djppv.exec:\djppv.exe65⤵
- Executes dropped EXE
PID:4784 -
\??\c:\9pjjj.exec:\9pjjj.exe66⤵PID:4056
-
\??\c:\xxrlxxx.exec:\xxrlxxx.exe67⤵PID:2532
-
\??\c:\hbbtth.exec:\hbbtth.exe68⤵PID:3296
-
\??\c:\pjpjd.exec:\pjpjd.exe69⤵PID:2260
-
\??\c:\rrlfxxl.exec:\rrlfxxl.exe70⤵PID:3200
-
\??\c:\tnbbnn.exec:\tnbbnn.exe71⤵PID:3692
-
\??\c:\tbnhnn.exec:\tbnhnn.exe72⤵PID:1812
-
\??\c:\lrlllll.exec:\lrlllll.exe73⤵PID:2832
-
\??\c:\llrlfff.exec:\llrlfff.exe74⤵PID:4544
-
\??\c:\thbhtb.exec:\thbhtb.exe75⤵PID:2976
-
\??\c:\dpddv.exec:\dpddv.exe76⤵PID:3652
-
\??\c:\xffrlrx.exec:\xffrlrx.exe77⤵PID:2676
-
\??\c:\lffrxll.exec:\lffrxll.exe78⤵PID:3452
-
\??\c:\bbhhbt.exec:\bbhhbt.exe79⤵PID:4212
-
\??\c:\vvvvv.exec:\vvvvv.exe80⤵PID:3564
-
\??\c:\rxflfll.exec:\rxflfll.exe81⤵PID:4284
-
\??\c:\hbhbtt.exec:\hbhbtt.exe82⤵PID:4832
-
\??\c:\pjdvd.exec:\pjdvd.exe83⤵PID:2672
-
\??\c:\xrxxrll.exec:\xrxxrll.exe84⤵PID:4432
-
\??\c:\tbnttt.exec:\tbnttt.exe85⤵PID:736
-
\??\c:\nhnnnb.exec:\nhnnnb.exe86⤵PID:5088
-
\??\c:\vpppj.exec:\vpppj.exe87⤵PID:3948
-
\??\c:\xrrlfrf.exec:\xrrlfrf.exe88⤵PID:956
-
\??\c:\tttbtt.exec:\tttbtt.exe89⤵PID:3712
-
\??\c:\htttnn.exec:\htttnn.exe90⤵PID:4396
-
\??\c:\9pvvp.exec:\9pvvp.exe91⤵PID:3680
-
\??\c:\lrffxxr.exec:\lrffxxr.exe92⤵PID:3280
-
\??\c:\xrrrlrl.exec:\xrrrlrl.exe93⤵PID:2992
-
\??\c:\hhnnhh.exec:\hhnnhh.exe94⤵PID:316
-
\??\c:\jjddv.exec:\jjddv.exe95⤵PID:3504
-
\??\c:\rxfrrfx.exec:\rxfrrfx.exe96⤵PID:5020
-
\??\c:\5thbnb.exec:\5thbnb.exe97⤵PID:1624
-
\??\c:\5vppj.exec:\5vppj.exe98⤵PID:3540
-
\??\c:\7rllffx.exec:\7rllffx.exe99⤵PID:2580
-
\??\c:\nhnhbb.exec:\nhnhbb.exe100⤵PID:4968
-
\??\c:\ddpjv.exec:\ddpjv.exe101⤵PID:4796
-
\??\c:\jpddj.exec:\jpddj.exe102⤵PID:3020
-
\??\c:\xfrrlll.exec:\xfrrlll.exe103⤵PID:2824
-
\??\c:\1nhhtt.exec:\1nhhtt.exe104⤵PID:3576
-
\??\c:\vdpvd.exec:\vdpvd.exe105⤵PID:1576
-
\??\c:\7frllfr.exec:\7frllfr.exe106⤵PID:4900
-
\??\c:\5ntttt.exec:\5ntttt.exe107⤵PID:3232
-
\??\c:\tnbbhn.exec:\tnbbhn.exe108⤵PID:2904
-
\??\c:\llxxrfx.exec:\llxxrfx.exe109⤵PID:212
-
\??\c:\rfxllfx.exec:\rfxllfx.exe110⤵PID:4508
-
\??\c:\tbnntt.exec:\tbnntt.exe111⤵PID:2500
-
\??\c:\djddv.exec:\djddv.exe112⤵PID:4312
-
\??\c:\lflffll.exec:\lflffll.exe113⤵PID:5108
-
\??\c:\frlxrrl.exec:\frlxrrl.exe114⤵PID:3100
-
\??\c:\ntbtbb.exec:\ntbtbb.exe115⤵PID:3764
-
\??\c:\7pppj.exec:\7pppj.exe116⤵PID:668
-
\??\c:\rxlxrrl.exec:\rxlxrrl.exe117⤵PID:1808
-
\??\c:\hnhhbb.exec:\hnhhbb.exe118⤵PID:4536
-
\??\c:\bhbttn.exec:\bhbttn.exe119⤵PID:3852
-
\??\c:\vpjjd.exec:\vpjjd.exe120⤵PID:116
-
\??\c:\lrrrxxr.exec:\lrrrxxr.exe121⤵PID:2252
-
\??\c:\thbbbh.exec:\thbbbh.exe122⤵PID:4676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-