Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 04:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67N.exe
-
Size
455KB
-
MD5
c7f1f4b8ae83f4a1949435c9192845a0
-
SHA1
7fc551e6b21a57f222aa3f10d744ea20b0b9ebbf
-
SHA256
08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67
-
SHA512
0c22de0dac2048c13cd8f44f1c46f009a981b85c1ea34a55708be5e857a24679e8c1141c94c9cf5ae2d9142eea5e231d1c96dc83ddf5b5e2d164dd219799ca34
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR4:q7Tc2NYHUrAwfMp3CDR4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/968-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4208-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2772-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/844-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-860-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-972-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-997-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-1151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-1200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4120-1280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-1401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3184 rlrfxxr.exe 2076 nhnbhb.exe 1208 jvdvp.exe 3636 ffrlfxl.exe 2684 nnnhbb.exe 1432 7lxxflr.exe 2132 rffxxxx.exe 1000 jddvv.exe 2640 hbhhbh.exe 3980 vjpjd.exe 4208 vppjd.exe 3372 3jvvp.exe 1596 xlrrrrr.exe 1664 3nhnnt.exe 3152 lfllfff.exe 4576 dpdvp.exe 3208 djpjd.exe 4064 rflfxxr.exe 1968 tthtnh.exe 2392 hhnhhh.exe 4792 bbbbtt.exe 3200 dpjjj.exe 2632 1bbbtb.exe 3376 nbtnhh.exe 2196 vjdvp.exe 2920 3pppj.exe 2772 fxxxxxx.exe 1900 hhhbbb.exe 3316 nnbtbb.exe 4136 5rxrrxr.exe 844 fxxrllf.exe 912 fffrrlf.exe 4796 pjdvv.exe 4060 flxrrrx.exe 2656 nhhbtt.exe 3892 jdjdd.exe 2176 bhnhbh.exe 4432 ddddv.exe 4972 xxllflf.exe 3004 tbbttt.exe 4848 1dvdv.exe 3708 lrxrllf.exe 3080 tnnhbt.exe 2348 ppvpv.exe 464 thhhbh.exe 2544 jjddd.exe 2284 lxfxrrr.exe 4696 xxxxxrr.exe 4332 tbhntb.exe 4440 9jdvp.exe 1400 xflffff.exe 3184 htthtn.exe 1928 jvdpj.exe 4672 xxxxrrr.exe 2076 bbbbtb.exe 2900 dvdvj.exe 4968 frxrfxf.exe 1176 frrfxrr.exe 4520 ttbbtt.exe 1204 vddvp.exe 1848 pjppj.exe 4780 xffrfxl.exe 1452 ntttnn.exe 2760 pjjjd.exe -
resource yara_rule behavioral2/memory/968-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1432-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4208-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2772-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/844-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-972-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-997-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-1151-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lllxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 968 wrote to memory of 3184 968 08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67N.exe 83 PID 968 wrote to memory of 3184 968 08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67N.exe 83 PID 968 wrote to memory of 3184 968 08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67N.exe 83 PID 3184 wrote to memory of 2076 3184 rlrfxxr.exe 84 PID 3184 wrote to memory of 2076 3184 rlrfxxr.exe 84 PID 3184 wrote to memory of 2076 3184 rlrfxxr.exe 84 PID 2076 wrote to memory of 1208 2076 nhnbhb.exe 85 PID 2076 wrote to memory of 1208 2076 nhnbhb.exe 85 PID 2076 wrote to memory of 1208 2076 nhnbhb.exe 85 PID 1208 wrote to memory of 3636 1208 jvdvp.exe 86 PID 1208 wrote to memory of 3636 1208 jvdvp.exe 86 PID 1208 wrote to memory of 3636 1208 jvdvp.exe 86 PID 3636 wrote to memory of 2684 3636 ffrlfxl.exe 87 PID 3636 wrote to memory of 2684 3636 ffrlfxl.exe 87 PID 3636 wrote to memory of 2684 3636 ffrlfxl.exe 87 PID 2684 wrote to memory of 1432 2684 nnnhbb.exe 88 PID 2684 wrote to memory of 1432 2684 nnnhbb.exe 88 PID 2684 wrote to memory of 1432 2684 nnnhbb.exe 88 PID 1432 wrote to memory of 2132 1432 7lxxflr.exe 89 PID 1432 wrote to memory of 2132 1432 7lxxflr.exe 89 PID 1432 wrote to memory of 2132 1432 7lxxflr.exe 89 PID 2132 wrote to memory of 1000 2132 rffxxxx.exe 90 PID 2132 wrote to memory of 1000 2132 rffxxxx.exe 90 PID 2132 wrote to memory of 1000 2132 rffxxxx.exe 90 PID 1000 wrote to memory of 2640 1000 jddvv.exe 91 PID 1000 wrote to memory of 2640 1000 jddvv.exe 91 PID 1000 wrote to memory of 2640 1000 jddvv.exe 91 PID 2640 wrote to memory of 3980 2640 hbhhbh.exe 92 PID 2640 wrote to memory of 3980 2640 hbhhbh.exe 92 PID 2640 wrote to memory of 3980 2640 hbhhbh.exe 92 PID 3980 wrote to memory of 4208 3980 vjpjd.exe 93 PID 3980 wrote to memory of 4208 3980 vjpjd.exe 93 PID 3980 wrote to memory of 4208 3980 vjpjd.exe 93 PID 4208 wrote to memory of 3372 4208 vppjd.exe 94 PID 4208 wrote to memory of 3372 4208 vppjd.exe 94 PID 4208 wrote to memory of 3372 4208 vppjd.exe 94 PID 3372 wrote to memory of 1596 3372 3jvvp.exe 95 PID 3372 wrote to memory of 1596 3372 3jvvp.exe 95 PID 3372 wrote to memory of 1596 3372 3jvvp.exe 95 PID 1596 wrote to memory of 1664 1596 xlrrrrr.exe 96 PID 1596 wrote to memory of 1664 1596 xlrrrrr.exe 96 PID 1596 wrote to memory of 1664 1596 xlrrrrr.exe 96 PID 1664 wrote to memory of 3152 1664 3nhnnt.exe 97 PID 1664 wrote to memory of 3152 1664 3nhnnt.exe 97 PID 1664 wrote to memory of 3152 1664 3nhnnt.exe 97 PID 3152 wrote to memory of 4576 3152 lfllfff.exe 98 PID 3152 wrote to memory of 4576 3152 lfllfff.exe 98 PID 3152 wrote to memory of 4576 3152 lfllfff.exe 98 PID 4576 wrote to memory of 3208 4576 dpdvp.exe 99 PID 4576 wrote to memory of 3208 4576 dpdvp.exe 99 PID 4576 wrote to memory of 3208 4576 dpdvp.exe 99 PID 3208 wrote to memory of 4064 3208 djpjd.exe 100 PID 3208 wrote to memory of 4064 3208 djpjd.exe 100 PID 3208 wrote to memory of 4064 3208 djpjd.exe 100 PID 4064 wrote to memory of 1968 4064 rflfxxr.exe 101 PID 4064 wrote to memory of 1968 4064 rflfxxr.exe 101 PID 4064 wrote to memory of 1968 4064 rflfxxr.exe 101 PID 1968 wrote to memory of 2392 1968 tthtnh.exe 102 PID 1968 wrote to memory of 2392 1968 tthtnh.exe 102 PID 1968 wrote to memory of 2392 1968 tthtnh.exe 102 PID 2392 wrote to memory of 4792 2392 hhnhhh.exe 103 PID 2392 wrote to memory of 4792 2392 hhnhhh.exe 103 PID 2392 wrote to memory of 4792 2392 hhnhhh.exe 103 PID 4792 wrote to memory of 3200 4792 bbbbtt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67N.exe"C:\Users\Admin\AppData\Local\Temp\08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\rlrfxxr.exec:\rlrfxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\nhnbhb.exec:\nhnbhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\jvdvp.exec:\jvdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\ffrlfxl.exec:\ffrlfxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\nnnhbb.exec:\nnnhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\7lxxflr.exec:\7lxxflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\rffxxxx.exec:\rffxxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\jddvv.exec:\jddvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\hbhhbh.exec:\hbhhbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\vjpjd.exec:\vjpjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\vppjd.exec:\vppjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\3jvvp.exec:\3jvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\3nhnnt.exec:\3nhnnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\lfllfff.exec:\lfllfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\dpdvp.exec:\dpdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\djpjd.exec:\djpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\rflfxxr.exec:\rflfxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\tthtnh.exec:\tthtnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\hhnhhh.exec:\hhnhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\bbbbtt.exec:\bbbbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\dpjjj.exec:\dpjjj.exe23⤵
- Executes dropped EXE
PID:3200 -
\??\c:\1bbbtb.exec:\1bbbtb.exe24⤵
- Executes dropped EXE
PID:2632 -
\??\c:\nbtnhh.exec:\nbtnhh.exe25⤵
- Executes dropped EXE
PID:3376 -
\??\c:\vjdvp.exec:\vjdvp.exe26⤵
- Executes dropped EXE
PID:2196 -
\??\c:\3pppj.exec:\3pppj.exe27⤵
- Executes dropped EXE
PID:2920 -
\??\c:\fxxxxxx.exec:\fxxxxxx.exe28⤵
- Executes dropped EXE
PID:2772 -
\??\c:\hhhbbb.exec:\hhhbbb.exe29⤵
- Executes dropped EXE
PID:1900 -
\??\c:\nnbtbb.exec:\nnbtbb.exe30⤵
- Executes dropped EXE
PID:3316 -
\??\c:\5rxrrxr.exec:\5rxrrxr.exe31⤵
- Executes dropped EXE
PID:4136 -
\??\c:\fxxrllf.exec:\fxxrllf.exe32⤵
- Executes dropped EXE
PID:844 -
\??\c:\fffrrlf.exec:\fffrrlf.exe33⤵
- Executes dropped EXE
PID:912 -
\??\c:\pjdvv.exec:\pjdvv.exe34⤵
- Executes dropped EXE
PID:4796 -
\??\c:\flxrrrx.exec:\flxrrrx.exe35⤵
- Executes dropped EXE
PID:4060 -
\??\c:\nhhbtt.exec:\nhhbtt.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2656 -
\??\c:\jdjdd.exec:\jdjdd.exe37⤵
- Executes dropped EXE
PID:3892 -
\??\c:\bhnhbh.exec:\bhnhbh.exe38⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ddddv.exec:\ddddv.exe39⤵
- Executes dropped EXE
PID:4432 -
\??\c:\xxllflf.exec:\xxllflf.exe40⤵
- Executes dropped EXE
PID:4972 -
\??\c:\tbbttt.exec:\tbbttt.exe41⤵
- Executes dropped EXE
PID:3004 -
\??\c:\1dvdv.exec:\1dvdv.exe42⤵
- Executes dropped EXE
PID:4848 -
\??\c:\lrxrllf.exec:\lrxrllf.exe43⤵
- Executes dropped EXE
PID:3708 -
\??\c:\tnnhbt.exec:\tnnhbt.exe44⤵
- Executes dropped EXE
PID:3080 -
\??\c:\ppvpv.exec:\ppvpv.exe45⤵
- Executes dropped EXE
PID:2348 -
\??\c:\thhhbh.exec:\thhhbh.exe46⤵
- Executes dropped EXE
PID:464 -
\??\c:\jjddd.exec:\jjddd.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe48⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xxxxxrr.exec:\xxxxxrr.exe49⤵
- Executes dropped EXE
PID:4696 -
\??\c:\tbhntb.exec:\tbhntb.exe50⤵
- Executes dropped EXE
PID:4332 -
\??\c:\9jdvp.exec:\9jdvp.exe51⤵
- Executes dropped EXE
PID:4440 -
\??\c:\xflffff.exec:\xflffff.exe52⤵
- Executes dropped EXE
PID:1400 -
\??\c:\rllffff.exec:\rllffff.exe53⤵PID:1568
-
\??\c:\htthtn.exec:\htthtn.exe54⤵
- Executes dropped EXE
PID:3184 -
\??\c:\jvdpj.exec:\jvdpj.exe55⤵
- Executes dropped EXE
PID:1928 -
\??\c:\xxxxrrr.exec:\xxxxrrr.exe56⤵
- Executes dropped EXE
PID:4672 -
\??\c:\bbbbtb.exec:\bbbbtb.exe57⤵
- Executes dropped EXE
PID:2076 -
\??\c:\dvdvj.exec:\dvdvj.exe58⤵
- Executes dropped EXE
PID:2900 -
\??\c:\frxrfxf.exec:\frxrfxf.exe59⤵
- Executes dropped EXE
PID:4968 -
\??\c:\frrfxrr.exec:\frrfxrr.exe60⤵
- Executes dropped EXE
PID:1176 -
\??\c:\ttbbtt.exec:\ttbbtt.exe61⤵
- Executes dropped EXE
PID:4520 -
\??\c:\vddvp.exec:\vddvp.exe62⤵
- Executes dropped EXE
PID:1204 -
\??\c:\pjppj.exec:\pjppj.exe63⤵
- Executes dropped EXE
PID:1848 -
\??\c:\xffrfxl.exec:\xffrfxl.exe64⤵
- Executes dropped EXE
PID:4780 -
\??\c:\ntttnn.exec:\ntttnn.exe65⤵
- Executes dropped EXE
PID:1452 -
\??\c:\pjjjd.exec:\pjjjd.exe66⤵
- Executes dropped EXE
PID:2760 -
\??\c:\pjpjd.exec:\pjpjd.exe67⤵PID:684
-
\??\c:\lfllflf.exec:\lfllflf.exe68⤵PID:2844
-
\??\c:\nbbttt.exec:\nbbttt.exe69⤵PID:4640
-
\??\c:\vjvdv.exec:\vjvdv.exe70⤵PID:3456
-
\??\c:\ddvjp.exec:\ddvjp.exe71⤵PID:4148
-
\??\c:\rrxxxlf.exec:\rrxxxlf.exe72⤵PID:3888
-
\??\c:\thhtnn.exec:\thhtnn.exe73⤵PID:1596
-
\??\c:\ppjjj.exec:\ppjjj.exe74⤵PID:2812
-
\??\c:\pppjj.exec:\pppjj.exe75⤵PID:5084
-
\??\c:\rrfxrll.exec:\rrfxrll.exe76⤵PID:776
-
\??\c:\btbtnn.exec:\btbtnn.exe77⤵
- System Location Discovery: System Language Discovery
PID:2808 -
\??\c:\vvvvd.exec:\vvvvd.exe78⤵PID:4532
-
\??\c:\9xrlfff.exec:\9xrlfff.exe79⤵PID:2828
-
\??\c:\lxxrllf.exec:\lxxrllf.exe80⤵PID:3180
-
\??\c:\bhhhbh.exec:\bhhhbh.exe81⤵PID:1724
-
\??\c:\1jvvp.exec:\1jvvp.exe82⤵PID:4124
-
\??\c:\lffxxrr.exec:\lffxxrr.exe83⤵PID:2736
-
\??\c:\thhbnn.exec:\thhbnn.exe84⤵PID:2128
-
\??\c:\3jjvj.exec:\3jjvj.exe85⤵PID:2908
-
\??\c:\vppjj.exec:\vppjj.exe86⤵PID:2292
-
\??\c:\llfrfxl.exec:\llfrfxl.exe87⤵PID:2816
-
\??\c:\lxxrlfr.exec:\lxxrlfr.exe88⤵PID:2208
-
\??\c:\pjpdj.exec:\pjpdj.exe89⤵PID:3572
-
\??\c:\xlrrlll.exec:\xlrrlll.exe90⤵PID:392
-
\??\c:\tntnhh.exec:\tntnhh.exe91⤵PID:4472
-
\??\c:\jjddv.exec:\jjddv.exe92⤵PID:3644
-
\??\c:\vjvjd.exec:\vjvjd.exe93⤵PID:1008
-
\??\c:\rxxrxrx.exec:\rxxrxrx.exe94⤵PID:2716
-
\??\c:\9btnnn.exec:\9btnnn.exe95⤵PID:2688
-
\??\c:\7ddvp.exec:\7ddvp.exe96⤵PID:1912
-
\??\c:\frfrfxl.exec:\frfrfxl.exe97⤵PID:4424
-
\??\c:\rrrlfff.exec:\rrrlfff.exe98⤵PID:548
-
\??\c:\htthbt.exec:\htthbt.exe99⤵PID:3632
-
\??\c:\9jdvj.exec:\9jdvj.exe100⤵PID:3108
-
\??\c:\fflfxlf.exec:\fflfxlf.exe101⤵PID:3664
-
\??\c:\hhbbtt.exec:\hhbbtt.exe102⤵PID:3892
-
\??\c:\bnnhbn.exec:\bnnhbn.exe103⤵PID:4836
-
\??\c:\jpppd.exec:\jpppd.exe104⤵PID:4648
-
\??\c:\9xxrlll.exec:\9xxrlll.exe105⤵PID:3396
-
\??\c:\1hbtnh.exec:\1hbtnh.exe106⤵PID:3600
-
\??\c:\ddvpd.exec:\ddvpd.exe107⤵PID:772
-
\??\c:\rxxfllr.exec:\rxxfllr.exe108⤵PID:720
-
\??\c:\lffrrlx.exec:\lffrrlx.exe109⤵PID:4536
-
\??\c:\tthhhh.exec:\tthhhh.exe110⤵PID:2032
-
\??\c:\pvdpj.exec:\pvdpj.exe111⤵PID:1864
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe112⤵PID:2188
-
\??\c:\hhnntt.exec:\hhnntt.exe113⤵PID:412
-
\??\c:\hbtnhb.exec:\hbtnhb.exe114⤵PID:3928
-
\??\c:\jdppj.exec:\jdppj.exe115⤵PID:2432
-
\??\c:\flffxff.exec:\flffxff.exe116⤵PID:4460
-
\??\c:\hbhbbb.exec:\hbhbbb.exe117⤵PID:376
-
\??\c:\pppjd.exec:\pppjd.exe118⤵PID:3492
-
\??\c:\3rrfrlf.exec:\3rrfrlf.exe119⤵PID:3948
-
\??\c:\tnnbtn.exec:\tnnbtn.exe120⤵PID:1160
-
\??\c:\hbnhhh.exec:\hbnhhh.exe121⤵PID:456
-
\??\c:\ppvjj.exec:\ppvjj.exe122⤵PID:2904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-