Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 07:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
843972cd00444c8b9eadd35fa9c56218065989065e0971f206c67476e4c2f6a2N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
843972cd00444c8b9eadd35fa9c56218065989065e0971f206c67476e4c2f6a2N.exe
-
Size
456KB
-
MD5
aba6579a3aa86bd40f9f834fed737200
-
SHA1
c521b9d28b269c2e957b149795548c54e9d46ef9
-
SHA256
843972cd00444c8b9eadd35fa9c56218065989065e0971f206c67476e4c2f6a2
-
SHA512
0eeff4734db86efee35817ddf8722e119e4defa275b4bbf7fd9655ef5a0a2402c031c900b763245bea199bcecf31a3792375c94439452e1bd6cffab64cc2b97e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRZ:q7Tc2NYHUrAwfMp3CDRZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4828-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2068-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/852-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/752-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2988-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1840-704-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/908-765-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-1653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2896 xfffxxx.exe 464 bnhbtt.exe 2068 fxrfffx.exe 1480 xllfffx.exe 1068 flfxrlf.exe 2776 thnhhh.exe 1168 fxxxxxx.exe 4184 bthbtn.exe 4300 bttnnh.exe 1984 3jjdv.exe 852 pvdpv.exe 1908 fxrlxfx.exe 3588 tntttt.exe 4112 5nnhbb.exe 3052 tnnnhh.exe 5088 pvddv.exe 1456 5jdvp.exe 4596 llrlrrr.exe 1832 bnbbtb.exe 3496 7jppj.exe 2468 vpppp.exe 2840 flflffx.exe 4924 vjpjd.exe 412 3xxrrlf.exe 3000 fffrlrx.exe 3824 vjjjd.exe 4492 bnbtnn.exe 4316 ffrxrxx.exe 4812 tnhhhb.exe 4468 jjjdd.exe 1452 tbbbtt.exe 1012 vpdvp.exe 1076 pjpjj.exe 2948 vjdvj.exe 5024 lrxlfrf.exe 3864 pddvj.exe 4284 5lrlllf.exe 2332 frfxrlf.exe 3976 bnnhbt.exe 3852 pddvp.exe 3552 xlffrlr.exe 3916 bntnhh.exe 752 thhbtn.exe 1828 jdvjv.exe 1420 nhtttn.exe 5040 ppvpj.exe 3684 rffxrlf.exe 2152 5hbhbb.exe 2300 nttnbt.exe 4508 3vdpv.exe 4348 7rrlrrl.exe 4364 7ttnhb.exe 1120 pjjdv.exe 1756 xxllllf.exe 448 xxxrfxx.exe 3648 ntthtt.exe 2388 dvpjj.exe 4768 xflfrlf.exe 2248 rrrrrrr.exe 2988 nhhbbb.exe 1444 vjdvp.exe 3380 dddvp.exe 3592 lfrlrlr.exe 4184 nbnbbt.exe -
resource yara_rule behavioral2/memory/2896-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/752-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2988-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1840-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/908-765-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxrrr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4828 wrote to memory of 2896 4828 843972cd00444c8b9eadd35fa9c56218065989065e0971f206c67476e4c2f6a2N.exe 83 PID 4828 wrote to memory of 2896 4828 843972cd00444c8b9eadd35fa9c56218065989065e0971f206c67476e4c2f6a2N.exe 83 PID 4828 wrote to memory of 2896 4828 843972cd00444c8b9eadd35fa9c56218065989065e0971f206c67476e4c2f6a2N.exe 83 PID 2896 wrote to memory of 464 2896 xfffxxx.exe 84 PID 2896 wrote to memory of 464 2896 xfffxxx.exe 84 PID 2896 wrote to memory of 464 2896 xfffxxx.exe 84 PID 464 wrote to memory of 2068 464 bnhbtt.exe 85 PID 464 wrote to memory of 2068 464 bnhbtt.exe 85 PID 464 wrote to memory of 2068 464 bnhbtt.exe 85 PID 2068 wrote to memory of 1480 2068 fxrfffx.exe 86 PID 2068 wrote to memory of 1480 2068 fxrfffx.exe 86 PID 2068 wrote to memory of 1480 2068 fxrfffx.exe 86 PID 1480 wrote to memory of 1068 1480 xllfffx.exe 87 PID 1480 wrote to memory of 1068 1480 xllfffx.exe 87 PID 1480 wrote to memory of 1068 1480 xllfffx.exe 87 PID 1068 wrote to memory of 2776 1068 flfxrlf.exe 88 PID 1068 wrote to memory of 2776 1068 flfxrlf.exe 88 PID 1068 wrote to memory of 2776 1068 flfxrlf.exe 88 PID 2776 wrote to memory of 1168 2776 thnhhh.exe 89 PID 2776 wrote to memory of 1168 2776 thnhhh.exe 89 PID 2776 wrote to memory of 1168 2776 thnhhh.exe 89 PID 1168 wrote to memory of 4184 1168 fxxxxxx.exe 90 PID 1168 wrote to memory of 4184 1168 fxxxxxx.exe 90 PID 1168 wrote to memory of 4184 1168 fxxxxxx.exe 90 PID 4184 wrote to memory of 4300 4184 bthbtn.exe 91 PID 4184 wrote to memory of 4300 4184 bthbtn.exe 91 PID 4184 wrote to memory of 4300 4184 bthbtn.exe 91 PID 4300 wrote to memory of 1984 4300 bttnnh.exe 92 PID 4300 wrote to memory of 1984 4300 bttnnh.exe 92 PID 4300 wrote to memory of 1984 4300 bttnnh.exe 92 PID 1984 wrote to memory of 852 1984 3jjdv.exe 93 PID 1984 wrote to memory of 852 1984 3jjdv.exe 93 PID 1984 wrote to memory of 852 1984 3jjdv.exe 93 PID 852 wrote to memory of 1908 852 pvdpv.exe 94 PID 852 wrote to memory of 1908 852 pvdpv.exe 94 PID 852 wrote to memory of 1908 852 pvdpv.exe 94 PID 1908 wrote to memory of 3588 1908 fxrlxfx.exe 95 PID 1908 wrote to memory of 3588 1908 fxrlxfx.exe 95 PID 1908 wrote to memory of 3588 1908 fxrlxfx.exe 95 PID 3588 wrote to memory of 4112 3588 tntttt.exe 96 PID 3588 wrote to memory of 4112 3588 tntttt.exe 96 PID 3588 wrote to memory of 4112 3588 tntttt.exe 96 PID 4112 wrote to memory of 3052 4112 5nnhbb.exe 97 PID 4112 wrote to memory of 3052 4112 5nnhbb.exe 97 PID 4112 wrote to memory of 3052 4112 5nnhbb.exe 97 PID 3052 wrote to memory of 5088 3052 tnnnhh.exe 98 PID 3052 wrote to memory of 5088 3052 tnnnhh.exe 98 PID 3052 wrote to memory of 5088 3052 tnnnhh.exe 98 PID 5088 wrote to memory of 1456 5088 pvddv.exe 99 PID 5088 wrote to memory of 1456 5088 pvddv.exe 99 PID 5088 wrote to memory of 1456 5088 pvddv.exe 99 PID 1456 wrote to memory of 4596 1456 5jdvp.exe 100 PID 1456 wrote to memory of 4596 1456 5jdvp.exe 100 PID 1456 wrote to memory of 4596 1456 5jdvp.exe 100 PID 4596 wrote to memory of 1832 4596 llrlrrr.exe 101 PID 4596 wrote to memory of 1832 4596 llrlrrr.exe 101 PID 4596 wrote to memory of 1832 4596 llrlrrr.exe 101 PID 1832 wrote to memory of 3496 1832 bnbbtb.exe 102 PID 1832 wrote to memory of 3496 1832 bnbbtb.exe 102 PID 1832 wrote to memory of 3496 1832 bnbbtb.exe 102 PID 3496 wrote to memory of 2468 3496 7jppj.exe 103 PID 3496 wrote to memory of 2468 3496 7jppj.exe 103 PID 3496 wrote to memory of 2468 3496 7jppj.exe 103 PID 2468 wrote to memory of 2840 2468 vpppp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\843972cd00444c8b9eadd35fa9c56218065989065e0971f206c67476e4c2f6a2N.exe"C:\Users\Admin\AppData\Local\Temp\843972cd00444c8b9eadd35fa9c56218065989065e0971f206c67476e4c2f6a2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\xfffxxx.exec:\xfffxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\bnhbtt.exec:\bnhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\fxrfffx.exec:\fxrfffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\xllfffx.exec:\xllfffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\flfxrlf.exec:\flfxrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\thnhhh.exec:\thnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\fxxxxxx.exec:\fxxxxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\bthbtn.exec:\bthbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\bttnnh.exec:\bttnnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\3jjdv.exec:\3jjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\pvdpv.exec:\pvdpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\fxrlxfx.exec:\fxrlxfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\tntttt.exec:\tntttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\5nnhbb.exec:\5nnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\tnnnhh.exec:\tnnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\pvddv.exec:\pvddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\5jdvp.exec:\5jdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\llrlrrr.exec:\llrlrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\bnbbtb.exec:\bnbbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\7jppj.exec:\7jppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\vpppp.exec:\vpppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\flflffx.exec:\flflffx.exe23⤵
- Executes dropped EXE
PID:2840 -
\??\c:\vjpjd.exec:\vjpjd.exe24⤵
- Executes dropped EXE
PID:4924 -
\??\c:\3xxrrlf.exec:\3xxrrlf.exe25⤵
- Executes dropped EXE
PID:412 -
\??\c:\fffrlrx.exec:\fffrlrx.exe26⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vjjjd.exec:\vjjjd.exe27⤵
- Executes dropped EXE
PID:3824 -
\??\c:\bnbtnn.exec:\bnbtnn.exe28⤵
- Executes dropped EXE
PID:4492 -
\??\c:\ffrxrxx.exec:\ffrxrxx.exe29⤵
- Executes dropped EXE
PID:4316 -
\??\c:\tnhhhb.exec:\tnhhhb.exe30⤵
- Executes dropped EXE
PID:4812 -
\??\c:\jjjdd.exec:\jjjdd.exe31⤵
- Executes dropped EXE
PID:4468 -
\??\c:\tbbbtt.exec:\tbbbtt.exe32⤵
- Executes dropped EXE
PID:1452 -
\??\c:\vpdvp.exec:\vpdvp.exe33⤵
- Executes dropped EXE
PID:1012 -
\??\c:\pjpjj.exec:\pjpjj.exe34⤵
- Executes dropped EXE
PID:1076 -
\??\c:\vjdvj.exec:\vjdvj.exe35⤵
- Executes dropped EXE
PID:2948 -
\??\c:\lrxlfrf.exec:\lrxlfrf.exe36⤵
- Executes dropped EXE
PID:5024 -
\??\c:\pddvj.exec:\pddvj.exe37⤵
- Executes dropped EXE
PID:3864 -
\??\c:\5lrlllf.exec:\5lrlllf.exe38⤵
- Executes dropped EXE
PID:4284 -
\??\c:\frfxrlf.exec:\frfxrlf.exe39⤵
- Executes dropped EXE
PID:2332 -
\??\c:\bnnhbt.exec:\bnnhbt.exe40⤵
- Executes dropped EXE
PID:3976 -
\??\c:\pddvp.exec:\pddvp.exe41⤵
- Executes dropped EXE
PID:3852 -
\??\c:\xlffrlr.exec:\xlffrlr.exe42⤵
- Executes dropped EXE
PID:3552 -
\??\c:\bntnhh.exec:\bntnhh.exe43⤵
- Executes dropped EXE
PID:3916 -
\??\c:\thhbtn.exec:\thhbtn.exe44⤵
- Executes dropped EXE
PID:752 -
\??\c:\jdvjv.exec:\jdvjv.exe45⤵
- Executes dropped EXE
PID:1828 -
\??\c:\nhtttn.exec:\nhtttn.exe46⤵
- Executes dropped EXE
PID:1420 -
\??\c:\ppvpj.exec:\ppvpj.exe47⤵
- Executes dropped EXE
PID:5040 -
\??\c:\rffxrlf.exec:\rffxrlf.exe48⤵
- Executes dropped EXE
PID:3684 -
\??\c:\5hbhbb.exec:\5hbhbb.exe49⤵
- Executes dropped EXE
PID:2152 -
\??\c:\nttnbt.exec:\nttnbt.exe50⤵
- Executes dropped EXE
PID:2300 -
\??\c:\3vdpv.exec:\3vdpv.exe51⤵
- Executes dropped EXE
PID:4508 -
\??\c:\7rrlrrl.exec:\7rrlrrl.exe52⤵
- Executes dropped EXE
PID:4348 -
\??\c:\7ttnhb.exec:\7ttnhb.exe53⤵
- Executes dropped EXE
PID:4364 -
\??\c:\pjjdv.exec:\pjjdv.exe54⤵
- Executes dropped EXE
PID:1120 -
\??\c:\xxllllf.exec:\xxllllf.exe55⤵
- Executes dropped EXE
PID:1756 -
\??\c:\xxxrfxx.exec:\xxxrfxx.exe56⤵
- Executes dropped EXE
PID:448 -
\??\c:\ntthtt.exec:\ntthtt.exe57⤵
- Executes dropped EXE
PID:3648 -
\??\c:\dvpjj.exec:\dvpjj.exe58⤵
- Executes dropped EXE
PID:2388 -
\??\c:\xflfrlf.exec:\xflfrlf.exe59⤵
- Executes dropped EXE
PID:4768 -
\??\c:\rrrrrrr.exec:\rrrrrrr.exe60⤵
- Executes dropped EXE
PID:2248 -
\??\c:\nhhbbb.exec:\nhhbbb.exe61⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vjdvp.exec:\vjdvp.exe62⤵
- Executes dropped EXE
PID:1444 -
\??\c:\dddvp.exec:\dddvp.exe63⤵
- Executes dropped EXE
PID:3380 -
\??\c:\lfrlrlr.exec:\lfrlrlr.exe64⤵
- Executes dropped EXE
PID:3592 -
\??\c:\nbnbbt.exec:\nbnbbt.exe65⤵
- Executes dropped EXE
PID:4184 -
\??\c:\dvjdp.exec:\dvjdp.exe66⤵PID:4816
-
\??\c:\jdvvv.exec:\jdvvv.exe67⤵PID:4552
-
\??\c:\llrrlfx.exec:\llrrlfx.exe68⤵PID:1984
-
\??\c:\nnnnhh.exec:\nnnnhh.exe69⤵PID:2500
-
\??\c:\bttnhb.exec:\bttnhb.exe70⤵PID:2724
-
\??\c:\dpvpj.exec:\dpvpj.exe71⤵PID:456
-
\??\c:\fxxxrlf.exec:\fxxxrlf.exe72⤵PID:3992
-
\??\c:\5rlrffx.exec:\5rlrffx.exe73⤵PID:796
-
\??\c:\tbbbbb.exec:\tbbbbb.exe74⤵PID:3064
-
\??\c:\pdpjp.exec:\pdpjp.exe75⤵PID:5088
-
\??\c:\dvdjd.exec:\dvdjd.exe76⤵
- System Location Discovery: System Language Discovery
PID:1448 -
\??\c:\3bhthh.exec:\3bhthh.exe77⤵PID:3596
-
\??\c:\vjjdp.exec:\vjjdp.exe78⤵PID:2696
-
\??\c:\xrxrxrr.exec:\xrxrxrr.exe79⤵PID:3116
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe80⤵PID:764
-
\??\c:\9bbthh.exec:\9bbthh.exe81⤵PID:5052
-
\??\c:\vvvpv.exec:\vvvpv.exe82⤵PID:4256
-
\??\c:\lllfflf.exec:\lllfflf.exe83⤵PID:2468
-
\??\c:\hhbtnh.exec:\hhbtnh.exe84⤵PID:2840
-
\??\c:\7jvpj.exec:\7jvpj.exe85⤵PID:4608
-
\??\c:\5vpdv.exec:\5vpdv.exe86⤵PID:412
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe87⤵PID:2060
-
\??\c:\nbbtnn.exec:\nbbtnn.exe88⤵PID:2856
-
\??\c:\jpjpj.exec:\jpjpj.exe89⤵PID:3824
-
\??\c:\ddjvj.exec:\ddjvj.exe90⤵PID:2240
-
\??\c:\1rlxrlf.exec:\1rlxrlf.exe91⤵PID:5100
-
\??\c:\bbnnnn.exec:\bbnnnn.exe92⤵PID:4504
-
\??\c:\tbhbbt.exec:\tbhbbt.exe93⤵PID:2160
-
\??\c:\djjdd.exec:\djjdd.exe94⤵PID:2900
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe95⤵PID:2964
-
\??\c:\9hbttt.exec:\9hbttt.exe96⤵PID:2652
-
\??\c:\hhtnhb.exec:\hhtnhb.exe97⤵PID:2080
-
\??\c:\dpvpp.exec:\dpvpp.exe98⤵PID:4868
-
\??\c:\xrfxlfl.exec:\xrfxlfl.exe99⤵PID:2948
-
\??\c:\nhnhtb.exec:\nhnhtb.exe100⤵PID:2176
-
\??\c:\nnthtn.exec:\nnthtn.exe101⤵PID:3864
-
\??\c:\ddpjd.exec:\ddpjd.exe102⤵PID:3540
-
\??\c:\frfrfxr.exec:\frfrfxr.exe103⤵PID:3180
-
\??\c:\hbbntt.exec:\hbbntt.exe104⤵PID:2184
-
\??\c:\5tnbhb.exec:\5tnbhb.exe105⤵PID:2956
-
\??\c:\vppdp.exec:\vppdp.exe106⤵PID:3552
-
\??\c:\fxrlllf.exec:\fxrlllf.exe107⤵PID:3952
-
\??\c:\hbbtnb.exec:\hbbtnb.exe108⤵PID:3996
-
\??\c:\htnbhh.exec:\htnbhh.exe109⤵PID:1712
-
\??\c:\pdjdv.exec:\pdjdv.exe110⤵PID:4672
-
\??\c:\rrlfxlr.exec:\rrlfxlr.exe111⤵PID:2056
-
\??\c:\nbhhbb.exec:\nbhhbb.exe112⤵PID:184
-
\??\c:\1jddv.exec:\1jddv.exe113⤵PID:388
-
\??\c:\vjpdv.exec:\vjpdv.exe114⤵PID:5072
-
\??\c:\1fxrrrr.exec:\1fxrrrr.exe115⤵PID:3364
-
\??\c:\hnnhbt.exec:\hnnhbt.exe116⤵PID:4380
-
\??\c:\bbbtnh.exec:\bbbtnh.exe117⤵PID:4348
-
\??\c:\pdpjp.exec:\pdpjp.exe118⤵PID:3668
-
\??\c:\dvdpp.exec:\dvdpp.exe119⤵PID:1300
-
\??\c:\thtnhb.exec:\thtnhb.exe120⤵PID:1780
-
\??\c:\nthhbb.exec:\nthhbb.exe121⤵PID:380
-
\??\c:\jvdvp.exec:\jvdvp.exe122⤵PID:4732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-