Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 18:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a7a4b86d5b866a895674a9f701cc1eeb4602ca8484c60926a3e13977b0f04262N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a7a4b86d5b866a895674a9f701cc1eeb4602ca8484c60926a3e13977b0f04262N.exe
-
Size
453KB
-
MD5
6770424f232e2326bc82e76ccb823670
-
SHA1
917cf1ec1263fec1eb87e6f3b8c924465f274104
-
SHA256
a7a4b86d5b866a895674a9f701cc1eeb4602ca8484c60926a3e13977b0f04262
-
SHA512
ce16b1bdfb05598853c4aaae2df3795558a1fb5b7c4070447ccadc04ea87ce1bdb2b2a98d49afb38213fb0e0e93f37832b609dab80259067b039c6d61b80b5c1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeH:q7Tc2NYHUrAwfMp3CDH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2248-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1408-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/956-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4208-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/888-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-870-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-904-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-1014-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-1273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-1316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-1618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2248 xrfxxrr.exe 1688 nnnhhb.exe 1964 dddvp.exe 2232 pvjjd.exe 2716 xlfrfxr.exe 4088 nnnnhh.exe 4936 jvdvv.exe 2612 rflllll.exe 4832 nttnhh.exe 2372 hnbtbb.exe 372 1ppjj.exe 1620 hbnbtb.exe 3156 jvdvp.exe 1552 3nnhbb.exe 1988 7ppjj.exe 1992 lflrrlf.exe 4464 bntttb.exe 812 jdvjj.exe 3964 vpppj.exe 4192 7xfxlrx.exe 3528 1bbhbb.exe 1256 9pjjp.exe 2276 djvdv.exe 3472 3lxrffr.exe 4716 hbthhb.exe 3516 3ddpp.exe 4588 7xxrlrf.exe 464 5bbttt.exe 4468 bhnhbh.exe 2092 3jppj.exe 3940 fxfxrfl.exe 4556 thtnhh.exe 2004 vpppj.exe 2880 5vjvv.exe 2428 xxfxrll.exe 5012 hbtnhb.exe 924 dvjdv.exe 4512 9jjdd.exe 3000 lffxrrr.exe 1060 hbtnhh.exe 1216 nbbthh.exe 1632 3pjjd.exe 3656 1xxlffx.exe 1464 btbttn.exe 2992 1ttnhn.exe 3216 jpdvp.exe 1548 lxxxxxx.exe 4332 7nnnnt.exe 956 tntnnn.exe 4872 jddvp.exe 2012 ffrrlll.exe 2656 nhhtnh.exe 4200 7ttnhh.exe 3488 djvpj.exe 4912 ffffxfl.exe 3272 rlrlfxr.exe 4436 5tbthh.exe 3112 ttnhbt.exe 1564 5nhhbb.exe 2740 9nhtbb.exe 3820 dvvpd.exe 3584 xxxrrlx.exe 748 xxffxfx.exe 5016 nbbbtt.exe -
resource yara_rule behavioral2/memory/2248-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1408-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/956-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3272-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4208-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/888-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4252-870-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-904-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1408 wrote to memory of 2248 1408 a7a4b86d5b866a895674a9f701cc1eeb4602ca8484c60926a3e13977b0f04262N.exe 82 PID 1408 wrote to memory of 2248 1408 a7a4b86d5b866a895674a9f701cc1eeb4602ca8484c60926a3e13977b0f04262N.exe 82 PID 1408 wrote to memory of 2248 1408 a7a4b86d5b866a895674a9f701cc1eeb4602ca8484c60926a3e13977b0f04262N.exe 82 PID 2248 wrote to memory of 1688 2248 xrfxxrr.exe 83 PID 2248 wrote to memory of 1688 2248 xrfxxrr.exe 83 PID 2248 wrote to memory of 1688 2248 xrfxxrr.exe 83 PID 1688 wrote to memory of 1964 1688 nnnhhb.exe 84 PID 1688 wrote to memory of 1964 1688 nnnhhb.exe 84 PID 1688 wrote to memory of 1964 1688 nnnhhb.exe 84 PID 1964 wrote to memory of 2232 1964 dddvp.exe 85 PID 1964 wrote to memory of 2232 1964 dddvp.exe 85 PID 1964 wrote to memory of 2232 1964 dddvp.exe 85 PID 2232 wrote to memory of 2716 2232 pvjjd.exe 86 PID 2232 wrote to memory of 2716 2232 pvjjd.exe 86 PID 2232 wrote to memory of 2716 2232 pvjjd.exe 86 PID 2716 wrote to memory of 4088 2716 xlfrfxr.exe 87 PID 2716 wrote to memory of 4088 2716 xlfrfxr.exe 87 PID 2716 wrote to memory of 4088 2716 xlfrfxr.exe 87 PID 4088 wrote to memory of 4936 4088 nnnnhh.exe 88 PID 4088 wrote to memory of 4936 4088 nnnnhh.exe 88 PID 4088 wrote to memory of 4936 4088 nnnnhh.exe 88 PID 4936 wrote to memory of 2612 4936 jvdvv.exe 89 PID 4936 wrote to memory of 2612 4936 jvdvv.exe 89 PID 4936 wrote to memory of 2612 4936 jvdvv.exe 89 PID 2612 wrote to memory of 4832 2612 rflllll.exe 90 PID 2612 wrote to memory of 4832 2612 rflllll.exe 90 PID 2612 wrote to memory of 4832 2612 rflllll.exe 90 PID 4832 wrote to memory of 2372 4832 nttnhh.exe 91 PID 4832 wrote to memory of 2372 4832 nttnhh.exe 91 PID 4832 wrote to memory of 2372 4832 nttnhh.exe 91 PID 2372 wrote to memory of 372 2372 hnbtbb.exe 92 PID 2372 wrote to memory of 372 2372 hnbtbb.exe 92 PID 2372 wrote to memory of 372 2372 hnbtbb.exe 92 PID 372 wrote to memory of 1620 372 1ppjj.exe 93 PID 372 wrote to memory of 1620 372 1ppjj.exe 93 PID 372 wrote to memory of 1620 372 1ppjj.exe 93 PID 1620 wrote to memory of 3156 1620 hbnbtb.exe 94 PID 1620 wrote to memory of 3156 1620 hbnbtb.exe 94 PID 1620 wrote to memory of 3156 1620 hbnbtb.exe 94 PID 3156 wrote to memory of 1552 3156 jvdvp.exe 95 PID 3156 wrote to memory of 1552 3156 jvdvp.exe 95 PID 3156 wrote to memory of 1552 3156 jvdvp.exe 95 PID 1552 wrote to memory of 1988 1552 3nnhbb.exe 96 PID 1552 wrote to memory of 1988 1552 3nnhbb.exe 96 PID 1552 wrote to memory of 1988 1552 3nnhbb.exe 96 PID 1988 wrote to memory of 1992 1988 7ppjj.exe 97 PID 1988 wrote to memory of 1992 1988 7ppjj.exe 97 PID 1988 wrote to memory of 1992 1988 7ppjj.exe 97 PID 1992 wrote to memory of 4464 1992 lflrrlf.exe 98 PID 1992 wrote to memory of 4464 1992 lflrrlf.exe 98 PID 1992 wrote to memory of 4464 1992 lflrrlf.exe 98 PID 4464 wrote to memory of 812 4464 bntttb.exe 99 PID 4464 wrote to memory of 812 4464 bntttb.exe 99 PID 4464 wrote to memory of 812 4464 bntttb.exe 99 PID 812 wrote to memory of 3964 812 jdvjj.exe 100 PID 812 wrote to memory of 3964 812 jdvjj.exe 100 PID 812 wrote to memory of 3964 812 jdvjj.exe 100 PID 3964 wrote to memory of 4192 3964 vpppj.exe 101 PID 3964 wrote to memory of 4192 3964 vpppj.exe 101 PID 3964 wrote to memory of 4192 3964 vpppj.exe 101 PID 4192 wrote to memory of 3528 4192 7xfxlrx.exe 102 PID 4192 wrote to memory of 3528 4192 7xfxlrx.exe 102 PID 4192 wrote to memory of 3528 4192 7xfxlrx.exe 102 PID 3528 wrote to memory of 1256 3528 1bbhbb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7a4b86d5b866a895674a9f701cc1eeb4602ca8484c60926a3e13977b0f04262N.exe"C:\Users\Admin\AppData\Local\Temp\a7a4b86d5b866a895674a9f701cc1eeb4602ca8484c60926a3e13977b0f04262N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\xrfxxrr.exec:\xrfxxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\nnnhhb.exec:\nnnhhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\dddvp.exec:\dddvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\pvjjd.exec:\pvjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\xlfrfxr.exec:\xlfrfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\nnnnhh.exec:\nnnnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\jvdvv.exec:\jvdvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\rflllll.exec:\rflllll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\nttnhh.exec:\nttnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\hnbtbb.exec:\hnbtbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\1ppjj.exec:\1ppjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\hbnbtb.exec:\hbnbtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\jvdvp.exec:\jvdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\3nnhbb.exec:\3nnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\7ppjj.exec:\7ppjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\lflrrlf.exec:\lflrrlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\bntttb.exec:\bntttb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\jdvjj.exec:\jdvjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\vpppj.exec:\vpppj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\7xfxlrx.exec:\7xfxlrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\1bbhbb.exec:\1bbhbb.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\9pjjp.exec:\9pjjp.exe23⤵
- Executes dropped EXE
PID:1256 -
\??\c:\djvdv.exec:\djvdv.exe24⤵
- Executes dropped EXE
PID:2276 -
\??\c:\3lxrffr.exec:\3lxrffr.exe25⤵
- Executes dropped EXE
PID:3472 -
\??\c:\hbthhb.exec:\hbthhb.exe26⤵
- Executes dropped EXE
PID:4716 -
\??\c:\3ddpp.exec:\3ddpp.exe27⤵
- Executes dropped EXE
PID:3516 -
\??\c:\7xxrlrf.exec:\7xxrlrf.exe28⤵
- Executes dropped EXE
PID:4588 -
\??\c:\5bbttt.exec:\5bbttt.exe29⤵
- Executes dropped EXE
PID:464 -
\??\c:\bhnhbh.exec:\bhnhbh.exe30⤵
- Executes dropped EXE
PID:4468 -
\??\c:\3jppj.exec:\3jppj.exe31⤵
- Executes dropped EXE
PID:2092 -
\??\c:\fxfxrfl.exec:\fxfxrfl.exe32⤵
- Executes dropped EXE
PID:3940 -
\??\c:\thtnhh.exec:\thtnhh.exe33⤵
- Executes dropped EXE
PID:4556 -
\??\c:\vpppj.exec:\vpppj.exe34⤵
- Executes dropped EXE
PID:2004 -
\??\c:\5vjvv.exec:\5vjvv.exe35⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xxfxrll.exec:\xxfxrll.exe36⤵
- Executes dropped EXE
PID:2428 -
\??\c:\hbtnhb.exec:\hbtnhb.exe37⤵
- Executes dropped EXE
PID:5012 -
\??\c:\dvjdv.exec:\dvjdv.exe38⤵
- Executes dropped EXE
PID:924 -
\??\c:\9jjdd.exec:\9jjdd.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4512 -
\??\c:\lffxrrr.exec:\lffxrrr.exe40⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hbtnhh.exec:\hbtnhh.exe41⤵
- Executes dropped EXE
PID:1060 -
\??\c:\nbbthh.exec:\nbbthh.exe42⤵
- Executes dropped EXE
PID:1216 -
\??\c:\3pjjd.exec:\3pjjd.exe43⤵
- Executes dropped EXE
PID:1632 -
\??\c:\1xxlffx.exec:\1xxlffx.exe44⤵
- Executes dropped EXE
PID:3656 -
\??\c:\btbttn.exec:\btbttn.exe45⤵
- Executes dropped EXE
PID:1464 -
\??\c:\1ttnhn.exec:\1ttnhn.exe46⤵
- Executes dropped EXE
PID:2992 -
\??\c:\jpdvp.exec:\jpdvp.exe47⤵
- Executes dropped EXE
PID:3216 -
\??\c:\lxxxxxx.exec:\lxxxxxx.exe48⤵
- Executes dropped EXE
PID:1548 -
\??\c:\7nnnnt.exec:\7nnnnt.exe49⤵
- Executes dropped EXE
PID:4332 -
\??\c:\tntnnn.exec:\tntnnn.exe50⤵
- Executes dropped EXE
PID:956 -
\??\c:\jddvp.exec:\jddvp.exe51⤵
- Executes dropped EXE
PID:4872 -
\??\c:\ffrrlll.exec:\ffrrlll.exe52⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nhhtnh.exec:\nhhtnh.exe53⤵
- Executes dropped EXE
PID:2656 -
\??\c:\7ttnhh.exec:\7ttnhh.exe54⤵
- Executes dropped EXE
PID:4200 -
\??\c:\djvpj.exec:\djvpj.exe55⤵
- Executes dropped EXE
PID:3488 -
\??\c:\ffffxfl.exec:\ffffxfl.exe56⤵
- Executes dropped EXE
PID:4912 -
\??\c:\rlrlfxr.exec:\rlrlfxr.exe57⤵
- Executes dropped EXE
PID:3272 -
\??\c:\5tbthh.exec:\5tbthh.exe58⤵
- Executes dropped EXE
PID:4436 -
\??\c:\ttnhbt.exec:\ttnhbt.exe59⤵
- Executes dropped EXE
PID:3112 -
\??\c:\5nhhbb.exec:\5nhhbb.exe60⤵
- Executes dropped EXE
PID:1564 -
\??\c:\9nhtbb.exec:\9nhtbb.exe61⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dvvpd.exec:\dvvpd.exe62⤵
- Executes dropped EXE
PID:3820 -
\??\c:\xxxrrlx.exec:\xxxrrlx.exe63⤵
- Executes dropped EXE
PID:3584 -
\??\c:\xxffxfx.exec:\xxffxfx.exe64⤵
- Executes dropped EXE
PID:748 -
\??\c:\nbbbtt.exec:\nbbbtt.exe65⤵
- Executes dropped EXE
PID:5016 -
\??\c:\1ppjj.exec:\1ppjj.exe66⤵PID:4052
-
\??\c:\xlrfxxf.exec:\xlrfxxf.exe67⤵PID:4964
-
\??\c:\djppj.exec:\djppj.exe68⤵PID:972
-
\??\c:\fxrlffr.exec:\fxrlffr.exe69⤵PID:2240
-
\??\c:\hhhbhb.exec:\hhhbhb.exe70⤵PID:3436
-
\??\c:\xrxrfrr.exec:\xrxrfrr.exe71⤵PID:4936
-
\??\c:\nbntbb.exec:\nbntbb.exe72⤵PID:768
-
\??\c:\3rlffff.exec:\3rlffff.exe73⤵PID:3920
-
\??\c:\lflxlfx.exec:\lflxlfx.exe74⤵PID:4880
-
\??\c:\flllxll.exec:\flllxll.exe75⤵PID:1868
-
\??\c:\vvddd.exec:\vvddd.exe76⤵PID:4320
-
\??\c:\xfxlfxl.exec:\xfxlfxl.exe77⤵PID:3292
-
\??\c:\bbntbt.exec:\bbntbt.exe78⤵PID:1944
-
\??\c:\rrrrlrr.exec:\rrrrlrr.exe79⤵PID:2548
-
\??\c:\xrxxxxr.exec:\xrxxxxr.exe80⤵PID:3692
-
\??\c:\nnbnhn.exec:\nnbnhn.exe81⤵PID:5048
-
\??\c:\btbtnn.exec:\btbtnn.exe82⤵PID:4412
-
\??\c:\3pvpj.exec:\3pvpj.exe83⤵PID:316
-
\??\c:\lxlrfff.exec:\lxlrfff.exe84⤵PID:2840
-
\??\c:\5nnnnn.exec:\5nnnnn.exe85⤵PID:4424
-
\??\c:\bbbbbt.exec:\bbbbbt.exe86⤵PID:1052
-
\??\c:\djvjd.exec:\djvjd.exe87⤵PID:1496
-
\??\c:\xrxxffx.exec:\xrxxffx.exe88⤵PID:4660
-
\??\c:\bnbbnh.exec:\bnbbnh.exe89⤵PID:2276
-
\??\c:\vddvp.exec:\vddvp.exe90⤵PID:3472
-
\??\c:\5jjjj.exec:\5jjjj.exe91⤵PID:2632
-
\??\c:\rxlffxr.exec:\rxlffxr.exe92⤵PID:5104
-
\??\c:\ttbtnn.exec:\ttbtnn.exe93⤵PID:872
-
\??\c:\dvdvp.exec:\dvdvp.exe94⤵PID:464
-
\??\c:\rflfxrr.exec:\rflfxrr.exe95⤵PID:4468
-
\??\c:\1nttnt.exec:\1nttnt.exe96⤵PID:2092
-
\??\c:\jvjvj.exec:\jvjvj.exe97⤵PID:1836
-
\??\c:\ffllllr.exec:\ffllllr.exe98⤵PID:2812
-
\??\c:\thnhnn.exec:\thnhnn.exe99⤵PID:2348
-
\??\c:\vdvpp.exec:\vdvpp.exe100⤵PID:5080
-
\??\c:\lxxffxr.exec:\lxxffxr.exe101⤵PID:4900
-
\??\c:\1bhbbb.exec:\1bhbbb.exe102⤵PID:2712
-
\??\c:\vvvpj.exec:\vvvpj.exe103⤵PID:3288
-
\??\c:\frxxxxx.exec:\frxxxxx.exe104⤵PID:3428
-
\??\c:\3btbtn.exec:\3btbtn.exe105⤵PID:3912
-
\??\c:\jdddd.exec:\jdddd.exe106⤵PID:848
-
\??\c:\pdjdj.exec:\pdjdj.exe107⤵PID:1528
-
\??\c:\rxxrrrr.exec:\rxxrrrr.exe108⤵PID:3624
-
\??\c:\htbbtt.exec:\htbbtt.exe109⤵PID:3656
-
\??\c:\pjppp.exec:\pjppp.exe110⤵PID:4916
-
\??\c:\pppjp.exec:\pppjp.exe111⤵PID:2992
-
\??\c:\flrrxll.exec:\flrrxll.exe112⤵PID:3448
-
\??\c:\3tnhbb.exec:\3tnhbb.exe113⤵PID:1176
-
\??\c:\dvppj.exec:\dvppj.exe114⤵PID:1860
-
\??\c:\vvppp.exec:\vvppp.exe115⤵PID:4332
-
\??\c:\frlfxxx.exec:\frlfxxx.exe116⤵PID:4748
-
\??\c:\btbtnh.exec:\btbtnh.exe117⤵PID:4208
-
\??\c:\vvjjd.exec:\vvjjd.exe118⤵PID:2156
-
\??\c:\rlxfxlx.exec:\rlxfxlx.exe119⤵PID:3052
-
\??\c:\ffffxxx.exec:\ffffxxx.exe120⤵PID:2652
-
\??\c:\bnttnt.exec:\bnttnt.exe121⤵PID:4744
-
\??\c:\vvjvd.exec:\vvjvd.exe122⤵PID:3488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-