Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 19:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eb57eb3a2a2c85c05c90c0af54720afac4aa06c2041236b1d6190bcf56a49971.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
eb57eb3a2a2c85c05c90c0af54720afac4aa06c2041236b1d6190bcf56a49971.exe
-
Size
454KB
-
MD5
2fee590e0ca9d4ef50e143bb1a663c80
-
SHA1
c66c9466f800b7480d59abd7af5c35d7d3181b81
-
SHA256
eb57eb3a2a2c85c05c90c0af54720afac4aa06c2041236b1d6190bcf56a49971
-
SHA512
46fd38b12f0e4931dabff9762dd0300ad50232dbd038b74eab12b947ec5c3992d90ea028e51e1d41d25104d82d33dbd29aa71e6b2ef82ada461bb4304e34b69e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeb:q7Tc2NYHUrAwfMp3CDb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2204-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1328-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/780-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2332-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-702-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-778-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/732-1164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3772 lffxfxx.exe 3332 httnnb.exe 3596 vjjdv.exe 4148 ttnnhn.exe 1328 hbbbbb.exe 780 llrrlrr.exe 2400 1llfffx.exe 4160 dddjj.exe 3184 xrllxxr.exe 220 jdjpp.exe 868 1hhbbh.exe 1092 rxxlllf.exe 2568 9hnhbb.exe 2936 nhhbhh.exe 1724 nnnnnn.exe 1632 7vddv.exe 1196 7hhbtt.exe 3576 9lxrxxf.exe 4628 tttbbt.exe 344 jjpjj.exe 2608 7lffxfx.exe 436 5ttnhh.exe 1192 pjdpp.exe 2540 xflllll.exe 3660 hbhbhh.exe 1416 vjdvj.exe 2460 jjvpj.exe 3000 ddvjp.exe 4660 pvpdd.exe 4416 llrlxxr.exe 2616 bnbtnn.exe 4432 xflfxrl.exe 952 thnnhh.exe 1716 fflfxxr.exe 4600 hntnhh.exe 4412 jpjjj.exe 4144 xxffrxx.exe 2220 tttnnt.exe 4084 9vpjp.exe 1556 xxfxrll.exe 3936 nthhbh.exe 3600 vdjjd.exe 2424 lflffff.exe 2308 thhbhh.exe 4916 djvvp.exe 4296 xfrlrrl.exe 468 pdvpj.exe 3860 vpdvd.exe 1792 xflllll.exe 3716 btnntb.exe 4400 pvjjp.exe 2204 httbnt.exe 1172 dvvpj.exe 4108 xfrrxfl.exe 3444 tthhbb.exe 3952 jjjdd.exe 2436 lxxrfxl.exe 404 7tbbhn.exe 1532 jpvvv.exe 320 ppvvp.exe 780 rlrrrrr.exe 2000 tttnth.exe 3620 3vjdj.exe 640 3rlfxxx.exe -
resource yara_rule behavioral2/memory/2204-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/780-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2332-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/732-1164-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllfrx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2204 wrote to memory of 3772 2204 eb57eb3a2a2c85c05c90c0af54720afac4aa06c2041236b1d6190bcf56a49971.exe 83 PID 2204 wrote to memory of 3772 2204 eb57eb3a2a2c85c05c90c0af54720afac4aa06c2041236b1d6190bcf56a49971.exe 83 PID 2204 wrote to memory of 3772 2204 eb57eb3a2a2c85c05c90c0af54720afac4aa06c2041236b1d6190bcf56a49971.exe 83 PID 3772 wrote to memory of 3332 3772 lffxfxx.exe 84 PID 3772 wrote to memory of 3332 3772 lffxfxx.exe 84 PID 3772 wrote to memory of 3332 3772 lffxfxx.exe 84 PID 3332 wrote to memory of 3596 3332 httnnb.exe 85 PID 3332 wrote to memory of 3596 3332 httnnb.exe 85 PID 3332 wrote to memory of 3596 3332 httnnb.exe 85 PID 3596 wrote to memory of 4148 3596 vjjdv.exe 86 PID 3596 wrote to memory of 4148 3596 vjjdv.exe 86 PID 3596 wrote to memory of 4148 3596 vjjdv.exe 86 PID 4148 wrote to memory of 1328 4148 ttnnhn.exe 87 PID 4148 wrote to memory of 1328 4148 ttnnhn.exe 87 PID 4148 wrote to memory of 1328 4148 ttnnhn.exe 87 PID 1328 wrote to memory of 780 1328 hbbbbb.exe 88 PID 1328 wrote to memory of 780 1328 hbbbbb.exe 88 PID 1328 wrote to memory of 780 1328 hbbbbb.exe 88 PID 780 wrote to memory of 2400 780 llrrlrr.exe 89 PID 780 wrote to memory of 2400 780 llrrlrr.exe 89 PID 780 wrote to memory of 2400 780 llrrlrr.exe 89 PID 2400 wrote to memory of 4160 2400 1llfffx.exe 90 PID 2400 wrote to memory of 4160 2400 1llfffx.exe 90 PID 2400 wrote to memory of 4160 2400 1llfffx.exe 90 PID 4160 wrote to memory of 3184 4160 dddjj.exe 91 PID 4160 wrote to memory of 3184 4160 dddjj.exe 91 PID 4160 wrote to memory of 3184 4160 dddjj.exe 91 PID 3184 wrote to memory of 220 3184 xrllxxr.exe 92 PID 3184 wrote to memory of 220 3184 xrllxxr.exe 92 PID 3184 wrote to memory of 220 3184 xrllxxr.exe 92 PID 220 wrote to memory of 868 220 jdjpp.exe 93 PID 220 wrote to memory of 868 220 jdjpp.exe 93 PID 220 wrote to memory of 868 220 jdjpp.exe 93 PID 868 wrote to memory of 1092 868 1hhbbh.exe 94 PID 868 wrote to memory of 1092 868 1hhbbh.exe 94 PID 868 wrote to memory of 1092 868 1hhbbh.exe 94 PID 1092 wrote to memory of 2568 1092 rxxlllf.exe 95 PID 1092 wrote to memory of 2568 1092 rxxlllf.exe 95 PID 1092 wrote to memory of 2568 1092 rxxlllf.exe 95 PID 2568 wrote to memory of 2936 2568 9hnhbb.exe 96 PID 2568 wrote to memory of 2936 2568 9hnhbb.exe 96 PID 2568 wrote to memory of 2936 2568 9hnhbb.exe 96 PID 2936 wrote to memory of 1724 2936 nhhbhh.exe 97 PID 2936 wrote to memory of 1724 2936 nhhbhh.exe 97 PID 2936 wrote to memory of 1724 2936 nhhbhh.exe 97 PID 1724 wrote to memory of 1632 1724 nnnnnn.exe 98 PID 1724 wrote to memory of 1632 1724 nnnnnn.exe 98 PID 1724 wrote to memory of 1632 1724 nnnnnn.exe 98 PID 1632 wrote to memory of 1196 1632 7vddv.exe 99 PID 1632 wrote to memory of 1196 1632 7vddv.exe 99 PID 1632 wrote to memory of 1196 1632 7vddv.exe 99 PID 1196 wrote to memory of 3576 1196 7hhbtt.exe 100 PID 1196 wrote to memory of 3576 1196 7hhbtt.exe 100 PID 1196 wrote to memory of 3576 1196 7hhbtt.exe 100 PID 3576 wrote to memory of 4628 3576 9lxrxxf.exe 101 PID 3576 wrote to memory of 4628 3576 9lxrxxf.exe 101 PID 3576 wrote to memory of 4628 3576 9lxrxxf.exe 101 PID 4628 wrote to memory of 344 4628 tttbbt.exe 102 PID 4628 wrote to memory of 344 4628 tttbbt.exe 102 PID 4628 wrote to memory of 344 4628 tttbbt.exe 102 PID 344 wrote to memory of 2608 344 jjpjj.exe 103 PID 344 wrote to memory of 2608 344 jjpjj.exe 103 PID 344 wrote to memory of 2608 344 jjpjj.exe 103 PID 2608 wrote to memory of 436 2608 7lffxfx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb57eb3a2a2c85c05c90c0af54720afac4aa06c2041236b1d6190bcf56a49971.exe"C:\Users\Admin\AppData\Local\Temp\eb57eb3a2a2c85c05c90c0af54720afac4aa06c2041236b1d6190bcf56a49971.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\lffxfxx.exec:\lffxfxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\httnnb.exec:\httnnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\vjjdv.exec:\vjjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\ttnnhn.exec:\ttnnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\hbbbbb.exec:\hbbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\llrrlrr.exec:\llrrlrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\1llfffx.exec:\1llfffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\dddjj.exec:\dddjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\xrllxxr.exec:\xrllxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\jdjpp.exec:\jdjpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\1hhbbh.exec:\1hhbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\rxxlllf.exec:\rxxlllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\9hnhbb.exec:\9hnhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\nhhbhh.exec:\nhhbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\nnnnnn.exec:\nnnnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\7vddv.exec:\7vddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\7hhbtt.exec:\7hhbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\9lxrxxf.exec:\9lxrxxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\tttbbt.exec:\tttbbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\jjpjj.exec:\jjpjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\7lffxfx.exec:\7lffxfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\5ttnhh.exec:\5ttnhh.exe23⤵
- Executes dropped EXE
PID:436 -
\??\c:\pjdpp.exec:\pjdpp.exe24⤵
- Executes dropped EXE
PID:1192 -
\??\c:\xflllll.exec:\xflllll.exe25⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hbhbhh.exec:\hbhbhh.exe26⤵
- Executes dropped EXE
PID:3660 -
\??\c:\vjdvj.exec:\vjdvj.exe27⤵
- Executes dropped EXE
PID:1416 -
\??\c:\jjvpj.exec:\jjvpj.exe28⤵
- Executes dropped EXE
PID:2460 -
\??\c:\ddvjp.exec:\ddvjp.exe29⤵
- Executes dropped EXE
PID:3000 -
\??\c:\pvpdd.exec:\pvpdd.exe30⤵
- Executes dropped EXE
PID:4660 -
\??\c:\llrlxxr.exec:\llrlxxr.exe31⤵
- Executes dropped EXE
PID:4416 -
\??\c:\bnbtnn.exec:\bnbtnn.exe32⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xflfxrl.exec:\xflfxrl.exe33⤵
- Executes dropped EXE
PID:4432 -
\??\c:\thnnhh.exec:\thnnhh.exe34⤵
- Executes dropped EXE
PID:952 -
\??\c:\fflfxxr.exec:\fflfxxr.exe35⤵
- Executes dropped EXE
PID:1716 -
\??\c:\hntnhh.exec:\hntnhh.exe36⤵
- Executes dropped EXE
PID:4600 -
\??\c:\jpjjj.exec:\jpjjj.exe37⤵
- Executes dropped EXE
PID:4412 -
\??\c:\xxffrxx.exec:\xxffrxx.exe38⤵
- Executes dropped EXE
PID:4144 -
\??\c:\tttnnt.exec:\tttnnt.exe39⤵
- Executes dropped EXE
PID:2220 -
\??\c:\9vpjp.exec:\9vpjp.exe40⤵
- Executes dropped EXE
PID:4084 -
\??\c:\xxfxrll.exec:\xxfxrll.exe41⤵
- Executes dropped EXE
PID:1556 -
\??\c:\nthhbh.exec:\nthhbh.exe42⤵
- Executes dropped EXE
PID:3936 -
\??\c:\vdjjd.exec:\vdjjd.exe43⤵
- Executes dropped EXE
PID:3600 -
\??\c:\lflffff.exec:\lflffff.exe44⤵
- Executes dropped EXE
PID:2424 -
\??\c:\thhbhh.exec:\thhbhh.exe45⤵
- Executes dropped EXE
PID:2308 -
\??\c:\djvvp.exec:\djvvp.exe46⤵
- Executes dropped EXE
PID:4916 -
\??\c:\xfrlrrl.exec:\xfrlrrl.exe47⤵
- Executes dropped EXE
PID:4296 -
\??\c:\pdvpj.exec:\pdvpj.exe48⤵
- Executes dropped EXE
PID:468 -
\??\c:\vpdvd.exec:\vpdvd.exe49⤵
- Executes dropped EXE
PID:3860 -
\??\c:\xflllll.exec:\xflllll.exe50⤵
- Executes dropped EXE
PID:1792 -
\??\c:\btnntb.exec:\btnntb.exe51⤵
- Executes dropped EXE
PID:3716 -
\??\c:\pvjjp.exec:\pvjjp.exe52⤵
- Executes dropped EXE
PID:4400 -
\??\c:\httbnt.exec:\httbnt.exe53⤵
- Executes dropped EXE
PID:2204 -
\??\c:\dvvpj.exec:\dvvpj.exe54⤵
- Executes dropped EXE
PID:1172 -
\??\c:\xfrrxfl.exec:\xfrrxfl.exe55⤵
- Executes dropped EXE
PID:4108 -
\??\c:\tthhbb.exec:\tthhbb.exe56⤵
- Executes dropped EXE
PID:3444 -
\??\c:\jjjdd.exec:\jjjdd.exe57⤵
- Executes dropped EXE
PID:3952 -
\??\c:\lxxrfxl.exec:\lxxrfxl.exe58⤵
- Executes dropped EXE
PID:2436 -
\??\c:\7tbbhn.exec:\7tbbhn.exe59⤵
- Executes dropped EXE
PID:404 -
\??\c:\jpvvv.exec:\jpvvv.exe60⤵
- Executes dropped EXE
PID:1532 -
\??\c:\ppvvp.exec:\ppvvp.exe61⤵
- Executes dropped EXE
PID:320 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe62⤵
- Executes dropped EXE
PID:780 -
\??\c:\tttnth.exec:\tttnth.exe63⤵
- Executes dropped EXE
PID:2000 -
\??\c:\3vjdj.exec:\3vjdj.exe64⤵
- Executes dropped EXE
PID:3620 -
\??\c:\3rlfxxx.exec:\3rlfxxx.exe65⤵
- Executes dropped EXE
PID:640 -
\??\c:\rrlfffx.exec:\rrlfffx.exe66⤵PID:5084
-
\??\c:\btnnnn.exec:\btnnnn.exe67⤵PID:5076
-
\??\c:\jjvvd.exec:\jjvvd.exe68⤵PID:1576
-
\??\c:\fflffff.exec:\fflffff.exe69⤵PID:2176
-
\??\c:\vjjdv.exec:\vjjdv.exe70⤵PID:3412
-
\??\c:\vvddv.exec:\vvddv.exe71⤵PID:1660
-
\??\c:\7rxrllx.exec:\7rxrllx.exe72⤵PID:3092
-
\??\c:\bhnnhh.exec:\bhnnhh.exe73⤵PID:3020
-
\??\c:\jpvpp.exec:\jpvpp.exe74⤵PID:1960
-
\??\c:\1rrrrrr.exec:\1rrrrrr.exe75⤵PID:5060
-
\??\c:\1flfxxx.exec:\1flfxxx.exe76⤵PID:5008
-
\??\c:\nttnhh.exec:\nttnhh.exe77⤵PID:2332
-
\??\c:\1vppj.exec:\1vppj.exe78⤵PID:3484
-
\??\c:\xxlfxrr.exec:\xxlfxrr.exe79⤵PID:1152
-
\??\c:\frllfrx.exec:\frllfrx.exe80⤵
- System Location Discovery: System Language Discovery
PID:3588 -
\??\c:\nntnnn.exec:\nntnnn.exe81⤵PID:4456
-
\??\c:\pjjpd.exec:\pjjpd.exe82⤵PID:4004
-
\??\c:\xxffxll.exec:\xxffxll.exe83⤵PID:2700
-
\??\c:\7btnnt.exec:\7btnnt.exe84⤵PID:3272
-
\??\c:\jdddd.exec:\jdddd.exe85⤵PID:3472
-
\??\c:\xfffxxf.exec:\xfffxxf.exe86⤵PID:2080
-
\??\c:\ntnhhh.exec:\ntnhhh.exe87⤵PID:4616
-
\??\c:\5jpjj.exec:\5jpjj.exe88⤵PID:4776
-
\??\c:\rllfflr.exec:\rllfflr.exe89⤵PID:3448
-
\??\c:\bttbht.exec:\bttbht.exe90⤵PID:540
-
\??\c:\ddvvv.exec:\ddvvv.exe91⤵PID:3500
-
\??\c:\fxfflfl.exec:\fxfflfl.exe92⤵PID:3000
-
\??\c:\frfxxxx.exec:\frfxxxx.exe93⤵PID:2944
-
\??\c:\bbnttt.exec:\bbnttt.exe94⤵PID:4496
-
\??\c:\jdjdd.exec:\jdjdd.exe95⤵PID:4504
-
\??\c:\xlffxrr.exec:\xlffxrr.exe96⤵PID:1236
-
\??\c:\hbtbnb.exec:\hbtbnb.exe97⤵PID:2604
-
\??\c:\vdjjd.exec:\vdjjd.exe98⤵PID:3652
-
\??\c:\rlfxfll.exec:\rlfxfll.exe99⤵PID:1044
-
\??\c:\xrfxxff.exec:\xrfxxff.exe100⤵PID:4956
-
\??\c:\3jjdv.exec:\3jjdv.exe101⤵PID:388
-
\??\c:\1ffxxfx.exec:\1ffxxfx.exe102⤵PID:4280
-
\??\c:\ffxxxxr.exec:\ffxxxxr.exe103⤵PID:3960
-
\??\c:\nbtnnn.exec:\nbtnnn.exe104⤵PID:2544
-
\??\c:\pdppj.exec:\pdppj.exe105⤵PID:3804
-
\??\c:\vvdjj.exec:\vvdjj.exe106⤵PID:4988
-
\??\c:\9rrllrx.exec:\9rrllrx.exe107⤵PID:2388
-
\??\c:\nbhbtt.exec:\nbhbtt.exe108⤵PID:4876
-
\??\c:\pdjdd.exec:\pdjdd.exe109⤵PID:1048
-
\??\c:\1rrlllf.exec:\1rrlllf.exe110⤵PID:1900
-
\??\c:\7tnnhn.exec:\7tnnhn.exe111⤵PID:4072
-
\??\c:\ttbbtb.exec:\ttbbtb.exe112⤵PID:1560
-
\??\c:\pdjpd.exec:\pdjpd.exe113⤵
- System Location Discovery: System Language Discovery
PID:4824 -
\??\c:\xrfrfxf.exec:\xrfrfxf.exe114⤵PID:232
-
\??\c:\hhbttn.exec:\hhbttn.exe115⤵PID:3220
-
\??\c:\dvdvp.exec:\dvdvp.exe116⤵PID:4284
-
\??\c:\jppvp.exec:\jppvp.exe117⤵PID:3716
-
\??\c:\rrrxrrl.exec:\rrrxrrl.exe118⤵PID:3772
-
\??\c:\1nhhhh.exec:\1nhhhh.exe119⤵PID:2884
-
\??\c:\5jppp.exec:\5jppp.exe120⤵PID:1552
-
\??\c:\5djdd.exec:\5djdd.exe121⤵PID:1096
-
\??\c:\rllfxxr.exec:\rllfxxr.exe122⤵PID:4744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-