Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 17:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e4b862b97d99e215037a91c2f5521397659e74a0c8f799472a06fcd26c11a45b.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e4b862b97d99e215037a91c2f5521397659e74a0c8f799472a06fcd26c11a45b.exe
-
Size
454KB
-
MD5
69646fb445a679869d2742383a19a98f
-
SHA1
ad82a79a01e7895d856b29a1cd52360e81b37d53
-
SHA256
e4b862b97d99e215037a91c2f5521397659e74a0c8f799472a06fcd26c11a45b
-
SHA512
dd965dc1d901c3889dc3db17e6037a327218b032c0fc2cf7c1b09fbb3e1f6c9e4048a3f87e40790960ad8344656bd51fac7bdf7baaf7ab1b598751c08126dee5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3108-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3816-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2784-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2116-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/852-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-690-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-978-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-1078-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-1262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-1416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-1559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-1581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3372 nbnnnn.exe 4472 pvjjv.exe 2640 bttnnh.exe 1628 pvdjv.exe 3816 7lxrrxr.exe 3668 ttbtnb.exe 4880 ppdvd.exe 3720 9dddv.exe 3508 dppjd.exe 4048 llxrffx.exe 4884 hhnntb.exe 1900 ddpjd.exe 1036 rflxllf.exe 2400 ppdvj.exe 2404 rflfxxr.exe 3672 vdpdd.exe 2196 3frfffx.exe 3696 pjdjv.exe 4944 ttnhbb.exe 1268 jdvdv.exe 1008 lfxxflf.exe 4724 5nnhbt.exe 1916 jddpj.exe 1688 1lrlllf.exe 812 hhthbb.exe 2024 5flfrrl.exe 456 1hhbtt.exe 404 1vdvd.exe 2256 7vdjv.exe 1784 tnhtbb.exe 4896 3vdvv.exe 2264 rfrxxfl.exe 2608 ddvvp.exe 2744 9xrrlrr.exe 4216 9vdvp.exe 2716 frfflll.exe 2712 tnnhtt.exe 3864 xffxrrl.exe 2100 nnhhnb.exe 4548 3rlxllx.exe 2784 thhtbt.exe 740 nhtntt.exe 3980 fxlfflr.exe 1364 xlfffff.exe 4584 hnnhhh.exe 64 vjppj.exe 4624 7rfxrrr.exe 2348 bhnhnn.exe 3816 vvvpv.exe 3668 lrrlxlx.exe 4984 rfflffr.exe 2176 hnnhbb.exe 640 pjjvp.exe 3700 5jdvp.exe 2304 xrxxrrl.exe 1192 thhtnh.exe 2116 jdvdv.exe 2820 fxfrlfx.exe 4036 fxxxxfx.exe 1668 bhnhbt.exe 5068 jjppp.exe 4408 fllxxrf.exe 212 hbbtnn.exe 1708 vvppj.exe -
resource yara_rule behavioral2/memory/3372-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3816-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3816-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2784-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2116-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1444-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-794-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ffrlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3108 wrote to memory of 3372 3108 e4b862b97d99e215037a91c2f5521397659e74a0c8f799472a06fcd26c11a45b.exe 84 PID 3108 wrote to memory of 3372 3108 e4b862b97d99e215037a91c2f5521397659e74a0c8f799472a06fcd26c11a45b.exe 84 PID 3108 wrote to memory of 3372 3108 e4b862b97d99e215037a91c2f5521397659e74a0c8f799472a06fcd26c11a45b.exe 84 PID 3372 wrote to memory of 4472 3372 nbnnnn.exe 85 PID 3372 wrote to memory of 4472 3372 nbnnnn.exe 85 PID 3372 wrote to memory of 4472 3372 nbnnnn.exe 85 PID 4472 wrote to memory of 2640 4472 pvjjv.exe 86 PID 4472 wrote to memory of 2640 4472 pvjjv.exe 86 PID 4472 wrote to memory of 2640 4472 pvjjv.exe 86 PID 2640 wrote to memory of 1628 2640 bttnnh.exe 87 PID 2640 wrote to memory of 1628 2640 bttnnh.exe 87 PID 2640 wrote to memory of 1628 2640 bttnnh.exe 87 PID 1628 wrote to memory of 3816 1628 pvdjv.exe 88 PID 1628 wrote to memory of 3816 1628 pvdjv.exe 88 PID 1628 wrote to memory of 3816 1628 pvdjv.exe 88 PID 3816 wrote to memory of 3668 3816 7lxrrxr.exe 89 PID 3816 wrote to memory of 3668 3816 7lxrrxr.exe 89 PID 3816 wrote to memory of 3668 3816 7lxrrxr.exe 89 PID 3668 wrote to memory of 4880 3668 ttbtnb.exe 90 PID 3668 wrote to memory of 4880 3668 ttbtnb.exe 90 PID 3668 wrote to memory of 4880 3668 ttbtnb.exe 90 PID 4880 wrote to memory of 3720 4880 ppdvd.exe 91 PID 4880 wrote to memory of 3720 4880 ppdvd.exe 91 PID 4880 wrote to memory of 3720 4880 ppdvd.exe 91 PID 3720 wrote to memory of 3508 3720 9dddv.exe 92 PID 3720 wrote to memory of 3508 3720 9dddv.exe 92 PID 3720 wrote to memory of 3508 3720 9dddv.exe 92 PID 3508 wrote to memory of 4048 3508 dppjd.exe 93 PID 3508 wrote to memory of 4048 3508 dppjd.exe 93 PID 3508 wrote to memory of 4048 3508 dppjd.exe 93 PID 4048 wrote to memory of 4884 4048 llxrffx.exe 94 PID 4048 wrote to memory of 4884 4048 llxrffx.exe 94 PID 4048 wrote to memory of 4884 4048 llxrffx.exe 94 PID 4884 wrote to memory of 1900 4884 hhnntb.exe 95 PID 4884 wrote to memory of 1900 4884 hhnntb.exe 95 PID 4884 wrote to memory of 1900 4884 hhnntb.exe 95 PID 1900 wrote to memory of 1036 1900 ddpjd.exe 96 PID 1900 wrote to memory of 1036 1900 ddpjd.exe 96 PID 1900 wrote to memory of 1036 1900 ddpjd.exe 96 PID 1036 wrote to memory of 2400 1036 rflxllf.exe 97 PID 1036 wrote to memory of 2400 1036 rflxllf.exe 97 PID 1036 wrote to memory of 2400 1036 rflxllf.exe 97 PID 2400 wrote to memory of 2404 2400 ppdvj.exe 98 PID 2400 wrote to memory of 2404 2400 ppdvj.exe 98 PID 2400 wrote to memory of 2404 2400 ppdvj.exe 98 PID 2404 wrote to memory of 3672 2404 rflfxxr.exe 99 PID 2404 wrote to memory of 3672 2404 rflfxxr.exe 99 PID 2404 wrote to memory of 3672 2404 rflfxxr.exe 99 PID 3672 wrote to memory of 2196 3672 vdpdd.exe 100 PID 3672 wrote to memory of 2196 3672 vdpdd.exe 100 PID 3672 wrote to memory of 2196 3672 vdpdd.exe 100 PID 2196 wrote to memory of 3696 2196 3frfffx.exe 101 PID 2196 wrote to memory of 3696 2196 3frfffx.exe 101 PID 2196 wrote to memory of 3696 2196 3frfffx.exe 101 PID 3696 wrote to memory of 4944 3696 pjdjv.exe 102 PID 3696 wrote to memory of 4944 3696 pjdjv.exe 102 PID 3696 wrote to memory of 4944 3696 pjdjv.exe 102 PID 4944 wrote to memory of 1268 4944 ttnhbb.exe 103 PID 4944 wrote to memory of 1268 4944 ttnhbb.exe 103 PID 4944 wrote to memory of 1268 4944 ttnhbb.exe 103 PID 1268 wrote to memory of 1008 1268 jdvdv.exe 104 PID 1268 wrote to memory of 1008 1268 jdvdv.exe 104 PID 1268 wrote to memory of 1008 1268 jdvdv.exe 104 PID 1008 wrote to memory of 4724 1008 lfxxflf.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4b862b97d99e215037a91c2f5521397659e74a0c8f799472a06fcd26c11a45b.exe"C:\Users\Admin\AppData\Local\Temp\e4b862b97d99e215037a91c2f5521397659e74a0c8f799472a06fcd26c11a45b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\nbnnnn.exec:\nbnnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\pvjjv.exec:\pvjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\bttnnh.exec:\bttnnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\pvdjv.exec:\pvdjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\7lxrrxr.exec:\7lxrrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\ttbtnb.exec:\ttbtnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\ppdvd.exec:\ppdvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\9dddv.exec:\9dddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\dppjd.exec:\dppjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\llxrffx.exec:\llxrffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\hhnntb.exec:\hhnntb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\ddpjd.exec:\ddpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\rflxllf.exec:\rflxllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\ppdvj.exec:\ppdvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\rflfxxr.exec:\rflfxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\vdpdd.exec:\vdpdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\3frfffx.exec:\3frfffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\pjdjv.exec:\pjdjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\ttnhbb.exec:\ttnhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\jdvdv.exec:\jdvdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\lfxxflf.exec:\lfxxflf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\5nnhbt.exec:\5nnhbt.exe23⤵
- Executes dropped EXE
PID:4724 -
\??\c:\jddpj.exec:\jddpj.exe24⤵
- Executes dropped EXE
PID:1916 -
\??\c:\1lrlllf.exec:\1lrlllf.exe25⤵
- Executes dropped EXE
PID:1688 -
\??\c:\hhthbb.exec:\hhthbb.exe26⤵
- Executes dropped EXE
PID:812 -
\??\c:\5flfrrl.exec:\5flfrrl.exe27⤵
- Executes dropped EXE
PID:2024 -
\??\c:\1hhbtt.exec:\1hhbtt.exe28⤵
- Executes dropped EXE
PID:456 -
\??\c:\1vdvd.exec:\1vdvd.exe29⤵
- Executes dropped EXE
PID:404 -
\??\c:\7vdjv.exec:\7vdjv.exe30⤵
- Executes dropped EXE
PID:2256 -
\??\c:\tnhtbb.exec:\tnhtbb.exe31⤵
- Executes dropped EXE
PID:1784 -
\??\c:\3vdvv.exec:\3vdvv.exe32⤵
- Executes dropped EXE
PID:4896 -
\??\c:\rfrxxfl.exec:\rfrxxfl.exe33⤵
- Executes dropped EXE
PID:2264 -
\??\c:\ddvvp.exec:\ddvvp.exe34⤵
- Executes dropped EXE
PID:2608 -
\??\c:\9xrrlrr.exec:\9xrrlrr.exe35⤵
- Executes dropped EXE
PID:2744 -
\??\c:\9vdvp.exec:\9vdvp.exe36⤵
- Executes dropped EXE
PID:4216 -
\??\c:\frfflll.exec:\frfflll.exe37⤵
- Executes dropped EXE
PID:2716 -
\??\c:\tnnhtt.exec:\tnnhtt.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\xffxrrl.exec:\xffxrrl.exe39⤵
- Executes dropped EXE
PID:3864 -
\??\c:\nnhhnb.exec:\nnhhnb.exe40⤵
- Executes dropped EXE
PID:2100 -
\??\c:\3rlxllx.exec:\3rlxllx.exe41⤵
- Executes dropped EXE
PID:4548 -
\??\c:\thhtbt.exec:\thhtbt.exe42⤵
- Executes dropped EXE
PID:2784 -
\??\c:\nhtntt.exec:\nhtntt.exe43⤵
- Executes dropped EXE
PID:740 -
\??\c:\fxlfflr.exec:\fxlfflr.exe44⤵
- Executes dropped EXE
PID:3980 -
\??\c:\xlfffff.exec:\xlfffff.exe45⤵
- Executes dropped EXE
PID:1364 -
\??\c:\hnnhhh.exec:\hnnhhh.exe46⤵
- Executes dropped EXE
PID:4584 -
\??\c:\vjppj.exec:\vjppj.exe47⤵
- Executes dropped EXE
PID:64 -
\??\c:\7rfxrrr.exec:\7rfxrrr.exe48⤵
- Executes dropped EXE
PID:4624 -
\??\c:\bhnhnn.exec:\bhnhnn.exe49⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vvvpv.exec:\vvvpv.exe50⤵
- Executes dropped EXE
PID:3816 -
\??\c:\lrrlxlx.exec:\lrrlxlx.exe51⤵
- Executes dropped EXE
PID:3668 -
\??\c:\rfflffr.exec:\rfflffr.exe52⤵
- Executes dropped EXE
PID:4984 -
\??\c:\hnnhbb.exec:\hnnhbb.exe53⤵
- Executes dropped EXE
PID:2176 -
\??\c:\pjjvp.exec:\pjjvp.exe54⤵
- Executes dropped EXE
PID:640 -
\??\c:\5jdvp.exec:\5jdvp.exe55⤵
- Executes dropped EXE
PID:3700 -
\??\c:\xrxxrrl.exec:\xrxxrrl.exe56⤵
- Executes dropped EXE
PID:2304 -
\??\c:\thhtnh.exec:\thhtnh.exe57⤵
- Executes dropped EXE
PID:1192 -
\??\c:\jdvdv.exec:\jdvdv.exe58⤵
- Executes dropped EXE
PID:2116 -
\??\c:\fxfrlfx.exec:\fxfrlfx.exe59⤵
- Executes dropped EXE
PID:2820 -
\??\c:\fxxxxfx.exec:\fxxxxfx.exe60⤵
- Executes dropped EXE
PID:4036 -
\??\c:\bhnhbt.exec:\bhnhbt.exe61⤵
- Executes dropped EXE
PID:1668 -
\??\c:\jjppp.exec:\jjppp.exe62⤵
- Executes dropped EXE
PID:5068 -
\??\c:\fllxxrf.exec:\fllxxrf.exe63⤵
- Executes dropped EXE
PID:4408 -
\??\c:\hbbtnn.exec:\hbbtnn.exe64⤵
- Executes dropped EXE
PID:212 -
\??\c:\vvppj.exec:\vvppj.exe65⤵
- Executes dropped EXE
PID:1708 -
\??\c:\3vjdv.exec:\3vjdv.exe66⤵PID:628
-
\??\c:\7rrlffx.exec:\7rrlffx.exe67⤵PID:2160
-
\??\c:\bbhtnh.exec:\bbhtnh.exe68⤵PID:1196
-
\??\c:\jpvjd.exec:\jpvjd.exe69⤵PID:3584
-
\??\c:\jpvpd.exec:\jpvpd.exe70⤵PID:2124
-
\??\c:\fflfrxr.exec:\fflfrxr.exe71⤵PID:1180
-
\??\c:\tnnnhn.exec:\tnnnhn.exe72⤵PID:1424
-
\??\c:\ddvjv.exec:\ddvjv.exe73⤵PID:2556
-
\??\c:\fxxrlff.exec:\fxxrlff.exe74⤵PID:1888
-
\??\c:\1nhhbb.exec:\1nhhbb.exe75⤵PID:3032
-
\??\c:\vdvvp.exec:\vdvvp.exe76⤵PID:852
-
\??\c:\1rrlflf.exec:\1rrlflf.exe77⤵PID:2448
-
\??\c:\hnhtnh.exec:\hnhtnh.exe78⤵PID:1760
-
\??\c:\jpjdv.exec:\jpjdv.exe79⤵PID:2024
-
\??\c:\lxxrllf.exec:\lxxrllf.exe80⤵PID:2460
-
\??\c:\9xlflfl.exec:\9xlflfl.exe81⤵PID:880
-
\??\c:\hbnhbn.exec:\hbnhbn.exe82⤵PID:2964
-
\??\c:\1dvpj.exec:\1dvpj.exe83⤵PID:4636
-
\??\c:\5xxrllx.exec:\5xxrllx.exe84⤵PID:3604
-
\??\c:\7xxrrll.exec:\7xxrrll.exe85⤵PID:3556
-
\??\c:\bbbnhh.exec:\bbbnhh.exe86⤵PID:4796
-
\??\c:\ppvpd.exec:\ppvpd.exe87⤵PID:2676
-
\??\c:\lrxrllf.exec:\lrxrllf.exe88⤵PID:3204
-
\??\c:\htnhbt.exec:\htnhbt.exe89⤵PID:1160
-
\??\c:\thhbhb.exec:\thhbhb.exe90⤵PID:3008
-
\??\c:\1pjdv.exec:\1pjdv.exe91⤵PID:2380
-
\??\c:\flfrlfr.exec:\flfrlfr.exe92⤵PID:3384
-
\??\c:\3nhhbt.exec:\3nhhbt.exe93⤵PID:2700
-
\??\c:\pjdpj.exec:\pjdpj.exe94⤵PID:5064
-
\??\c:\1rlfxrl.exec:\1rlfxrl.exe95⤵PID:1980
-
\??\c:\hbtnhb.exec:\hbtnhb.exe96⤵PID:4516
-
\??\c:\httnhb.exec:\httnhb.exe97⤵PID:4964
-
\??\c:\jvddv.exec:\jvddv.exe98⤵PID:1728
-
\??\c:\xxlffff.exec:\xxlffff.exe99⤵PID:3780
-
\??\c:\tbhthh.exec:\tbhthh.exe100⤵PID:1112
-
\??\c:\vdjdv.exec:\vdjdv.exe101⤵PID:4644
-
\??\c:\djpdv.exec:\djpdv.exe102⤵PID:3760
-
\??\c:\3xxrllx.exec:\3xxrllx.exe103⤵PID:2148
-
\??\c:\bnnhbt.exec:\bnnhbt.exe104⤵PID:1444
-
\??\c:\9vvpj.exec:\9vvpj.exe105⤵PID:2424
-
\??\c:\rlrxrlr.exec:\rlrxrlr.exe106⤵PID:4788
-
\??\c:\5nttnt.exec:\5nttnt.exe107⤵PID:3252
-
\??\c:\vjpjv.exec:\vjpjv.exe108⤵PID:3952
-
\??\c:\dpjvj.exec:\dpjvj.exe109⤵PID:3720
-
\??\c:\rffrflx.exec:\rffrflx.exe110⤵PID:4460
-
\??\c:\9bhbtt.exec:\9bhbtt.exe111⤵PID:4048
-
\??\c:\pjjvd.exec:\pjjvd.exe112⤵PID:3964
-
\??\c:\7vpjp.exec:\7vpjp.exe113⤵PID:4884
-
\??\c:\frxrrrr.exec:\frxrrrr.exe114⤵PID:3648
-
\??\c:\9hbttt.exec:\9hbttt.exe115⤵PID:5104
-
\??\c:\3jjjd.exec:\3jjjd.exe116⤵PID:2004
-
\??\c:\flrxxfl.exec:\flrxxfl.exe117⤵PID:232
-
\??\c:\flxlfrr.exec:\flxlfrr.exe118⤵PID:532
-
\??\c:\hhtntn.exec:\hhtntn.exe119⤵PID:888
-
\??\c:\1djvp.exec:\1djvp.exe120⤵PID:1480
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe121⤵PID:4688
-
\??\c:\thbnbb.exec:\thbnbb.exe122⤵PID:3808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-