Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 02:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
860b943bccff2152aaee105123e57b974c5f623757589997c39dea4cc8441cb0N.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
120 seconds
General
-
Target
860b943bccff2152aaee105123e57b974c5f623757589997c39dea4cc8441cb0N.exe
-
Size
454KB
-
MD5
24bfa7eb216f423710f0bb88f6207010
-
SHA1
ae7368e5502e06875dc6fff647ba86afb7e6890e
-
SHA256
860b943bccff2152aaee105123e57b974c5f623757589997c39dea4cc8441cb0
-
SHA512
44b32493285aaa7c585693c454d8def370614954e7d62b3fe5942fd9776cbcf6571fe8fb68c8403f61d6cb9af894ad44ba3b0576da6bb373005da8d2c6107e73
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbel:q7Tc2NYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4376-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/884-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2988-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2072-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4244-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1328-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1904-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/952-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/988-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1184-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-658-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-734-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4244-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-911-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-957-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-1367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2164 bbhhhn.exe 1724 hbnnnn.exe 884 9nnnhh.exe 1520 rlxxxfr.exe 3284 3hnhhn.exe 1984 ppvvv.exe 4184 nnhhtb.exe 1380 flfxrlf.exe 4676 jdpjv.exe 2728 5nhtth.exe 4160 pdddd.exe 2988 bbbtnn.exe 3472 ddjjd.exe 4112 bntnnt.exe 5020 vjvvv.exe 3080 jdppj.exe 2072 xxxrrrl.exe 4952 hhtnhh.exe 2272 xxxxrrr.exe 5072 ppppp.exe 3224 xxfxrrr.exe 3584 3pvdp.exe 4244 ffllfxx.exe 4636 nntttt.exe 1328 jvjdv.exe 5112 jjddj.exe 2640 lllfxxr.exe 3504 jdppj.exe 4128 7lflxrf.exe 3476 thhhhh.exe 4496 jjppj.exe 2868 xxrrffr.exe 1748 xrfffff.exe 3632 nbbbtn.exe 1616 tnbttt.exe 3680 ppvvp.exe 5080 rrxrlll.exe 3120 5rrrlrl.exe 2696 nbnhbt.exe 4972 pjvvp.exe 4760 xrffxrl.exe 2212 lfffxff.exe 1124 hnnnhh.exe 2064 pjpvp.exe 4528 flxrllr.exe 1980 5tnnnt.exe 1800 ppdvp.exe 3992 dpdjd.exe 4004 fflffxx.exe 412 bnbbth.exe 5096 7tbttt.exe 4608 ddvvv.exe 2980 llrlllx.exe 1592 ffflflf.exe 216 ttbhhn.exe 1652 jppvv.exe 4788 7lfxrrl.exe 2188 tthnnn.exe 3092 htbthh.exe 3568 ddvvv.exe 2964 rlfxrrr.exe 600 nthtnh.exe 1168 dpdpd.exe 2940 rrfrlff.exe -
resource yara_rule behavioral2/memory/4376-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/884-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2988-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2072-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2272-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/952-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/952-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/988-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1184-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-738-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrffllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lrrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4376 wrote to memory of 2164 4376 860b943bccff2152aaee105123e57b974c5f623757589997c39dea4cc8441cb0N.exe 82 PID 4376 wrote to memory of 2164 4376 860b943bccff2152aaee105123e57b974c5f623757589997c39dea4cc8441cb0N.exe 82 PID 4376 wrote to memory of 2164 4376 860b943bccff2152aaee105123e57b974c5f623757589997c39dea4cc8441cb0N.exe 82 PID 2164 wrote to memory of 1724 2164 bbhhhn.exe 83 PID 2164 wrote to memory of 1724 2164 bbhhhn.exe 83 PID 2164 wrote to memory of 1724 2164 bbhhhn.exe 83 PID 1724 wrote to memory of 884 1724 hbnnnn.exe 84 PID 1724 wrote to memory of 884 1724 hbnnnn.exe 84 PID 1724 wrote to memory of 884 1724 hbnnnn.exe 84 PID 884 wrote to memory of 1520 884 9nnnhh.exe 85 PID 884 wrote to memory of 1520 884 9nnnhh.exe 85 PID 884 wrote to memory of 1520 884 9nnnhh.exe 85 PID 1520 wrote to memory of 3284 1520 rlxxxfr.exe 86 PID 1520 wrote to memory of 3284 1520 rlxxxfr.exe 86 PID 1520 wrote to memory of 3284 1520 rlxxxfr.exe 86 PID 3284 wrote to memory of 1984 3284 3hnhhn.exe 87 PID 3284 wrote to memory of 1984 3284 3hnhhn.exe 87 PID 3284 wrote to memory of 1984 3284 3hnhhn.exe 87 PID 1984 wrote to memory of 4184 1984 ppvvv.exe 88 PID 1984 wrote to memory of 4184 1984 ppvvv.exe 88 PID 1984 wrote to memory of 4184 1984 ppvvv.exe 88 PID 4184 wrote to memory of 1380 4184 nnhhtb.exe 89 PID 4184 wrote to memory of 1380 4184 nnhhtb.exe 89 PID 4184 wrote to memory of 1380 4184 nnhhtb.exe 89 PID 1380 wrote to memory of 4676 1380 flfxrlf.exe 90 PID 1380 wrote to memory of 4676 1380 flfxrlf.exe 90 PID 1380 wrote to memory of 4676 1380 flfxrlf.exe 90 PID 4676 wrote to memory of 2728 4676 jdpjv.exe 91 PID 4676 wrote to memory of 2728 4676 jdpjv.exe 91 PID 4676 wrote to memory of 2728 4676 jdpjv.exe 91 PID 2728 wrote to memory of 4160 2728 5nhtth.exe 92 PID 2728 wrote to memory of 4160 2728 5nhtth.exe 92 PID 2728 wrote to memory of 4160 2728 5nhtth.exe 92 PID 4160 wrote to memory of 2988 4160 pdddd.exe 93 PID 4160 wrote to memory of 2988 4160 pdddd.exe 93 PID 4160 wrote to memory of 2988 4160 pdddd.exe 93 PID 2988 wrote to memory of 3472 2988 bbbtnn.exe 94 PID 2988 wrote to memory of 3472 2988 bbbtnn.exe 94 PID 2988 wrote to memory of 3472 2988 bbbtnn.exe 94 PID 3472 wrote to memory of 4112 3472 ddjjd.exe 95 PID 3472 wrote to memory of 4112 3472 ddjjd.exe 95 PID 3472 wrote to memory of 4112 3472 ddjjd.exe 95 PID 4112 wrote to memory of 5020 4112 bntnnt.exe 96 PID 4112 wrote to memory of 5020 4112 bntnnt.exe 96 PID 4112 wrote to memory of 5020 4112 bntnnt.exe 96 PID 5020 wrote to memory of 3080 5020 vjvvv.exe 97 PID 5020 wrote to memory of 3080 5020 vjvvv.exe 97 PID 5020 wrote to memory of 3080 5020 vjvvv.exe 97 PID 3080 wrote to memory of 2072 3080 jdppj.exe 98 PID 3080 wrote to memory of 2072 3080 jdppj.exe 98 PID 3080 wrote to memory of 2072 3080 jdppj.exe 98 PID 2072 wrote to memory of 4952 2072 xxxrrrl.exe 99 PID 2072 wrote to memory of 4952 2072 xxxrrrl.exe 99 PID 2072 wrote to memory of 4952 2072 xxxrrrl.exe 99 PID 4952 wrote to memory of 2272 4952 hhtnhh.exe 100 PID 4952 wrote to memory of 2272 4952 hhtnhh.exe 100 PID 4952 wrote to memory of 2272 4952 hhtnhh.exe 100 PID 2272 wrote to memory of 5072 2272 xxxxrrr.exe 101 PID 2272 wrote to memory of 5072 2272 xxxxrrr.exe 101 PID 2272 wrote to memory of 5072 2272 xxxxrrr.exe 101 PID 5072 wrote to memory of 3224 5072 ppppp.exe 102 PID 5072 wrote to memory of 3224 5072 ppppp.exe 102 PID 5072 wrote to memory of 3224 5072 ppppp.exe 102 PID 3224 wrote to memory of 3584 3224 xxfxrrr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\860b943bccff2152aaee105123e57b974c5f623757589997c39dea4cc8441cb0N.exe"C:\Users\Admin\AppData\Local\Temp\860b943bccff2152aaee105123e57b974c5f623757589997c39dea4cc8441cb0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\bbhhhn.exec:\bbhhhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\hbnnnn.exec:\hbnnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\9nnnhh.exec:\9nnnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\rlxxxfr.exec:\rlxxxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\3hnhhn.exec:\3hnhhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\ppvvv.exec:\ppvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\nnhhtb.exec:\nnhhtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\flfxrlf.exec:\flfxrlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\jdpjv.exec:\jdpjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\5nhtth.exec:\5nhtth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\pdddd.exec:\pdddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\bbbtnn.exec:\bbbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\ddjjd.exec:\ddjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\bntnnt.exec:\bntnnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\vjvvv.exec:\vjvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\jdppj.exec:\jdppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\xxxrrrl.exec:\xxxrrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\hhtnhh.exec:\hhtnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\xxxxrrr.exec:\xxxxrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\ppppp.exec:\ppppp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\xxfxrrr.exec:\xxfxrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\3pvdp.exec:\3pvdp.exe23⤵
- Executes dropped EXE
PID:3584 -
\??\c:\ffllfxx.exec:\ffllfxx.exe24⤵
- Executes dropped EXE
PID:4244 -
\??\c:\nntttt.exec:\nntttt.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4636 -
\??\c:\jvjdv.exec:\jvjdv.exe26⤵
- Executes dropped EXE
PID:1328 -
\??\c:\jjddj.exec:\jjddj.exe27⤵
- Executes dropped EXE
PID:5112 -
\??\c:\lllfxxr.exec:\lllfxxr.exe28⤵
- Executes dropped EXE
PID:2640 -
\??\c:\jdppj.exec:\jdppj.exe29⤵
- Executes dropped EXE
PID:3504 -
\??\c:\7lflxrf.exec:\7lflxrf.exe30⤵
- Executes dropped EXE
PID:4128 -
\??\c:\thhhhh.exec:\thhhhh.exe31⤵
- Executes dropped EXE
PID:3476 -
\??\c:\jjppj.exec:\jjppj.exe32⤵
- Executes dropped EXE
PID:4496 -
\??\c:\xxrrffr.exec:\xxrrffr.exe33⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xrfffff.exec:\xrfffff.exe34⤵
- Executes dropped EXE
PID:1748 -
\??\c:\nbbbtn.exec:\nbbbtn.exe35⤵
- Executes dropped EXE
PID:3632 -
\??\c:\tnbttt.exec:\tnbttt.exe36⤵
- Executes dropped EXE
PID:1616 -
\??\c:\ppvvp.exec:\ppvvp.exe37⤵
- Executes dropped EXE
PID:3680 -
\??\c:\rrxrlll.exec:\rrxrlll.exe38⤵
- Executes dropped EXE
PID:5080 -
\??\c:\5rrrlrl.exec:\5rrrlrl.exe39⤵
- Executes dropped EXE
PID:3120 -
\??\c:\nbnhbt.exec:\nbnhbt.exe40⤵
- Executes dropped EXE
PID:2696 -
\??\c:\pjvvp.exec:\pjvvp.exe41⤵
- Executes dropped EXE
PID:4972 -
\??\c:\xrffxrl.exec:\xrffxrl.exe42⤵
- Executes dropped EXE
PID:4760 -
\??\c:\lfffxff.exec:\lfffxff.exe43⤵
- Executes dropped EXE
PID:2212 -
\??\c:\hnnnhh.exec:\hnnnhh.exe44⤵
- Executes dropped EXE
PID:1124 -
\??\c:\pjpvp.exec:\pjpvp.exe45⤵
- Executes dropped EXE
PID:2064 -
\??\c:\flxrllr.exec:\flxrllr.exe46⤵
- Executes dropped EXE
PID:4528 -
\??\c:\5tnnnt.exec:\5tnnnt.exe47⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ppdvp.exec:\ppdvp.exe48⤵
- Executes dropped EXE
PID:1800 -
\??\c:\dpdjd.exec:\dpdjd.exe49⤵
- Executes dropped EXE
PID:3992 -
\??\c:\fflffxx.exec:\fflffxx.exe50⤵
- Executes dropped EXE
PID:4004 -
\??\c:\bnbbth.exec:\bnbbth.exe51⤵
- Executes dropped EXE
PID:412 -
\??\c:\7tbttt.exec:\7tbttt.exe52⤵
- Executes dropped EXE
PID:5096 -
\??\c:\ddvvv.exec:\ddvvv.exe53⤵
- Executes dropped EXE
PID:4608 -
\??\c:\llrlllx.exec:\llrlllx.exe54⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ffflflf.exec:\ffflflf.exe55⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ttbhhn.exec:\ttbhhn.exe56⤵
- Executes dropped EXE
PID:216 -
\??\c:\jppvv.exec:\jppvv.exe57⤵
- Executes dropped EXE
PID:1652 -
\??\c:\7lfxrrl.exec:\7lfxrrl.exe58⤵
- Executes dropped EXE
PID:4788 -
\??\c:\tthnnn.exec:\tthnnn.exe59⤵
- Executes dropped EXE
PID:2188 -
\??\c:\htbthh.exec:\htbthh.exe60⤵
- Executes dropped EXE
PID:3092 -
\??\c:\ddvvv.exec:\ddvvv.exe61⤵
- Executes dropped EXE
PID:3568 -
\??\c:\rlfxrrr.exec:\rlfxrrr.exe62⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nthtnh.exec:\nthtnh.exe63⤵
- Executes dropped EXE
PID:600 -
\??\c:\dpdpd.exec:\dpdpd.exe64⤵
- Executes dropped EXE
PID:1168 -
\??\c:\rrfrlff.exec:\rrfrlff.exe65⤵
- Executes dropped EXE
PID:2940 -
\??\c:\5tnhhh.exec:\5tnhhh.exe66⤵PID:4268
-
\??\c:\thnntt.exec:\thnntt.exe67⤵PID:4148
-
\??\c:\3ddvp.exec:\3ddvp.exe68⤵PID:1920
-
\??\c:\7rxxlrl.exec:\7rxxlrl.exe69⤵PID:5020
-
\??\c:\tnnhbb.exec:\tnnhbb.exe70⤵PID:932
-
\??\c:\vdjvj.exec:\vdjvj.exe71⤵PID:3128
-
\??\c:\jpvpj.exec:\jpvpj.exe72⤵PID:1904
-
\??\c:\xlrlffx.exec:\xlrlffx.exe73⤵PID:4772
-
\??\c:\nnbbnt.exec:\nnbbnt.exe74⤵PID:2744
-
\??\c:\jdpvd.exec:\jdpvd.exe75⤵PID:232
-
\??\c:\lfflfxr.exec:\lfflfxr.exe76⤵PID:4656
-
\??\c:\thhnnb.exec:\thhnnb.exe77⤵PID:3336
-
\??\c:\ddjvv.exec:\ddjvv.exe78⤵PID:952
-
\??\c:\vppdv.exec:\vppdv.exe79⤵PID:3584
-
\??\c:\fffxrll.exec:\fffxrll.exe80⤵PID:2216
-
\??\c:\btbthh.exec:\btbthh.exe81⤵PID:4104
-
\??\c:\dvddp.exec:\dvddp.exe82⤵PID:988
-
\??\c:\lfxrffl.exec:\lfxrffl.exe83⤵PID:4468
-
\??\c:\ttbbbb.exec:\ttbbbb.exe84⤵PID:4400
-
\??\c:\jjpvv.exec:\jjpvv.exe85⤵PID:3536
-
\??\c:\vjjdv.exec:\vjjdv.exe86⤵PID:3688
-
\??\c:\lffrlfr.exec:\lffrlfr.exe87⤵PID:4596
-
\??\c:\nhhhbb.exec:\nhhhbb.exe88⤵PID:956
-
\??\c:\nbhbtt.exec:\nbhbtt.exe89⤵PID:3460
-
\??\c:\vpppj.exec:\vpppj.exe90⤵PID:2592
-
\??\c:\5xfxlxx.exec:\5xfxlxx.exe91⤵PID:1344
-
\??\c:\9bhnhh.exec:\9bhnhh.exe92⤵PID:2660
-
\??\c:\bbhbnt.exec:\bbhbnt.exe93⤵PID:1192
-
\??\c:\pjpjv.exec:\pjpjv.exe94⤵PID:3240
-
\??\c:\lrxrffr.exec:\lrxrffr.exe95⤵PID:2588
-
\??\c:\ntnnhn.exec:\ntnnhn.exe96⤵PID:548
-
\??\c:\vvjdj.exec:\vvjdj.exe97⤵PID:3680
-
\??\c:\rrxxxxf.exec:\rrxxxxf.exe98⤵PID:2716
-
\??\c:\llxlrll.exec:\llxlrll.exe99⤵PID:380
-
\??\c:\nttnhh.exec:\nttnhh.exe100⤵PID:1488
-
\??\c:\jvdvp.exec:\jvdvp.exe101⤵PID:1316
-
\??\c:\1lrrxxx.exec:\1lrrxxx.exe102⤵PID:1208
-
\??\c:\ffrrrrr.exec:\ffrrrrr.exe103⤵PID:3432
-
\??\c:\nbbbnn.exec:\nbbbnn.exe104⤵PID:1860
-
\??\c:\vjvvv.exec:\vjvvv.exe105⤵PID:4512
-
\??\c:\lrfllrl.exec:\lrfllrl.exe106⤵PID:772
-
\??\c:\9hbtnn.exec:\9hbtnn.exe107⤵PID:1896
-
\??\c:\pjjdp.exec:\pjjdp.exe108⤵PID:4976
-
\??\c:\dvpdv.exec:\dvpdv.exe109⤵PID:2020
-
\??\c:\lrxfrlx.exec:\lrxfrlx.exe110⤵PID:4004
-
\??\c:\btthbn.exec:\btthbn.exe111⤵PID:4828
-
\??\c:\7vjpj.exec:\7vjpj.exe112⤵PID:4540
-
\??\c:\rlrflfr.exec:\rlrflfr.exe113⤵PID:4608
-
\??\c:\rxfxlff.exec:\rxfxlff.exe114⤵PID:2484
-
\??\c:\3nhbnn.exec:\3nhbnn.exe115⤵PID:1592
-
\??\c:\dpvdv.exec:\dpvdv.exe116⤵PID:1604
-
\??\c:\rflfrrl.exec:\rflfrrl.exe117⤵PID:1652
-
\??\c:\1rlfrrf.exec:\1rlfrrf.exe118⤵PID:2424
-
\??\c:\nnnhbb.exec:\nnnhbb.exe119⤵PID:3096
-
\??\c:\pvdpj.exec:\pvdpj.exe120⤵PID:1380
-
\??\c:\rfrrlll.exec:\rfrrlll.exe121⤵PID:3520
-
\??\c:\xrrrlll.exec:\xrrrlll.exe122⤵
- System Location Discovery: System Language Discovery
PID:2728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-