Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 22:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
533c971a93c68cc2acd4d805306c1d7c37217abb3582210de44923afb5ce0bb0.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
120 seconds
General
-
Target
533c971a93c68cc2acd4d805306c1d7c37217abb3582210de44923afb5ce0bb0.exe
-
Size
453KB
-
MD5
642160d240df6ab9ff7b1492c16c89e9
-
SHA1
82a5ac74014ab882e7905d6c4ed4013aec181f9d
-
SHA256
533c971a93c68cc2acd4d805306c1d7c37217abb3582210de44923afb5ce0bb0
-
SHA512
22b2d5573b8e82a5dce995b4c182c86c488914afe3b3ffb29851530242cd8d10557acd3cbd3edc83aa857c16e15a778b1bbe8db522604fe8ed03ecae8f02b3da
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeB:q7Tc2NYHUrAwfMp3CDB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4916-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1316-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3160-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-725-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/672-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-857-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-915-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-1000-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-1250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-1952-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2556 hnnhbb.exe 4036 pvppd.exe 2008 vjjpp.exe 4876 nnbbbh.exe 3620 jjpvv.exe 3116 xrfllll.exe 1544 pjjdv.exe 3264 rxfxrxx.exe 948 btnhbt.exe 4312 bhthhh.exe 4596 lfxlfrf.exe 2016 hbtbth.exe 4968 llllfff.exe 2640 jvdvv.exe 2376 xllfxxx.exe 1704 tnnnnn.exe 4616 hbnnnt.exe 4516 xffffff.exe 2128 dvjjj.exe 3476 9frrxff.exe 3900 5jjpj.exe 1116 fxfffrr.exe 2936 hbttth.exe 3496 vpdjj.exe 2384 nhttnt.exe 3924 bnhbnh.exe 4156 5ntttt.exe 4404 hhnntt.exe 3164 ppddp.exe 1728 ffrxxxf.exe 3964 bthhtb.exe 4908 9xxrrxx.exe 3216 hntttt.exe 5096 7dddv.exe 1796 jdvjj.exe 4456 bhnhhn.exe 4132 tnnhtb.exe 2116 vjvpj.exe 4056 3lxrrxr.exe 1256 nntnnn.exe 4328 ttttbb.exe 4332 pjdvd.exe 1072 xrxrrrl.exe 1228 1rrrrrr.exe 2692 bthhbb.exe 1360 dpdvp.exe 1692 llxlrxx.exe 2600 nbnttb.exe 2212 3vvvv.exe 4256 rlxlrxx.exe 2432 7tbbtt.exe 2304 vpvjj.exe 316 vvjjv.exe 2252 xlllllf.exe 2548 bhhhhh.exe 1104 dvddd.exe 2744 lrrrrrx.exe 4512 3rllffr.exe 4712 5tttnt.exe 3264 jvjdv.exe 1484 fxlffff.exe 1956 1xllffr.exe 3736 tbnttt.exe 2708 ddjjv.exe -
resource yara_rule behavioral2/memory/4916-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2252-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1316-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3160-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/672-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-857-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-915-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-916-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/904-947-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flllrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ntbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4916 wrote to memory of 2556 4916 533c971a93c68cc2acd4d805306c1d7c37217abb3582210de44923afb5ce0bb0.exe 82 PID 4916 wrote to memory of 2556 4916 533c971a93c68cc2acd4d805306c1d7c37217abb3582210de44923afb5ce0bb0.exe 82 PID 4916 wrote to memory of 2556 4916 533c971a93c68cc2acd4d805306c1d7c37217abb3582210de44923afb5ce0bb0.exe 82 PID 2556 wrote to memory of 4036 2556 hnnhbb.exe 83 PID 2556 wrote to memory of 4036 2556 hnnhbb.exe 83 PID 2556 wrote to memory of 4036 2556 hnnhbb.exe 83 PID 4036 wrote to memory of 2008 4036 pvppd.exe 84 PID 4036 wrote to memory of 2008 4036 pvppd.exe 84 PID 4036 wrote to memory of 2008 4036 pvppd.exe 84 PID 2008 wrote to memory of 4876 2008 vjjpp.exe 85 PID 2008 wrote to memory of 4876 2008 vjjpp.exe 85 PID 2008 wrote to memory of 4876 2008 vjjpp.exe 85 PID 4876 wrote to memory of 3620 4876 nnbbbh.exe 86 PID 4876 wrote to memory of 3620 4876 nnbbbh.exe 86 PID 4876 wrote to memory of 3620 4876 nnbbbh.exe 86 PID 3620 wrote to memory of 3116 3620 jjpvv.exe 87 PID 3620 wrote to memory of 3116 3620 jjpvv.exe 87 PID 3620 wrote to memory of 3116 3620 jjpvv.exe 87 PID 3116 wrote to memory of 1544 3116 xrfllll.exe 88 PID 3116 wrote to memory of 1544 3116 xrfllll.exe 88 PID 3116 wrote to memory of 1544 3116 xrfllll.exe 88 PID 1544 wrote to memory of 3264 1544 pjjdv.exe 89 PID 1544 wrote to memory of 3264 1544 pjjdv.exe 89 PID 1544 wrote to memory of 3264 1544 pjjdv.exe 89 PID 3264 wrote to memory of 948 3264 rxfxrxx.exe 90 PID 3264 wrote to memory of 948 3264 rxfxrxx.exe 90 PID 3264 wrote to memory of 948 3264 rxfxrxx.exe 90 PID 948 wrote to memory of 4312 948 btnhbt.exe 91 PID 948 wrote to memory of 4312 948 btnhbt.exe 91 PID 948 wrote to memory of 4312 948 btnhbt.exe 91 PID 4312 wrote to memory of 4596 4312 bhthhh.exe 92 PID 4312 wrote to memory of 4596 4312 bhthhh.exe 92 PID 4312 wrote to memory of 4596 4312 bhthhh.exe 92 PID 4596 wrote to memory of 2016 4596 lfxlfrf.exe 93 PID 4596 wrote to memory of 2016 4596 lfxlfrf.exe 93 PID 4596 wrote to memory of 2016 4596 lfxlfrf.exe 93 PID 2016 wrote to memory of 4968 2016 hbtbth.exe 94 PID 2016 wrote to memory of 4968 2016 hbtbth.exe 94 PID 2016 wrote to memory of 4968 2016 hbtbth.exe 94 PID 4968 wrote to memory of 2640 4968 llllfff.exe 95 PID 4968 wrote to memory of 2640 4968 llllfff.exe 95 PID 4968 wrote to memory of 2640 4968 llllfff.exe 95 PID 2640 wrote to memory of 2376 2640 jvdvv.exe 96 PID 2640 wrote to memory of 2376 2640 jvdvv.exe 96 PID 2640 wrote to memory of 2376 2640 jvdvv.exe 96 PID 2376 wrote to memory of 1704 2376 xllfxxx.exe 97 PID 2376 wrote to memory of 1704 2376 xllfxxx.exe 97 PID 2376 wrote to memory of 1704 2376 xllfxxx.exe 97 PID 1704 wrote to memory of 4616 1704 tnnnnn.exe 98 PID 1704 wrote to memory of 4616 1704 tnnnnn.exe 98 PID 1704 wrote to memory of 4616 1704 tnnnnn.exe 98 PID 4616 wrote to memory of 4516 4616 hbnnnt.exe 99 PID 4616 wrote to memory of 4516 4616 hbnnnt.exe 99 PID 4616 wrote to memory of 4516 4616 hbnnnt.exe 99 PID 4516 wrote to memory of 2128 4516 xffffff.exe 100 PID 4516 wrote to memory of 2128 4516 xffffff.exe 100 PID 4516 wrote to memory of 2128 4516 xffffff.exe 100 PID 2128 wrote to memory of 3476 2128 dvjjj.exe 101 PID 2128 wrote to memory of 3476 2128 dvjjj.exe 101 PID 2128 wrote to memory of 3476 2128 dvjjj.exe 101 PID 3476 wrote to memory of 3900 3476 9frrxff.exe 102 PID 3476 wrote to memory of 3900 3476 9frrxff.exe 102 PID 3476 wrote to memory of 3900 3476 9frrxff.exe 102 PID 3900 wrote to memory of 1116 3900 5jjpj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\533c971a93c68cc2acd4d805306c1d7c37217abb3582210de44923afb5ce0bb0.exe"C:\Users\Admin\AppData\Local\Temp\533c971a93c68cc2acd4d805306c1d7c37217abb3582210de44923afb5ce0bb0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\hnnhbb.exec:\hnnhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\pvppd.exec:\pvppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\vjjpp.exec:\vjjpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\nnbbbh.exec:\nnbbbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\jjpvv.exec:\jjpvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\xrfllll.exec:\xrfllll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\pjjdv.exec:\pjjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\rxfxrxx.exec:\rxfxrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\btnhbt.exec:\btnhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\bhthhh.exec:\bhthhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\lfxlfrf.exec:\lfxlfrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\hbtbth.exec:\hbtbth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\llllfff.exec:\llllfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\jvdvv.exec:\jvdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\xllfxxx.exec:\xllfxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\tnnnnn.exec:\tnnnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\hbnnnt.exec:\hbnnnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\xffffff.exec:\xffffff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\dvjjj.exec:\dvjjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\9frrxff.exec:\9frrxff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\5jjpj.exec:\5jjpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\fxfffrr.exec:\fxfffrr.exe23⤵
- Executes dropped EXE
PID:1116 -
\??\c:\hbttth.exec:\hbttth.exe24⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vpdjj.exec:\vpdjj.exe25⤵
- Executes dropped EXE
PID:3496 -
\??\c:\nhttnt.exec:\nhttnt.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2384 -
\??\c:\bnhbnh.exec:\bnhbnh.exe27⤵
- Executes dropped EXE
PID:3924 -
\??\c:\5ntttt.exec:\5ntttt.exe28⤵
- Executes dropped EXE
PID:4156 -
\??\c:\hhnntt.exec:\hhnntt.exe29⤵
- Executes dropped EXE
PID:4404 -
\??\c:\ppddp.exec:\ppddp.exe30⤵
- Executes dropped EXE
PID:3164 -
\??\c:\ffrxxxf.exec:\ffrxxxf.exe31⤵
- Executes dropped EXE
PID:1728 -
\??\c:\bthhtb.exec:\bthhtb.exe32⤵
- Executes dropped EXE
PID:3964 -
\??\c:\9xxrrxx.exec:\9xxrrxx.exe33⤵
- Executes dropped EXE
PID:4908 -
\??\c:\hntttt.exec:\hntttt.exe34⤵
- Executes dropped EXE
PID:3216 -
\??\c:\7dddv.exec:\7dddv.exe35⤵
- Executes dropped EXE
PID:5096 -
\??\c:\jdvjj.exec:\jdvjj.exe36⤵
- Executes dropped EXE
PID:1796 -
\??\c:\bhnhhn.exec:\bhnhhn.exe37⤵
- Executes dropped EXE
PID:4456 -
\??\c:\tnnhtb.exec:\tnnhtb.exe38⤵
- Executes dropped EXE
PID:4132 -
\??\c:\vjvpj.exec:\vjvpj.exe39⤵
- Executes dropped EXE
PID:2116 -
\??\c:\3lxrrxr.exec:\3lxrrxr.exe40⤵
- Executes dropped EXE
PID:4056 -
\??\c:\nntnnn.exec:\nntnnn.exe41⤵
- Executes dropped EXE
PID:1256 -
\??\c:\ttttbb.exec:\ttttbb.exe42⤵
- Executes dropped EXE
PID:4328 -
\??\c:\pjdvd.exec:\pjdvd.exe43⤵
- Executes dropped EXE
PID:4332 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe44⤵
- Executes dropped EXE
PID:1072 -
\??\c:\1rrrrrr.exec:\1rrrrrr.exe45⤵
- Executes dropped EXE
PID:1228 -
\??\c:\bthhbb.exec:\bthhbb.exe46⤵
- Executes dropped EXE
PID:2692 -
\??\c:\dpdvp.exec:\dpdvp.exe47⤵
- Executes dropped EXE
PID:1360 -
\??\c:\llxlrxx.exec:\llxlrxx.exe48⤵
- Executes dropped EXE
PID:1692 -
\??\c:\nbnttb.exec:\nbnttb.exe49⤵
- Executes dropped EXE
PID:2600 -
\??\c:\3vvvv.exec:\3vvvv.exe50⤵
- Executes dropped EXE
PID:2212 -
\??\c:\rlxlrxx.exec:\rlxlrxx.exe51⤵
- Executes dropped EXE
PID:4256 -
\??\c:\7tbbtt.exec:\7tbbtt.exe52⤵
- Executes dropped EXE
PID:2432 -
\??\c:\vpvjj.exec:\vpvjj.exe53⤵
- Executes dropped EXE
PID:2304 -
\??\c:\vvjjv.exec:\vvjjv.exe54⤵
- Executes dropped EXE
PID:316 -
\??\c:\xlllllf.exec:\xlllllf.exe55⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bhhhhh.exec:\bhhhhh.exe56⤵
- Executes dropped EXE
PID:2548 -
\??\c:\dvddd.exec:\dvddd.exe57⤵
- Executes dropped EXE
PID:1104 -
\??\c:\lrrrrrx.exec:\lrrrrrx.exe58⤵
- Executes dropped EXE
PID:2744 -
\??\c:\3rllffr.exec:\3rllffr.exe59⤵
- Executes dropped EXE
PID:4512 -
\??\c:\5tttnt.exec:\5tttnt.exe60⤵
- Executes dropped EXE
PID:4712 -
\??\c:\jvjdv.exec:\jvjdv.exe61⤵
- Executes dropped EXE
PID:3264 -
\??\c:\fxlffff.exec:\fxlffff.exe62⤵
- Executes dropped EXE
PID:1484 -
\??\c:\1xllffr.exec:\1xllffr.exe63⤵
- Executes dropped EXE
PID:1956 -
\??\c:\tbnttt.exec:\tbnttt.exe64⤵
- Executes dropped EXE
PID:3736 -
\??\c:\ddjjv.exec:\ddjjv.exe65⤵
- Executes dropped EXE
PID:2708 -
\??\c:\jdjjj.exec:\jdjjj.exe66⤵PID:2724
-
\??\c:\nhttnb.exec:\nhttnb.exe67⤵PID:1452
-
\??\c:\tnhhhn.exec:\tnhhhn.exe68⤵PID:4092
-
\??\c:\vvppp.exec:\vvppp.exe69⤵PID:1376
-
\??\c:\5lrrrxr.exec:\5lrrrxr.exe70⤵PID:4048
-
\??\c:\xxrrflr.exec:\xxrrflr.exe71⤵PID:1188
-
\??\c:\bhtbhb.exec:\bhtbhb.exe72⤵PID:4984
-
\??\c:\vjjjd.exec:\vjjjd.exe73⤵PID:3232
-
\??\c:\xfrffff.exec:\xfrffff.exe74⤵PID:4276
-
\??\c:\9tbbbh.exec:\9tbbbh.exe75⤵PID:1536
-
\??\c:\7jvvv.exec:\7jvvv.exe76⤵PID:4584
-
\??\c:\llxxllf.exec:\llxxllf.exe77⤵PID:516
-
\??\c:\5bthhb.exec:\5bthhb.exe78⤵PID:552
-
\??\c:\bbnbhn.exec:\bbnbhn.exe79⤵PID:1316
-
\??\c:\vpvvv.exec:\vpvvv.exe80⤵PID:4448
-
\??\c:\fxllxxl.exec:\fxllxxl.exe81⤵PID:1348
-
\??\c:\xrllrrr.exec:\xrllrrr.exe82⤵PID:4516
-
\??\c:\7nbttn.exec:\7nbttn.exe83⤵PID:2216
-
\??\c:\7djdv.exec:\7djdv.exe84⤵PID:5056
-
\??\c:\flxxrxx.exec:\flxxrxx.exe85⤵PID:2396
-
\??\c:\rrfxxff.exec:\rrfxxff.exe86⤵PID:3604
-
\??\c:\nhttnt.exec:\nhttnt.exe87⤵PID:1116
-
\??\c:\vvdjv.exec:\vvdjv.exe88⤵PID:2972
-
\??\c:\dvjjj.exec:\dvjjj.exe89⤵PID:2484
-
\??\c:\fxrrflx.exec:\fxrrflx.exe90⤵PID:2180
-
\??\c:\bnbtnn.exec:\bnbtnn.exe91⤵PID:2144
-
\??\c:\pjvpp.exec:\pjvpp.exe92⤵PID:776
-
\??\c:\flllfll.exec:\flllfll.exe93⤵PID:2392
-
\??\c:\btbttt.exec:\btbttt.exe94⤵PID:808
-
\??\c:\bbnnnb.exec:\bbnnnb.exe95⤵PID:2680
-
\??\c:\pjpjd.exec:\pjpjd.exe96⤵PID:3952
-
\??\c:\rlrrllf.exec:\rlrrllf.exe97⤵PID:3164
-
\??\c:\bhnnhn.exec:\bhnnhn.exe98⤵PID:3584
-
\??\c:\jjppp.exec:\jjppp.exe99⤵PID:3484
-
\??\c:\vdjpp.exec:\vdjpp.exe100⤵PID:1200
-
\??\c:\xlrrrxx.exec:\xlrrrxx.exe101⤵PID:1504
-
\??\c:\5hhbtt.exec:\5hhbtt.exe102⤵PID:3632
-
\??\c:\hthhbb.exec:\hthhbb.exe103⤵PID:1508
-
\??\c:\1dddv.exec:\1dddv.exe104⤵PID:1796
-
\??\c:\flfrffl.exec:\flfrffl.exe105⤵PID:5060
-
\??\c:\nhnhhh.exec:\nhnhhh.exe106⤵PID:432
-
\??\c:\ntnhbb.exec:\ntnhbb.exe107⤵PID:4452
-
\??\c:\vpddd.exec:\vpddd.exe108⤵PID:1860
-
\??\c:\xrxlllf.exec:\xrxlllf.exe109⤵PID:2980
-
\??\c:\bbhhhh.exec:\bbhhhh.exe110⤵PID:3148
-
\??\c:\7thhht.exec:\7thhht.exe111⤵PID:3340
-
\??\c:\pjvpj.exec:\pjvpj.exe112⤵PID:5004
-
\??\c:\rrffxxx.exec:\rrffxxx.exe113⤵PID:208
-
\??\c:\btbbtn.exec:\btbbtn.exe114⤵PID:4140
-
\??\c:\ppdjd.exec:\ppdjd.exe115⤵PID:3668
-
\??\c:\lrxffrf.exec:\lrxffrf.exe116⤵PID:2436
-
\??\c:\xlffffr.exec:\xlffffr.exe117⤵PID:3464
-
\??\c:\hthhnn.exec:\hthhnn.exe118⤵PID:3068
-
\??\c:\jvjvp.exec:\jvjvp.exe119⤵PID:2008
-
\??\c:\llrrrrx.exec:\llrrrrx.exe120⤵PID:1636
-
\??\c:\9bhhhn.exec:\9bhhhn.exe121⤵PID:4464
-
\??\c:\ddppj.exec:\ddppj.exe122⤵PID:3136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-