Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 19:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
db085ee1b7ea5c07b0da1366b5d3fa78183f0d32c67fd3823ae61ccf1af19089.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
db085ee1b7ea5c07b0da1366b5d3fa78183f0d32c67fd3823ae61ccf1af19089.exe
-
Size
454KB
-
MD5
0e4f6455c0aa2928e695707c6e334c41
-
SHA1
9361c77046d5a3dcf1daa931240f13adeb2b1749
-
SHA256
db085ee1b7ea5c07b0da1366b5d3fa78183f0d32c67fd3823ae61ccf1af19089
-
SHA512
a5eb3194d1d1c68c3d42076cc356d8a1f43102c8174f3c2933e4ed304c713f0aa5999cfc711cab8f4fbdc3cf4093ada222a8c544f76e457c9454a5cfca353849
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTi:q7Tc2NYHUrAwfMp3CDG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/4316-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/520-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/800-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/616-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1344-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3900-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-785-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-810-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-826-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-1034-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-1071-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-1555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4000 rxlffff.exe 3856 htbtnh.exe 4032 nhnnnn.exe 4764 frlxrxx.exe 1424 tthhht.exe 208 ttbtbh.exe 3340 5lrllrl.exe 3952 ddpvv.exe 2856 thnhhb.exe 3224 dpppj.exe 2688 vjppj.exe 3532 nthbbt.exe 368 pjjdd.exe 4184 btttnn.exe 520 jjpdd.exe 3560 flrllll.exe 5036 jvvpj.exe 2232 bhhhbh.exe 4040 pjjdv.exe 3656 3llllrl.exe 3480 jpjdp.exe 540 pjvvv.exe 4956 rllfxxr.exe 2240 7rlfxxr.exe 2532 tttnhh.exe 764 pdvpj.exe 2140 hbbbbb.exe 2932 dvpjp.exe 4048 pdjdd.exe 4148 5ffxxxr.exe 3964 thbbtt.exe 3180 dvddj.exe 4548 tbbbtb.exe 3220 djpjj.exe 1888 rxxlxrl.exe 1860 vddvp.exe 2200 lxlfxff.exe 5076 hthhbb.exe 3540 pvdpd.exe 4524 xrxfxrl.exe 4168 hbbbbb.exe 1000 dvpvp.exe 2976 rllfxrl.exe 3976 nhttbt.exe 3680 vvvvp.exe 4652 fxfxxfx.exe 5052 fxffxff.exe 3324 tnbbtt.exe 3476 pdppp.exe 1864 xlxrlll.exe 644 9nnhhh.exe 3508 thhbth.exe 4432 dvppj.exe 3340 xrrrrrr.exe 4704 bbbbbh.exe 3896 hnbbtt.exe 800 jvvvp.exe 2204 9llfllx.exe 408 tntntb.exe 4732 pdpjd.exe 4464 7dppv.exe 704 lfllfff.exe 3140 vjppp.exe 972 vpjjj.exe -
resource yara_rule behavioral2/memory/4316-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/520-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/800-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/616-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/460-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1344-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3900-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-785-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-810-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-826-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-1034-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-1071-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4316 wrote to memory of 4000 4316 db085ee1b7ea5c07b0da1366b5d3fa78183f0d32c67fd3823ae61ccf1af19089.exe 83 PID 4316 wrote to memory of 4000 4316 db085ee1b7ea5c07b0da1366b5d3fa78183f0d32c67fd3823ae61ccf1af19089.exe 83 PID 4316 wrote to memory of 4000 4316 db085ee1b7ea5c07b0da1366b5d3fa78183f0d32c67fd3823ae61ccf1af19089.exe 83 PID 4000 wrote to memory of 3856 4000 rxlffff.exe 84 PID 4000 wrote to memory of 3856 4000 rxlffff.exe 84 PID 4000 wrote to memory of 3856 4000 rxlffff.exe 84 PID 3856 wrote to memory of 4032 3856 htbtnh.exe 85 PID 3856 wrote to memory of 4032 3856 htbtnh.exe 85 PID 3856 wrote to memory of 4032 3856 htbtnh.exe 85 PID 4032 wrote to memory of 4764 4032 nhnnnn.exe 86 PID 4032 wrote to memory of 4764 4032 nhnnnn.exe 86 PID 4032 wrote to memory of 4764 4032 nhnnnn.exe 86 PID 4764 wrote to memory of 1424 4764 frlxrxx.exe 87 PID 4764 wrote to memory of 1424 4764 frlxrxx.exe 87 PID 4764 wrote to memory of 1424 4764 frlxrxx.exe 87 PID 1424 wrote to memory of 208 1424 tthhht.exe 88 PID 1424 wrote to memory of 208 1424 tthhht.exe 88 PID 1424 wrote to memory of 208 1424 tthhht.exe 88 PID 208 wrote to memory of 3340 208 ttbtbh.exe 89 PID 208 wrote to memory of 3340 208 ttbtbh.exe 89 PID 208 wrote to memory of 3340 208 ttbtbh.exe 89 PID 3340 wrote to memory of 3952 3340 5lrllrl.exe 90 PID 3340 wrote to memory of 3952 3340 5lrllrl.exe 90 PID 3340 wrote to memory of 3952 3340 5lrllrl.exe 90 PID 3952 wrote to memory of 2856 3952 ddpvv.exe 91 PID 3952 wrote to memory of 2856 3952 ddpvv.exe 91 PID 3952 wrote to memory of 2856 3952 ddpvv.exe 91 PID 2856 wrote to memory of 3224 2856 thnhhb.exe 92 PID 2856 wrote to memory of 3224 2856 thnhhb.exe 92 PID 2856 wrote to memory of 3224 2856 thnhhb.exe 92 PID 3224 wrote to memory of 2688 3224 dpppj.exe 93 PID 3224 wrote to memory of 2688 3224 dpppj.exe 93 PID 3224 wrote to memory of 2688 3224 dpppj.exe 93 PID 2688 wrote to memory of 3532 2688 vjppj.exe 94 PID 2688 wrote to memory of 3532 2688 vjppj.exe 94 PID 2688 wrote to memory of 3532 2688 vjppj.exe 94 PID 3532 wrote to memory of 368 3532 nthbbt.exe 95 PID 3532 wrote to memory of 368 3532 nthbbt.exe 95 PID 3532 wrote to memory of 368 3532 nthbbt.exe 95 PID 368 wrote to memory of 4184 368 pjjdd.exe 96 PID 368 wrote to memory of 4184 368 pjjdd.exe 96 PID 368 wrote to memory of 4184 368 pjjdd.exe 96 PID 4184 wrote to memory of 520 4184 btttnn.exe 97 PID 4184 wrote to memory of 520 4184 btttnn.exe 97 PID 4184 wrote to memory of 520 4184 btttnn.exe 97 PID 520 wrote to memory of 3560 520 jjpdd.exe 98 PID 520 wrote to memory of 3560 520 jjpdd.exe 98 PID 520 wrote to memory of 3560 520 jjpdd.exe 98 PID 3560 wrote to memory of 5036 3560 flrllll.exe 99 PID 3560 wrote to memory of 5036 3560 flrllll.exe 99 PID 3560 wrote to memory of 5036 3560 flrllll.exe 99 PID 5036 wrote to memory of 2232 5036 jvvpj.exe 100 PID 5036 wrote to memory of 2232 5036 jvvpj.exe 100 PID 5036 wrote to memory of 2232 5036 jvvpj.exe 100 PID 2232 wrote to memory of 4040 2232 bhhhbh.exe 101 PID 2232 wrote to memory of 4040 2232 bhhhbh.exe 101 PID 2232 wrote to memory of 4040 2232 bhhhbh.exe 101 PID 4040 wrote to memory of 3656 4040 pjjdv.exe 102 PID 4040 wrote to memory of 3656 4040 pjjdv.exe 102 PID 4040 wrote to memory of 3656 4040 pjjdv.exe 102 PID 3656 wrote to memory of 3480 3656 3llllrl.exe 103 PID 3656 wrote to memory of 3480 3656 3llllrl.exe 103 PID 3656 wrote to memory of 3480 3656 3llllrl.exe 103 PID 3480 wrote to memory of 540 3480 jpjdp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\db085ee1b7ea5c07b0da1366b5d3fa78183f0d32c67fd3823ae61ccf1af19089.exe"C:\Users\Admin\AppData\Local\Temp\db085ee1b7ea5c07b0da1366b5d3fa78183f0d32c67fd3823ae61ccf1af19089.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\rxlffff.exec:\rxlffff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\htbtnh.exec:\htbtnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\nhnnnn.exec:\nhnnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\frlxrxx.exec:\frlxrxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\tthhht.exec:\tthhht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\ttbtbh.exec:\ttbtbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\5lrllrl.exec:\5lrllrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\ddpvv.exec:\ddpvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\thnhhb.exec:\thnhhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\dpppj.exec:\dpppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\vjppj.exec:\vjppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\nthbbt.exec:\nthbbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\pjjdd.exec:\pjjdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\btttnn.exec:\btttnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\jjpdd.exec:\jjpdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
\??\c:\flrllll.exec:\flrllll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\jvvpj.exec:\jvvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\bhhhbh.exec:\bhhhbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\pjjdv.exec:\pjjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\3llllrl.exec:\3llllrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\jpjdp.exec:\jpjdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\pjvvv.exec:\pjvvv.exe23⤵
- Executes dropped EXE
PID:540 -
\??\c:\rllfxxr.exec:\rllfxxr.exe24⤵
- Executes dropped EXE
PID:4956 -
\??\c:\7rlfxxr.exec:\7rlfxxr.exe25⤵
- Executes dropped EXE
PID:2240 -
\??\c:\tttnhh.exec:\tttnhh.exe26⤵
- Executes dropped EXE
PID:2532 -
\??\c:\pdvpj.exec:\pdvpj.exe27⤵
- Executes dropped EXE
PID:764 -
\??\c:\hbbbbb.exec:\hbbbbb.exe28⤵
- Executes dropped EXE
PID:2140 -
\??\c:\dvpjp.exec:\dvpjp.exe29⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pdjdd.exec:\pdjdd.exe30⤵
- Executes dropped EXE
PID:4048 -
\??\c:\5ffxxxr.exec:\5ffxxxr.exe31⤵
- Executes dropped EXE
PID:4148 -
\??\c:\thbbtt.exec:\thbbtt.exe32⤵
- Executes dropped EXE
PID:3964 -
\??\c:\dvddj.exec:\dvddj.exe33⤵
- Executes dropped EXE
PID:3180 -
\??\c:\tbbbtb.exec:\tbbbtb.exe34⤵
- Executes dropped EXE
PID:4548 -
\??\c:\djpjj.exec:\djpjj.exe35⤵
- Executes dropped EXE
PID:3220 -
\??\c:\rxxlxrl.exec:\rxxlxrl.exe36⤵
- Executes dropped EXE
PID:1888 -
\??\c:\vddvp.exec:\vddvp.exe37⤵
- Executes dropped EXE
PID:1860 -
\??\c:\lxlfxff.exec:\lxlfxff.exe38⤵
- Executes dropped EXE
PID:2200 -
\??\c:\hthhbb.exec:\hthhbb.exe39⤵
- Executes dropped EXE
PID:5076 -
\??\c:\pvdpd.exec:\pvdpd.exe40⤵
- Executes dropped EXE
PID:3540 -
\??\c:\xrxfxrl.exec:\xrxfxrl.exe41⤵
- Executes dropped EXE
PID:4524 -
\??\c:\hbbbbb.exec:\hbbbbb.exe42⤵
- Executes dropped EXE
PID:4168 -
\??\c:\dvpvp.exec:\dvpvp.exe43⤵
- Executes dropped EXE
PID:1000 -
\??\c:\rllfxrl.exec:\rllfxrl.exe44⤵
- Executes dropped EXE
PID:2976 -
\??\c:\nhttbt.exec:\nhttbt.exe45⤵
- Executes dropped EXE
PID:3976 -
\??\c:\vvvvp.exec:\vvvvp.exe46⤵
- Executes dropped EXE
PID:3680 -
\??\c:\fxfxxfx.exec:\fxfxxfx.exe47⤵
- Executes dropped EXE
PID:4652 -
\??\c:\fxffxff.exec:\fxffxff.exe48⤵
- Executes dropped EXE
PID:5052 -
\??\c:\tnbbtt.exec:\tnbbtt.exe49⤵
- Executes dropped EXE
PID:3324 -
\??\c:\pdppp.exec:\pdppp.exe50⤵
- Executes dropped EXE
PID:3476 -
\??\c:\xlxrlll.exec:\xlxrlll.exe51⤵
- Executes dropped EXE
PID:1864 -
\??\c:\9nnhhh.exec:\9nnhhh.exe52⤵
- Executes dropped EXE
PID:644 -
\??\c:\thhbth.exec:\thhbth.exe53⤵
- Executes dropped EXE
PID:3508 -
\??\c:\dvppj.exec:\dvppj.exe54⤵
- Executes dropped EXE
PID:4432 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe55⤵
- Executes dropped EXE
PID:3340 -
\??\c:\bbbbbh.exec:\bbbbbh.exe56⤵
- Executes dropped EXE
PID:4704 -
\??\c:\hnbbtt.exec:\hnbbtt.exe57⤵
- Executes dropped EXE
PID:3896 -
\??\c:\jvvvp.exec:\jvvvp.exe58⤵
- Executes dropped EXE
PID:800 -
\??\c:\9llfllx.exec:\9llfllx.exe59⤵
- Executes dropped EXE
PID:2204 -
\??\c:\tntntb.exec:\tntntb.exe60⤵
- Executes dropped EXE
PID:408 -
\??\c:\pdpjd.exec:\pdpjd.exe61⤵
- Executes dropped EXE
PID:4732 -
\??\c:\7dppv.exec:\7dppv.exe62⤵
- Executes dropped EXE
PID:4464 -
\??\c:\lfllfff.exec:\lfllfff.exe63⤵
- Executes dropped EXE
PID:704 -
\??\c:\vjppp.exec:\vjppp.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3140 -
\??\c:\vpjjj.exec:\vpjjj.exe65⤵
- Executes dropped EXE
PID:972 -
\??\c:\rrrlllf.exec:\rrrlllf.exe66⤵PID:520
-
\??\c:\nbbttb.exec:\nbbttb.exe67⤵PID:4472
-
\??\c:\bbbhhh.exec:\bbbhhh.exe68⤵PID:2004
-
\??\c:\jpppj.exec:\jpppj.exe69⤵PID:2128
-
\??\c:\flffxlf.exec:\flffxlf.exe70⤵PID:964
-
\??\c:\xlrlffx.exec:\xlrlffx.exe71⤵PID:616
-
\??\c:\bnbbtt.exec:\bnbbtt.exe72⤵PID:2284
-
\??\c:\pjddj.exec:\pjddj.exe73⤵PID:4256
-
\??\c:\9lfllxx.exec:\9lfllxx.exe74⤵PID:4556
-
\??\c:\nhnhbt.exec:\nhnhbt.exe75⤵PID:4860
-
\??\c:\pjjjd.exec:\pjjjd.exe76⤵PID:552
-
\??\c:\jjjjj.exec:\jjjjj.exe77⤵PID:2388
-
\??\c:\9fxrxxf.exec:\9fxrxxf.exe78⤵PID:4820
-
\??\c:\hhnbth.exec:\hhnbth.exe79⤵PID:1204
-
\??\c:\ttbtbb.exec:\ttbtbb.exe80⤵PID:2892
-
\??\c:\vjddp.exec:\vjddp.exe81⤵PID:4520
-
\??\c:\fxllrrx.exec:\fxllrrx.exe82⤵PID:560
-
\??\c:\hntbnn.exec:\hntbnn.exe83⤵PID:1736
-
\??\c:\nbhhbb.exec:\nbhhbb.exe84⤵PID:1016
-
\??\c:\vvpjv.exec:\vvpjv.exe85⤵PID:460
-
\??\c:\rrxxffl.exec:\rrxxffl.exe86⤵PID:2468
-
\??\c:\tnbbhh.exec:\tnbbhh.exe87⤵PID:5020
-
\??\c:\tbtbhn.exec:\tbtbhn.exe88⤵PID:3764
-
\??\c:\vdjvp.exec:\vdjvp.exe89⤵PID:868
-
\??\c:\lrfxrlr.exec:\lrfxrlr.exe90⤵PID:1600
-
\??\c:\nbhbbt.exec:\nbhbbt.exe91⤵PID:4688
-
\??\c:\nhnhbb.exec:\nhnhbb.exe92⤵PID:1656
-
\??\c:\7jppj.exec:\7jppj.exe93⤵PID:1920
-
\??\c:\fxlfflf.exec:\fxlfflf.exe94⤵PID:4488
-
\??\c:\tnbhhh.exec:\tnbhhh.exe95⤵PID:4532
-
\??\c:\bbhhhh.exec:\bbhhhh.exe96⤵PID:3540
-
\??\c:\vppjv.exec:\vppjv.exe97⤵PID:4348
-
\??\c:\fllffrx.exec:\fllffrx.exe98⤵PID:2456
-
\??\c:\xxxxlll.exec:\xxxxlll.exe99⤵PID:1000
-
\??\c:\thnhbn.exec:\thnhbn.exe100⤵PID:1528
-
\??\c:\jpvvp.exec:\jpvvp.exe101⤵PID:4000
-
\??\c:\lxxlffx.exec:\lxxlffx.exe102⤵PID:320
-
\??\c:\nnttbb.exec:\nnttbb.exe103⤵PID:4652
-
\??\c:\hbhbhb.exec:\hbhbhb.exe104⤵PID:5052
-
\??\c:\5jpjp.exec:\5jpjp.exe105⤵PID:1664
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe106⤵PID:232
-
\??\c:\xfllrrr.exec:\xfllrrr.exe107⤵PID:2372
-
\??\c:\hhbthh.exec:\hhbthh.exe108⤵PID:644
-
\??\c:\djvvp.exec:\djvvp.exe109⤵PID:1124
-
\??\c:\rxfrrll.exec:\rxfrrll.exe110⤵PID:1328
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe111⤵PID:3636
-
\??\c:\ththtt.exec:\ththtt.exe112⤵PID:3428
-
\??\c:\bttnhh.exec:\bttnhh.exe113⤵PID:5012
-
\??\c:\djpjj.exec:\djpjj.exe114⤵PID:1652
-
\??\c:\rfllrff.exec:\rfllrff.exe115⤵PID:3720
-
\??\c:\nbhhbb.exec:\nbhhbb.exe116⤵PID:2688
-
\??\c:\hbnhhh.exec:\hbnhhh.exe117⤵PID:3532
-
\??\c:\vvjdj.exec:\vvjdj.exe118⤵PID:4152
-
\??\c:\3rrlflr.exec:\3rrlflr.exe119⤵PID:2216
-
\??\c:\ntbtnn.exec:\ntbtnn.exe120⤵PID:4160
-
\??\c:\tbhhbb.exec:\tbhhbb.exe121⤵PID:5044
-
\??\c:\jvppp.exec:\jvppp.exe122⤵PID:5092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-