Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 19:51
Behavioral task
behavioral1
Sample
6650f01432a457f6a17044db68c6cf75e27330bc705f059e210c17cc525d955cN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
6650f01432a457f6a17044db68c6cf75e27330bc705f059e210c17cc525d955cN.exe
-
Size
331KB
-
MD5
0d94534926a8c71e666fe09be6078cf0
-
SHA1
48543ed2021b9a0e28f4a9f474509ed76f223f48
-
SHA256
6650f01432a457f6a17044db68c6cf75e27330bc705f059e210c17cc525d955c
-
SHA512
f4226c988eb684142c917fb60a1e2bb7e42918444a78ce23ab3fad7e755a97912c5f27067f5cf0145ce2b5397b4d6c1ae8902116a9e270b60e14dfef595d224a
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbem:R4wFHoSHYHUrAwfMp3CDm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2636-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3876-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2752-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1744-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3164-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2836-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3316-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2064-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4756-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4016-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2684-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1440-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4188-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4172-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1564-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3692-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1656-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1312-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/516-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1480-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1264-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3468-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3992-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3640-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1736-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1072-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4464-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1968-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4500-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2708-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1792-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1964-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3000-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4748-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/644-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4016-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3704-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1448-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/660-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1496-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2504-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2780-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1232-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2864-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-414-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2836-590-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/680-595-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-694-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-879-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/772-888-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2356-1099-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4364 nbbnhb.exe 4940 vvjpv.exe 3876 ntbntt.exe 2752 9ddjv.exe 1744 5lxfrfl.exe 3164 3vpdp.exe 2736 ffrxfrr.exe 2836 frlfxrf.exe 4952 lxxxlfx.exe 3316 hbnnbb.exe 3892 rxfxllr.exe 2064 ntthtn.exe 3936 xflfllf.exe 4756 hbbtnh.exe 4016 vppdv.exe 2684 3hhbtn.exe 1440 dvdvp.exe 4188 lfxrxxx.exe 4172 htnhhb.exe 1564 ddddv.exe 1608 xlxrxxl.exe 3692 nhnhbb.exe 1656 pjjjj.exe 860 xlxrllf.exe 412 bhttnn.exe 4836 jddvp.exe 1016 xflxfrf.exe 2268 nbhthh.exe 1312 dvvvj.exe 3420 pvdvp.exe 2652 xxxflxr.exe 2792 9tbbtt.exe 4088 vpvpj.exe 2104 jdjdj.exe 4688 rrrlfff.exe 516 tntthh.exe 1480 pjvvp.exe 1264 rfrlllr.exe 1980 bbtntn.exe 3468 5htnhn.exe 2180 jdpdj.exe 3992 5flrllf.exe 3640 rffxxxr.exe 3600 ntbttt.exe 1800 ppjdd.exe 1736 vdjdd.exe 1072 5ffrllf.exe 960 7hhbtb.exe 3664 7bnntb.exe 5116 rlllxxl.exe 3636 thbtnb.exe 3528 3nnhtn.exe 4464 5pvpj.exe 1968 xrrfrlx.exe 4580 1xxxxfx.exe 4788 vpddd.exe 460 rllffxx.exe 4884 rflxxrr.exe 4500 bhnhbt.exe 4400 ddppd.exe 1096 xrrlfll.exe 2708 thnhnh.exe 2044 httnhh.exe 4596 vvjjp.exe -
resource yara_rule behavioral2/memory/2636-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000d000000023b53-3.dat upx behavioral2/memory/2636-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4364-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b76-8.dat upx behavioral2/files/0x000a000000023b7b-11.dat upx behavioral2/memory/4940-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7c-19.dat upx behavioral2/memory/3876-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7d-23.dat upx behavioral2/memory/2752-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7e-28.dat upx behavioral2/memory/1744-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b7f-33.dat upx behavioral2/memory/3164-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b80-38.dat upx behavioral2/memory/2836-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b81-42.dat upx behavioral2/files/0x000a000000023b82-48.dat upx behavioral2/memory/4952-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b83-52.dat upx behavioral2/memory/3316-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b84-57.dat upx behavioral2/files/0x000a000000023b85-61.dat upx behavioral2/memory/2064-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b86-66.dat upx behavioral2/files/0x000a000000023b87-70.dat upx behavioral2/memory/4756-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b88-75.dat upx behavioral2/memory/4016-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b77-80.dat upx behavioral2/memory/2684-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b89-85.dat upx behavioral2/memory/1440-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8a-90.dat upx behavioral2/memory/4188-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4172-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8c-96.dat upx behavioral2/memory/1564-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8d-101.dat upx behavioral2/files/0x000a000000023b8e-105.dat upx behavioral2/memory/3692-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1656-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8f-110.dat upx behavioral2/files/0x000a000000023b90-115.dat upx behavioral2/files/0x000a000000023b91-119.dat upx behavioral2/memory/412-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b92-125.dat upx behavioral2/files/0x000a000000023b93-129.dat upx behavioral2/files/0x000a000000023b94-133.dat upx behavioral2/files/0x000a000000023b95-136.dat upx behavioral2/memory/1312-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b96-140.dat upx behavioral2/files/0x000a000000023b97-145.dat upx behavioral2/files/0x000a000000023b98-149.dat upx behavioral2/memory/4088-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4688-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/516-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1480-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1264-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1980-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3468-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3992-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3640-183-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2636 wrote to memory of 4364 2636 6650f01432a457f6a17044db68c6cf75e27330bc705f059e210c17cc525d955cN.exe 82 PID 2636 wrote to memory of 4364 2636 6650f01432a457f6a17044db68c6cf75e27330bc705f059e210c17cc525d955cN.exe 82 PID 2636 wrote to memory of 4364 2636 6650f01432a457f6a17044db68c6cf75e27330bc705f059e210c17cc525d955cN.exe 82 PID 4364 wrote to memory of 4940 4364 nbbnhb.exe 83 PID 4364 wrote to memory of 4940 4364 nbbnhb.exe 83 PID 4364 wrote to memory of 4940 4364 nbbnhb.exe 83 PID 4940 wrote to memory of 3876 4940 vvjpv.exe 84 PID 4940 wrote to memory of 3876 4940 vvjpv.exe 84 PID 4940 wrote to memory of 3876 4940 vvjpv.exe 84 PID 3876 wrote to memory of 2752 3876 ntbntt.exe 85 PID 3876 wrote to memory of 2752 3876 ntbntt.exe 85 PID 3876 wrote to memory of 2752 3876 ntbntt.exe 85 PID 2752 wrote to memory of 1744 2752 9ddjv.exe 86 PID 2752 wrote to memory of 1744 2752 9ddjv.exe 86 PID 2752 wrote to memory of 1744 2752 9ddjv.exe 86 PID 1744 wrote to memory of 3164 1744 5lxfrfl.exe 87 PID 1744 wrote to memory of 3164 1744 5lxfrfl.exe 87 PID 1744 wrote to memory of 3164 1744 5lxfrfl.exe 87 PID 3164 wrote to memory of 2736 3164 3vpdp.exe 88 PID 3164 wrote to memory of 2736 3164 3vpdp.exe 88 PID 3164 wrote to memory of 2736 3164 3vpdp.exe 88 PID 2736 wrote to memory of 2836 2736 ffrxfrr.exe 89 PID 2736 wrote to memory of 2836 2736 ffrxfrr.exe 89 PID 2736 wrote to memory of 2836 2736 ffrxfrr.exe 89 PID 2836 wrote to memory of 4952 2836 frlfxrf.exe 90 PID 2836 wrote to memory of 4952 2836 frlfxrf.exe 90 PID 2836 wrote to memory of 4952 2836 frlfxrf.exe 90 PID 4952 wrote to memory of 3316 4952 lxxxlfx.exe 91 PID 4952 wrote to memory of 3316 4952 lxxxlfx.exe 91 PID 4952 wrote to memory of 3316 4952 lxxxlfx.exe 91 PID 3316 wrote to memory of 3892 3316 hbnnbb.exe 92 PID 3316 wrote to memory of 3892 3316 hbnnbb.exe 92 PID 3316 wrote to memory of 3892 3316 hbnnbb.exe 92 PID 3892 wrote to memory of 2064 3892 rxfxllr.exe 93 PID 3892 wrote to memory of 2064 3892 rxfxllr.exe 93 PID 3892 wrote to memory of 2064 3892 rxfxllr.exe 93 PID 2064 wrote to memory of 3936 2064 ntthtn.exe 94 PID 2064 wrote to memory of 3936 2064 ntthtn.exe 94 PID 2064 wrote to memory of 3936 2064 ntthtn.exe 94 PID 3936 wrote to memory of 4756 3936 xflfllf.exe 95 PID 3936 wrote to memory of 4756 3936 xflfllf.exe 95 PID 3936 wrote to memory of 4756 3936 xflfllf.exe 95 PID 4756 wrote to memory of 4016 4756 hbbtnh.exe 96 PID 4756 wrote to memory of 4016 4756 hbbtnh.exe 96 PID 4756 wrote to memory of 4016 4756 hbbtnh.exe 96 PID 4016 wrote to memory of 2684 4016 vppdv.exe 97 PID 4016 wrote to memory of 2684 4016 vppdv.exe 97 PID 4016 wrote to memory of 2684 4016 vppdv.exe 97 PID 2684 wrote to memory of 1440 2684 3hhbtn.exe 98 PID 2684 wrote to memory of 1440 2684 3hhbtn.exe 98 PID 2684 wrote to memory of 1440 2684 3hhbtn.exe 98 PID 1440 wrote to memory of 4188 1440 dvdvp.exe 99 PID 1440 wrote to memory of 4188 1440 dvdvp.exe 99 PID 1440 wrote to memory of 4188 1440 dvdvp.exe 99 PID 4188 wrote to memory of 4172 4188 lfxrxxx.exe 100 PID 4188 wrote to memory of 4172 4188 lfxrxxx.exe 100 PID 4188 wrote to memory of 4172 4188 lfxrxxx.exe 100 PID 4172 wrote to memory of 1564 4172 htnhhb.exe 101 PID 4172 wrote to memory of 1564 4172 htnhhb.exe 101 PID 4172 wrote to memory of 1564 4172 htnhhb.exe 101 PID 1564 wrote to memory of 1608 1564 ddddv.exe 102 PID 1564 wrote to memory of 1608 1564 ddddv.exe 102 PID 1564 wrote to memory of 1608 1564 ddddv.exe 102 PID 1608 wrote to memory of 3692 1608 xlxrxxl.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\6650f01432a457f6a17044db68c6cf75e27330bc705f059e210c17cc525d955cN.exe"C:\Users\Admin\AppData\Local\Temp\6650f01432a457f6a17044db68c6cf75e27330bc705f059e210c17cc525d955cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\nbbnhb.exec:\nbbnhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\vvjpv.exec:\vvjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\ntbntt.exec:\ntbntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\9ddjv.exec:\9ddjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\5lxfrfl.exec:\5lxfrfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\3vpdp.exec:\3vpdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\ffrxfrr.exec:\ffrxfrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\frlfxrf.exec:\frlfxrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\lxxxlfx.exec:\lxxxlfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\hbnnbb.exec:\hbnnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\rxfxllr.exec:\rxfxllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\ntthtn.exec:\ntthtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\xflfllf.exec:\xflfllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\hbbtnh.exec:\hbbtnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\vppdv.exec:\vppdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\3hhbtn.exec:\3hhbtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\dvdvp.exec:\dvdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\lfxrxxx.exec:\lfxrxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\htnhhb.exec:\htnhhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\ddddv.exec:\ddddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\xlxrxxl.exec:\xlxrxxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\nhnhbb.exec:\nhnhbb.exe23⤵
- Executes dropped EXE
PID:3692 -
\??\c:\pjjjj.exec:\pjjjj.exe24⤵
- Executes dropped EXE
PID:1656 -
\??\c:\xlxrllf.exec:\xlxrllf.exe25⤵
- Executes dropped EXE
PID:860 -
\??\c:\bhttnn.exec:\bhttnn.exe26⤵
- Executes dropped EXE
PID:412 -
\??\c:\jddvp.exec:\jddvp.exe27⤵
- Executes dropped EXE
PID:4836 -
\??\c:\xflxfrf.exec:\xflxfrf.exe28⤵
- Executes dropped EXE
PID:1016 -
\??\c:\nbhthh.exec:\nbhthh.exe29⤵
- Executes dropped EXE
PID:2268 -
\??\c:\dvvvj.exec:\dvvvj.exe30⤵
- Executes dropped EXE
PID:1312 -
\??\c:\pvdvp.exec:\pvdvp.exe31⤵
- Executes dropped EXE
PID:3420 -
\??\c:\xxxflxr.exec:\xxxflxr.exe32⤵
- Executes dropped EXE
PID:2652 -
\??\c:\9tbbtt.exec:\9tbbtt.exe33⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vpvpj.exec:\vpvpj.exe34⤵
- Executes dropped EXE
PID:4088 -
\??\c:\jdjdj.exec:\jdjdj.exe35⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rrrlfff.exec:\rrrlfff.exe36⤵
- Executes dropped EXE
PID:4688 -
\??\c:\tntthh.exec:\tntthh.exe37⤵
- Executes dropped EXE
PID:516 -
\??\c:\pjvvp.exec:\pjvvp.exe38⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rfrlllr.exec:\rfrlllr.exe39⤵
- Executes dropped EXE
PID:1264 -
\??\c:\bbtntn.exec:\bbtntn.exe40⤵
- Executes dropped EXE
PID:1980 -
\??\c:\5htnhn.exec:\5htnhn.exe41⤵
- Executes dropped EXE
PID:3468 -
\??\c:\jdpdj.exec:\jdpdj.exe42⤵
- Executes dropped EXE
PID:2180 -
\??\c:\5flrllf.exec:\5flrllf.exe43⤵
- Executes dropped EXE
PID:3992 -
\??\c:\rffxxxr.exec:\rffxxxr.exe44⤵
- Executes dropped EXE
PID:3640 -
\??\c:\ntbttt.exec:\ntbttt.exe45⤵
- Executes dropped EXE
PID:3600 -
\??\c:\ppjdd.exec:\ppjdd.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1800 -
\??\c:\vdjdd.exec:\vdjdd.exe47⤵
- Executes dropped EXE
PID:1736 -
\??\c:\5ffrllf.exec:\5ffrllf.exe48⤵
- Executes dropped EXE
PID:1072 -
\??\c:\7hhbtb.exec:\7hhbtb.exe49⤵
- Executes dropped EXE
PID:960 -
\??\c:\7bnntb.exec:\7bnntb.exe50⤵
- Executes dropped EXE
PID:3664 -
\??\c:\rlllxxl.exec:\rlllxxl.exe51⤵
- Executes dropped EXE
PID:5116 -
\??\c:\thbtnb.exec:\thbtnb.exe52⤵
- Executes dropped EXE
PID:3636 -
\??\c:\3nnhtn.exec:\3nnhtn.exe53⤵
- Executes dropped EXE
PID:3528 -
\??\c:\5pvpj.exec:\5pvpj.exe54⤵
- Executes dropped EXE
PID:4464 -
\??\c:\xrrfrlx.exec:\xrrfrlx.exe55⤵
- Executes dropped EXE
PID:1968 -
\??\c:\1xxxxfx.exec:\1xxxxfx.exe56⤵
- Executes dropped EXE
PID:4580 -
\??\c:\vpddd.exec:\vpddd.exe57⤵
- Executes dropped EXE
PID:4788 -
\??\c:\rllffxx.exec:\rllffxx.exe58⤵
- Executes dropped EXE
PID:460 -
\??\c:\rflxxrr.exec:\rflxxrr.exe59⤵
- Executes dropped EXE
PID:4884 -
\??\c:\bhnhbt.exec:\bhnhbt.exe60⤵
- Executes dropped EXE
PID:4500 -
\??\c:\ddppd.exec:\ddppd.exe61⤵
- Executes dropped EXE
PID:4400 -
\??\c:\xrrlfll.exec:\xrrlfll.exe62⤵
- Executes dropped EXE
PID:1096 -
\??\c:\thnhnh.exec:\thnhnh.exe63⤵
- Executes dropped EXE
PID:2708 -
\??\c:\httnhh.exec:\httnhh.exe64⤵
- Executes dropped EXE
PID:2044 -
\??\c:\vvjjp.exec:\vvjjp.exe65⤵
- Executes dropped EXE
PID:4596 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe66⤵
- System Location Discovery: System Language Discovery
PID:840 -
\??\c:\lrlrrfx.exec:\lrlrrfx.exe67⤵PID:3876
-
\??\c:\1nnhbb.exec:\1nnhbb.exe68⤵PID:2752
-
\??\c:\9ddvp.exec:\9ddvp.exe69⤵PID:4492
-
\??\c:\llffrrr.exec:\llffrrr.exe70⤵PID:2452
-
\??\c:\lxrxxrx.exec:\lxrxxrx.exe71⤵PID:1792
-
\??\c:\htnnht.exec:\htnnht.exe72⤵PID:3228
-
\??\c:\3vpjv.exec:\3vpjv.exe73⤵PID:876
-
\??\c:\lfxrrrr.exec:\lfxrrrr.exe74⤵PID:2412
-
\??\c:\rllfxrf.exec:\rllfxrf.exe75⤵PID:4800
-
\??\c:\hbhthb.exec:\hbhthb.exe76⤵PID:4860
-
\??\c:\jvpdp.exec:\jvpdp.exe77⤵PID:1964
-
\??\c:\7vvvp.exec:\7vvvp.exe78⤵PID:3628
-
\??\c:\xxrfrlf.exec:\xxrfrlf.exe79⤵PID:3000
-
\??\c:\hhbhth.exec:\hhbhth.exe80⤵PID:2772
-
\??\c:\7ppdv.exec:\7ppdv.exe81⤵PID:4748
-
\??\c:\7jjdd.exec:\7jjdd.exe82⤵PID:4980
-
\??\c:\lrfrllr.exec:\lrfrllr.exe83⤵PID:1076
-
\??\c:\hbnbht.exec:\hbnbht.exe84⤵PID:388
-
\??\c:\jjjdp.exec:\jjjdp.exe85⤵PID:644
-
\??\c:\vdpvv.exec:\vdpvv.exe86⤵PID:3688
-
\??\c:\rlrlxrr.exec:\rlrlxrr.exe87⤵PID:4016
-
\??\c:\bbbttn.exec:\bbbttn.exe88⤵PID:3176
-
\??\c:\thbnht.exec:\thbnht.exe89⤵PID:3704
-
\??\c:\pjpvd.exec:\pjpvd.exe90⤵PID:220
-
\??\c:\fllrrff.exec:\fllrrff.exe91⤵PID:4004
-
\??\c:\hhhbtn.exec:\hhhbtn.exe92⤵PID:2692
-
\??\c:\bnttnn.exec:\bnttnn.exe93⤵PID:4012
-
\??\c:\pddvp.exec:\pddvp.exe94⤵PID:3012
-
\??\c:\rxlfrlf.exec:\rxlfrlf.exe95⤵PID:60
-
\??\c:\nhnhnh.exec:\nhnhnh.exe96⤵PID:560
-
\??\c:\nhnntb.exec:\nhnntb.exe97⤵PID:4828
-
\??\c:\vvdvj.exec:\vvdvj.exe98⤵PID:4872
-
\??\c:\fxxrlll.exec:\fxxrlll.exe99⤵PID:1224
-
\??\c:\tnnntt.exec:\tnnntt.exe100⤵PID:2664
-
\??\c:\jjjjj.exec:\jjjjj.exe101⤵PID:1448
-
\??\c:\lrfxfrx.exec:\lrfxfrx.exe102⤵PID:4560
-
\??\c:\7flllrr.exec:\7flllrr.exe103⤵PID:4264
-
\??\c:\httnhb.exec:\httnhb.exe104⤵PID:660
-
\??\c:\5jjpv.exec:\5jjpv.exe105⤵PID:1496
-
\??\c:\lxfxfxr.exec:\lxfxfxr.exe106⤵PID:3332
-
\??\c:\rllrllf.exec:\rllrllf.exe107⤵PID:2548
-
\??\c:\hhbtbt.exec:\hhbtbt.exe108⤵PID:1668
-
\??\c:\jjvvj.exec:\jjvvj.exe109⤵PID:2504
-
\??\c:\djdvj.exec:\djdvj.exe110⤵PID:3888
-
\??\c:\xlffrlf.exec:\xlffrlf.exe111⤵PID:4088
-
\??\c:\ntbnnt.exec:\ntbnnt.exe112⤵PID:3588
-
\??\c:\ttbhhh.exec:\ttbhhh.exe113⤵PID:116
-
\??\c:\pvvdj.exec:\pvvdj.exe114⤵PID:3904
-
\??\c:\1xrxllf.exec:\1xrxllf.exe115⤵PID:3512
-
\??\c:\nbhhbb.exec:\nbhhbb.exe116⤵PID:744
-
\??\c:\3ntnhh.exec:\3ntnhh.exe117⤵PID:2780
-
\??\c:\dpddj.exec:\dpddj.exe118⤵PID:2520
-
\??\c:\9fflfrl.exec:\9fflfrl.exe119⤵PID:2356
-
\??\c:\9nnhbb.exec:\9nnhbb.exe120⤵PID:2180
-
\??\c:\btbtnh.exec:\btbtnh.exe121⤵PID:1628
-
\??\c:\pjjdv.exec:\pjjdv.exe122⤵PID:4896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-