Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 03:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe
-
Size
453KB
-
MD5
04fc4f3237ec8bfb841a240dd4235a2c
-
SHA1
a70ee0996f9b06cf76ba95f19de28126c2c78bf1
-
SHA256
17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48
-
SHA512
2ea2754785469ee527d7398cb05a7f7cbb49c6660963a6b906a7133aba47ff75b31099ce8f01e910bf8545a721cc74c46f560dcc295c696d1bc9f76e72f855f2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeO:q7Tc2NYHUrAwfMp3CDO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/3836-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/112-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2068-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2624-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/888-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1256-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/112-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/700-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-1908-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3836 frfrfxl.exe 2360 nbbntn.exe 4868 9lfrxrl.exe 3000 fflxlfr.exe 4556 hthnht.exe 3700 rfllflx.exe 392 jjvjv.exe 112 tttthh.exe 404 1hbnbn.exe 4076 ddjvj.exe 1128 fxfxfxr.exe 536 3xxlrfl.exe 3604 nhhthn.exe 4888 flrffxx.exe 2552 dvdvv.exe 3592 lfxlfxl.exe 2068 9thtnh.exe 2640 9vvjv.exe 2372 xlfxlfr.exe 3332 vjjdp.exe 2480 hnnbnh.exe 1032 7jjvd.exe 1304 3lrxrlx.exe 4472 bhnbtn.exe 3512 nhbnbn.exe 4820 vddpd.exe 4580 ddjpj.exe 2040 5llfrrf.exe 316 vpjdv.exe 3500 5pvdp.exe 3952 lflxxxx.exe 1048 9llffxx.exe 4780 1jdpd.exe 3708 vddjv.exe 2880 rffrrrf.exe 2032 9rfrlfx.exe 532 tnhbtn.exe 3464 dpjjd.exe 2624 fxrfrrf.exe 5104 1hbthh.exe 2308 nhbntn.exe 1716 vjddv.exe 4384 7rrflfx.exe 4632 rlflfxl.exe 3496 nbhtht.exe 1720 jpddj.exe 3656 flfrfxr.exe 5064 3lfrffl.exe 888 nnbttb.exe 1752 9jjpp.exe 976 3pdpd.exe 2284 rrxlxxl.exe 1312 7nnbnh.exe 4704 jvpdp.exe 3256 3pjvj.exe 1256 lrrfflx.exe 392 3llxlxl.exe 112 3bthtn.exe 4460 vpdvj.exe 924 lflxllx.exe 4076 3hbthb.exe 3452 ttthtn.exe 3008 9ppvj.exe 4680 fffrfxl.exe -
resource yara_rule behavioral2/memory/3836-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/112-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2624-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/888-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1256-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/112-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/700-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-998-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3496 wrote to memory of 3836 3496 17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe 82 PID 3496 wrote to memory of 3836 3496 17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe 82 PID 3496 wrote to memory of 3836 3496 17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe 82 PID 3836 wrote to memory of 2360 3836 frfrfxl.exe 83 PID 3836 wrote to memory of 2360 3836 frfrfxl.exe 83 PID 3836 wrote to memory of 2360 3836 frfrfxl.exe 83 PID 2360 wrote to memory of 4868 2360 nbbntn.exe 84 PID 2360 wrote to memory of 4868 2360 nbbntn.exe 84 PID 2360 wrote to memory of 4868 2360 nbbntn.exe 84 PID 4868 wrote to memory of 3000 4868 9lfrxrl.exe 85 PID 4868 wrote to memory of 3000 4868 9lfrxrl.exe 85 PID 4868 wrote to memory of 3000 4868 9lfrxrl.exe 85 PID 3000 wrote to memory of 4556 3000 fflxlfr.exe 86 PID 3000 wrote to memory of 4556 3000 fflxlfr.exe 86 PID 3000 wrote to memory of 4556 3000 fflxlfr.exe 86 PID 4556 wrote to memory of 3700 4556 hthnht.exe 87 PID 4556 wrote to memory of 3700 4556 hthnht.exe 87 PID 4556 wrote to memory of 3700 4556 hthnht.exe 87 PID 3700 wrote to memory of 392 3700 rfllflx.exe 88 PID 3700 wrote to memory of 392 3700 rfllflx.exe 88 PID 3700 wrote to memory of 392 3700 rfllflx.exe 88 PID 392 wrote to memory of 112 392 jjvjv.exe 89 PID 392 wrote to memory of 112 392 jjvjv.exe 89 PID 392 wrote to memory of 112 392 jjvjv.exe 89 PID 112 wrote to memory of 404 112 tttthh.exe 90 PID 112 wrote to memory of 404 112 tttthh.exe 90 PID 112 wrote to memory of 404 112 tttthh.exe 90 PID 404 wrote to memory of 4076 404 1hbnbn.exe 91 PID 404 wrote to memory of 4076 404 1hbnbn.exe 91 PID 404 wrote to memory of 4076 404 1hbnbn.exe 91 PID 4076 wrote to memory of 1128 4076 ddjvj.exe 92 PID 4076 wrote to memory of 1128 4076 ddjvj.exe 92 PID 4076 wrote to memory of 1128 4076 ddjvj.exe 92 PID 1128 wrote to memory of 536 1128 fxfxfxr.exe 93 PID 1128 wrote to memory of 536 1128 fxfxfxr.exe 93 PID 1128 wrote to memory of 536 1128 fxfxfxr.exe 93 PID 536 wrote to memory of 3604 536 3xxlrfl.exe 94 PID 536 wrote to memory of 3604 536 3xxlrfl.exe 94 PID 536 wrote to memory of 3604 536 3xxlrfl.exe 94 PID 3604 wrote to memory of 4888 3604 nhhthn.exe 95 PID 3604 wrote to memory of 4888 3604 nhhthn.exe 95 PID 3604 wrote to memory of 4888 3604 nhhthn.exe 95 PID 4888 wrote to memory of 2552 4888 flrffxx.exe 96 PID 4888 wrote to memory of 2552 4888 flrffxx.exe 96 PID 4888 wrote to memory of 2552 4888 flrffxx.exe 96 PID 2552 wrote to memory of 3592 2552 dvdvv.exe 97 PID 2552 wrote to memory of 3592 2552 dvdvv.exe 97 PID 2552 wrote to memory of 3592 2552 dvdvv.exe 97 PID 3592 wrote to memory of 2068 3592 lfxlfxl.exe 98 PID 3592 wrote to memory of 2068 3592 lfxlfxl.exe 98 PID 3592 wrote to memory of 2068 3592 lfxlfxl.exe 98 PID 2068 wrote to memory of 2640 2068 9thtnh.exe 99 PID 2068 wrote to memory of 2640 2068 9thtnh.exe 99 PID 2068 wrote to memory of 2640 2068 9thtnh.exe 99 PID 2640 wrote to memory of 2372 2640 9vvjv.exe 100 PID 2640 wrote to memory of 2372 2640 9vvjv.exe 100 PID 2640 wrote to memory of 2372 2640 9vvjv.exe 100 PID 2372 wrote to memory of 3332 2372 xlfxlfr.exe 101 PID 2372 wrote to memory of 3332 2372 xlfxlfr.exe 101 PID 2372 wrote to memory of 3332 2372 xlfxlfr.exe 101 PID 3332 wrote to memory of 2480 3332 vjjdp.exe 102 PID 3332 wrote to memory of 2480 3332 vjjdp.exe 102 PID 3332 wrote to memory of 2480 3332 vjjdp.exe 102 PID 2480 wrote to memory of 1032 2480 hnnbnh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe"C:\Users\Admin\AppData\Local\Temp\17ce41e2302954c4cf2a71fc85e6a1438f6010dd0aafe0b9a032dc53541d7e48.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\frfrfxl.exec:\frfrfxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\nbbntn.exec:\nbbntn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\9lfrxrl.exec:\9lfrxrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\fflxlfr.exec:\fflxlfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\hthnht.exec:\hthnht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\rfllflx.exec:\rfllflx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\jjvjv.exec:\jjvjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\tttthh.exec:\tttthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\1hbnbn.exec:\1hbnbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\ddjvj.exec:\ddjvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\fxfxfxr.exec:\fxfxfxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\3xxlrfl.exec:\3xxlrfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\nhhthn.exec:\nhhthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\flrffxx.exec:\flrffxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\dvdvv.exec:\dvdvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\lfxlfxl.exec:\lfxlfxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\9thtnh.exec:\9thtnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\9vvjv.exec:\9vvjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\xlfxlfr.exec:\xlfxlfr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\vjjdp.exec:\vjjdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\hnnbnh.exec:\hnnbnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\7jjvd.exec:\7jjvd.exe23⤵
- Executes dropped EXE
PID:1032 -
\??\c:\3lrxrlx.exec:\3lrxrlx.exe24⤵
- Executes dropped EXE
PID:1304 -
\??\c:\bhnbtn.exec:\bhnbtn.exe25⤵
- Executes dropped EXE
PID:4472 -
\??\c:\nhbnbn.exec:\nhbnbn.exe26⤵
- Executes dropped EXE
PID:3512 -
\??\c:\vddpd.exec:\vddpd.exe27⤵
- Executes dropped EXE
PID:4820 -
\??\c:\ddjpj.exec:\ddjpj.exe28⤵
- Executes dropped EXE
PID:4580 -
\??\c:\5llfrrf.exec:\5llfrrf.exe29⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vpjdv.exec:\vpjdv.exe30⤵
- Executes dropped EXE
PID:316 -
\??\c:\5pvdp.exec:\5pvdp.exe31⤵
- Executes dropped EXE
PID:3500 -
\??\c:\lflxxxx.exec:\lflxxxx.exe32⤵
- Executes dropped EXE
PID:3952 -
\??\c:\9llffxx.exec:\9llffxx.exe33⤵
- Executes dropped EXE
PID:1048 -
\??\c:\1jdpd.exec:\1jdpd.exe34⤵
- Executes dropped EXE
PID:4780 -
\??\c:\vddjv.exec:\vddjv.exe35⤵
- Executes dropped EXE
PID:3708 -
\??\c:\rffrrrf.exec:\rffrrrf.exe36⤵
- Executes dropped EXE
PID:2880 -
\??\c:\9rfrlfx.exec:\9rfrlfx.exe37⤵
- Executes dropped EXE
PID:2032 -
\??\c:\tnhbtn.exec:\tnhbtn.exe38⤵
- Executes dropped EXE
PID:532 -
\??\c:\dpjjd.exec:\dpjjd.exe39⤵
- Executes dropped EXE
PID:3464 -
\??\c:\fxrfrrf.exec:\fxrfrrf.exe40⤵
- Executes dropped EXE
PID:2624 -
\??\c:\1hbthh.exec:\1hbthh.exe41⤵
- Executes dropped EXE
PID:5104 -
\??\c:\nhbntn.exec:\nhbntn.exe42⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vjddv.exec:\vjddv.exe43⤵
- Executes dropped EXE
PID:1716 -
\??\c:\7rrflfx.exec:\7rrflfx.exe44⤵
- Executes dropped EXE
PID:4384 -
\??\c:\rlflfxl.exec:\rlflfxl.exe45⤵
- Executes dropped EXE
PID:4632 -
\??\c:\nbhtht.exec:\nbhtht.exe46⤵
- Executes dropped EXE
PID:3496 -
\??\c:\jpddj.exec:\jpddj.exe47⤵
- Executes dropped EXE
PID:1720 -
\??\c:\flfrfxr.exec:\flfrfxr.exe48⤵
- Executes dropped EXE
PID:3656 -
\??\c:\3lfrffl.exec:\3lfrffl.exe49⤵
- Executes dropped EXE
PID:5064 -
\??\c:\nnbttb.exec:\nnbttb.exe50⤵
- Executes dropped EXE
PID:888 -
\??\c:\9jjpp.exec:\9jjpp.exe51⤵
- Executes dropped EXE
PID:1752 -
\??\c:\3pdpd.exec:\3pdpd.exe52⤵
- Executes dropped EXE
PID:976 -
\??\c:\rrxlxxl.exec:\rrxlxxl.exe53⤵
- Executes dropped EXE
PID:2284 -
\??\c:\7nnbnh.exec:\7nnbnh.exe54⤵
- Executes dropped EXE
PID:1312 -
\??\c:\jvpdp.exec:\jvpdp.exe55⤵
- Executes dropped EXE
PID:4704 -
\??\c:\3pjvj.exec:\3pjvj.exe56⤵
- Executes dropped EXE
PID:3256 -
\??\c:\lrrfflx.exec:\lrrfflx.exe57⤵
- Executes dropped EXE
PID:1256 -
\??\c:\3llxlxl.exec:\3llxlxl.exe58⤵
- Executes dropped EXE
PID:392 -
\??\c:\3bthtn.exec:\3bthtn.exe59⤵
- Executes dropped EXE
PID:112 -
\??\c:\vpdvj.exec:\vpdvj.exe60⤵
- Executes dropped EXE
PID:4460 -
\??\c:\lflxllx.exec:\lflxllx.exe61⤵
- Executes dropped EXE
PID:924 -
\??\c:\3hbthb.exec:\3hbthb.exe62⤵
- Executes dropped EXE
PID:4076 -
\??\c:\ttthtn.exec:\ttthtn.exe63⤵
- Executes dropped EXE
PID:3452 -
\??\c:\9ppvj.exec:\9ppvj.exe64⤵
- Executes dropped EXE
PID:3008 -
\??\c:\fffrfxl.exec:\fffrfxl.exe65⤵
- Executes dropped EXE
PID:4680 -
\??\c:\1ththb.exec:\1ththb.exe66⤵PID:3372
-
\??\c:\bbbthb.exec:\bbbthb.exe67⤵PID:4236
-
\??\c:\3vvjd.exec:\3vvjd.exe68⤵PID:3432
-
\??\c:\1xxlxrf.exec:\1xxlxrf.exe69⤵PID:3740
-
\??\c:\bbtnbh.exec:\bbtnbh.exe70⤵PID:5060
-
\??\c:\dvdvp.exec:\dvdvp.exe71⤵PID:3084
-
\??\c:\vpddv.exec:\vpddv.exe72⤵PID:2964
-
\??\c:\rflxrlf.exec:\rflxrlf.exe73⤵PID:756
-
\??\c:\5btnhb.exec:\5btnhb.exe74⤵PID:4048
-
\??\c:\9djvd.exec:\9djvd.exe75⤵PID:3840
-
\??\c:\jpjdp.exec:\jpjdp.exe76⤵PID:3120
-
\??\c:\frlfrrf.exec:\frlfrrf.exe77⤵PID:2736
-
\??\c:\3bnhht.exec:\3bnhht.exe78⤵PID:2528
-
\??\c:\hnnhtn.exec:\hnnhtn.exe79⤵PID:5072
-
\??\c:\dvpjp.exec:\dvpjp.exe80⤵PID:412
-
\??\c:\1jdpd.exec:\1jdpd.exe81⤵PID:2080
-
\??\c:\lrrfxrx.exec:\lrrfxrx.exe82⤵PID:4456
-
\??\c:\hthtbn.exec:\hthtbn.exe83⤵PID:4364
-
\??\c:\vdddp.exec:\vdddp.exe84⤵PID:4120
-
\??\c:\pdpjp.exec:\pdpjp.exe85⤵PID:1960
-
\??\c:\ffrlrlf.exec:\ffrlrlf.exe86⤵PID:4056
-
\??\c:\hntbth.exec:\hntbth.exe87⤵PID:2296
-
\??\c:\3bbnnn.exec:\3bbnnn.exe88⤵PID:700
-
\??\c:\vjjvj.exec:\vjjvj.exe89⤵PID:5020
-
\??\c:\9ththb.exec:\9ththb.exe90⤵PID:4908
-
\??\c:\djjdd.exec:\djjdd.exe91⤵PID:1104
-
\??\c:\9rxrxfl.exec:\9rxrxfl.exe92⤵PID:2088
-
\??\c:\5llxrll.exec:\5llxrll.exe93⤵PID:4104
-
\??\c:\ttbnbt.exec:\ttbnbt.exe94⤵PID:4688
-
\??\c:\vjjvv.exec:\vjjvv.exe95⤵PID:5076
-
\??\c:\jddvd.exec:\jddvd.exe96⤵PID:4276
-
\??\c:\9llfxrr.exec:\9llfxrr.exe97⤵PID:2728
-
\??\c:\hhbthh.exec:\hhbthh.exe98⤵PID:1540
-
\??\c:\1dpdj.exec:\1dpdj.exe99⤵PID:3924
-
\??\c:\rllxlxl.exec:\rllxlxl.exe100⤵PID:3440
-
\??\c:\7nhtbt.exec:\7nhtbt.exe101⤵PID:1336
-
\??\c:\vpppp.exec:\vpppp.exe102⤵PID:3936
-
\??\c:\jjpjv.exec:\jjpjv.exe103⤵PID:984
-
\??\c:\xrrlxxx.exec:\xrrlxxx.exe104⤵PID:1604
-
\??\c:\1bbnhn.exec:\1bbnhn.exe105⤵PID:1112
-
\??\c:\9nbhbt.exec:\9nbhbt.exe106⤵PID:4340
-
\??\c:\jpdpj.exec:\jpdpj.exe107⤵PID:2444
-
\??\c:\rxxlxrl.exec:\rxxlxrl.exe108⤵PID:2380
-
\??\c:\3bbtnn.exec:\3bbtnn.exe109⤵PID:4896
-
\??\c:\vpjvp.exec:\vpjvp.exe110⤵PID:3896
-
\??\c:\jvdvp.exec:\jvdvp.exe111⤵PID:4916
-
\??\c:\rffrffr.exec:\rffrffr.exe112⤵PID:4316
-
\??\c:\7tbttt.exec:\7tbttt.exe113⤵PID:3420
-
\??\c:\3nnbhh.exec:\3nnbhh.exe114⤵PID:3620
-
\??\c:\jvvpd.exec:\jvvpd.exe115⤵PID:1396
-
\??\c:\rlrlxxr.exec:\rlrlxxr.exe116⤵PID:4792
-
\??\c:\1rlxrlx.exec:\1rlxrlx.exe117⤵PID:1884
-
\??\c:\bbthnh.exec:\bbthnh.exe118⤵PID:3400
-
\??\c:\dppjj.exec:\dppjj.exe119⤵PID:2848
-
\??\c:\5fffxxr.exec:\5fffxxr.exe120⤵PID:2968
-
\??\c:\lxlfffl.exec:\lxlfffl.exe121⤵
- System Location Discovery: System Language Discovery
PID:3368 -
\??\c:\3hbthb.exec:\3hbthb.exe122⤵
- System Location Discovery: System Language Discovery
PID:1312
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-