Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 18:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
92c646d11accd76eb68083395d87df6e4282b96d399fd8baf3aab511024a722c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
92c646d11accd76eb68083395d87df6e4282b96d399fd8baf3aab511024a722c.exe
-
Size
454KB
-
MD5
e7db2d39f386cf4a37d76eecb8776111
-
SHA1
31fb88d1592a801c3bdbd096f32d2ed87e6df706
-
SHA256
92c646d11accd76eb68083395d87df6e4282b96d399fd8baf3aab511024a722c
-
SHA512
c7bc6890c992f7dfd75c34517c076b0fbaa717c6a54b93ef35acb58a38c2244a40f53026b30fe363438560859a6d69896483f7f45055e33d5d454b83f89e75a1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 60 IoCs
resource yara_rule behavioral2/memory/3388-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/184-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/752-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4248-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/752-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/668-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2988-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-674-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-774-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-905-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-930-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-967-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1140-1062-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4848 nntnhh.exe 3476 djjdd.exe 4416 rrrlllx.exe 4348 flrfxff.exe 2024 bbbbtt.exe 4012 5jvvd.exe 1592 tntnhh.exe 1056 3jpjj.exe 2552 xflffff.exe 184 9vjjp.exe 3480 thhhbb.exe 5028 nnnhbb.exe 2756 pjjjd.exe 764 rrllrrr.exe 3540 nntttt.exe 2800 bhhbtt.exe 3808 vppjd.exe 4872 btbttt.exe 1636 9pppj.exe 4976 jjpjj.exe 5032 llrrlrl.exe 4676 vdddj.exe 2936 djpjv.exe 4160 5lxxflf.exe 3176 3hbttt.exe 2916 jjjdv.exe 4612 nnnhhh.exe 2248 pppjj.exe 2488 ddvvv.exe 4904 bnbbtb.exe 3184 jdjjd.exe 752 3rlxrfx.exe 3020 1djjj.exe 1120 llfffff.exe 5096 jdjjp.exe 2828 9xrrflx.exe 1332 tbbbbb.exe 4956 dvdvv.exe 4432 vppjj.exe 3128 hbbtnh.exe 392 vpjpd.exe 2996 jvjvp.exe 3556 ffrlfxr.exe 3692 hhnhnh.exe 1968 ddvjd.exe 5072 9lrlxxr.exe 3080 hbbbtn.exe 2096 ddvjd.exe 3292 xxxrlfr.exe 1044 hnthbt.exe 2740 pdvvp.exe 556 xrrlxxl.exe 4800 nbnthh.exe 2556 jdvpp.exe 4648 rflffll.exe 3960 bnnbnn.exe 2320 pjdjd.exe 4248 flxxllx.exe 2908 bbbttn.exe 5012 vpvpd.exe 4784 9xxrllf.exe 4780 lrrfxrf.exe 3200 hbtthb.exe 2368 vvddd.exe -
resource yara_rule behavioral2/memory/3476-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/184-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/752-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/752-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/668-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2988-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-886-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-905-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-930-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3388 wrote to memory of 4848 3388 92c646d11accd76eb68083395d87df6e4282b96d399fd8baf3aab511024a722c.exe 83 PID 3388 wrote to memory of 4848 3388 92c646d11accd76eb68083395d87df6e4282b96d399fd8baf3aab511024a722c.exe 83 PID 3388 wrote to memory of 4848 3388 92c646d11accd76eb68083395d87df6e4282b96d399fd8baf3aab511024a722c.exe 83 PID 4848 wrote to memory of 3476 4848 nntnhh.exe 84 PID 4848 wrote to memory of 3476 4848 nntnhh.exe 84 PID 4848 wrote to memory of 3476 4848 nntnhh.exe 84 PID 3476 wrote to memory of 4416 3476 djjdd.exe 85 PID 3476 wrote to memory of 4416 3476 djjdd.exe 85 PID 3476 wrote to memory of 4416 3476 djjdd.exe 85 PID 4416 wrote to memory of 4348 4416 rrrlllx.exe 86 PID 4416 wrote to memory of 4348 4416 rrrlllx.exe 86 PID 4416 wrote to memory of 4348 4416 rrrlllx.exe 86 PID 4348 wrote to memory of 2024 4348 flrfxff.exe 87 PID 4348 wrote to memory of 2024 4348 flrfxff.exe 87 PID 4348 wrote to memory of 2024 4348 flrfxff.exe 87 PID 2024 wrote to memory of 4012 2024 bbbbtt.exe 88 PID 2024 wrote to memory of 4012 2024 bbbbtt.exe 88 PID 2024 wrote to memory of 4012 2024 bbbbtt.exe 88 PID 4012 wrote to memory of 1592 4012 5jvvd.exe 89 PID 4012 wrote to memory of 1592 4012 5jvvd.exe 89 PID 4012 wrote to memory of 1592 4012 5jvvd.exe 89 PID 1592 wrote to memory of 1056 1592 tntnhh.exe 90 PID 1592 wrote to memory of 1056 1592 tntnhh.exe 90 PID 1592 wrote to memory of 1056 1592 tntnhh.exe 90 PID 1056 wrote to memory of 2552 1056 3jpjj.exe 91 PID 1056 wrote to memory of 2552 1056 3jpjj.exe 91 PID 1056 wrote to memory of 2552 1056 3jpjj.exe 91 PID 2552 wrote to memory of 184 2552 xflffff.exe 92 PID 2552 wrote to memory of 184 2552 xflffff.exe 92 PID 2552 wrote to memory of 184 2552 xflffff.exe 92 PID 184 wrote to memory of 3480 184 9vjjp.exe 93 PID 184 wrote to memory of 3480 184 9vjjp.exe 93 PID 184 wrote to memory of 3480 184 9vjjp.exe 93 PID 3480 wrote to memory of 5028 3480 thhhbb.exe 94 PID 3480 wrote to memory of 5028 3480 thhhbb.exe 94 PID 3480 wrote to memory of 5028 3480 thhhbb.exe 94 PID 5028 wrote to memory of 2756 5028 nnnhbb.exe 95 PID 5028 wrote to memory of 2756 5028 nnnhbb.exe 95 PID 5028 wrote to memory of 2756 5028 nnnhbb.exe 95 PID 2756 wrote to memory of 764 2756 pjjjd.exe 96 PID 2756 wrote to memory of 764 2756 pjjjd.exe 96 PID 2756 wrote to memory of 764 2756 pjjjd.exe 96 PID 764 wrote to memory of 3540 764 rrllrrr.exe 97 PID 764 wrote to memory of 3540 764 rrllrrr.exe 97 PID 764 wrote to memory of 3540 764 rrllrrr.exe 97 PID 3540 wrote to memory of 2800 3540 nntttt.exe 98 PID 3540 wrote to memory of 2800 3540 nntttt.exe 98 PID 3540 wrote to memory of 2800 3540 nntttt.exe 98 PID 2800 wrote to memory of 3808 2800 bhhbtt.exe 99 PID 2800 wrote to memory of 3808 2800 bhhbtt.exe 99 PID 2800 wrote to memory of 3808 2800 bhhbtt.exe 99 PID 3808 wrote to memory of 4872 3808 vppjd.exe 100 PID 3808 wrote to memory of 4872 3808 vppjd.exe 100 PID 3808 wrote to memory of 4872 3808 vppjd.exe 100 PID 4872 wrote to memory of 1636 4872 btbttt.exe 101 PID 4872 wrote to memory of 1636 4872 btbttt.exe 101 PID 4872 wrote to memory of 1636 4872 btbttt.exe 101 PID 1636 wrote to memory of 4976 1636 9pppj.exe 102 PID 1636 wrote to memory of 4976 1636 9pppj.exe 102 PID 1636 wrote to memory of 4976 1636 9pppj.exe 102 PID 4976 wrote to memory of 5032 4976 jjpjj.exe 103 PID 4976 wrote to memory of 5032 4976 jjpjj.exe 103 PID 4976 wrote to memory of 5032 4976 jjpjj.exe 103 PID 5032 wrote to memory of 4676 5032 llrrlrl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\92c646d11accd76eb68083395d87df6e4282b96d399fd8baf3aab511024a722c.exe"C:\Users\Admin\AppData\Local\Temp\92c646d11accd76eb68083395d87df6e4282b96d399fd8baf3aab511024a722c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\nntnhh.exec:\nntnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\djjdd.exec:\djjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\rrrlllx.exec:\rrrlllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\flrfxff.exec:\flrfxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\bbbbtt.exec:\bbbbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\5jvvd.exec:\5jvvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\tntnhh.exec:\tntnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\3jpjj.exec:\3jpjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\xflffff.exec:\xflffff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\9vjjp.exec:\9vjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:184 -
\??\c:\thhhbb.exec:\thhhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\nnnhbb.exec:\nnnhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\pjjjd.exec:\pjjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\rrllrrr.exec:\rrllrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\nntttt.exec:\nntttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\bhhbtt.exec:\bhhbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\vppjd.exec:\vppjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\btbttt.exec:\btbttt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\9pppj.exec:\9pppj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\jjpjj.exec:\jjpjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\llrrlrl.exec:\llrrlrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\vdddj.exec:\vdddj.exe23⤵
- Executes dropped EXE
PID:4676 -
\??\c:\djpjv.exec:\djpjv.exe24⤵
- Executes dropped EXE
PID:2936 -
\??\c:\5lxxflf.exec:\5lxxflf.exe25⤵
- Executes dropped EXE
PID:4160 -
\??\c:\3hbttt.exec:\3hbttt.exe26⤵
- Executes dropped EXE
PID:3176 -
\??\c:\jjjdv.exec:\jjjdv.exe27⤵
- Executes dropped EXE
PID:2916 -
\??\c:\nnnhhh.exec:\nnnhhh.exe28⤵
- Executes dropped EXE
PID:4612 -
\??\c:\pppjj.exec:\pppjj.exe29⤵
- Executes dropped EXE
PID:2248 -
\??\c:\ddvvv.exec:\ddvvv.exe30⤵
- Executes dropped EXE
PID:2488 -
\??\c:\bnbbtb.exec:\bnbbtb.exe31⤵
- Executes dropped EXE
PID:4904 -
\??\c:\jdjjd.exec:\jdjjd.exe32⤵
- Executes dropped EXE
PID:3184 -
\??\c:\3rlxrfx.exec:\3rlxrfx.exe33⤵
- Executes dropped EXE
PID:752 -
\??\c:\1djjj.exec:\1djjj.exe34⤵
- Executes dropped EXE
PID:3020 -
\??\c:\llfffff.exec:\llfffff.exe35⤵
- Executes dropped EXE
PID:1120 -
\??\c:\jdjjp.exec:\jdjjp.exe36⤵
- Executes dropped EXE
PID:5096 -
\??\c:\9xrrflx.exec:\9xrrflx.exe37⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tbbbbb.exec:\tbbbbb.exe38⤵
- Executes dropped EXE
PID:1332 -
\??\c:\dvdvv.exec:\dvdvv.exe39⤵
- Executes dropped EXE
PID:4956 -
\??\c:\vppjj.exec:\vppjj.exe40⤵
- Executes dropped EXE
PID:4432 -
\??\c:\hbbtnh.exec:\hbbtnh.exe41⤵
- Executes dropped EXE
PID:3128 -
\??\c:\vpjpd.exec:\vpjpd.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:392 -
\??\c:\jvjvp.exec:\jvjvp.exe43⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ffrlfxr.exec:\ffrlfxr.exe44⤵
- Executes dropped EXE
PID:3556 -
\??\c:\hhnhnh.exec:\hhnhnh.exe45⤵
- Executes dropped EXE
PID:3692 -
\??\c:\ddvjd.exec:\ddvjd.exe46⤵
- Executes dropped EXE
PID:1968 -
\??\c:\9lrlxxr.exec:\9lrlxxr.exe47⤵
- Executes dropped EXE
PID:5072 -
\??\c:\hbbbtn.exec:\hbbbtn.exe48⤵
- Executes dropped EXE
PID:3080 -
\??\c:\ddvjd.exec:\ddvjd.exe49⤵
- Executes dropped EXE
PID:2096 -
\??\c:\xxxrlfr.exec:\xxxrlfr.exe50⤵
- Executes dropped EXE
PID:3292 -
\??\c:\hnthbt.exec:\hnthbt.exe51⤵
- Executes dropped EXE
PID:1044 -
\??\c:\pdvvp.exec:\pdvvp.exe52⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xrrlxxl.exec:\xrrlxxl.exe53⤵
- Executes dropped EXE
PID:556 -
\??\c:\nbnthh.exec:\nbnthh.exe54⤵
- Executes dropped EXE
PID:4800 -
\??\c:\jdvpp.exec:\jdvpp.exe55⤵
- Executes dropped EXE
PID:2556 -
\??\c:\rflffll.exec:\rflffll.exe56⤵
- Executes dropped EXE
PID:4648 -
\??\c:\bnnbnn.exec:\bnnbnn.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3960 -
\??\c:\pjdjd.exec:\pjdjd.exe58⤵
- Executes dropped EXE
PID:2320 -
\??\c:\flxxllx.exec:\flxxllx.exe59⤵
- Executes dropped EXE
PID:4248 -
\??\c:\bbbttn.exec:\bbbttn.exe60⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vpvpd.exec:\vpvpd.exe61⤵
- Executes dropped EXE
PID:5012 -
\??\c:\9xxrllf.exec:\9xxrllf.exe62⤵
- Executes dropped EXE
PID:4784 -
\??\c:\lrrfxrf.exec:\lrrfxrf.exe63⤵
- Executes dropped EXE
PID:4780 -
\??\c:\hbtthb.exec:\hbtthb.exe64⤵
- Executes dropped EXE
PID:3200 -
\??\c:\vvddd.exec:\vvddd.exe65⤵
- Executes dropped EXE
PID:2368 -
\??\c:\rfllfrr.exec:\rfllfrr.exe66⤵PID:3144
-
\??\c:\lfxfrfl.exec:\lfxfrfl.exe67⤵PID:3876
-
\??\c:\nnnhbt.exec:\nnnhbt.exe68⤵PID:1636
-
\??\c:\jjddv.exec:\jjddv.exe69⤵PID:468
-
\??\c:\xlxrllf.exec:\xlxrllf.exe70⤵
- System Location Discovery: System Language Discovery
PID:5088 -
\??\c:\bbtnhh.exec:\bbtnhh.exe71⤵PID:3212
-
\??\c:\ddvvj.exec:\ddvvj.exe72⤵PID:4676
-
\??\c:\rfxlfrf.exec:\rfxlfrf.exe73⤵PID:1728
-
\??\c:\bhtnht.exec:\bhtnht.exe74⤵PID:2428
-
\??\c:\vdpjd.exec:\vdpjd.exe75⤵PID:3496
-
\??\c:\djdpj.exec:\djdpj.exe76⤵
- System Location Discovery: System Language Discovery
PID:5104 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe77⤵PID:936
-
\??\c:\bhnhbh.exec:\bhnhbh.exe78⤵PID:4284
-
\??\c:\ppdvp.exec:\ppdvp.exe79⤵PID:1580
-
\??\c:\jjjdv.exec:\jjjdv.exe80⤵PID:3392
-
\??\c:\xrlllrr.exec:\xrlllrr.exe81⤵PID:5060
-
\??\c:\9ttnbh.exec:\9ttnbh.exe82⤵PID:3676
-
\??\c:\5ppjv.exec:\5ppjv.exe83⤵PID:1028
-
\??\c:\xffxfxr.exec:\xffxfxr.exe84⤵PID:4596
-
\??\c:\rxrlffx.exec:\rxrlffx.exe85⤵
- System Location Discovery: System Language Discovery
PID:4880 -
\??\c:\bthbbn.exec:\bthbbn.exe86⤵PID:752
-
\??\c:\pppjj.exec:\pppjj.exe87⤵
- System Location Discovery: System Language Discovery
PID:4016 -
\??\c:\rrlfxrl.exec:\rrlfxrl.exe88⤵PID:1476
-
\??\c:\1btntt.exec:\1btntt.exe89⤵PID:3624
-
\??\c:\pppjd.exec:\pppjd.exe90⤵PID:3512
-
\??\c:\ffxrfxl.exec:\ffxrfxl.exe91⤵PID:2828
-
\??\c:\nnnhbt.exec:\nnnhbt.exe92⤵PID:668
-
\??\c:\1btthh.exec:\1btthh.exe93⤵PID:1868
-
\??\c:\vjdjd.exec:\vjdjd.exe94⤵PID:2988
-
\??\c:\ffxrffx.exec:\ffxrffx.exe95⤵PID:2920
-
\??\c:\thhnhb.exec:\thhnhb.exe96⤵PID:1576
-
\??\c:\9ddvv.exec:\9ddvv.exe97⤵PID:1380
-
\??\c:\9llfllr.exec:\9llfllr.exe98⤵PID:392
-
\??\c:\rxxrfxr.exec:\rxxrfxr.exe99⤵PID:4000
-
\??\c:\nttntn.exec:\nttntn.exe100⤵PID:1996
-
\??\c:\vvvvv.exec:\vvvvv.exe101⤵PID:3316
-
\??\c:\jddvp.exec:\jddvp.exe102⤵PID:1192
-
\??\c:\5rfxllf.exec:\5rfxllf.exe103⤵PID:4332
-
\??\c:\tbhttn.exec:\tbhttn.exe104⤵PID:4092
-
\??\c:\djjjp.exec:\djjjp.exe105⤵PID:2020
-
\??\c:\rrrfxrl.exec:\rrrfxrl.exe106⤵PID:5100
-
\??\c:\nnbbhh.exec:\nnbbhh.exe107⤵PID:1604
-
\??\c:\vpjdj.exec:\vpjdj.exe108⤵PID:2080
-
\??\c:\3xrrfff.exec:\3xrrfff.exe109⤵PID:1044
-
\??\c:\rlxrllx.exec:\rlxrllx.exe110⤵PID:2000
-
\??\c:\nthhbb.exec:\nthhbb.exe111⤵PID:5056
-
\??\c:\5ppjd.exec:\5ppjd.exe112⤵PID:4700
-
\??\c:\5dvvp.exec:\5dvvp.exe113⤵PID:4340
-
\??\c:\9fxrffx.exec:\9fxrffx.exe114⤵PID:3048
-
\??\c:\nnnhhh.exec:\nnnhhh.exe115⤵PID:3872
-
\??\c:\9ppjj.exec:\9ppjj.exe116⤵PID:1884
-
\??\c:\xfllfxl.exec:\xfllfxl.exe117⤵PID:2320
-
\??\c:\nhnnhh.exec:\nhnnhh.exe118⤵PID:3540
-
\??\c:\jjvpj.exec:\jjvpj.exe119⤵PID:2908
-
\??\c:\vvpjd.exec:\vvpjd.exe120⤵PID:1088
-
\??\c:\9fllrrx.exec:\9fllrrx.exe121⤵PID:3916
-
\??\c:\7tnbbt.exec:\7tnbbt.exe122⤵PID:2216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-