Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 09:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
696c331b0ad5e94391b429989879a08179748525967620391642ad10715e43aaN.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
696c331b0ad5e94391b429989879a08179748525967620391642ad10715e43aaN.exe
-
Size
453KB
-
MD5
8a0c3ae1868afe61bc92f803e3adc8a0
-
SHA1
13dabc4b970fb1b95dd4ce0d5606eac7e24f035d
-
SHA256
696c331b0ad5e94391b429989879a08179748525967620391642ad10715e43aa
-
SHA512
90493171a712a0f2679d83d04ea5abdb9a333c75414accf8918167950c8b356689ebc992a2eeed0bd12964736152cc360a63a32734b2e410e0a1b6e2d5143322
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet:q7Tc2NYHUrAwfMp3CDt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3016-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2680-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1760-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/980-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/788-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3788-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/980-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1244-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-697-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-755-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-759-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-808-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-854-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-925-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-1020-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-1441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/244-1880-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2976 5bbbtb.exe 3856 hhhnbb.exe 2644 3bnnnb.exe 4804 pppvd.exe 2680 ppjjv.exe 116 xxllxlx.exe 2964 jjvdp.exe 3952 nbbnbn.exe 3428 vdjdj.exe 1484 1bnntt.exe 408 jjppv.exe 5032 nnhhbh.exe 2336 rlxxxxr.exe 4160 nhhnnb.exe 3968 xllxrrx.exe 2796 jjdpp.exe 1760 lxfxxfl.exe 2232 pdjdj.exe 2188 rlrlrll.exe 4388 xxxxffx.exe 4136 thtbbn.exe 3788 3frrfrr.exe 1616 7btttt.exe 1496 nnnhnb.exe 4680 vdppv.exe 2972 htbhnh.exe 3664 xxlrrxx.exe 2940 jvjpj.exe 980 bbnnnn.exe 1200 rxxxllx.exe 4452 hbhhnn.exe 4924 rlfffll.exe 868 vpddv.exe 4468 lfrrrxf.exe 2612 jdjpv.exe 1244 bthbtt.exe 3960 rllllll.exe 4952 nbbbtt.exe 2692 fffllfl.exe 1892 jjdpj.exe 4344 lxrlrfx.exe 4316 btbbtn.exe 848 flxxfrr.exe 1352 5bhtbn.exe 4992 ppppp.exe 3932 lflrfll.exe 4900 tbbhht.exe 224 dvdvv.exe 788 bnttnn.exe 2372 vjvvp.exe 3972 lfrxxfr.exe 2964 dvdpv.exe 216 fxrlfxl.exe 3952 9pdvv.exe 4940 rfrrlrr.exe 2204 nhbhth.exe 4484 lxlffff.exe 2776 rrxlflf.exe 4464 bhtnnn.exe 1932 ddppd.exe 4184 lxlrlxr.exe 1952 5htbtb.exe 2672 9jpjd.exe 4364 3rfxflr.exe -
resource yara_rule behavioral2/memory/3016-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/980-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/788-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3788-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/980-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1244-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3704-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-759-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxlfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2976 3016 696c331b0ad5e94391b429989879a08179748525967620391642ad10715e43aaN.exe 83 PID 3016 wrote to memory of 2976 3016 696c331b0ad5e94391b429989879a08179748525967620391642ad10715e43aaN.exe 83 PID 3016 wrote to memory of 2976 3016 696c331b0ad5e94391b429989879a08179748525967620391642ad10715e43aaN.exe 83 PID 2976 wrote to memory of 3856 2976 5bbbtb.exe 84 PID 2976 wrote to memory of 3856 2976 5bbbtb.exe 84 PID 2976 wrote to memory of 3856 2976 5bbbtb.exe 84 PID 3856 wrote to memory of 2644 3856 hhhnbb.exe 85 PID 3856 wrote to memory of 2644 3856 hhhnbb.exe 85 PID 3856 wrote to memory of 2644 3856 hhhnbb.exe 85 PID 2644 wrote to memory of 4804 2644 3bnnnb.exe 86 PID 2644 wrote to memory of 4804 2644 3bnnnb.exe 86 PID 2644 wrote to memory of 4804 2644 3bnnnb.exe 86 PID 4804 wrote to memory of 2680 4804 pppvd.exe 87 PID 4804 wrote to memory of 2680 4804 pppvd.exe 87 PID 4804 wrote to memory of 2680 4804 pppvd.exe 87 PID 2680 wrote to memory of 116 2680 ppjjv.exe 88 PID 2680 wrote to memory of 116 2680 ppjjv.exe 88 PID 2680 wrote to memory of 116 2680 ppjjv.exe 88 PID 116 wrote to memory of 2964 116 xxllxlx.exe 89 PID 116 wrote to memory of 2964 116 xxllxlx.exe 89 PID 116 wrote to memory of 2964 116 xxllxlx.exe 89 PID 2964 wrote to memory of 3952 2964 jjvdp.exe 90 PID 2964 wrote to memory of 3952 2964 jjvdp.exe 90 PID 2964 wrote to memory of 3952 2964 jjvdp.exe 90 PID 3952 wrote to memory of 3428 3952 nbbnbn.exe 91 PID 3952 wrote to memory of 3428 3952 nbbnbn.exe 91 PID 3952 wrote to memory of 3428 3952 nbbnbn.exe 91 PID 3428 wrote to memory of 1484 3428 vdjdj.exe 92 PID 3428 wrote to memory of 1484 3428 vdjdj.exe 92 PID 3428 wrote to memory of 1484 3428 vdjdj.exe 92 PID 1484 wrote to memory of 408 1484 1bnntt.exe 93 PID 1484 wrote to memory of 408 1484 1bnntt.exe 93 PID 1484 wrote to memory of 408 1484 1bnntt.exe 93 PID 408 wrote to memory of 5032 408 jjppv.exe 94 PID 408 wrote to memory of 5032 408 jjppv.exe 94 PID 408 wrote to memory of 5032 408 jjppv.exe 94 PID 5032 wrote to memory of 2336 5032 nnhhbh.exe 95 PID 5032 wrote to memory of 2336 5032 nnhhbh.exe 95 PID 5032 wrote to memory of 2336 5032 nnhhbh.exe 95 PID 2336 wrote to memory of 4160 2336 rlxxxxr.exe 96 PID 2336 wrote to memory of 4160 2336 rlxxxxr.exe 96 PID 2336 wrote to memory of 4160 2336 rlxxxxr.exe 96 PID 4160 wrote to memory of 3968 4160 nhhnnb.exe 97 PID 4160 wrote to memory of 3968 4160 nhhnnb.exe 97 PID 4160 wrote to memory of 3968 4160 nhhnnb.exe 97 PID 3968 wrote to memory of 2796 3968 xllxrrx.exe 98 PID 3968 wrote to memory of 2796 3968 xllxrrx.exe 98 PID 3968 wrote to memory of 2796 3968 xllxrrx.exe 98 PID 2796 wrote to memory of 1760 2796 jjdpp.exe 99 PID 2796 wrote to memory of 1760 2796 jjdpp.exe 99 PID 2796 wrote to memory of 1760 2796 jjdpp.exe 99 PID 1760 wrote to memory of 2232 1760 lxfxxfl.exe 100 PID 1760 wrote to memory of 2232 1760 lxfxxfl.exe 100 PID 1760 wrote to memory of 2232 1760 lxfxxfl.exe 100 PID 2232 wrote to memory of 2188 2232 pdjdj.exe 101 PID 2232 wrote to memory of 2188 2232 pdjdj.exe 101 PID 2232 wrote to memory of 2188 2232 pdjdj.exe 101 PID 2188 wrote to memory of 4388 2188 rlrlrll.exe 102 PID 2188 wrote to memory of 4388 2188 rlrlrll.exe 102 PID 2188 wrote to memory of 4388 2188 rlrlrll.exe 102 PID 4388 wrote to memory of 4136 4388 xxxxffx.exe 103 PID 4388 wrote to memory of 4136 4388 xxxxffx.exe 103 PID 4388 wrote to memory of 4136 4388 xxxxffx.exe 103 PID 4136 wrote to memory of 3788 4136 thtbbn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\696c331b0ad5e94391b429989879a08179748525967620391642ad10715e43aaN.exe"C:\Users\Admin\AppData\Local\Temp\696c331b0ad5e94391b429989879a08179748525967620391642ad10715e43aaN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\5bbbtb.exec:\5bbbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\hhhnbb.exec:\hhhnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\3bnnnb.exec:\3bnnnb.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\pppvd.exec:\pppvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\ppjjv.exec:\ppjjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\xxllxlx.exec:\xxllxlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\jjvdp.exec:\jjvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\nbbnbn.exec:\nbbnbn.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\vdjdj.exec:\vdjdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\1bnntt.exec:\1bnntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\jjppv.exec:\jjppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\nnhhbh.exec:\nnhhbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\rlxxxxr.exec:\rlxxxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\nhhnnb.exec:\nhhnnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\xllxrrx.exec:\xllxrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\jjdpp.exec:\jjdpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\lxfxxfl.exec:\lxfxxfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\pdjdj.exec:\pdjdj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\rlrlrll.exec:\rlrlrll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\xxxxffx.exec:\xxxxffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\thtbbn.exec:\thtbbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\3frrfrr.exec:\3frrfrr.exe23⤵
- Executes dropped EXE
PID:3788 -
\??\c:\7btttt.exec:\7btttt.exe24⤵
- Executes dropped EXE
PID:1616 -
\??\c:\nnnhnb.exec:\nnnhnb.exe25⤵
- Executes dropped EXE
PID:1496 -
\??\c:\vdppv.exec:\vdppv.exe26⤵
- Executes dropped EXE
PID:4680 -
\??\c:\htbhnh.exec:\htbhnh.exe27⤵
- Executes dropped EXE
PID:2972 -
\??\c:\xxlrrxx.exec:\xxlrrxx.exe28⤵
- Executes dropped EXE
PID:3664 -
\??\c:\jvjpj.exec:\jvjpj.exe29⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bbnnnn.exec:\bbnnnn.exe30⤵
- Executes dropped EXE
PID:980 -
\??\c:\rxxxllx.exec:\rxxxllx.exe31⤵
- Executes dropped EXE
PID:1200 -
\??\c:\hbhhnn.exec:\hbhhnn.exe32⤵
- Executes dropped EXE
PID:4452 -
\??\c:\rlfffll.exec:\rlfffll.exe33⤵
- Executes dropped EXE
PID:4924 -
\??\c:\vpddv.exec:\vpddv.exe34⤵
- Executes dropped EXE
PID:868 -
\??\c:\lfrrrxf.exec:\lfrrrxf.exe35⤵
- Executes dropped EXE
PID:4468 -
\??\c:\jdjpv.exec:\jdjpv.exe36⤵
- Executes dropped EXE
PID:2612 -
\??\c:\bthbtt.exec:\bthbtt.exe37⤵
- Executes dropped EXE
PID:1244 -
\??\c:\rllllll.exec:\rllllll.exe38⤵
- Executes dropped EXE
PID:3960 -
\??\c:\nbbbtt.exec:\nbbbtt.exe39⤵
- Executes dropped EXE
PID:4952 -
\??\c:\fffllfl.exec:\fffllfl.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jjdpj.exec:\jjdpj.exe41⤵
- Executes dropped EXE
PID:1892 -
\??\c:\lxrlrfx.exec:\lxrlrfx.exe42⤵
- Executes dropped EXE
PID:4344 -
\??\c:\btbbtn.exec:\btbbtn.exe43⤵
- Executes dropped EXE
PID:4316 -
\??\c:\flxxfrr.exec:\flxxfrr.exe44⤵
- Executes dropped EXE
PID:848 -
\??\c:\5bhtbn.exec:\5bhtbn.exe45⤵
- Executes dropped EXE
PID:1352 -
\??\c:\ppppp.exec:\ppppp.exe46⤵
- Executes dropped EXE
PID:4992 -
\??\c:\lflrfll.exec:\lflrfll.exe47⤵
- Executes dropped EXE
PID:3932 -
\??\c:\tbbhht.exec:\tbbhht.exe48⤵
- Executes dropped EXE
PID:4900 -
\??\c:\dvdvv.exec:\dvdvv.exe49⤵
- Executes dropped EXE
PID:224 -
\??\c:\bnttnn.exec:\bnttnn.exe50⤵
- Executes dropped EXE
PID:788 -
\??\c:\vjvvp.exec:\vjvvp.exe51⤵
- Executes dropped EXE
PID:2372 -
\??\c:\lfrxxfr.exec:\lfrxxfr.exe52⤵
- Executes dropped EXE
PID:3972 -
\??\c:\dvdpv.exec:\dvdpv.exe53⤵
- Executes dropped EXE
PID:2964 -
\??\c:\fxrlfxl.exec:\fxrlfxl.exe54⤵
- Executes dropped EXE
PID:216 -
\??\c:\9pdvv.exec:\9pdvv.exe55⤵
- Executes dropped EXE
PID:3952 -
\??\c:\rfrrlrr.exec:\rfrrlrr.exe56⤵
- Executes dropped EXE
PID:4940 -
\??\c:\nhbhth.exec:\nhbhth.exe57⤵
- Executes dropped EXE
PID:2204 -
\??\c:\lxlffff.exec:\lxlffff.exe58⤵
- Executes dropped EXE
PID:4484 -
\??\c:\rrxlflf.exec:\rrxlflf.exe59⤵
- Executes dropped EXE
PID:2776 -
\??\c:\bhtnnn.exec:\bhtnnn.exe60⤵
- Executes dropped EXE
PID:4464 -
\??\c:\ddppd.exec:\ddppd.exe61⤵
- Executes dropped EXE
PID:1932 -
\??\c:\lxlrlxr.exec:\lxlrlxr.exe62⤵
- Executes dropped EXE
PID:4184 -
\??\c:\5htbtb.exec:\5htbtb.exe63⤵
- Executes dropped EXE
PID:1952 -
\??\c:\9jpjd.exec:\9jpjd.exe64⤵
- Executes dropped EXE
PID:2672 -
\??\c:\3rfxflr.exec:\3rfxflr.exe65⤵
- Executes dropped EXE
PID:4364 -
\??\c:\nbhhhh.exec:\nbhhhh.exe66⤵PID:5092
-
\??\c:\vpjvp.exec:\vpjvp.exe67⤵PID:3908
-
\??\c:\rfrflrr.exec:\rfrflrr.exe68⤵PID:2568
-
\??\c:\httttb.exec:\httttb.exe69⤵PID:3712
-
\??\c:\jdjpp.exec:\jdjpp.exe70⤵PID:616
-
\??\c:\flfxlrl.exec:\flfxlrl.exe71⤵PID:2668
-
\??\c:\7xxrlrf.exec:\7xxrlrf.exe72⤵PID:3484
-
\??\c:\tnnhbb.exec:\tnnhbb.exe73⤵PID:1980
-
\??\c:\djdvp.exec:\djdvp.exe74⤵PID:3788
-
\??\c:\xfrlffx.exec:\xfrlffx.exe75⤵PID:4860
-
\??\c:\bhtttt.exec:\bhtttt.exe76⤵PID:2388
-
\??\c:\vvdvd.exec:\vvdvd.exe77⤵PID:4972
-
\??\c:\frrrxfr.exec:\frrrxfr.exe78⤵PID:2140
-
\??\c:\tthbhh.exec:\tthbhh.exe79⤵PID:1184
-
\??\c:\ddjjj.exec:\ddjjj.exe80⤵PID:1548
-
\??\c:\llfrlrr.exec:\llfrlrr.exe81⤵PID:544
-
\??\c:\7nhnnb.exec:\7nhnnb.exe82⤵PID:400
-
\??\c:\ddjdp.exec:\ddjdp.exe83⤵PID:980
-
\??\c:\lfffrrr.exec:\lfffrrr.exe84⤵PID:2544
-
\??\c:\bhhhhb.exec:\bhhhhb.exe85⤵PID:2468
-
\??\c:\vdvpj.exec:\vdvpj.exe86⤵PID:2944
-
\??\c:\lrfxrlx.exec:\lrfxrlx.exe87⤵PID:3220
-
\??\c:\bhttbn.exec:\bhttbn.exe88⤵PID:1888
-
\??\c:\dpdvp.exec:\dpdvp.exe89⤵PID:5108
-
\??\c:\hnhhtt.exec:\hnhhtt.exe90⤵PID:3928
-
\??\c:\tnbbht.exec:\tnbbht.exe91⤵PID:2612
-
\??\c:\9jjjp.exec:\9jjjp.exe92⤵PID:2200
-
\??\c:\ffllflx.exec:\ffllflx.exe93⤵PID:3960
-
\??\c:\djvpd.exec:\djvpd.exe94⤵PID:1296
-
\??\c:\jjppp.exec:\jjppp.exe95⤵PID:3456
-
\??\c:\xfrrllf.exec:\xfrrllf.exe96⤵PID:4168
-
\??\c:\1dddd.exec:\1dddd.exe97⤵PID:1000
-
\??\c:\frffxff.exec:\frffxff.exe98⤵PID:1532
-
\??\c:\ttntbt.exec:\ttntbt.exe99⤵PID:3120
-
\??\c:\ddvdv.exec:\ddvdv.exe100⤵PID:1332
-
\??\c:\ffllllr.exec:\ffllllr.exe101⤵PID:1836
-
\??\c:\bnhnnb.exec:\bnhnnb.exe102⤵PID:1620
-
\??\c:\7xrxfrf.exec:\7xrxfrf.exe103⤵PID:3528
-
\??\c:\nbbtth.exec:\nbbtth.exe104⤵PID:4728
-
\??\c:\pdjjv.exec:\pdjjv.exe105⤵PID:4420
-
\??\c:\lrlxfrf.exec:\lrlxfrf.exe106⤵PID:2104
-
\??\c:\tbntnt.exec:\tbntnt.exe107⤵PID:4824
-
\??\c:\jdjdp.exec:\jdjdp.exe108⤵PID:3636
-
\??\c:\rllrrfr.exec:\rllrrfr.exe109⤵PID:4704
-
\??\c:\tnbtnt.exec:\tnbtnt.exe110⤵PID:1652
-
\??\c:\jjjdp.exec:\jjjdp.exe111⤵PID:3516
-
\??\c:\xrfflll.exec:\xrfflll.exe112⤵PID:3800
-
\??\c:\bhnnnt.exec:\bhnnnt.exe113⤵PID:4524
-
\??\c:\hhnnnn.exec:\hhnnnn.exe114⤵PID:3720
-
\??\c:\xfxlfrf.exec:\xfxlfrf.exe115⤵
- System Location Discovery: System Language Discovery
PID:3704 -
\??\c:\btnttb.exec:\btnttb.exe116⤵PID:3940
-
\??\c:\vvvjj.exec:\vvvjj.exe117⤵PID:4484
-
\??\c:\vpjjj.exec:\vpjjj.exe118⤵PID:2440
-
\??\c:\lrxfrlx.exec:\lrxfrlx.exe119⤵PID:4528
-
\??\c:\pvdjp.exec:\pvdjp.exe120⤵PID:2980
-
\??\c:\jjpvv.exec:\jjpvv.exe121⤵PID:5072
-
\??\c:\rrrxxfr.exec:\rrrxxfr.exe122⤵PID:3500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-