Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 20:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0001a7ab06c7f4148eece5a72f3564b7b843d07856e1c9262a6ff504c2e50fb8.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
0001a7ab06c7f4148eece5a72f3564b7b843d07856e1c9262a6ff504c2e50fb8.exe
-
Size
456KB
-
MD5
430385f6b0cea96bc323579154a00ea2
-
SHA1
b15c50045353994d20d587a371f953cf4b69cba9
-
SHA256
0001a7ab06c7f4148eece5a72f3564b7b843d07856e1c9262a6ff504c2e50fb8
-
SHA512
77a95e43f7ae3048eae4794f81d1cdc5ac9ea2ede0defe8db78432c3990a48365079b8b26753de1060d46d2db826ad280dab503fcd0a3cabbb007084f1874926
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRx:q7Tc2NYHUrAwfMp3CDRx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/516-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1028-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1768-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2068-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/736-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-654-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-673-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-707-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-885-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-892-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/528-1163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3216 hhnhhh.exe 644 xllrrrr.exe 4848 hhhbbh.exe 4720 jddvv.exe 1952 hhbbtb.exe 4960 ffxxxxx.exe 4992 hbtnnn.exe 2056 llxrlrl.exe 2804 tttnhh.exe 2644 hbhbth.exe 3684 xxffrrx.exe 2368 9ttnhn.exe 3468 3djdd.exe 1772 dvddv.exe 968 xllllll.exe 1260 nttnnb.exe 1388 ttttth.exe 4988 jjvvp.exe 4240 vdddv.exe 1696 rflrrxf.exe 1720 9rxxrll.exe 4696 bhhbtn.exe 4812 nbtnhh.exe 5116 dvvvp.exe 2456 xlxrrff.exe 4516 fxfffff.exe 4236 pjpdv.exe 4524 flfxlrr.exe 3188 rxrlrrr.exe 736 pdddd.exe 4036 xfxlfrf.exe 1892 dddvp.exe 2200 1rfflrf.exe 1272 bbbbbb.exe 3632 7pvvv.exe 1352 rxffxxr.exe 1028 hhnhhh.exe 4480 3vvvp.exe 4628 frrlrlf.exe 2828 nthbht.exe 3256 dpddv.exe 1632 rlrlllf.exe 3628 bhhbtb.exe 4764 tbnnhh.exe 2388 pvvvv.exe 4568 fflrrxf.exe 1972 lffffxr.exe 3252 thnnhh.exe 4412 5jpjd.exe 468 rfrlfxr.exe 4708 ntthbt.exe 1768 tthbnn.exe 5100 vjjjj.exe 4092 ffxrfxr.exe 1424 bntbht.exe 4784 ppjdp.exe 2068 5rlfffx.exe 876 rrfrffr.exe 3972 nhhttt.exe 3984 vdvpj.exe 1636 ffxllll.exe 4992 nnbhbh.exe 5084 5nhbtn.exe 3208 vvvpd.exe -
resource yara_rule behavioral2/memory/516-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2804-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1388-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1028-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/736-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-885-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-892-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-984-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 516 wrote to memory of 3216 516 0001a7ab06c7f4148eece5a72f3564b7b843d07856e1c9262a6ff504c2e50fb8.exe 83 PID 516 wrote to memory of 3216 516 0001a7ab06c7f4148eece5a72f3564b7b843d07856e1c9262a6ff504c2e50fb8.exe 83 PID 516 wrote to memory of 3216 516 0001a7ab06c7f4148eece5a72f3564b7b843d07856e1c9262a6ff504c2e50fb8.exe 83 PID 3216 wrote to memory of 644 3216 hhnhhh.exe 84 PID 3216 wrote to memory of 644 3216 hhnhhh.exe 84 PID 3216 wrote to memory of 644 3216 hhnhhh.exe 84 PID 644 wrote to memory of 4848 644 xllrrrr.exe 85 PID 644 wrote to memory of 4848 644 xllrrrr.exe 85 PID 644 wrote to memory of 4848 644 xllrrrr.exe 85 PID 4848 wrote to memory of 4720 4848 hhhbbh.exe 86 PID 4848 wrote to memory of 4720 4848 hhhbbh.exe 86 PID 4848 wrote to memory of 4720 4848 hhhbbh.exe 86 PID 4720 wrote to memory of 1952 4720 jddvv.exe 87 PID 4720 wrote to memory of 1952 4720 jddvv.exe 87 PID 4720 wrote to memory of 1952 4720 jddvv.exe 87 PID 1952 wrote to memory of 4960 1952 hhbbtb.exe 88 PID 1952 wrote to memory of 4960 1952 hhbbtb.exe 88 PID 1952 wrote to memory of 4960 1952 hhbbtb.exe 88 PID 4960 wrote to memory of 4992 4960 ffxxxxx.exe 89 PID 4960 wrote to memory of 4992 4960 ffxxxxx.exe 89 PID 4960 wrote to memory of 4992 4960 ffxxxxx.exe 89 PID 4992 wrote to memory of 2056 4992 hbtnnn.exe 90 PID 4992 wrote to memory of 2056 4992 hbtnnn.exe 90 PID 4992 wrote to memory of 2056 4992 hbtnnn.exe 90 PID 2056 wrote to memory of 2804 2056 llxrlrl.exe 91 PID 2056 wrote to memory of 2804 2056 llxrlrl.exe 91 PID 2056 wrote to memory of 2804 2056 llxrlrl.exe 91 PID 2804 wrote to memory of 2644 2804 tttnhh.exe 92 PID 2804 wrote to memory of 2644 2804 tttnhh.exe 92 PID 2804 wrote to memory of 2644 2804 tttnhh.exe 92 PID 2644 wrote to memory of 3684 2644 hbhbth.exe 93 PID 2644 wrote to memory of 3684 2644 hbhbth.exe 93 PID 2644 wrote to memory of 3684 2644 hbhbth.exe 93 PID 3684 wrote to memory of 2368 3684 xxffrrx.exe 94 PID 3684 wrote to memory of 2368 3684 xxffrrx.exe 94 PID 3684 wrote to memory of 2368 3684 xxffrrx.exe 94 PID 2368 wrote to memory of 3468 2368 9ttnhn.exe 95 PID 2368 wrote to memory of 3468 2368 9ttnhn.exe 95 PID 2368 wrote to memory of 3468 2368 9ttnhn.exe 95 PID 3468 wrote to memory of 1772 3468 3djdd.exe 96 PID 3468 wrote to memory of 1772 3468 3djdd.exe 96 PID 3468 wrote to memory of 1772 3468 3djdd.exe 96 PID 1772 wrote to memory of 968 1772 dvddv.exe 97 PID 1772 wrote to memory of 968 1772 dvddv.exe 97 PID 1772 wrote to memory of 968 1772 dvddv.exe 97 PID 968 wrote to memory of 1260 968 xllllll.exe 98 PID 968 wrote to memory of 1260 968 xllllll.exe 98 PID 968 wrote to memory of 1260 968 xllllll.exe 98 PID 1260 wrote to memory of 1388 1260 nttnnb.exe 99 PID 1260 wrote to memory of 1388 1260 nttnnb.exe 99 PID 1260 wrote to memory of 1388 1260 nttnnb.exe 99 PID 1388 wrote to memory of 4988 1388 ttttth.exe 100 PID 1388 wrote to memory of 4988 1388 ttttth.exe 100 PID 1388 wrote to memory of 4988 1388 ttttth.exe 100 PID 4988 wrote to memory of 4240 4988 jjvvp.exe 101 PID 4988 wrote to memory of 4240 4988 jjvvp.exe 101 PID 4988 wrote to memory of 4240 4988 jjvvp.exe 101 PID 4240 wrote to memory of 1696 4240 vdddv.exe 102 PID 4240 wrote to memory of 1696 4240 vdddv.exe 102 PID 4240 wrote to memory of 1696 4240 vdddv.exe 102 PID 1696 wrote to memory of 1720 1696 rflrrxf.exe 103 PID 1696 wrote to memory of 1720 1696 rflrrxf.exe 103 PID 1696 wrote to memory of 1720 1696 rflrrxf.exe 103 PID 1720 wrote to memory of 4696 1720 9rxxrll.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\0001a7ab06c7f4148eece5a72f3564b7b843d07856e1c9262a6ff504c2e50fb8.exe"C:\Users\Admin\AppData\Local\Temp\0001a7ab06c7f4148eece5a72f3564b7b843d07856e1c9262a6ff504c2e50fb8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\hhnhhh.exec:\hhnhhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\xllrrrr.exec:\xllrrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\hhhbbh.exec:\hhhbbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\jddvv.exec:\jddvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\hhbbtb.exec:\hhbbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\ffxxxxx.exec:\ffxxxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\hbtnnn.exec:\hbtnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\llxrlrl.exec:\llxrlrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\tttnhh.exec:\tttnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\hbhbth.exec:\hbhbth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\xxffrrx.exec:\xxffrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\9ttnhn.exec:\9ttnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\3djdd.exec:\3djdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\dvddv.exec:\dvddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\xllllll.exec:\xllllll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\nttnnb.exec:\nttnnb.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\ttttth.exec:\ttttth.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\jjvvp.exec:\jjvvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\vdddv.exec:\vdddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\rflrrxf.exec:\rflrrxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\9rxxrll.exec:\9rxxrll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\bhhbtn.exec:\bhhbtn.exe23⤵
- Executes dropped EXE
PID:4696 -
\??\c:\nbtnhh.exec:\nbtnhh.exe24⤵
- Executes dropped EXE
PID:4812 -
\??\c:\dvvvp.exec:\dvvvp.exe25⤵
- Executes dropped EXE
PID:5116 -
\??\c:\xlxrrff.exec:\xlxrrff.exe26⤵
- Executes dropped EXE
PID:2456 -
\??\c:\fxfffff.exec:\fxfffff.exe27⤵
- Executes dropped EXE
PID:4516 -
\??\c:\pjpdv.exec:\pjpdv.exe28⤵
- Executes dropped EXE
PID:4236 -
\??\c:\flfxlrr.exec:\flfxlrr.exe29⤵
- Executes dropped EXE
PID:4524 -
\??\c:\rxrlrrr.exec:\rxrlrrr.exe30⤵
- Executes dropped EXE
PID:3188 -
\??\c:\pdddd.exec:\pdddd.exe31⤵
- Executes dropped EXE
PID:736 -
\??\c:\xfxlfrf.exec:\xfxlfrf.exe32⤵
- Executes dropped EXE
PID:4036 -
\??\c:\dddvp.exec:\dddvp.exe33⤵
- Executes dropped EXE
PID:1892 -
\??\c:\1rfflrf.exec:\1rfflrf.exe34⤵
- Executes dropped EXE
PID:2200 -
\??\c:\bbbbbb.exec:\bbbbbb.exe35⤵
- Executes dropped EXE
PID:1272 -
\??\c:\7pvvv.exec:\7pvvv.exe36⤵
- Executes dropped EXE
PID:3632 -
\??\c:\rxffxxr.exec:\rxffxxr.exe37⤵
- Executes dropped EXE
PID:1352 -
\??\c:\hhnhhh.exec:\hhnhhh.exe38⤵
- Executes dropped EXE
PID:1028 -
\??\c:\3vvvp.exec:\3vvvp.exe39⤵
- Executes dropped EXE
PID:4480 -
\??\c:\frrlrlf.exec:\frrlrlf.exe40⤵
- Executes dropped EXE
PID:4628 -
\??\c:\nthbht.exec:\nthbht.exe41⤵
- Executes dropped EXE
PID:2828 -
\??\c:\dpddv.exec:\dpddv.exe42⤵
- Executes dropped EXE
PID:3256 -
\??\c:\rlrlllf.exec:\rlrlllf.exe43⤵
- Executes dropped EXE
PID:1632 -
\??\c:\bhhbtb.exec:\bhhbtb.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3628 -
\??\c:\tbnnhh.exec:\tbnnhh.exe45⤵
- Executes dropped EXE
PID:4764 -
\??\c:\pvvvv.exec:\pvvvv.exe46⤵
- Executes dropped EXE
PID:2388 -
\??\c:\fflrrxf.exec:\fflrrxf.exe47⤵
- Executes dropped EXE
PID:4568 -
\??\c:\lffffxr.exec:\lffffxr.exe48⤵
- Executes dropped EXE
PID:1972 -
\??\c:\thnnhh.exec:\thnnhh.exe49⤵
- Executes dropped EXE
PID:3252 -
\??\c:\5jpjd.exec:\5jpjd.exe50⤵
- Executes dropped EXE
PID:4412 -
\??\c:\rfrlfxr.exec:\rfrlfxr.exe51⤵
- Executes dropped EXE
PID:468 -
\??\c:\ntthbt.exec:\ntthbt.exe52⤵
- Executes dropped EXE
PID:4708 -
\??\c:\tthbnn.exec:\tthbnn.exe53⤵
- Executes dropped EXE
PID:1768 -
\??\c:\vjjjj.exec:\vjjjj.exe54⤵
- Executes dropped EXE
PID:5100 -
\??\c:\ffxrfxr.exec:\ffxrfxr.exe55⤵
- Executes dropped EXE
PID:4092 -
\??\c:\bntbht.exec:\bntbht.exe56⤵
- Executes dropped EXE
PID:1424 -
\??\c:\ppjdp.exec:\ppjdp.exe57⤵
- Executes dropped EXE
PID:4784 -
\??\c:\5rlfffx.exec:\5rlfffx.exe58⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rrfrffr.exec:\rrfrffr.exe59⤵
- Executes dropped EXE
PID:876 -
\??\c:\nhhttt.exec:\nhhttt.exe60⤵
- Executes dropped EXE
PID:3972 -
\??\c:\vdvpj.exec:\vdvpj.exe61⤵
- Executes dropped EXE
PID:3984 -
\??\c:\ffxllll.exec:\ffxllll.exe62⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nnbhbh.exec:\nnbhbh.exe63⤵
- Executes dropped EXE
PID:4992 -
\??\c:\5nhbtn.exec:\5nhbtn.exe64⤵
- Executes dropped EXE
PID:5084 -
\??\c:\vvvpd.exec:\vvvpd.exe65⤵
- Executes dropped EXE
PID:3208 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe66⤵PID:4168
-
\??\c:\rflfxrl.exec:\rflfxrl.exe67⤵PID:2644
-
\??\c:\1hhtnh.exec:\1hhtnh.exe68⤵PID:3892
-
\??\c:\ddjvp.exec:\ddjvp.exe69⤵PID:2580
-
\??\c:\lfxlxxl.exec:\lfxlxxl.exe70⤵PID:1428
-
\??\c:\xfxrlll.exec:\xfxrlll.exe71⤵PID:3468
-
\??\c:\hbbthh.exec:\hbbthh.exe72⤵PID:4892
-
\??\c:\dvvvp.exec:\dvvvp.exe73⤵PID:968
-
\??\c:\xffxxlr.exec:\xffxxlr.exe74⤵PID:1988
-
\??\c:\rrlfrfr.exec:\rrlfrfr.exe75⤵PID:4768
-
\??\c:\nnbntb.exec:\nnbntb.exe76⤵PID:916
-
\??\c:\jjjjd.exec:\jjjjd.exe77⤵
- System Location Discovery: System Language Discovery
PID:4956 -
\??\c:\ffrlxxr.exec:\ffrlxxr.exe78⤵PID:1588
-
\??\c:\nnhbtn.exec:\nnhbtn.exe79⤵PID:812
-
\??\c:\bttnbt.exec:\bttnbt.exe80⤵PID:1720
-
\??\c:\vdjdd.exec:\vdjdd.exe81⤵PID:920
-
\??\c:\1ffxlfr.exec:\1ffxlfr.exe82⤵PID:2524
-
\??\c:\nthbth.exec:\nthbth.exe83⤵PID:1164
-
\??\c:\nhhtnh.exec:\nhhtnh.exe84⤵PID:1472
-
\??\c:\9vvvp.exec:\9vvvp.exe85⤵PID:2792
-
\??\c:\frxrlfx.exec:\frxrlfx.exe86⤵PID:4052
-
\??\c:\7bhbtn.exec:\7bhbtn.exe87⤵PID:412
-
\??\c:\nntnbt.exec:\nntnbt.exe88⤵PID:4464
-
\??\c:\1dpjp.exec:\1dpjp.exe89⤵PID:4632
-
\??\c:\rffxlfr.exec:\rffxlfr.exe90⤵PID:976
-
\??\c:\nnhbth.exec:\nnhbth.exe91⤵PID:112
-
\??\c:\bhhhbh.exec:\bhhhbh.exe92⤵PID:4704
-
\??\c:\3vvvp.exec:\3vvvp.exe93⤵PID:736
-
\??\c:\ffxrllf.exec:\ffxrllf.exe94⤵PID:3692
-
\??\c:\hnbtnn.exec:\hnbtnn.exe95⤵
- System Location Discovery: System Language Discovery
PID:3224 -
\??\c:\djpjj.exec:\djpjj.exe96⤵PID:4408
-
\??\c:\xxrflfx.exec:\xxrflfx.exe97⤵PID:4424
-
\??\c:\nbhnhh.exec:\nbhnhh.exe98⤵PID:1172
-
\??\c:\7jdvp.exec:\7jdvp.exe99⤵PID:1176
-
\??\c:\lrllffx.exec:\lrllffx.exe100⤵PID:1212
-
\??\c:\9bbtnn.exec:\9bbtnn.exe101⤵PID:5092
-
\??\c:\btbntt.exec:\btbntt.exe102⤵PID:3084
-
\??\c:\5ddvj.exec:\5ddvj.exe103⤵PID:1180
-
\??\c:\3rrrflr.exec:\3rrrflr.exe104⤵PID:2944
-
\??\c:\5tnbtb.exec:\5tnbtb.exe105⤵PID:4040
-
\??\c:\tnhhbt.exec:\tnhhbt.exe106⤵PID:2280
-
\??\c:\djjjj.exec:\djjjj.exe107⤵PID:4444
-
\??\c:\fxffrrl.exec:\fxffrrl.exe108⤵PID:1000
-
\??\c:\xrxrlfx.exec:\xrxrlfx.exe109⤵PID:3100
-
\??\c:\tbtnbb.exec:\tbtnbb.exe110⤵PID:4248
-
\??\c:\djppv.exec:\djppv.exe111⤵PID:2272
-
\??\c:\rxlfxxl.exec:\rxlfxxl.exe112⤵PID:3560
-
\??\c:\rffxffx.exec:\rffxffx.exe113⤵PID:1652
-
\??\c:\1htnbh.exec:\1htnbh.exe114⤵PID:3168
-
\??\c:\5jvpd.exec:\5jvpd.exe115⤵PID:4476
-
\??\c:\xllrflf.exec:\xllrflf.exe116⤵PID:4708
-
\??\c:\htbtbb.exec:\htbtbb.exe117⤵PID:644
-
\??\c:\tnnhbb.exec:\tnnhbb.exe118⤵PID:4548
-
\??\c:\ppddv.exec:\ppddv.exe119⤵PID:4848
-
\??\c:\1xlllrl.exec:\1xlllrl.exe120⤵PID:4820
-
\??\c:\tnnbbt.exec:\tnnbbt.exe121⤵PID:448
-
\??\c:\dvdjd.exec:\dvdjd.exe122⤵PID:2996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-