Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 05:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7ce24f98d605e466397ca44ea84f8b9bb807e92fcfe09e6afd8d82a690eea5f9N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
7ce24f98d605e466397ca44ea84f8b9bb807e92fcfe09e6afd8d82a690eea5f9N.exe
-
Size
454KB
-
MD5
1ef241005d4ef3a44f69114fb4b9de00
-
SHA1
530c9516f91327e8b887966d9eb932448706d025
-
SHA256
7ce24f98d605e466397ca44ea84f8b9bb807e92fcfe09e6afd8d82a690eea5f9
-
SHA512
4a8723fb5924f127c814a9a4930edc5f56141b0ef0c44257639ee138585dd72d7770cf88caab8e47ba30ee56f3b70fec0eb96ce5f95a0a58d42244f375b24fd1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4708-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/384-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/348-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1840-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3272-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1028-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/796-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2836-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-678-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-867-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-907-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-1086-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-1243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4844 3nthtn.exe 2616 jjvjd.exe 2276 frfxrlx.exe 1424 jddvp.exe 4528 hbbthb.exe 2160 xlfrlxl.exe 5004 vjjdp.exe 2796 5lrlfxl.exe 4012 ththbt.exe 3000 rlfxffx.exe 5032 tttbnh.exe 3688 lffxrrl.exe 544 ppppp.exe 3112 bbnhnn.exe 4892 hhhbbn.exe 2332 jpddv.exe 4896 fxxxxxr.exe 4484 lxfxxxf.exe 2024 1rxrffx.exe 2020 ppvvv.exe 920 nnbtnt.exe 3460 rflllll.exe 4532 xffxxxx.exe 3524 vjjjj.exe 384 3tnnhh.exe 4440 lflffll.exe 4900 vppjd.exe 976 nbhhbb.exe 348 dppjd.exe 4356 frxxlfx.exe 924 hhbbtt.exe 4492 tthbnn.exe 1840 bhhhbb.exe 4424 xfxrrrr.exe 1172 tthtnt.exe 3272 pvjvd.exe 1028 1lxxrxr.exe 2176 ttthhh.exe 840 7jjdd.exe 2828 9lxrffx.exe 3256 7rrrlrl.exe 3744 tbbbnt.exe 5024 ppvpd.exe 3988 vdjdp.exe 2076 xfflfxx.exe 3076 7hbbhh.exe 4336 jvvpp.exe 1972 vjpdv.exe 1420 xxxxxxr.exe 4388 9hhtnn.exe 1576 ppdvv.exe 3148 9rffxxr.exe 1144 9flxfxf.exe 3668 hbbttt.exe 2540 jvppj.exe 2444 rffxllf.exe 796 3btnnh.exe 1732 9vdpj.exe 3984 pppjp.exe 5004 fflxxrl.exe 3584 tttnhh.exe 2072 vppdv.exe 1944 rlfxlfr.exe 4012 nnbtnn.exe -
resource yara_rule behavioral2/memory/4708-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/384-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/348-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1840-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3272-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1028-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/796-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-694-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flffxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4708 wrote to memory of 4844 4708 7ce24f98d605e466397ca44ea84f8b9bb807e92fcfe09e6afd8d82a690eea5f9N.exe 83 PID 4708 wrote to memory of 4844 4708 7ce24f98d605e466397ca44ea84f8b9bb807e92fcfe09e6afd8d82a690eea5f9N.exe 83 PID 4708 wrote to memory of 4844 4708 7ce24f98d605e466397ca44ea84f8b9bb807e92fcfe09e6afd8d82a690eea5f9N.exe 83 PID 4844 wrote to memory of 2616 4844 3nthtn.exe 84 PID 4844 wrote to memory of 2616 4844 3nthtn.exe 84 PID 4844 wrote to memory of 2616 4844 3nthtn.exe 84 PID 2616 wrote to memory of 2276 2616 jjvjd.exe 85 PID 2616 wrote to memory of 2276 2616 jjvjd.exe 85 PID 2616 wrote to memory of 2276 2616 jjvjd.exe 85 PID 2276 wrote to memory of 1424 2276 frfxrlx.exe 86 PID 2276 wrote to memory of 1424 2276 frfxrlx.exe 86 PID 2276 wrote to memory of 1424 2276 frfxrlx.exe 86 PID 1424 wrote to memory of 4528 1424 jddvp.exe 87 PID 1424 wrote to memory of 4528 1424 jddvp.exe 87 PID 1424 wrote to memory of 4528 1424 jddvp.exe 87 PID 4528 wrote to memory of 2160 4528 hbbthb.exe 88 PID 4528 wrote to memory of 2160 4528 hbbthb.exe 88 PID 4528 wrote to memory of 2160 4528 hbbthb.exe 88 PID 2160 wrote to memory of 5004 2160 xlfrlxl.exe 89 PID 2160 wrote to memory of 5004 2160 xlfrlxl.exe 89 PID 2160 wrote to memory of 5004 2160 xlfrlxl.exe 89 PID 5004 wrote to memory of 2796 5004 vjjdp.exe 90 PID 5004 wrote to memory of 2796 5004 vjjdp.exe 90 PID 5004 wrote to memory of 2796 5004 vjjdp.exe 90 PID 2796 wrote to memory of 4012 2796 5lrlfxl.exe 91 PID 2796 wrote to memory of 4012 2796 5lrlfxl.exe 91 PID 2796 wrote to memory of 4012 2796 5lrlfxl.exe 91 PID 4012 wrote to memory of 3000 4012 ththbt.exe 92 PID 4012 wrote to memory of 3000 4012 ththbt.exe 92 PID 4012 wrote to memory of 3000 4012 ththbt.exe 92 PID 3000 wrote to memory of 5032 3000 rlfxffx.exe 93 PID 3000 wrote to memory of 5032 3000 rlfxffx.exe 93 PID 3000 wrote to memory of 5032 3000 rlfxffx.exe 93 PID 5032 wrote to memory of 3688 5032 tttbnh.exe 94 PID 5032 wrote to memory of 3688 5032 tttbnh.exe 94 PID 5032 wrote to memory of 3688 5032 tttbnh.exe 94 PID 3688 wrote to memory of 544 3688 lffxrrl.exe 95 PID 3688 wrote to memory of 544 3688 lffxrrl.exe 95 PID 3688 wrote to memory of 544 3688 lffxrrl.exe 95 PID 544 wrote to memory of 3112 544 ppppp.exe 96 PID 544 wrote to memory of 3112 544 ppppp.exe 96 PID 544 wrote to memory of 3112 544 ppppp.exe 96 PID 3112 wrote to memory of 4892 3112 bbnhnn.exe 97 PID 3112 wrote to memory of 4892 3112 bbnhnn.exe 97 PID 3112 wrote to memory of 4892 3112 bbnhnn.exe 97 PID 4892 wrote to memory of 2332 4892 hhhbbn.exe 98 PID 4892 wrote to memory of 2332 4892 hhhbbn.exe 98 PID 4892 wrote to memory of 2332 4892 hhhbbn.exe 98 PID 2332 wrote to memory of 4896 2332 jpddv.exe 99 PID 2332 wrote to memory of 4896 2332 jpddv.exe 99 PID 2332 wrote to memory of 4896 2332 jpddv.exe 99 PID 4896 wrote to memory of 4484 4896 fxxxxxr.exe 100 PID 4896 wrote to memory of 4484 4896 fxxxxxr.exe 100 PID 4896 wrote to memory of 4484 4896 fxxxxxr.exe 100 PID 4484 wrote to memory of 2024 4484 lxfxxxf.exe 101 PID 4484 wrote to memory of 2024 4484 lxfxxxf.exe 101 PID 4484 wrote to memory of 2024 4484 lxfxxxf.exe 101 PID 2024 wrote to memory of 2020 2024 1rxrffx.exe 102 PID 2024 wrote to memory of 2020 2024 1rxrffx.exe 102 PID 2024 wrote to memory of 2020 2024 1rxrffx.exe 102 PID 2020 wrote to memory of 920 2020 ppvvv.exe 103 PID 2020 wrote to memory of 920 2020 ppvvv.exe 103 PID 2020 wrote to memory of 920 2020 ppvvv.exe 103 PID 920 wrote to memory of 3460 920 nnbtnt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ce24f98d605e466397ca44ea84f8b9bb807e92fcfe09e6afd8d82a690eea5f9N.exe"C:\Users\Admin\AppData\Local\Temp\7ce24f98d605e466397ca44ea84f8b9bb807e92fcfe09e6afd8d82a690eea5f9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\3nthtn.exec:\3nthtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\jjvjd.exec:\jjvjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\frfxrlx.exec:\frfxrlx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\jddvp.exec:\jddvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\hbbthb.exec:\hbbthb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\xlfrlxl.exec:\xlfrlxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\vjjdp.exec:\vjjdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\5lrlfxl.exec:\5lrlfxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\ththbt.exec:\ththbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\rlfxffx.exec:\rlfxffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\tttbnh.exec:\tttbnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\lffxrrl.exec:\lffxrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\ppppp.exec:\ppppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\bbnhnn.exec:\bbnhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\hhhbbn.exec:\hhhbbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\jpddv.exec:\jpddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\fxxxxxr.exec:\fxxxxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\lxfxxxf.exec:\lxfxxxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\1rxrffx.exec:\1rxrffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\ppvvv.exec:\ppvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\nnbtnt.exec:\nnbtnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\rflllll.exec:\rflllll.exe23⤵
- Executes dropped EXE
PID:3460 -
\??\c:\xffxxxx.exec:\xffxxxx.exe24⤵
- Executes dropped EXE
PID:4532 -
\??\c:\vjjjj.exec:\vjjjj.exe25⤵
- Executes dropped EXE
PID:3524 -
\??\c:\3tnnhh.exec:\3tnnhh.exe26⤵
- Executes dropped EXE
PID:384 -
\??\c:\lflffll.exec:\lflffll.exe27⤵
- Executes dropped EXE
PID:4440 -
\??\c:\vppjd.exec:\vppjd.exe28⤵
- Executes dropped EXE
PID:4900 -
\??\c:\nbhhbb.exec:\nbhhbb.exe29⤵
- Executes dropped EXE
PID:976 -
\??\c:\dppjd.exec:\dppjd.exe30⤵
- Executes dropped EXE
PID:348 -
\??\c:\frxxlfx.exec:\frxxlfx.exe31⤵
- Executes dropped EXE
PID:4356 -
\??\c:\hhbbtt.exec:\hhbbtt.exe32⤵
- Executes dropped EXE
PID:924 -
\??\c:\tthbnn.exec:\tthbnn.exe33⤵
- Executes dropped EXE
PID:4492 -
\??\c:\bhhhbb.exec:\bhhhbb.exe34⤵
- Executes dropped EXE
PID:1840 -
\??\c:\xfxrrrr.exec:\xfxrrrr.exe35⤵
- Executes dropped EXE
PID:4424 -
\??\c:\tthtnt.exec:\tthtnt.exe36⤵
- Executes dropped EXE
PID:1172 -
\??\c:\pvjvd.exec:\pvjvd.exe37⤵
- Executes dropped EXE
PID:3272 -
\??\c:\1lxxrxr.exec:\1lxxrxr.exe38⤵
- Executes dropped EXE
PID:1028 -
\??\c:\ttthhh.exec:\ttthhh.exe39⤵
- Executes dropped EXE
PID:2176 -
\??\c:\7jjdd.exec:\7jjdd.exe40⤵
- Executes dropped EXE
PID:840 -
\??\c:\9lxrffx.exec:\9lxrffx.exe41⤵
- Executes dropped EXE
PID:2828 -
\??\c:\7rrrlrl.exec:\7rrrlrl.exe42⤵
- Executes dropped EXE
PID:3256 -
\??\c:\tbbbnt.exec:\tbbbnt.exe43⤵
- Executes dropped EXE
PID:3744 -
\??\c:\ppvpd.exec:\ppvpd.exe44⤵
- Executes dropped EXE
PID:5024 -
\??\c:\vdjdp.exec:\vdjdp.exe45⤵
- Executes dropped EXE
PID:3988 -
\??\c:\xfflfxx.exec:\xfflfxx.exe46⤵
- Executes dropped EXE
PID:2076 -
\??\c:\7hbbhh.exec:\7hbbhh.exe47⤵
- Executes dropped EXE
PID:3076 -
\??\c:\jvvpp.exec:\jvvpp.exe48⤵
- Executes dropped EXE
PID:4336 -
\??\c:\vjpdv.exec:\vjpdv.exe49⤵
- Executes dropped EXE
PID:1972 -
\??\c:\xxxxxxr.exec:\xxxxxxr.exe50⤵
- Executes dropped EXE
PID:1420 -
\??\c:\9hhtnn.exec:\9hhtnn.exe51⤵
- Executes dropped EXE
PID:4388 -
\??\c:\ppdvv.exec:\ppdvv.exe52⤵
- Executes dropped EXE
PID:1576 -
\??\c:\9rffxxr.exec:\9rffxxr.exe53⤵
- Executes dropped EXE
PID:3148 -
\??\c:\9flxfxf.exec:\9flxfxf.exe54⤵
- Executes dropped EXE
PID:1144 -
\??\c:\hbbttt.exec:\hbbttt.exe55⤵
- Executes dropped EXE
PID:3668 -
\??\c:\jvppj.exec:\jvppj.exe56⤵
- Executes dropped EXE
PID:2540 -
\??\c:\rffxllf.exec:\rffxllf.exe57⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3btnnh.exec:\3btnnh.exe58⤵
- Executes dropped EXE
PID:796 -
\??\c:\9vdpj.exec:\9vdpj.exe59⤵
- Executes dropped EXE
PID:1732 -
\??\c:\pppjp.exec:\pppjp.exe60⤵
- Executes dropped EXE
PID:3984 -
\??\c:\fflxxrl.exec:\fflxxrl.exe61⤵
- Executes dropped EXE
PID:5004 -
\??\c:\tttnhh.exec:\tttnhh.exe62⤵
- Executes dropped EXE
PID:3584 -
\??\c:\vppdv.exec:\vppdv.exe63⤵
- Executes dropped EXE
PID:2072 -
\??\c:\rlfxlfr.exec:\rlfxlfr.exe64⤵
- Executes dropped EXE
PID:1944 -
\??\c:\nnbtnn.exec:\nnbtnn.exe65⤵
- Executes dropped EXE
PID:4012 -
\??\c:\bnnhbt.exec:\bnnhbt.exe66⤵PID:4976
-
\??\c:\ppdvp.exec:\ppdvp.exe67⤵PID:5088
-
\??\c:\rfflfxr.exec:\rfflfxr.exe68⤵PID:228
-
\??\c:\ffffxrl.exec:\ffffxrl.exe69⤵PID:3644
-
\??\c:\nhhnbt.exec:\nhhnbt.exe70⤵PID:1232
-
\??\c:\vvvpj.exec:\vvvpj.exe71⤵PID:968
-
\??\c:\jjjjv.exec:\jjjjv.exe72⤵PID:1148
-
\??\c:\frxxrlx.exec:\frxxrlx.exe73⤵PID:2836
-
\??\c:\httnhb.exec:\httnhb.exe74⤵PID:4212
-
\??\c:\3hhtnn.exec:\3hhtnn.exe75⤵PID:5008
-
\??\c:\vppdv.exec:\vppdv.exe76⤵PID:1588
-
\??\c:\xflfxxr.exec:\xflfxxr.exe77⤵PID:1040
-
\??\c:\tnbtnn.exec:\tnbtnn.exe78⤵PID:4696
-
\??\c:\7ppdv.exec:\7ppdv.exe79⤵PID:2352
-
\??\c:\xfxrlll.exec:\xfxrlll.exe80⤵PID:4320
-
\??\c:\bttnhb.exec:\bttnhb.exe81⤵PID:1436
-
\??\c:\vvvpp.exec:\vvvpp.exe82⤵PID:2792
-
\??\c:\vvvvd.exec:\vvvvd.exe83⤵PID:4920
-
\??\c:\fxrrlfx.exec:\fxrrlfx.exe84⤵PID:4464
-
\??\c:\nhhttn.exec:\nhhttn.exe85⤵PID:384
-
\??\c:\tbhbtn.exec:\tbhbtn.exe86⤵PID:2652
-
\??\c:\vppdp.exec:\vppdp.exe87⤵PID:3188
-
\??\c:\dpjdp.exec:\dpjdp.exe88⤵PID:3660
-
\??\c:\9lfxrxx.exec:\9lfxrxx.exe89⤵PID:112
-
\??\c:\bhnbtt.exec:\bhnbtt.exe90⤵PID:3384
-
\??\c:\jddvj.exec:\jddvj.exe91⤵PID:1004
-
\??\c:\lflxrrl.exec:\lflxrrl.exe92⤵PID:4816
-
\??\c:\hbbnhb.exec:\hbbnhb.exe93⤵PID:2200
-
\??\c:\hhhbnh.exec:\hhhbnh.exe94⤵PID:3432
-
\??\c:\vpjdp.exec:\vpjdp.exe95⤵PID:4408
-
\??\c:\ffxrffr.exec:\ffxrffr.exe96⤵PID:4204
-
\??\c:\9nnnht.exec:\9nnnht.exe97⤵PID:2084
-
\??\c:\pjjvj.exec:\pjjvj.exe98⤵PID:3272
-
\??\c:\rxxrllf.exec:\rxxrllf.exe99⤵PID:4628
-
\??\c:\xxlfrlx.exec:\xxlfrlx.exe100⤵PID:2176
-
\??\c:\bhtnbb.exec:\bhtnbb.exe101⤵PID:2620
-
\??\c:\1vvvp.exec:\1vvvp.exe102⤵PID:2292
-
\??\c:\fffxxll.exec:\fffxxll.exe103⤵PID:3256
-
\??\c:\thbtnn.exec:\thbtnn.exe104⤵PID:3744
-
\??\c:\nhhbtn.exec:\nhhbtn.exe105⤵PID:1236
-
\??\c:\djjpj.exec:\djjpj.exe106⤵PID:3988
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe107⤵PID:2768
-
\??\c:\hhtnbt.exec:\hhtnbt.exe108⤵PID:1444
-
\??\c:\vdvvp.exec:\vdvvp.exe109⤵PID:4436
-
\??\c:\dvpdv.exec:\dvpdv.exe110⤵PID:2576
-
\??\c:\rllfxrr.exec:\rllfxrr.exe111⤵PID:4348
-
\??\c:\ttbttn.exec:\ttbttn.exe112⤵PID:3128
-
\??\c:\tnhtnh.exec:\tnhtnh.exe113⤵PID:1016
-
\??\c:\vpjvj.exec:\vpjvj.exe114⤵PID:4328
-
\??\c:\5ffxllx.exec:\5ffxllx.exe115⤵PID:1356
-
\??\c:\nhbnhb.exec:\nhbnhb.exe116⤵PID:3904
-
\??\c:\5tthbt.exec:\5tthbt.exe117⤵PID:4784
-
\??\c:\7vjdv.exec:\7vjdv.exe118⤵PID:2540
-
\??\c:\rflxrlx.exec:\rflxrlx.exe119⤵PID:3972
-
\??\c:\rrlfrlf.exec:\rrlfrlf.exe120⤵PID:2136
-
\??\c:\hnhtnn.exec:\hnhtnn.exe121⤵PID:2688
-
\??\c:\jdppp.exec:\jdppp.exe122⤵PID:5084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-