Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 08:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e85a854d6a4bc31e543b47bebacadd308454f5976368de4a8b863085ee2848edN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e85a854d6a4bc31e543b47bebacadd308454f5976368de4a8b863085ee2848edN.exe
-
Size
455KB
-
MD5
8dec366d7fef6d4e92ccb7c7c7c229f0
-
SHA1
196cd045c2ccf819019c5db40be0179e292b4b11
-
SHA256
e85a854d6a4bc31e543b47bebacadd308454f5976368de4a8b863085ee2848ed
-
SHA512
ac530311cd71570bf7eb717fad140514e0d6387625bd14869fc8e434cd722259ff1f16de6433ef7d0d22108ce19e8e94efc12d918738ec0cea486f1ac2870afd
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet:q7Tc2NYHUrAwfMp3CDt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/5008-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1508-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/844-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1236-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1084-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1420-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-855-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-1183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-1262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/688-1955-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4436 rxlxrlf.exe 3504 tnnnnh.exe 1944 ddddv.exe 1172 nntbht.exe 4996 rrrlllf.exe 4568 pvddv.exe 1464 nhbbhh.exe 2492 rlxrrrx.exe 2792 hhhbtn.exe 1508 jjjdd.exe 220 ppdjd.exe 2312 3vpjv.exe 2468 xxlfllx.exe 536 tthhbt.exe 2916 tntnhh.exe 3056 vjpjj.exe 3472 1jjdp.exe 4816 rflllrl.exe 3064 7ddvp.exe 3764 lflfffr.exe 3508 hbtntn.exe 844 vjpjd.exe 4104 lfrrrxr.exe 1236 9jdvp.exe 3512 xlrlfxr.exe 2532 rfxrllr.exe 2684 vjjdv.exe 1084 ffxrxrx.exe 3020 lxlxffx.exe 4780 rxfffxx.exe 1528 hbnnhh.exe 3924 fllfxrl.exe 1600 9jvpj.exe 2548 fflfrrl.exe 4836 rxfxlff.exe 3392 nthbhh.exe 2304 7vjdv.exe 3496 7rrlxrl.exe 4676 hbbbtn.exe 3624 jdddv.exe 2444 pjjdv.exe 2668 llxxflr.exe 2496 3thhtt.exe 4192 vvvpd.exe 2592 9xrlxxr.exe 5096 rxlxlll.exe 4360 bhtbtt.exe 4952 9bbbbb.exe 1552 frfxrll.exe 3312 rxllfff.exe 2544 bnnnnn.exe 4456 pjppv.exe 1944 5fxrllf.exe 3900 7ntbtb.exe 2280 jvvjv.exe 3988 vdpdd.exe 4528 fxfxfxx.exe 1464 bbtnnh.exe 2760 9pvpv.exe 5084 dppdv.exe 4636 rlrlllf.exe 2036 9hnhbb.exe 4004 dvdvp.exe 1180 1vvjv.exe -
resource yara_rule behavioral2/memory/5008-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1508-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/844-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1236-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-643-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ntttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5008 wrote to memory of 4436 5008 e85a854d6a4bc31e543b47bebacadd308454f5976368de4a8b863085ee2848edN.exe 83 PID 5008 wrote to memory of 4436 5008 e85a854d6a4bc31e543b47bebacadd308454f5976368de4a8b863085ee2848edN.exe 83 PID 5008 wrote to memory of 4436 5008 e85a854d6a4bc31e543b47bebacadd308454f5976368de4a8b863085ee2848edN.exe 83 PID 4436 wrote to memory of 3504 4436 rxlxrlf.exe 84 PID 4436 wrote to memory of 3504 4436 rxlxrlf.exe 84 PID 4436 wrote to memory of 3504 4436 rxlxrlf.exe 84 PID 3504 wrote to memory of 1944 3504 tnnnnh.exe 85 PID 3504 wrote to memory of 1944 3504 tnnnnh.exe 85 PID 3504 wrote to memory of 1944 3504 tnnnnh.exe 85 PID 1944 wrote to memory of 1172 1944 ddddv.exe 86 PID 1944 wrote to memory of 1172 1944 ddddv.exe 86 PID 1944 wrote to memory of 1172 1944 ddddv.exe 86 PID 1172 wrote to memory of 4996 1172 nntbht.exe 87 PID 1172 wrote to memory of 4996 1172 nntbht.exe 87 PID 1172 wrote to memory of 4996 1172 nntbht.exe 87 PID 4996 wrote to memory of 4568 4996 rrrlllf.exe 88 PID 4996 wrote to memory of 4568 4996 rrrlllf.exe 88 PID 4996 wrote to memory of 4568 4996 rrrlllf.exe 88 PID 4568 wrote to memory of 1464 4568 pvddv.exe 89 PID 4568 wrote to memory of 1464 4568 pvddv.exe 89 PID 4568 wrote to memory of 1464 4568 pvddv.exe 89 PID 1464 wrote to memory of 2492 1464 nhbbhh.exe 90 PID 1464 wrote to memory of 2492 1464 nhbbhh.exe 90 PID 1464 wrote to memory of 2492 1464 nhbbhh.exe 90 PID 2492 wrote to memory of 2792 2492 rlxrrrx.exe 91 PID 2492 wrote to memory of 2792 2492 rlxrrrx.exe 91 PID 2492 wrote to memory of 2792 2492 rlxrrrx.exe 91 PID 2792 wrote to memory of 1508 2792 hhhbtn.exe 92 PID 2792 wrote to memory of 1508 2792 hhhbtn.exe 92 PID 2792 wrote to memory of 1508 2792 hhhbtn.exe 92 PID 1508 wrote to memory of 220 1508 jjjdd.exe 93 PID 1508 wrote to memory of 220 1508 jjjdd.exe 93 PID 1508 wrote to memory of 220 1508 jjjdd.exe 93 PID 220 wrote to memory of 2312 220 ppdjd.exe 94 PID 220 wrote to memory of 2312 220 ppdjd.exe 94 PID 220 wrote to memory of 2312 220 ppdjd.exe 94 PID 2312 wrote to memory of 2468 2312 3vpjv.exe 95 PID 2312 wrote to memory of 2468 2312 3vpjv.exe 95 PID 2312 wrote to memory of 2468 2312 3vpjv.exe 95 PID 2468 wrote to memory of 536 2468 xxlfllx.exe 96 PID 2468 wrote to memory of 536 2468 xxlfllx.exe 96 PID 2468 wrote to memory of 536 2468 xxlfllx.exe 96 PID 536 wrote to memory of 2916 536 tthhbt.exe 97 PID 536 wrote to memory of 2916 536 tthhbt.exe 97 PID 536 wrote to memory of 2916 536 tthhbt.exe 97 PID 2916 wrote to memory of 3056 2916 tntnhh.exe 98 PID 2916 wrote to memory of 3056 2916 tntnhh.exe 98 PID 2916 wrote to memory of 3056 2916 tntnhh.exe 98 PID 3056 wrote to memory of 3472 3056 vjpjj.exe 99 PID 3056 wrote to memory of 3472 3056 vjpjj.exe 99 PID 3056 wrote to memory of 3472 3056 vjpjj.exe 99 PID 3472 wrote to memory of 4816 3472 1jjdp.exe 100 PID 3472 wrote to memory of 4816 3472 1jjdp.exe 100 PID 3472 wrote to memory of 4816 3472 1jjdp.exe 100 PID 4816 wrote to memory of 3064 4816 rflllrl.exe 101 PID 4816 wrote to memory of 3064 4816 rflllrl.exe 101 PID 4816 wrote to memory of 3064 4816 rflllrl.exe 101 PID 3064 wrote to memory of 3764 3064 7ddvp.exe 102 PID 3064 wrote to memory of 3764 3064 7ddvp.exe 102 PID 3064 wrote to memory of 3764 3064 7ddvp.exe 102 PID 3764 wrote to memory of 3508 3764 lflfffr.exe 103 PID 3764 wrote to memory of 3508 3764 lflfffr.exe 103 PID 3764 wrote to memory of 3508 3764 lflfffr.exe 103 PID 3508 wrote to memory of 844 3508 hbtntn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\e85a854d6a4bc31e543b47bebacadd308454f5976368de4a8b863085ee2848edN.exe"C:\Users\Admin\AppData\Local\Temp\e85a854d6a4bc31e543b47bebacadd308454f5976368de4a8b863085ee2848edN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\rxlxrlf.exec:\rxlxrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\tnnnnh.exec:\tnnnnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\ddddv.exec:\ddddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\nntbht.exec:\nntbht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\rrrlllf.exec:\rrrlllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\pvddv.exec:\pvddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\nhbbhh.exec:\nhbbhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\hhhbtn.exec:\hhhbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\jjjdd.exec:\jjjdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\ppdjd.exec:\ppdjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\3vpjv.exec:\3vpjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\xxlfllx.exec:\xxlfllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\tthhbt.exec:\tthhbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\tntnhh.exec:\tntnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\vjpjj.exec:\vjpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\1jjdp.exec:\1jjdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\rflllrl.exec:\rflllrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\7ddvp.exec:\7ddvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\lflfffr.exec:\lflfffr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\hbtntn.exec:\hbtntn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\vjpjd.exec:\vjpjd.exe23⤵
- Executes dropped EXE
PID:844 -
\??\c:\lfrrrxr.exec:\lfrrrxr.exe24⤵
- Executes dropped EXE
PID:4104 -
\??\c:\9jdvp.exec:\9jdvp.exe25⤵
- Executes dropped EXE
PID:1236 -
\??\c:\xlrlfxr.exec:\xlrlfxr.exe26⤵
- Executes dropped EXE
PID:3512 -
\??\c:\rfxrllr.exec:\rfxrllr.exe27⤵
- Executes dropped EXE
PID:2532 -
\??\c:\vjjdv.exec:\vjjdv.exe28⤵
- Executes dropped EXE
PID:2684 -
\??\c:\ffxrxrx.exec:\ffxrxrx.exe29⤵
- Executes dropped EXE
PID:1084 -
\??\c:\lxlxffx.exec:\lxlxffx.exe30⤵
- Executes dropped EXE
PID:3020 -
\??\c:\rxfffxx.exec:\rxfffxx.exe31⤵
- Executes dropped EXE
PID:4780 -
\??\c:\hbnnhh.exec:\hbnnhh.exe32⤵
- Executes dropped EXE
PID:1528 -
\??\c:\fllfxrl.exec:\fllfxrl.exe33⤵
- Executes dropped EXE
PID:3924 -
\??\c:\9jvpj.exec:\9jvpj.exe34⤵
- Executes dropped EXE
PID:1600 -
\??\c:\fflfrrl.exec:\fflfrrl.exe35⤵
- Executes dropped EXE
PID:2548 -
\??\c:\rxfxlff.exec:\rxfxlff.exe36⤵
- Executes dropped EXE
PID:4836 -
\??\c:\nthbhh.exec:\nthbhh.exe37⤵
- Executes dropped EXE
PID:3392 -
\??\c:\7vjdv.exec:\7vjdv.exe38⤵
- Executes dropped EXE
PID:2304 -
\??\c:\7rrlxrl.exec:\7rrlxrl.exe39⤵
- Executes dropped EXE
PID:3496 -
\??\c:\hbbbtn.exec:\hbbbtn.exe40⤵
- Executes dropped EXE
PID:4676 -
\??\c:\jdddv.exec:\jdddv.exe41⤵
- Executes dropped EXE
PID:3624 -
\??\c:\pjjdv.exec:\pjjdv.exe42⤵
- Executes dropped EXE
PID:2444 -
\??\c:\llxxflr.exec:\llxxflr.exe43⤵
- Executes dropped EXE
PID:2668 -
\??\c:\3thhtt.exec:\3thhtt.exe44⤵
- Executes dropped EXE
PID:2496 -
\??\c:\vvvpd.exec:\vvvpd.exe45⤵
- Executes dropped EXE
PID:4192 -
\??\c:\9xrlxxr.exec:\9xrlxxr.exe46⤵
- Executes dropped EXE
PID:2592 -
\??\c:\rxlxlll.exec:\rxlxlll.exe47⤵
- Executes dropped EXE
PID:5096 -
\??\c:\bhtbtt.exec:\bhtbtt.exe48⤵
- Executes dropped EXE
PID:4360 -
\??\c:\9bbbbb.exec:\9bbbbb.exe49⤵
- Executes dropped EXE
PID:4952 -
\??\c:\frfxrll.exec:\frfxrll.exe50⤵
- Executes dropped EXE
PID:1552 -
\??\c:\rxllfff.exec:\rxllfff.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3312 -
\??\c:\bnnnnn.exec:\bnnnnn.exe52⤵
- Executes dropped EXE
PID:2544 -
\??\c:\pjppv.exec:\pjppv.exe53⤵
- Executes dropped EXE
PID:4456 -
\??\c:\5fxrllf.exec:\5fxrllf.exe54⤵
- Executes dropped EXE
PID:1944 -
\??\c:\7ntbtb.exec:\7ntbtb.exe55⤵
- Executes dropped EXE
PID:3900 -
\??\c:\jvvjv.exec:\jvvjv.exe56⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vdpdd.exec:\vdpdd.exe57⤵
- Executes dropped EXE
PID:3988 -
\??\c:\fxfxfxx.exec:\fxfxfxx.exe58⤵
- Executes dropped EXE
PID:4528 -
\??\c:\bbtnnh.exec:\bbtnnh.exe59⤵
- Executes dropped EXE
PID:1464 -
\??\c:\9pvpv.exec:\9pvpv.exe60⤵
- Executes dropped EXE
PID:2760 -
\??\c:\dppdv.exec:\dppdv.exe61⤵
- Executes dropped EXE
PID:5084 -
\??\c:\rlrlllf.exec:\rlrlllf.exe62⤵
- Executes dropped EXE
PID:4636 -
\??\c:\9hnhbb.exec:\9hnhbb.exe63⤵
- Executes dropped EXE
PID:2036 -
\??\c:\dvdvp.exec:\dvdvp.exe64⤵
- Executes dropped EXE
PID:4004 -
\??\c:\1vvjv.exec:\1vvjv.exe65⤵
- Executes dropped EXE
PID:1180 -
\??\c:\fxfrlll.exec:\fxfrlll.exe66⤵PID:1420
-
\??\c:\9hnhbt.exec:\9hnhbt.exe67⤵PID:672
-
\??\c:\vdppj.exec:\vdppj.exe68⤵PID:4580
-
\??\c:\jddvj.exec:\jddvj.exe69⤵PID:4144
-
\??\c:\7xrlffx.exec:\7xrlffx.exe70⤵PID:4584
-
\??\c:\1bbhbb.exec:\1bbhbb.exe71⤵PID:3556
-
\??\c:\jvvpp.exec:\jvvpp.exe72⤵PID:2072
-
\??\c:\fxlflll.exec:\fxlflll.exe73⤵PID:3472
-
\??\c:\tnhhbt.exec:\tnhhbt.exe74⤵PID:2148
-
\??\c:\pvjdv.exec:\pvjdv.exe75⤵PID:3776
-
\??\c:\xlxrfff.exec:\xlxrfff.exe76⤵PID:4152
-
\??\c:\9flfxxr.exec:\9flfxxr.exe77⤵PID:2404
-
\??\c:\9tttnn.exec:\9tttnn.exe78⤵PID:3568
-
\??\c:\ppvpv.exec:\ppvpv.exe79⤵PID:5104
-
\??\c:\5flfxxx.exec:\5flfxxx.exe80⤵PID:3140
-
\??\c:\lffxfff.exec:\lffxfff.exe81⤵PID:2908
-
\??\c:\thhbnn.exec:\thhbnn.exe82⤵PID:3968
-
\??\c:\vpddv.exec:\vpddv.exe83⤵PID:1168
-
\??\c:\dpvpd.exec:\dpvpd.exe84⤵PID:1596
-
\??\c:\rllfrrl.exec:\rllfrrl.exe85⤵PID:2480
-
\??\c:\hnnnhn.exec:\hnnnhn.exe86⤵PID:2800
-
\??\c:\jjvdd.exec:\jjvdd.exe87⤵PID:2188
-
\??\c:\jdpdd.exec:\jdpdd.exe88⤵PID:3248
-
\??\c:\xxlxllf.exec:\xxlxllf.exe89⤵PID:4640
-
\??\c:\tnbtnn.exec:\tnbtnn.exe90⤵PID:4852
-
\??\c:\jjjdd.exec:\jjjdd.exe91⤵PID:4780
-
\??\c:\vvjjv.exec:\vvjjv.exe92⤵PID:2612
-
\??\c:\hhthht.exec:\hhthht.exe93⤵PID:2712
-
\??\c:\tnnbnb.exec:\tnnbnb.exe94⤵PID:2420
-
\??\c:\vpddv.exec:\vpddv.exe95⤵PID:4716
-
\??\c:\xxfxrff.exec:\xxfxrff.exe96⤵PID:4980
-
\??\c:\hbbbtt.exec:\hbbbtt.exe97⤵PID:3392
-
\??\c:\dpjdv.exec:\dpjdv.exe98⤵PID:2828
-
\??\c:\vvvpv.exec:\vvvpv.exe99⤵PID:2384
-
\??\c:\lflffff.exec:\lflffff.exe100⤵PID:1664
-
\??\c:\hhtnhb.exec:\hhtnhb.exe101⤵PID:4772
-
\??\c:\jvdvp.exec:\jvdvp.exe102⤵
- System Location Discovery: System Language Discovery
PID:4552 -
\??\c:\dpvjd.exec:\dpvjd.exe103⤵PID:1876
-
\??\c:\xxxxrrl.exec:\xxxxrrl.exe104⤵PID:1280
-
\??\c:\nhtbbt.exec:\nhtbbt.exe105⤵PID:312
-
\??\c:\hbhtnn.exec:\hbhtnn.exe106⤵PID:3952
-
\??\c:\5jjdp.exec:\5jjdp.exe107⤵PID:4344
-
\??\c:\3fffxxx.exec:\3fffxxx.exe108⤵
- System Location Discovery: System Language Discovery
PID:3664 -
\??\c:\htbtnn.exec:\htbtnn.exe109⤵PID:1952
-
\??\c:\pjddv.exec:\pjddv.exe110⤵PID:4436
-
\??\c:\pdjvp.exec:\pdjvp.exe111⤵PID:1552
-
\??\c:\rlrlxxr.exec:\rlrlxxr.exe112⤵PID:1732
-
\??\c:\ttbbtt.exec:\ttbbtt.exe113⤵PID:2544
-
\??\c:\vvvpj.exec:\vvvpj.exe114⤵PID:4476
-
\??\c:\xlxllff.exec:\xlxllff.exe115⤵PID:3560
-
\??\c:\lxfflll.exec:\lxfflll.exe116⤵PID:1504
-
\??\c:\3hhbtn.exec:\3hhbtn.exe117⤵PID:4576
-
\??\c:\jvpdv.exec:\jvpdv.exe118⤵PID:5048
-
\??\c:\frfxxlf.exec:\frfxxlf.exe119⤵PID:3548
-
\??\c:\1ntntn.exec:\1ntntn.exe120⤵PID:1368
-
\??\c:\jdpjv.exec:\jdpjv.exe121⤵PID:4968
-
\??\c:\vppjv.exec:\vppjv.exe122⤵PID:968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-