Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 05:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe
Resource
win7-20240708-en
7 signatures
150 seconds
General
-
Target
c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe
-
Size
454KB
-
MD5
92f17e71b40b4d85ea4357514506b3d8
-
SHA1
699da613e097a661464b5c7dbc097537baae99f9
-
SHA256
c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b
-
SHA512
0060cc946c8b2e9c230a1b7913a5fc56598af747160ef6f38ee9ce11ef8e779f6b14b54e04bb999981d7fa29302b14e82809176b3c4f804dfb4dc70e8ea7ed4e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeI:q7Tc2NYHUrAwfMp3CDI
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/640-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/756-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1184-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2472-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/944-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/668-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-845-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-1014-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-1210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 756 nhnbbt.exe 4416 jvpjd.exe 4336 hhnnhb.exe 3568 rfxflxr.exe 1656 lrfrfxl.exe 2128 djpjd.exe 228 xrlxlrl.exe 5064 djjdp.exe 2384 fxrlfxr.exe 3404 xlrxllx.exe 220 nhhtnb.exe 3144 7jppd.exe 4420 xrrlllf.exe 1128 btttnn.exe 4580 jjvjd.exe 3444 rffxrrl.exe 1872 nhnnnt.exe 4516 vdjvp.exe 1184 1xlxlll.exe 2512 rrxxxxr.exe 4968 vjjdv.exe 2472 hnbtnh.exe 4652 jvjdv.exe 1076 htbttn.exe 1996 hhtttt.exe 4048 pppjd.exe 4876 3jvpj.exe 944 jjvpd.exe 668 nnhtnn.exe 2340 1xlfxlf.exe 1332 httnht.exe 940 1ppvj.exe 4644 nhnhbt.exe 2768 7ffxlfx.exe 2160 hhnhbb.exe 3748 dpppj.exe 1224 jvdvp.exe 2412 5lrffxl.exe 4520 btnbth.exe 4480 pjjdp.exe 1148 fxxrffx.exe 1756 hbntnn.exe 4044 jddvp.exe 4320 vjjpd.exe 3732 xffrfxr.exe 3000 7nttnt.exe 4648 thnhbb.exe 4712 pjvpd.exe 4976 frxlxxf.exe 3848 7hhbhh.exe 4460 9jjpj.exe 4828 rflfrll.exe 428 frlfxrl.exe 1680 htbnhh.exe 3764 bnnhth.exe 3700 vjpdv.exe 2516 xfflfxr.exe 1496 hhhtnn.exe 4560 jvddv.exe 2556 xrfxfff.exe 4264 xflfxrr.exe 2084 nhnnhn.exe 3980 vvjjv.exe 1488 fxxrlfr.exe -
resource yara_rule behavioral2/memory/640-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1184-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/944-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/668-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-738-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfrrl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 640 wrote to memory of 756 640 c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe 82 PID 640 wrote to memory of 756 640 c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe 82 PID 640 wrote to memory of 756 640 c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe 82 PID 756 wrote to memory of 4416 756 nhnbbt.exe 83 PID 756 wrote to memory of 4416 756 nhnbbt.exe 83 PID 756 wrote to memory of 4416 756 nhnbbt.exe 83 PID 4416 wrote to memory of 4336 4416 jvpjd.exe 84 PID 4416 wrote to memory of 4336 4416 jvpjd.exe 84 PID 4416 wrote to memory of 4336 4416 jvpjd.exe 84 PID 4336 wrote to memory of 3568 4336 hhnnhb.exe 85 PID 4336 wrote to memory of 3568 4336 hhnnhb.exe 85 PID 4336 wrote to memory of 3568 4336 hhnnhb.exe 85 PID 3568 wrote to memory of 1656 3568 rfxflxr.exe 86 PID 3568 wrote to memory of 1656 3568 rfxflxr.exe 86 PID 3568 wrote to memory of 1656 3568 rfxflxr.exe 86 PID 1656 wrote to memory of 2128 1656 lrfrfxl.exe 87 PID 1656 wrote to memory of 2128 1656 lrfrfxl.exe 87 PID 1656 wrote to memory of 2128 1656 lrfrfxl.exe 87 PID 2128 wrote to memory of 228 2128 djpjd.exe 88 PID 2128 wrote to memory of 228 2128 djpjd.exe 88 PID 2128 wrote to memory of 228 2128 djpjd.exe 88 PID 228 wrote to memory of 5064 228 xrlxlrl.exe 89 PID 228 wrote to memory of 5064 228 xrlxlrl.exe 89 PID 228 wrote to memory of 5064 228 xrlxlrl.exe 89 PID 5064 wrote to memory of 2384 5064 djjdp.exe 90 PID 5064 wrote to memory of 2384 5064 djjdp.exe 90 PID 5064 wrote to memory of 2384 5064 djjdp.exe 90 PID 2384 wrote to memory of 3404 2384 fxrlfxr.exe 91 PID 2384 wrote to memory of 3404 2384 fxrlfxr.exe 91 PID 2384 wrote to memory of 3404 2384 fxrlfxr.exe 91 PID 3404 wrote to memory of 220 3404 xlrxllx.exe 92 PID 3404 wrote to memory of 220 3404 xlrxllx.exe 92 PID 3404 wrote to memory of 220 3404 xlrxllx.exe 92 PID 220 wrote to memory of 3144 220 nhhtnb.exe 93 PID 220 wrote to memory of 3144 220 nhhtnb.exe 93 PID 220 wrote to memory of 3144 220 nhhtnb.exe 93 PID 3144 wrote to memory of 4420 3144 7jppd.exe 94 PID 3144 wrote to memory of 4420 3144 7jppd.exe 94 PID 3144 wrote to memory of 4420 3144 7jppd.exe 94 PID 4420 wrote to memory of 1128 4420 xrrlllf.exe 95 PID 4420 wrote to memory of 1128 4420 xrrlllf.exe 95 PID 4420 wrote to memory of 1128 4420 xrrlllf.exe 95 PID 1128 wrote to memory of 4580 1128 btttnn.exe 96 PID 1128 wrote to memory of 4580 1128 btttnn.exe 96 PID 1128 wrote to memory of 4580 1128 btttnn.exe 96 PID 4580 wrote to memory of 3444 4580 jjvjd.exe 97 PID 4580 wrote to memory of 3444 4580 jjvjd.exe 97 PID 4580 wrote to memory of 3444 4580 jjvjd.exe 97 PID 3444 wrote to memory of 1872 3444 rffxrrl.exe 98 PID 3444 wrote to memory of 1872 3444 rffxrrl.exe 98 PID 3444 wrote to memory of 1872 3444 rffxrrl.exe 98 PID 1872 wrote to memory of 4516 1872 nhnnnt.exe 99 PID 1872 wrote to memory of 4516 1872 nhnnnt.exe 99 PID 1872 wrote to memory of 4516 1872 nhnnnt.exe 99 PID 4516 wrote to memory of 1184 4516 vdjvp.exe 100 PID 4516 wrote to memory of 1184 4516 vdjvp.exe 100 PID 4516 wrote to memory of 1184 4516 vdjvp.exe 100 PID 1184 wrote to memory of 2512 1184 1xlxlll.exe 101 PID 1184 wrote to memory of 2512 1184 1xlxlll.exe 101 PID 1184 wrote to memory of 2512 1184 1xlxlll.exe 101 PID 2512 wrote to memory of 4968 2512 rrxxxxr.exe 102 PID 2512 wrote to memory of 4968 2512 rrxxxxr.exe 102 PID 2512 wrote to memory of 4968 2512 rrxxxxr.exe 102 PID 4968 wrote to memory of 2472 4968 vjjdv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe"C:\Users\Admin\AppData\Local\Temp\c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\nhnbbt.exec:\nhnbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\jvpjd.exec:\jvpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\hhnnhb.exec:\hhnnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\rfxflxr.exec:\rfxflxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\lrfrfxl.exec:\lrfrfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\djpjd.exec:\djpjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\xrlxlrl.exec:\xrlxlrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\djjdp.exec:\djjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\xlrxllx.exec:\xlrxllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\nhhtnb.exec:\nhhtnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\7jppd.exec:\7jppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\xrrlllf.exec:\xrrlllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\btttnn.exec:\btttnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\jjvjd.exec:\jjvjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\rffxrrl.exec:\rffxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\nhnnnt.exec:\nhnnnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\vdjvp.exec:\vdjvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\1xlxlll.exec:\1xlxlll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\rrxxxxr.exec:\rrxxxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\vjjdv.exec:\vjjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\hnbtnh.exec:\hnbtnh.exe23⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jvjdv.exec:\jvjdv.exe24⤵
- Executes dropped EXE
PID:4652 -
\??\c:\htbttn.exec:\htbttn.exe25⤵
- Executes dropped EXE
PID:1076 -
\??\c:\hhtttt.exec:\hhtttt.exe26⤵
- Executes dropped EXE
PID:1996 -
\??\c:\pppjd.exec:\pppjd.exe27⤵
- Executes dropped EXE
PID:4048 -
\??\c:\3jvpj.exec:\3jvpj.exe28⤵
- Executes dropped EXE
PID:4876 -
\??\c:\jjvpd.exec:\jjvpd.exe29⤵
- Executes dropped EXE
PID:944 -
\??\c:\nnhtnn.exec:\nnhtnn.exe30⤵
- Executes dropped EXE
PID:668 -
\??\c:\1xlfxlf.exec:\1xlfxlf.exe31⤵
- Executes dropped EXE
PID:2340 -
\??\c:\httnht.exec:\httnht.exe32⤵
- Executes dropped EXE
PID:1332 -
\??\c:\1ppvj.exec:\1ppvj.exe33⤵
- Executes dropped EXE
PID:940 -
\??\c:\nhnhbt.exec:\nhnhbt.exe34⤵
- Executes dropped EXE
PID:4644 -
\??\c:\7ffxlfx.exec:\7ffxlfx.exe35⤵
- Executes dropped EXE
PID:2768 -
\??\c:\hhnhbb.exec:\hhnhbb.exe36⤵
- Executes dropped EXE
PID:2160 -
\??\c:\dpppj.exec:\dpppj.exe37⤵
- Executes dropped EXE
PID:3748 -
\??\c:\jvdvp.exec:\jvdvp.exe38⤵
- Executes dropped EXE
PID:1224 -
\??\c:\5lrffxl.exec:\5lrffxl.exe39⤵
- Executes dropped EXE
PID:2412 -
\??\c:\btnbth.exec:\btnbth.exe40⤵
- Executes dropped EXE
PID:4520 -
\??\c:\pjjdp.exec:\pjjdp.exe41⤵
- Executes dropped EXE
PID:4480 -
\??\c:\fxxrffx.exec:\fxxrffx.exe42⤵
- Executes dropped EXE
PID:1148 -
\??\c:\hbntnn.exec:\hbntnn.exe43⤵
- Executes dropped EXE
PID:1756 -
\??\c:\jddvp.exec:\jddvp.exe44⤵
- Executes dropped EXE
PID:4044 -
\??\c:\vjjpd.exec:\vjjpd.exe45⤵
- Executes dropped EXE
PID:4320 -
\??\c:\xffrfxr.exec:\xffrfxr.exe46⤵
- Executes dropped EXE
PID:3732 -
\??\c:\7nttnt.exec:\7nttnt.exe47⤵
- Executes dropped EXE
PID:3000 -
\??\c:\thnhbb.exec:\thnhbb.exe48⤵
- Executes dropped EXE
PID:4648 -
\??\c:\pjvpd.exec:\pjvpd.exe49⤵
- Executes dropped EXE
PID:4712 -
\??\c:\frxlxxf.exec:\frxlxxf.exe50⤵
- Executes dropped EXE
PID:4976 -
\??\c:\7hhbhh.exec:\7hhbhh.exe51⤵
- Executes dropped EXE
PID:3848 -
\??\c:\9jjpj.exec:\9jjpj.exe52⤵
- Executes dropped EXE
PID:4460 -
\??\c:\rflfrll.exec:\rflfrll.exe53⤵
- Executes dropped EXE
PID:4828 -
\??\c:\frlfxrl.exec:\frlfxrl.exe54⤵
- Executes dropped EXE
PID:428 -
\??\c:\htbnhh.exec:\htbnhh.exe55⤵
- Executes dropped EXE
PID:1680 -
\??\c:\bnnhth.exec:\bnnhth.exe56⤵
- Executes dropped EXE
PID:3764 -
\??\c:\vjpdv.exec:\vjpdv.exe57⤵
- Executes dropped EXE
PID:3700 -
\??\c:\xfflfxr.exec:\xfflfxr.exe58⤵
- Executes dropped EXE
PID:2516 -
\??\c:\hhhtnn.exec:\hhhtnn.exe59⤵
- Executes dropped EXE
PID:1496 -
\??\c:\jvddv.exec:\jvddv.exe60⤵
- Executes dropped EXE
PID:4560 -
\??\c:\xrfxfff.exec:\xrfxfff.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2556 -
\??\c:\xflfxrr.exec:\xflfxrr.exe62⤵
- Executes dropped EXE
PID:4264 -
\??\c:\nhnnhn.exec:\nhnnhn.exe63⤵
- Executes dropped EXE
PID:2084 -
\??\c:\vvjjv.exec:\vvjjv.exe64⤵
- Executes dropped EXE
PID:3980 -
\??\c:\fxxrlfr.exec:\fxxrlfr.exe65⤵
- Executes dropped EXE
PID:1488 -
\??\c:\rxrxlrl.exec:\rxrxlrl.exe66⤵PID:3340
-
\??\c:\hnthtt.exec:\hnthtt.exe67⤵PID:3096
-
\??\c:\vdjvj.exec:\vdjvj.exe68⤵PID:2384
-
\??\c:\1jdvd.exec:\1jdvd.exe69⤵PID:264
-
\??\c:\rlfrlxl.exec:\rlfrlxl.exe70⤵PID:2312
-
\??\c:\tttnbb.exec:\tttnbb.exe71⤵PID:2584
-
\??\c:\3pvpd.exec:\3pvpd.exe72⤵PID:2688
-
\??\c:\llrlxxr.exec:\llrlxxr.exe73⤵PID:4864
-
\??\c:\thtntn.exec:\thtntn.exe74⤵PID:1128
-
\??\c:\vjjdd.exec:\vjjdd.exe75⤵PID:1472
-
\??\c:\jddpj.exec:\jddpj.exe76⤵PID:4772
-
\??\c:\xflxrll.exec:\xflxrll.exe77⤵PID:3472
-
\??\c:\htbnbt.exec:\htbnbt.exe78⤵PID:4688
-
\??\c:\vppdv.exec:\vppdv.exe79⤵PID:2800
-
\??\c:\dvdpp.exec:\dvdpp.exe80⤵PID:3992
-
\??\c:\rxfrlfx.exec:\rxfrlfx.exe81⤵PID:3904
-
\??\c:\htnbnh.exec:\htnbnh.exe82⤵PID:2248
-
\??\c:\hbnnnn.exec:\hbnnnn.exe83⤵PID:1528
-
\??\c:\vvvdv.exec:\vvvdv.exe84⤵PID:4496
-
\??\c:\xflfxff.exec:\xflfxff.exe85⤵PID:3780
-
\??\c:\tntttb.exec:\tntttb.exe86⤵PID:2104
-
\??\c:\9djvp.exec:\9djvp.exe87⤵PID:4652
-
\??\c:\fxlxrff.exec:\fxlxrff.exe88⤵PID:1076
-
\??\c:\3rfrxrr.exec:\3rfrxrr.exe89⤵PID:3012
-
\??\c:\tnntnn.exec:\tnntnn.exe90⤵PID:1536
-
\??\c:\pdvpd.exec:\pdvpd.exe91⤵PID:2208
-
\??\c:\xlxrllf.exec:\xlxrllf.exe92⤵PID:3412
-
\??\c:\fffxlrf.exec:\fffxlrf.exe93⤵PID:4960
-
\??\c:\nbbtnn.exec:\nbbtnn.exe94⤵PID:2660
-
\??\c:\1pvvd.exec:\1pvvd.exe95⤵PID:4172
-
\??\c:\rflfrrl.exec:\rflfrrl.exe96⤵PID:1788
-
\??\c:\5ttnhh.exec:\5ttnhh.exe97⤵PID:1600
-
\??\c:\bbhhtn.exec:\bbhhtn.exe98⤵PID:4556
-
\??\c:\9jpjj.exec:\9jpjj.exe99⤵PID:3300
-
\??\c:\frrlxxl.exec:\frrlxxl.exe100⤵PID:512
-
\??\c:\9nnhhh.exec:\9nnhhh.exe101⤵PID:516
-
\??\c:\dvvpd.exec:\dvvpd.exe102⤵PID:860
-
\??\c:\fffrffx.exec:\fffrffx.exe103⤵PID:1916
-
\??\c:\9ffrfxl.exec:\9ffrfxl.exe104⤵PID:2296
-
\??\c:\thnnbb.exec:\thnnbb.exe105⤵PID:2316
-
\??\c:\dvpjv.exec:\dvpjv.exe106⤵PID:4504
-
\??\c:\rlfxlrl.exec:\rlfxlrl.exe107⤵PID:4440
-
\??\c:\9tbttn.exec:\9tbttn.exe108⤵PID:1328
-
\??\c:\djjvp.exec:\djjvp.exe109⤵PID:1712
-
\??\c:\xlrlxrl.exec:\xlrlxrl.exe110⤵PID:1008
-
\??\c:\xrxrrrx.exec:\xrxrrrx.exe111⤵PID:4748
-
\??\c:\tttnhh.exec:\tttnhh.exe112⤵PID:3964
-
\??\c:\vvdvv.exec:\vvdvv.exe113⤵PID:2948
-
\??\c:\frrfrlf.exec:\frrfrlf.exe114⤵PID:452
-
\??\c:\ntnnnt.exec:\ntnnnt.exe115⤵PID:4648
-
\??\c:\bnnhtn.exec:\bnnhtn.exe116⤵PID:916
-
\??\c:\pddpj.exec:\pddpj.exe117⤵PID:2376
-
\??\c:\lxxlfxx.exec:\lxxlfxx.exe118⤵PID:4620
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe119⤵PID:3672
-
\??\c:\7bnhbt.exec:\7bnhbt.exe120⤵PID:4828
-
\??\c:\ppdpd.exec:\ppdpd.exe121⤵PID:3820
-
\??\c:\rflfrrl.exec:\rflfrrl.exe122⤵PID:4400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-