Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 22:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a5b1b4b14970fb2a5ea5170e2318763d5c3c0c316f4847b1b2984e0b8c99889cN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a5b1b4b14970fb2a5ea5170e2318763d5c3c0c316f4847b1b2984e0b8c99889cN.exe
-
Size
454KB
-
MD5
8843be0004df392bc5c2fd65800648f0
-
SHA1
489e459dbaacfdf5b00c25df2452364b53ddd0a9
-
SHA256
a5b1b4b14970fb2a5ea5170e2318763d5c3c0c316f4847b1b2984e0b8c99889c
-
SHA512
cc81570eebb0d5a161ae2a9e4dadcd0284c1f0a5cc80bab9516eb34042c2e59d884a1a9ec7df43303c953bbd7fcc13d73da58c66db4c7ec97085d3ba9d845266
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeD:q7Tc2NYHUrAwfMp3CDD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/1660-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-162-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1632-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-198-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2012-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-236-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1692-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-283-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2992-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-307-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1976-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-363-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2672-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-389-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/2528-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-467-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2684-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-664-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/552-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-846-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-1085-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1660 1xfrrlr.exe 1548 tnhnth.exe 2124 xrflrrl.exe 2688 nthhhh.exe 2652 vjpdd.exe 2660 rlrllxx.exe 2760 bntbhb.exe 2204 dppvj.exe 2680 3rfrxff.exe 2524 tnbtbh.exe 2968 jdpvj.exe 2304 htnnnn.exe 2324 5jvjj.exe 1928 3pvjd.exe 1252 tbhhnt.exe 2312 9pvvp.exe 2264 frffllx.exe 1896 nhtthn.exe 1632 vjppd.exe 2608 rlfrxrx.exe 2836 nhnntt.exe 2012 dvdjv.exe 2876 flrxfrx.exe 2164 7vvpd.exe 1656 fflxlfl.exe 2828 nnhnbb.exe 1692 9ttnnn.exe 1440 hbtbhh.exe 1880 fxrxflr.exe 900 hhbthn.exe 2992 jdjdp.exe 1636 rfxflfl.exe 1976 btbhht.exe 2120 dpdvd.exe 2100 fllrrrr.exe 1780 3ntbhh.exe 2792 ddpvp.exe 3020 rfrlrlf.exe 2796 fxxxffl.exe 2660 9bhnbh.exe 2804 dpjpv.exe 2672 1pvjp.exe 2624 3xfxllf.exe 2752 tnbhhb.exe 2528 bnbttt.exe 2440 pdpdv.exe 2956 fxrxxff.exe 276 xlllxff.exe 1664 hbtbhh.exe 1840 pddjp.exe 2292 xrfxfxf.exe 2284 xfffrll.exe 2312 tthntt.exe 2264 pdpjd.exe 1248 dpjdp.exe 1216 xfrrxxl.exe 2596 1hntbh.exe 2684 1hnttn.exe 2724 vpvvj.exe 2148 lffxxxf.exe 2012 hbttbh.exe 2876 nhnthn.exe 2044 5jdvd.exe 1932 1xfrxrr.exe -
resource yara_rule behavioral1/memory/1660-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-406-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2312-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/552-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-740-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-765-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-846-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-1017-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-1024-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-1105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-1202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-1234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-1307-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 1660 2112 a5b1b4b14970fb2a5ea5170e2318763d5c3c0c316f4847b1b2984e0b8c99889cN.exe 30 PID 2112 wrote to memory of 1660 2112 a5b1b4b14970fb2a5ea5170e2318763d5c3c0c316f4847b1b2984e0b8c99889cN.exe 30 PID 2112 wrote to memory of 1660 2112 a5b1b4b14970fb2a5ea5170e2318763d5c3c0c316f4847b1b2984e0b8c99889cN.exe 30 PID 2112 wrote to memory of 1660 2112 a5b1b4b14970fb2a5ea5170e2318763d5c3c0c316f4847b1b2984e0b8c99889cN.exe 30 PID 1660 wrote to memory of 1548 1660 1xfrrlr.exe 31 PID 1660 wrote to memory of 1548 1660 1xfrrlr.exe 31 PID 1660 wrote to memory of 1548 1660 1xfrrlr.exe 31 PID 1660 wrote to memory of 1548 1660 1xfrrlr.exe 31 PID 1548 wrote to memory of 2124 1548 tnhnth.exe 32 PID 1548 wrote to memory of 2124 1548 tnhnth.exe 32 PID 1548 wrote to memory of 2124 1548 tnhnth.exe 32 PID 1548 wrote to memory of 2124 1548 tnhnth.exe 32 PID 2124 wrote to memory of 2688 2124 xrflrrl.exe 33 PID 2124 wrote to memory of 2688 2124 xrflrrl.exe 33 PID 2124 wrote to memory of 2688 2124 xrflrrl.exe 33 PID 2124 wrote to memory of 2688 2124 xrflrrl.exe 33 PID 2688 wrote to memory of 2652 2688 nthhhh.exe 34 PID 2688 wrote to memory of 2652 2688 nthhhh.exe 34 PID 2688 wrote to memory of 2652 2688 nthhhh.exe 34 PID 2688 wrote to memory of 2652 2688 nthhhh.exe 34 PID 2652 wrote to memory of 2660 2652 vjpdd.exe 35 PID 2652 wrote to memory of 2660 2652 vjpdd.exe 35 PID 2652 wrote to memory of 2660 2652 vjpdd.exe 35 PID 2652 wrote to memory of 2660 2652 vjpdd.exe 35 PID 2660 wrote to memory of 2760 2660 rlrllxx.exe 36 PID 2660 wrote to memory of 2760 2660 rlrllxx.exe 36 PID 2660 wrote to memory of 2760 2660 rlrllxx.exe 36 PID 2660 wrote to memory of 2760 2660 rlrllxx.exe 36 PID 2760 wrote to memory of 2204 2760 bntbhb.exe 37 PID 2760 wrote to memory of 2204 2760 bntbhb.exe 37 PID 2760 wrote to memory of 2204 2760 bntbhb.exe 37 PID 2760 wrote to memory of 2204 2760 bntbhb.exe 37 PID 2204 wrote to memory of 2680 2204 dppvj.exe 38 PID 2204 wrote to memory of 2680 2204 dppvj.exe 38 PID 2204 wrote to memory of 2680 2204 dppvj.exe 38 PID 2204 wrote to memory of 2680 2204 dppvj.exe 38 PID 2680 wrote to memory of 2524 2680 3rfrxff.exe 39 PID 2680 wrote to memory of 2524 2680 3rfrxff.exe 39 PID 2680 wrote to memory of 2524 2680 3rfrxff.exe 39 PID 2680 wrote to memory of 2524 2680 3rfrxff.exe 39 PID 2524 wrote to memory of 2968 2524 tnbtbh.exe 40 PID 2524 wrote to memory of 2968 2524 tnbtbh.exe 40 PID 2524 wrote to memory of 2968 2524 tnbtbh.exe 40 PID 2524 wrote to memory of 2968 2524 tnbtbh.exe 40 PID 2968 wrote to memory of 2304 2968 jdpvj.exe 41 PID 2968 wrote to memory of 2304 2968 jdpvj.exe 41 PID 2968 wrote to memory of 2304 2968 jdpvj.exe 41 PID 2968 wrote to memory of 2304 2968 jdpvj.exe 41 PID 2304 wrote to memory of 2324 2304 htnnnn.exe 42 PID 2304 wrote to memory of 2324 2304 htnnnn.exe 42 PID 2304 wrote to memory of 2324 2304 htnnnn.exe 42 PID 2304 wrote to memory of 2324 2304 htnnnn.exe 42 PID 2324 wrote to memory of 1928 2324 5jvjj.exe 43 PID 2324 wrote to memory of 1928 2324 5jvjj.exe 43 PID 2324 wrote to memory of 1928 2324 5jvjj.exe 43 PID 2324 wrote to memory of 1928 2324 5jvjj.exe 43 PID 1928 wrote to memory of 1252 1928 3pvjd.exe 44 PID 1928 wrote to memory of 1252 1928 3pvjd.exe 44 PID 1928 wrote to memory of 1252 1928 3pvjd.exe 44 PID 1928 wrote to memory of 1252 1928 3pvjd.exe 44 PID 1252 wrote to memory of 2312 1252 tbhhnt.exe 45 PID 1252 wrote to memory of 2312 1252 tbhhnt.exe 45 PID 1252 wrote to memory of 2312 1252 tbhhnt.exe 45 PID 1252 wrote to memory of 2312 1252 tbhhnt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5b1b4b14970fb2a5ea5170e2318763d5c3c0c316f4847b1b2984e0b8c99889cN.exe"C:\Users\Admin\AppData\Local\Temp\a5b1b4b14970fb2a5ea5170e2318763d5c3c0c316f4847b1b2984e0b8c99889cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\1xfrrlr.exec:\1xfrrlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\tnhnth.exec:\tnhnth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\xrflrrl.exec:\xrflrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\nthhhh.exec:\nthhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\vjpdd.exec:\vjpdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\rlrllxx.exec:\rlrllxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\bntbhb.exec:\bntbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\dppvj.exec:\dppvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\3rfrxff.exec:\3rfrxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\tnbtbh.exec:\tnbtbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\jdpvj.exec:\jdpvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\htnnnn.exec:\htnnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\5jvjj.exec:\5jvjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\3pvjd.exec:\3pvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\tbhhnt.exec:\tbhhnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\9pvvp.exec:\9pvvp.exe17⤵
- Executes dropped EXE
PID:2312 -
\??\c:\frffllx.exec:\frffllx.exe18⤵
- Executes dropped EXE
PID:2264 -
\??\c:\nhtthn.exec:\nhtthn.exe19⤵
- Executes dropped EXE
PID:1896 -
\??\c:\vjppd.exec:\vjppd.exe20⤵
- Executes dropped EXE
PID:1632 -
\??\c:\rlfrxrx.exec:\rlfrxrx.exe21⤵
- Executes dropped EXE
PID:2608 -
\??\c:\nhnntt.exec:\nhnntt.exe22⤵
- Executes dropped EXE
PID:2836 -
\??\c:\dvdjv.exec:\dvdjv.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2012 -
\??\c:\flrxfrx.exec:\flrxfrx.exe24⤵
- Executes dropped EXE
PID:2876 -
\??\c:\7vvpd.exec:\7vvpd.exe25⤵
- Executes dropped EXE
PID:2164 -
\??\c:\fflxlfl.exec:\fflxlfl.exe26⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nnhnbb.exec:\nnhnbb.exe27⤵
- Executes dropped EXE
PID:2828 -
\??\c:\9ttnnn.exec:\9ttnnn.exe28⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hbtbhh.exec:\hbtbhh.exe29⤵
- Executes dropped EXE
PID:1440 -
\??\c:\fxrxflr.exec:\fxrxflr.exe30⤵
- Executes dropped EXE
PID:1880 -
\??\c:\hhbthn.exec:\hhbthn.exe31⤵
- Executes dropped EXE
PID:900 -
\??\c:\jdjdp.exec:\jdjdp.exe32⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rfxflfl.exec:\rfxflfl.exe33⤵
- Executes dropped EXE
PID:1636 -
\??\c:\btbhht.exec:\btbhht.exe34⤵
- Executes dropped EXE
PID:1976 -
\??\c:\dpdvd.exec:\dpdvd.exe35⤵
- Executes dropped EXE
PID:2120 -
\??\c:\fllrrrr.exec:\fllrrrr.exe36⤵
- Executes dropped EXE
PID:2100 -
\??\c:\3ntbhh.exec:\3ntbhh.exe37⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ddpvp.exec:\ddpvp.exe38⤵
- Executes dropped EXE
PID:2792 -
\??\c:\rfrlrlf.exec:\rfrlrlf.exe39⤵
- Executes dropped EXE
PID:3020 -
\??\c:\fxxxffl.exec:\fxxxffl.exe40⤵
- Executes dropped EXE
PID:2796 -
\??\c:\9bhnbh.exec:\9bhnbh.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\dpjpv.exec:\dpjpv.exe42⤵
- Executes dropped EXE
PID:2804 -
\??\c:\1pvjp.exec:\1pvjp.exe43⤵
- Executes dropped EXE
PID:2672 -
\??\c:\3xfxllf.exec:\3xfxllf.exe44⤵
- Executes dropped EXE
PID:2624 -
\??\c:\tnbhhb.exec:\tnbhhb.exe45⤵
- Executes dropped EXE
PID:2752 -
\??\c:\bnbttt.exec:\bnbttt.exe46⤵
- Executes dropped EXE
PID:2528 -
\??\c:\pdpdv.exec:\pdpdv.exe47⤵
- Executes dropped EXE
PID:2440 -
\??\c:\fxrxxff.exec:\fxrxxff.exe48⤵
- Executes dropped EXE
PID:2956 -
\??\c:\xlllxff.exec:\xlllxff.exe49⤵
- Executes dropped EXE
PID:276 -
\??\c:\hbtbhh.exec:\hbtbhh.exe50⤵
- Executes dropped EXE
PID:1664 -
\??\c:\pddjp.exec:\pddjp.exe51⤵
- Executes dropped EXE
PID:1840 -
\??\c:\xrfxfxf.exec:\xrfxfxf.exe52⤵
- Executes dropped EXE
PID:2292 -
\??\c:\xfffrll.exec:\xfffrll.exe53⤵
- Executes dropped EXE
PID:2284 -
\??\c:\tthntt.exec:\tthntt.exe54⤵
- Executes dropped EXE
PID:2312 -
\??\c:\pdpjd.exec:\pdpjd.exe55⤵
- Executes dropped EXE
PID:2264 -
\??\c:\dpjdp.exec:\dpjdp.exe56⤵
- Executes dropped EXE
PID:1248 -
\??\c:\xfrrxxl.exec:\xfrrxxl.exe57⤵
- Executes dropped EXE
PID:1216 -
\??\c:\1hntbh.exec:\1hntbh.exe58⤵
- Executes dropped EXE
PID:2596 -
\??\c:\1hnttn.exec:\1hnttn.exe59⤵
- Executes dropped EXE
PID:2684 -
\??\c:\vpvvj.exec:\vpvvj.exe60⤵
- Executes dropped EXE
PID:2724 -
\??\c:\lffxxxf.exec:\lffxxxf.exe61⤵
- Executes dropped EXE
PID:2148 -
\??\c:\hbttbh.exec:\hbttbh.exe62⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nhnthn.exec:\nhnthn.exe63⤵
- Executes dropped EXE
PID:2876 -
\??\c:\5jdvd.exec:\5jdvd.exe64⤵
- Executes dropped EXE
PID:2044 -
\??\c:\1xfrxrr.exec:\1xfrxrr.exe65⤵
- Executes dropped EXE
PID:1932 -
\??\c:\7rlrrxl.exec:\7rlrrxl.exe66⤵PID:592
-
\??\c:\tnhnnn.exec:\tnhnnn.exe67⤵PID:2236
-
\??\c:\3jdjp.exec:\3jdjp.exe68⤵PID:2200
-
\??\c:\lxrlllr.exec:\lxrlllr.exe69⤵PID:812
-
\??\c:\xrffllr.exec:\xrffllr.exe70⤵PID:2068
-
\??\c:\thntbt.exec:\thntbt.exe71⤵PID:2308
-
\??\c:\3bttbb.exec:\3bttbb.exe72⤵PID:1832
-
\??\c:\pdvdj.exec:\pdvdj.exe73⤵PID:2336
-
\??\c:\fxffrrf.exec:\fxffrrf.exe74⤵PID:1492
-
\??\c:\3hbbhh.exec:\3hbbhh.exe75⤵PID:2844
-
\??\c:\1vddp.exec:\1vddp.exe76⤵PID:2920
-
\??\c:\lxfffff.exec:\lxfffff.exe77⤵PID:864
-
\??\c:\xrflxfl.exec:\xrflxfl.exe78⤵PID:2952
-
\??\c:\bnbbhn.exec:\bnbbhn.exe79⤵PID:3000
-
\??\c:\vvpvd.exec:\vvpvd.exe80⤵PID:2712
-
\??\c:\pjvpv.exec:\pjvpv.exe81⤵PID:2612
-
\??\c:\xxrlxfr.exec:\xxrlxfr.exe82⤵PID:3020
-
\??\c:\llrxlfl.exec:\llrxlfl.exe83⤵PID:2796
-
\??\c:\7ntbhh.exec:\7ntbhh.exe84⤵PID:2808
-
\??\c:\pdjdd.exec:\pdjdd.exe85⤵PID:2640
-
\??\c:\pjjpj.exec:\pjjpj.exe86⤵PID:2452
-
\??\c:\9xlrffl.exec:\9xlrffl.exe87⤵PID:2584
-
\??\c:\bnnnnh.exec:\bnnnnh.exe88⤵PID:2572
-
\??\c:\7nhntb.exec:\7nhntb.exe89⤵PID:2228
-
\??\c:\5jdvd.exec:\5jdvd.exe90⤵PID:1140
-
\??\c:\9fxxffl.exec:\9fxxffl.exe91⤵PID:2244
-
\??\c:\nbnnnh.exec:\nbnnnh.exe92⤵PID:1852
-
\??\c:\nbhbhb.exec:\nbhbhb.exe93⤵PID:1956
-
\??\c:\3dvvj.exec:\3dvvj.exe94⤵PID:2288
-
\??\c:\djdvv.exec:\djdvv.exe95⤵PID:552
-
\??\c:\lxrrxxr.exec:\lxrrxxr.exe96⤵PID:1736
-
\??\c:\ntbthb.exec:\ntbthb.exe97⤵PID:1256
-
\??\c:\7vjjp.exec:\7vjjp.exe98⤵PID:1036
-
\??\c:\frllrfr.exec:\frllrfr.exe99⤵PID:1872
-
\??\c:\rlrrflx.exec:\rlrrflx.exe100⤵PID:1344
-
\??\c:\1ntntt.exec:\1ntntt.exe101⤵PID:2948
-
\??\c:\dvjjv.exec:\dvjjv.exe102⤵PID:2576
-
\??\c:\xlxrxrx.exec:\xlxrxrx.exe103⤵PID:1392
-
\??\c:\ffrrflr.exec:\ffrrflr.exe104⤵PID:2880
-
\??\c:\htbtbn.exec:\htbtbn.exe105⤵PID:2716
-
\??\c:\djvvd.exec:\djvvd.exe106⤵PID:408
-
\??\c:\frlrffr.exec:\frlrffr.exe107⤵PID:1616
-
\??\c:\xflllll.exec:\xflllll.exe108⤵PID:1608
-
\??\c:\tnbhtt.exec:\tnbhtt.exe109⤵PID:956
-
\??\c:\bbnthb.exec:\bbnthb.exe110⤵PID:3040
-
\??\c:\vvjpv.exec:\vvjpv.exe111⤵PID:608
-
\??\c:\frlxflr.exec:\frlxflr.exe112⤵PID:1980
-
\??\c:\rflrrrr.exec:\rflrrrr.exe113⤵PID:1860
-
\??\c:\ntbbnn.exec:\ntbbnn.exe114⤵PID:2384
-
\??\c:\pjddj.exec:\pjddj.exe115⤵PID:756
-
\??\c:\pdvvd.exec:\pdvvd.exe116⤵PID:2992
-
\??\c:\fxlrfff.exec:\fxlrfff.exe117⤵PID:2280
-
\??\c:\btbbhh.exec:\btbbhh.exe118⤵PID:2388
-
\??\c:\thhtth.exec:\thhtth.exe119⤵PID:1660
-
\??\c:\jdvjd.exec:\jdvjd.exe120⤵PID:1264
-
\??\c:\xxlrffl.exec:\xxlrffl.exe121⤵PID:2124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-