Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 05:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
15bf18aa36f593ffa3854fca3507df37feb545182fff77f47c3fc5c08553927eN.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
15bf18aa36f593ffa3854fca3507df37feb545182fff77f47c3fc5c08553927eN.exe
-
Size
456KB
-
MD5
67d8d32573912a089093c556a4f0eee0
-
SHA1
c1d418218e022e6921722ebd103db32946aa5c4d
-
SHA256
15bf18aa36f593ffa3854fca3507df37feb545182fff77f47c3fc5c08553927e
-
SHA512
39852c57b930575f0ff9edbcbb61377df04dd86c80de69e058edc907a72951b0ada6fd15a2f0ba1b156be8dca54f446528af5342c753d341d803692e4a09f865
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRF:q7Tc2NYHUrAwfMp3CDRF
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4004-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2712-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2480-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/992-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1080-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1756-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/996-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1840-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3828-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-682-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-970-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-1464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1460 pjppv.exe 3724 hnnhnt.exe 3224 pjdvv.exe 4184 pvvjd.exe 2236 hntthn.exe 2712 xflfffl.exe 2496 vvddv.exe 3668 xxxlrfl.exe 2480 djvdd.exe 1480 rrrrrff.exe 1820 pvppd.exe 992 7xfffrl.exe 3308 5rllrfr.exe 3020 bthhhn.exe 216 rxllrxl.exe 1080 7hbttt.exe 1756 ddvvv.exe 2160 hnbnnh.exe 2732 1xlxxxx.exe 116 7djdp.exe 552 7bbbhn.exe 1368 xrfflrr.exe 2912 dvdjj.exe 1016 tthhhn.exe 4736 dpdvv.exe 5028 7vdvv.exe 996 ttbbhh.exe 4384 pjvvp.exe 5000 llrxxlf.exe 3244 3jvdv.exe 4308 1rxrlrr.exe 4976 jjppj.exe 4192 lrxxxxx.exe 3528 bhnhbb.exe 1976 djjdd.exe 4480 lrxrlfx.exe 4200 btttbh.exe 4168 7tnnht.exe 3560 3pjdp.exe 5080 1ffxlfx.exe 2396 nhhbtn.exe 3036 nhtnnn.exe 3580 vpvpj.exe 4896 3lllfxx.exe 4884 bbhbtt.exe 1620 1hbttn.exe 3740 vjdvd.exe 3544 lrxrrlf.exe 1360 5tbtnn.exe 1936 bbnnnt.exe 1840 ffrlllx.exe 2552 hbbhbb.exe 1672 tnnthb.exe 916 vdjdp.exe 2300 7xxrlxx.exe 2340 lxlfxxx.exe 2244 pdppj.exe 436 3dvjp.exe 4676 3llfxff.exe 4412 9nhbnn.exe 4304 dppjv.exe 3924 xllxrrf.exe 1488 ttbnhb.exe 1380 tttttn.exe -
resource yara_rule behavioral2/memory/4004-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2712-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/992-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/996-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1840-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3828-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-970-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4004 wrote to memory of 1460 4004 15bf18aa36f593ffa3854fca3507df37feb545182fff77f47c3fc5c08553927eN.exe 82 PID 4004 wrote to memory of 1460 4004 15bf18aa36f593ffa3854fca3507df37feb545182fff77f47c3fc5c08553927eN.exe 82 PID 4004 wrote to memory of 1460 4004 15bf18aa36f593ffa3854fca3507df37feb545182fff77f47c3fc5c08553927eN.exe 82 PID 1460 wrote to memory of 3724 1460 pjppv.exe 83 PID 1460 wrote to memory of 3724 1460 pjppv.exe 83 PID 1460 wrote to memory of 3724 1460 pjppv.exe 83 PID 3724 wrote to memory of 3224 3724 hnnhnt.exe 84 PID 3724 wrote to memory of 3224 3724 hnnhnt.exe 84 PID 3724 wrote to memory of 3224 3724 hnnhnt.exe 84 PID 3224 wrote to memory of 4184 3224 pjdvv.exe 85 PID 3224 wrote to memory of 4184 3224 pjdvv.exe 85 PID 3224 wrote to memory of 4184 3224 pjdvv.exe 85 PID 4184 wrote to memory of 2236 4184 pvvjd.exe 86 PID 4184 wrote to memory of 2236 4184 pvvjd.exe 86 PID 4184 wrote to memory of 2236 4184 pvvjd.exe 86 PID 2236 wrote to memory of 2712 2236 hntthn.exe 87 PID 2236 wrote to memory of 2712 2236 hntthn.exe 87 PID 2236 wrote to memory of 2712 2236 hntthn.exe 87 PID 2712 wrote to memory of 2496 2712 xflfffl.exe 88 PID 2712 wrote to memory of 2496 2712 xflfffl.exe 88 PID 2712 wrote to memory of 2496 2712 xflfffl.exe 88 PID 2496 wrote to memory of 3668 2496 vvddv.exe 89 PID 2496 wrote to memory of 3668 2496 vvddv.exe 89 PID 2496 wrote to memory of 3668 2496 vvddv.exe 89 PID 3668 wrote to memory of 2480 3668 xxxlrfl.exe 90 PID 3668 wrote to memory of 2480 3668 xxxlrfl.exe 90 PID 3668 wrote to memory of 2480 3668 xxxlrfl.exe 90 PID 2480 wrote to memory of 1480 2480 djvdd.exe 91 PID 2480 wrote to memory of 1480 2480 djvdd.exe 91 PID 2480 wrote to memory of 1480 2480 djvdd.exe 91 PID 1480 wrote to memory of 1820 1480 rrrrrff.exe 92 PID 1480 wrote to memory of 1820 1480 rrrrrff.exe 92 PID 1480 wrote to memory of 1820 1480 rrrrrff.exe 92 PID 1820 wrote to memory of 992 1820 pvppd.exe 93 PID 1820 wrote to memory of 992 1820 pvppd.exe 93 PID 1820 wrote to memory of 992 1820 pvppd.exe 93 PID 992 wrote to memory of 3308 992 7xfffrl.exe 94 PID 992 wrote to memory of 3308 992 7xfffrl.exe 94 PID 992 wrote to memory of 3308 992 7xfffrl.exe 94 PID 3308 wrote to memory of 3020 3308 5rllrfr.exe 95 PID 3308 wrote to memory of 3020 3308 5rllrfr.exe 95 PID 3308 wrote to memory of 3020 3308 5rllrfr.exe 95 PID 3020 wrote to memory of 216 3020 bthhhn.exe 96 PID 3020 wrote to memory of 216 3020 bthhhn.exe 96 PID 3020 wrote to memory of 216 3020 bthhhn.exe 96 PID 216 wrote to memory of 1080 216 rxllrxl.exe 97 PID 216 wrote to memory of 1080 216 rxllrxl.exe 97 PID 216 wrote to memory of 1080 216 rxllrxl.exe 97 PID 1080 wrote to memory of 1756 1080 7hbttt.exe 98 PID 1080 wrote to memory of 1756 1080 7hbttt.exe 98 PID 1080 wrote to memory of 1756 1080 7hbttt.exe 98 PID 1756 wrote to memory of 2160 1756 ddvvv.exe 99 PID 1756 wrote to memory of 2160 1756 ddvvv.exe 99 PID 1756 wrote to memory of 2160 1756 ddvvv.exe 99 PID 2160 wrote to memory of 2732 2160 hnbnnh.exe 100 PID 2160 wrote to memory of 2732 2160 hnbnnh.exe 100 PID 2160 wrote to memory of 2732 2160 hnbnnh.exe 100 PID 2732 wrote to memory of 116 2732 1xlxxxx.exe 101 PID 2732 wrote to memory of 116 2732 1xlxxxx.exe 101 PID 2732 wrote to memory of 116 2732 1xlxxxx.exe 101 PID 116 wrote to memory of 552 116 7djdp.exe 102 PID 116 wrote to memory of 552 116 7djdp.exe 102 PID 116 wrote to memory of 552 116 7djdp.exe 102 PID 552 wrote to memory of 1368 552 7bbbhn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\15bf18aa36f593ffa3854fca3507df37feb545182fff77f47c3fc5c08553927eN.exe"C:\Users\Admin\AppData\Local\Temp\15bf18aa36f593ffa3854fca3507df37feb545182fff77f47c3fc5c08553927eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\pjppv.exec:\pjppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\hnnhnt.exec:\hnnhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\pjdvv.exec:\pjdvv.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\pvvjd.exec:\pvvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\hntthn.exec:\hntthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\xflfffl.exec:\xflfffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\vvddv.exec:\vvddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\xxxlrfl.exec:\xxxlrfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\djvdd.exec:\djvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\rrrrrff.exec:\rrrrrff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\pvppd.exec:\pvppd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\7xfffrl.exec:\7xfffrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\5rllrfr.exec:\5rllrfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\bthhhn.exec:\bthhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\rxllrxl.exec:\rxllrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\7hbttt.exec:\7hbttt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\ddvvv.exec:\ddvvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\hnbnnh.exec:\hnbnnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\1xlxxxx.exec:\1xlxxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\7djdp.exec:\7djdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\7bbbhn.exec:\7bbbhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\xrfflrr.exec:\xrfflrr.exe23⤵
- Executes dropped EXE
PID:1368 -
\??\c:\dvdjj.exec:\dvdjj.exe24⤵
- Executes dropped EXE
PID:2912 -
\??\c:\tthhhn.exec:\tthhhn.exe25⤵
- Executes dropped EXE
PID:1016 -
\??\c:\dpdvv.exec:\dpdvv.exe26⤵
- Executes dropped EXE
PID:4736 -
\??\c:\7vdvv.exec:\7vdvv.exe27⤵
- Executes dropped EXE
PID:5028 -
\??\c:\ttbbhh.exec:\ttbbhh.exe28⤵
- Executes dropped EXE
PID:996 -
\??\c:\pjvvp.exec:\pjvvp.exe29⤵
- Executes dropped EXE
PID:4384 -
\??\c:\llrxxlf.exec:\llrxxlf.exe30⤵
- Executes dropped EXE
PID:5000 -
\??\c:\3jvdv.exec:\3jvdv.exe31⤵
- Executes dropped EXE
PID:3244 -
\??\c:\1rxrlrr.exec:\1rxrlrr.exe32⤵
- Executes dropped EXE
PID:4308 -
\??\c:\jjppj.exec:\jjppj.exe33⤵
- Executes dropped EXE
PID:4976 -
\??\c:\lrxxxxx.exec:\lrxxxxx.exe34⤵
- Executes dropped EXE
PID:4192 -
\??\c:\bhnhbb.exec:\bhnhbb.exe35⤵
- Executes dropped EXE
PID:3528 -
\??\c:\djjdd.exec:\djjdd.exe36⤵
- Executes dropped EXE
PID:1976 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe37⤵
- Executes dropped EXE
PID:4480 -
\??\c:\btttbh.exec:\btttbh.exe38⤵
- Executes dropped EXE
PID:4200 -
\??\c:\7tnnht.exec:\7tnnht.exe39⤵
- Executes dropped EXE
PID:4168 -
\??\c:\3pjdp.exec:\3pjdp.exe40⤵
- Executes dropped EXE
PID:3560 -
\??\c:\1ffxlfx.exec:\1ffxlfx.exe41⤵
- Executes dropped EXE
PID:5080 -
\??\c:\nhhbtn.exec:\nhhbtn.exe42⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nhtnnn.exec:\nhtnnn.exe43⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vpvpj.exec:\vpvpj.exe44⤵
- Executes dropped EXE
PID:3580 -
\??\c:\3lllfxx.exec:\3lllfxx.exe45⤵
- Executes dropped EXE
PID:4896 -
\??\c:\bbhbtt.exec:\bbhbtt.exe46⤵
- Executes dropped EXE
PID:4884 -
\??\c:\1hbttn.exec:\1hbttn.exe47⤵
- Executes dropped EXE
PID:1620 -
\??\c:\vjdvd.exec:\vjdvd.exe48⤵
- Executes dropped EXE
PID:3740 -
\??\c:\lrxrrlf.exec:\lrxrrlf.exe49⤵
- Executes dropped EXE
PID:3544 -
\??\c:\5tbtnn.exec:\5tbtnn.exe50⤵
- Executes dropped EXE
PID:1360 -
\??\c:\bbnnnt.exec:\bbnnnt.exe51⤵
- Executes dropped EXE
PID:1936 -
\??\c:\djvdv.exec:\djvdv.exe52⤵PID:4392
-
\??\c:\ffrlllx.exec:\ffrlllx.exe53⤵
- Executes dropped EXE
PID:1840 -
\??\c:\hbbhbb.exec:\hbbhbb.exe54⤵
- Executes dropped EXE
PID:2552 -
\??\c:\tnnthb.exec:\tnnthb.exe55⤵
- Executes dropped EXE
PID:1672 -
\??\c:\vdjdp.exec:\vdjdp.exe56⤵
- Executes dropped EXE
PID:916 -
\??\c:\7xxrlxx.exec:\7xxrlxx.exe57⤵
- Executes dropped EXE
PID:2300 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe58⤵
- Executes dropped EXE
PID:2340 -
\??\c:\pdppj.exec:\pdppj.exe59⤵
- Executes dropped EXE
PID:2244 -
\??\c:\3dvjp.exec:\3dvjp.exe60⤵
- Executes dropped EXE
PID:436 -
\??\c:\3llfxff.exec:\3llfxff.exe61⤵
- Executes dropped EXE
PID:4676 -
\??\c:\9nhbnn.exec:\9nhbnn.exe62⤵
- Executes dropped EXE
PID:4412 -
\??\c:\dppjv.exec:\dppjv.exe63⤵
- Executes dropped EXE
PID:4304 -
\??\c:\xllxrrf.exec:\xllxrrf.exe64⤵
- Executes dropped EXE
PID:3924 -
\??\c:\ttbnhb.exec:\ttbnhb.exe65⤵
- Executes dropped EXE
PID:1488 -
\??\c:\tttttn.exec:\tttttn.exe66⤵
- Executes dropped EXE
PID:1380 -
\??\c:\1djpj.exec:\1djpj.exe67⤵PID:3772
-
\??\c:\3lllfff.exec:\3lllfff.exe68⤵PID:1528
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe69⤵PID:4360
-
\??\c:\5jppv.exec:\5jppv.exe70⤵
- System Location Discovery: System Language Discovery
PID:3512 -
\??\c:\xxflfxx.exec:\xxflfxx.exe71⤵PID:3204
-
\??\c:\1tthbt.exec:\1tthbt.exe72⤵PID:992
-
\??\c:\bttthb.exec:\bttthb.exe73⤵PID:3308
-
\??\c:\9dvvp.exec:\9dvvp.exe74⤵PID:4028
-
\??\c:\9rrlfff.exec:\9rrlfff.exe75⤵PID:2972
-
\??\c:\bbbthh.exec:\bbbthh.exe76⤵PID:216
-
\??\c:\3pppj.exec:\3pppj.exe77⤵PID:4496
-
\??\c:\pvdpd.exec:\pvdpd.exe78⤵PID:228
-
\??\c:\lrrlxrl.exec:\lrrlxrl.exe79⤵PID:2948
-
\??\c:\bttnhb.exec:\bttnhb.exe80⤵PID:2124
-
\??\c:\djdvp.exec:\djdvp.exe81⤵PID:4880
-
\??\c:\jpdpd.exec:\jpdpd.exe82⤵PID:2516
-
\??\c:\5rfxfxr.exec:\5rfxfxr.exe83⤵PID:3256
-
\??\c:\bbhbnn.exec:\bbhbnn.exe84⤵PID:3828
-
\??\c:\dvdvp.exec:\dvdvp.exe85⤵PID:2036
-
\??\c:\9rxlxfx.exec:\9rxlxfx.exe86⤵PID:4136
-
\??\c:\xrxrllf.exec:\xrxrllf.exe87⤵PID:2912
-
\??\c:\bhnhbb.exec:\bhnhbb.exe88⤵PID:4824
-
\??\c:\5pvpd.exec:\5pvpd.exe89⤵PID:3232
-
\??\c:\5fxlxxx.exec:\5fxlxxx.exe90⤵PID:4440
-
\??\c:\nbhhbb.exec:\nbhhbb.exe91⤵PID:912
-
\??\c:\vdjdp.exec:\vdjdp.exe92⤵PID:4944
-
\??\c:\jjpjv.exec:\jjpjv.exe93⤵PID:4344
-
\??\c:\3rrrllx.exec:\3rrrllx.exe94⤵PID:400
-
\??\c:\htbttn.exec:\htbttn.exe95⤵PID:5000
-
\??\c:\3jdpj.exec:\3jdpj.exe96⤵PID:3032
-
\??\c:\7rlfrlf.exec:\7rlfrlf.exe97⤵PID:4308
-
\??\c:\nbnnhh.exec:\nbnnhh.exe98⤵PID:3332
-
\??\c:\9jddp.exec:\9jddp.exe99⤵PID:316
-
\??\c:\pjvpv.exec:\pjvpv.exe100⤵PID:2900
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe101⤵PID:3696
-
\??\c:\hbbnhb.exec:\hbbnhb.exe102⤵PID:3456
-
\??\c:\vpvpd.exec:\vpvpd.exe103⤵PID:528
-
\??\c:\ddjdv.exec:\ddjdv.exe104⤵PID:2360
-
\??\c:\xlrlrrl.exec:\xlrlrrl.exe105⤵PID:4656
-
\??\c:\hbhbtt.exec:\hbhbtt.exe106⤵PID:2440
-
\??\c:\hhhtbt.exec:\hhhtbt.exe107⤵PID:5092
-
\??\c:\1pjdp.exec:\1pjdp.exe108⤵PID:2396
-
\??\c:\5xxxllf.exec:\5xxxllf.exe109⤵PID:3588
-
\??\c:\5btbtb.exec:\5btbtb.exe110⤵PID:2432
-
\??\c:\djvjd.exec:\djvjd.exe111⤵PID:3660
-
\??\c:\jdjdv.exec:\jdjdv.exe112⤵PID:1044
-
\??\c:\3lrxffx.exec:\3lrxffx.exe113⤵PID:1120
-
\??\c:\nnbhtb.exec:\nnbhtb.exe114⤵PID:4760
-
\??\c:\dpdvp.exec:\dpdvp.exe115⤵PID:2180
-
\??\c:\1ffxlfl.exec:\1ffxlfl.exe116⤵PID:1192
-
\??\c:\lxxrllf.exec:\lxxrllf.exe117⤵PID:2232
-
\??\c:\nbnhhb.exec:\nbnhhb.exe118⤵PID:1236
-
\??\c:\thnhbt.exec:\thnhbt.exe119⤵PID:1840
-
\??\c:\pvvpj.exec:\pvvpj.exe120⤵PID:840
-
\??\c:\rlxlfxr.exec:\rlxlfxr.exe121⤵PID:2368
-
\??\c:\1rxrllf.exec:\1rxrllf.exe122⤵PID:5060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-