Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 08:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9f0cfdb0bd2ce5f715dd291dd127297586b43ff90a031b7e26f5130a0592ba8fN.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9f0cfdb0bd2ce5f715dd291dd127297586b43ff90a031b7e26f5130a0592ba8fN.exe
-
Size
456KB
-
MD5
f2ff4d878412cba135f0b9346cca90e0
-
SHA1
961b4089289df0a2b98eb7aefa709a0825c20846
-
SHA256
9f0cfdb0bd2ce5f715dd291dd127297586b43ff90a031b7e26f5130a0592ba8f
-
SHA512
b6e18de3bc648f25444b280fc09e9b042d946ef69792eaacbc84e09bb72d622b6d05fcf38a31c85c3c1466423881e2f059574c89576a5613a21419d1cef6220d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRC:q7Tc2NYHUrAwfMp3CDRC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1724-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/996-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4284-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/784-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/732-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/944-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2092-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/900-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-568-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-767-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-783-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-1143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-1200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-1818-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-1873-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4408 frrrllf.exe 4968 nnnhbb.exe 2320 bbbtnb.exe 1028 lrlfxxr.exe 5092 3vdjj.exe 5116 hnnhhh.exe 4884 vjpjd.exe 3616 bbnbnn.exe 3320 rxrxlxf.exe 1564 9djdj.exe 2240 httttn.exe 996 7pppj.exe 4284 xrxfxfl.exe 4688 dpdvv.exe 4996 rlrlffx.exe 1816 jpdpv.exe 3924 nbttnn.exe 5000 5nhbbh.exe 784 xxxrffx.exe 1552 nnnhbb.exe 1832 hhbtnb.exe 732 pdjjd.exe 3820 hhnbhh.exe 3588 vjpjj.exe 1304 hhbhnb.exe 888 1pdvd.exe 552 nnbtnn.exe 1504 pvjdv.exe 4076 ppvpp.exe 436 ppdvv.exe 3752 xrrrlll.exe 396 pddvv.exe 1476 rrrrlll.exe 2452 rrrllll.exe 2040 hbttnn.exe 2524 1pjdp.exe 4572 lxlfffl.exe 4484 hthtnn.exe 3156 pvddv.exe 5064 3rrfxxr.exe 3580 xxxrrlf.exe 4288 bhtntn.exe 2032 ddppv.exe 1000 7rrlffx.exe 2416 thbhbh.exe 4796 vjvvj.exe 1532 1frflrx.exe 1464 rlxfxlf.exe 4580 tnttnn.exe 4476 ppdvv.exe 2816 jjjjv.exe 4444 rlllffr.exe 3520 bhtnhh.exe 3028 jvppp.exe 4932 jddpp.exe 3896 3llffxr.exe 3780 nhnhhb.exe 2136 vvdvd.exe 2224 1rllrrl.exe 972 bbbnnn.exe 4284 vjpjj.exe 3668 1jjvp.exe 1568 lfllflr.exe 2828 tnbtnh.exe -
resource yara_rule behavioral2/memory/1724-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/996-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4284-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/784-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/732-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/944-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2092-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/900-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-767-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-783-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-808-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-971-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ffrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1724 wrote to memory of 4408 1724 9f0cfdb0bd2ce5f715dd291dd127297586b43ff90a031b7e26f5130a0592ba8fN.exe 82 PID 1724 wrote to memory of 4408 1724 9f0cfdb0bd2ce5f715dd291dd127297586b43ff90a031b7e26f5130a0592ba8fN.exe 82 PID 1724 wrote to memory of 4408 1724 9f0cfdb0bd2ce5f715dd291dd127297586b43ff90a031b7e26f5130a0592ba8fN.exe 82 PID 4408 wrote to memory of 4968 4408 frrrllf.exe 83 PID 4408 wrote to memory of 4968 4408 frrrllf.exe 83 PID 4408 wrote to memory of 4968 4408 frrrllf.exe 83 PID 4968 wrote to memory of 2320 4968 nnnhbb.exe 84 PID 4968 wrote to memory of 2320 4968 nnnhbb.exe 84 PID 4968 wrote to memory of 2320 4968 nnnhbb.exe 84 PID 2320 wrote to memory of 1028 2320 bbbtnb.exe 85 PID 2320 wrote to memory of 1028 2320 bbbtnb.exe 85 PID 2320 wrote to memory of 1028 2320 bbbtnb.exe 85 PID 1028 wrote to memory of 5092 1028 lrlfxxr.exe 86 PID 1028 wrote to memory of 5092 1028 lrlfxxr.exe 86 PID 1028 wrote to memory of 5092 1028 lrlfxxr.exe 86 PID 5092 wrote to memory of 5116 5092 3vdjj.exe 87 PID 5092 wrote to memory of 5116 5092 3vdjj.exe 87 PID 5092 wrote to memory of 5116 5092 3vdjj.exe 87 PID 5116 wrote to memory of 4884 5116 hnnhhh.exe 88 PID 5116 wrote to memory of 4884 5116 hnnhhh.exe 88 PID 5116 wrote to memory of 4884 5116 hnnhhh.exe 88 PID 4884 wrote to memory of 3616 4884 vjpjd.exe 89 PID 4884 wrote to memory of 3616 4884 vjpjd.exe 89 PID 4884 wrote to memory of 3616 4884 vjpjd.exe 89 PID 3616 wrote to memory of 3320 3616 bbnbnn.exe 90 PID 3616 wrote to memory of 3320 3616 bbnbnn.exe 90 PID 3616 wrote to memory of 3320 3616 bbnbnn.exe 90 PID 3320 wrote to memory of 1564 3320 rxrxlxf.exe 91 PID 3320 wrote to memory of 1564 3320 rxrxlxf.exe 91 PID 3320 wrote to memory of 1564 3320 rxrxlxf.exe 91 PID 1564 wrote to memory of 2240 1564 9djdj.exe 92 PID 1564 wrote to memory of 2240 1564 9djdj.exe 92 PID 1564 wrote to memory of 2240 1564 9djdj.exe 92 PID 2240 wrote to memory of 996 2240 httttn.exe 93 PID 2240 wrote to memory of 996 2240 httttn.exe 93 PID 2240 wrote to memory of 996 2240 httttn.exe 93 PID 996 wrote to memory of 4284 996 7pppj.exe 94 PID 996 wrote to memory of 4284 996 7pppj.exe 94 PID 996 wrote to memory of 4284 996 7pppj.exe 94 PID 4284 wrote to memory of 4688 4284 xrxfxfl.exe 95 PID 4284 wrote to memory of 4688 4284 xrxfxfl.exe 95 PID 4284 wrote to memory of 4688 4284 xrxfxfl.exe 95 PID 4688 wrote to memory of 4996 4688 dpdvv.exe 96 PID 4688 wrote to memory of 4996 4688 dpdvv.exe 96 PID 4688 wrote to memory of 4996 4688 dpdvv.exe 96 PID 4996 wrote to memory of 1816 4996 rlrlffx.exe 97 PID 4996 wrote to memory of 1816 4996 rlrlffx.exe 97 PID 4996 wrote to memory of 1816 4996 rlrlffx.exe 97 PID 1816 wrote to memory of 3924 1816 jpdpv.exe 98 PID 1816 wrote to memory of 3924 1816 jpdpv.exe 98 PID 1816 wrote to memory of 3924 1816 jpdpv.exe 98 PID 3924 wrote to memory of 5000 3924 nbttnn.exe 99 PID 3924 wrote to memory of 5000 3924 nbttnn.exe 99 PID 3924 wrote to memory of 5000 3924 nbttnn.exe 99 PID 5000 wrote to memory of 784 5000 5nhbbh.exe 100 PID 5000 wrote to memory of 784 5000 5nhbbh.exe 100 PID 5000 wrote to memory of 784 5000 5nhbbh.exe 100 PID 784 wrote to memory of 1552 784 xxxrffx.exe 101 PID 784 wrote to memory of 1552 784 xxxrffx.exe 101 PID 784 wrote to memory of 1552 784 xxxrffx.exe 101 PID 1552 wrote to memory of 1832 1552 nnnhbb.exe 102 PID 1552 wrote to memory of 1832 1552 nnnhbb.exe 102 PID 1552 wrote to memory of 1832 1552 nnnhbb.exe 102 PID 1832 wrote to memory of 732 1832 hhbtnb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f0cfdb0bd2ce5f715dd291dd127297586b43ff90a031b7e26f5130a0592ba8fN.exe"C:\Users\Admin\AppData\Local\Temp\9f0cfdb0bd2ce5f715dd291dd127297586b43ff90a031b7e26f5130a0592ba8fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\frrrllf.exec:\frrrllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\nnnhbb.exec:\nnnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\bbbtnb.exec:\bbbtnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\lrlfxxr.exec:\lrlfxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\3vdjj.exec:\3vdjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\hnnhhh.exec:\hnnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\vjpjd.exec:\vjpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\bbnbnn.exec:\bbnbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\rxrxlxf.exec:\rxrxlxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\9djdj.exec:\9djdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\httttn.exec:\httttn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\7pppj.exec:\7pppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\xrxfxfl.exec:\xrxfxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\dpdvv.exec:\dpdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\rlrlffx.exec:\rlrlffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\jpdpv.exec:\jpdpv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\nbttnn.exec:\nbttnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\5nhbbh.exec:\5nhbbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\xxxrffx.exec:\xxxrffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\nnnhbb.exec:\nnnhbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\hhbtnb.exec:\hhbtnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\pdjjd.exec:\pdjjd.exe23⤵
- Executes dropped EXE
PID:732 -
\??\c:\hhnbhh.exec:\hhnbhh.exe24⤵
- Executes dropped EXE
PID:3820 -
\??\c:\vjpjj.exec:\vjpjj.exe25⤵
- Executes dropped EXE
PID:3588 -
\??\c:\hhbhnb.exec:\hhbhnb.exe26⤵
- Executes dropped EXE
PID:1304 -
\??\c:\1pdvd.exec:\1pdvd.exe27⤵
- Executes dropped EXE
PID:888 -
\??\c:\nnbtnn.exec:\nnbtnn.exe28⤵
- Executes dropped EXE
PID:552 -
\??\c:\pvjdv.exec:\pvjdv.exe29⤵
- Executes dropped EXE
PID:1504 -
\??\c:\ppvpp.exec:\ppvpp.exe30⤵
- Executes dropped EXE
PID:4076 -
\??\c:\ppdvv.exec:\ppdvv.exe31⤵
- Executes dropped EXE
PID:436 -
\??\c:\xrrrlll.exec:\xrrrlll.exe32⤵
- Executes dropped EXE
PID:3752 -
\??\c:\pddvv.exec:\pddvv.exe33⤵
- Executes dropped EXE
PID:396 -
\??\c:\rrrrlll.exec:\rrrrlll.exe34⤵
- Executes dropped EXE
PID:1476 -
\??\c:\rrrllll.exec:\rrrllll.exe35⤵
- Executes dropped EXE
PID:2452 -
\??\c:\hbttnn.exec:\hbttnn.exe36⤵
- Executes dropped EXE
PID:2040 -
\??\c:\1pjdp.exec:\1pjdp.exe37⤵
- Executes dropped EXE
PID:2524 -
\??\c:\lxlfffl.exec:\lxlfffl.exe38⤵
- Executes dropped EXE
PID:4572 -
\??\c:\hthtnn.exec:\hthtnn.exe39⤵
- Executes dropped EXE
PID:4484 -
\??\c:\pvddv.exec:\pvddv.exe40⤵
- Executes dropped EXE
PID:3156 -
\??\c:\3rrfxxr.exec:\3rrfxxr.exe41⤵
- Executes dropped EXE
PID:5064 -
\??\c:\xxxrrlf.exec:\xxxrrlf.exe42⤵
- Executes dropped EXE
PID:3580 -
\??\c:\bhtntn.exec:\bhtntn.exe43⤵
- Executes dropped EXE
PID:4288 -
\??\c:\ddppv.exec:\ddppv.exe44⤵
- Executes dropped EXE
PID:2032 -
\??\c:\7rrlffx.exec:\7rrlffx.exe45⤵
- Executes dropped EXE
PID:1000 -
\??\c:\thbhbh.exec:\thbhbh.exe46⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vjvvj.exec:\vjvvj.exe47⤵
- Executes dropped EXE
PID:4796 -
\??\c:\1frflrx.exec:\1frflrx.exe48⤵
- Executes dropped EXE
PID:1532 -
\??\c:\rlxfxlf.exec:\rlxfxlf.exe49⤵
- Executes dropped EXE
PID:1464 -
\??\c:\tnttnn.exec:\tnttnn.exe50⤵
- Executes dropped EXE
PID:4580 -
\??\c:\ppdvv.exec:\ppdvv.exe51⤵
- Executes dropped EXE
PID:4476 -
\??\c:\jjjjv.exec:\jjjjv.exe52⤵
- Executes dropped EXE
PID:2816 -
\??\c:\rlllffr.exec:\rlllffr.exe53⤵
- Executes dropped EXE
PID:4444 -
\??\c:\bhtnhh.exec:\bhtnhh.exe54⤵
- Executes dropped EXE
PID:3520 -
\??\c:\jvppp.exec:\jvppp.exe55⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jddpp.exec:\jddpp.exe56⤵
- Executes dropped EXE
PID:4932 -
\??\c:\3llffxr.exec:\3llffxr.exe57⤵
- Executes dropped EXE
PID:3896 -
\??\c:\nhnhhb.exec:\nhnhhb.exe58⤵
- Executes dropped EXE
PID:3780 -
\??\c:\vvdvd.exec:\vvdvd.exe59⤵
- Executes dropped EXE
PID:2136 -
\??\c:\1rllrrl.exec:\1rllrrl.exe60⤵
- Executes dropped EXE
PID:2224 -
\??\c:\bbbnnn.exec:\bbbnnn.exe61⤵
- Executes dropped EXE
PID:972 -
\??\c:\vjpjj.exec:\vjpjj.exe62⤵
- Executes dropped EXE
PID:4284 -
\??\c:\1jjvp.exec:\1jjvp.exe63⤵
- Executes dropped EXE
PID:3668 -
\??\c:\lfllflr.exec:\lfllflr.exe64⤵
- Executes dropped EXE
PID:1568 -
\??\c:\tnbtnh.exec:\tnbtnh.exe65⤵
- Executes dropped EXE
PID:2828 -
\??\c:\dddvj.exec:\dddvj.exe66⤵PID:3864
-
\??\c:\3llfxxl.exec:\3llfxxl.exe67⤵PID:1172
-
\??\c:\bntnnn.exec:\bntnnn.exe68⤵PID:3924
-
\??\c:\jdjdj.exec:\jdjdj.exe69⤵PID:3732
-
\??\c:\pdjdv.exec:\pdjdv.exe70⤵PID:1676
-
\??\c:\xrfxrxf.exec:\xrfxrxf.exe71⤵PID:1596
-
\??\c:\bttnhh.exec:\bttnhh.exe72⤵
- System Location Discovery: System Language Discovery
PID:1552 -
\??\c:\7vdvd.exec:\7vdvd.exe73⤵PID:4316
-
\??\c:\rrrlflf.exec:\rrrlflf.exe74⤵PID:4680
-
\??\c:\htbbtt.exec:\htbbtt.exe75⤵PID:4992
-
\??\c:\nntnbh.exec:\nntnbh.exe76⤵PID:1056
-
\??\c:\pdpjd.exec:\pdpjd.exe77⤵PID:3820
-
\??\c:\fffxxxx.exec:\fffxxxx.exe78⤵PID:412
-
\??\c:\bnbttn.exec:\bnbttn.exe79⤵PID:468
-
\??\c:\pdjdp.exec:\pdjdp.exe80⤵PID:3596
-
\??\c:\vjpjd.exec:\vjpjd.exe81⤵PID:1140
-
\??\c:\fxllfll.exec:\fxllfll.exe82⤵PID:1200
-
\??\c:\nhhbbb.exec:\nhhbbb.exe83⤵PID:2236
-
\??\c:\dvvpj.exec:\dvvpj.exe84⤵PID:1648
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe85⤵PID:944
-
\??\c:\bbhbtt.exec:\bbhbtt.exe86⤵PID:4848
-
\??\c:\bthbtt.exec:\bthbtt.exe87⤵PID:5100
-
\??\c:\1pvpj.exec:\1pvpj.exe88⤵PID:2076
-
\??\c:\llxrlfl.exec:\llxrlfl.exe89⤵PID:1120
-
\??\c:\lllfxxf.exec:\lllfxxf.exe90⤵PID:3436
-
\??\c:\bnnnhh.exec:\bnnnhh.exe91⤵PID:2040
-
\??\c:\5vjvd.exec:\5vjvd.exe92⤵PID:4956
-
\??\c:\ffrxfxf.exec:\ffrxfxf.exe93⤵PID:2388
-
\??\c:\nhhbtn.exec:\nhhbtn.exe94⤵PID:4380
-
\??\c:\jjpjp.exec:\jjpjp.exe95⤵PID:3572
-
\??\c:\ddvvp.exec:\ddvvp.exe96⤵PID:3784
-
\??\c:\rxxrlff.exec:\rxxrlff.exe97⤵PID:4280
-
\??\c:\hbhbnh.exec:\hbhbnh.exe98⤵PID:4288
-
\??\c:\bbtnnb.exec:\bbtnnb.exe99⤵PID:1432
-
\??\c:\3lrllll.exec:\3lrllll.exe100⤵PID:1724
-
\??\c:\hntnnn.exec:\hntnnn.exe101⤵PID:2200
-
\??\c:\3vdvj.exec:\3vdvj.exe102⤵PID:2752
-
\??\c:\7pppj.exec:\7pppj.exe103⤵PID:1164
-
\??\c:\xxxrlxx.exec:\xxxrlxx.exe104⤵PID:2788
-
\??\c:\hbnhtb.exec:\hbnhtb.exe105⤵PID:4084
-
\??\c:\jvvvp.exec:\jvvvp.exe106⤵
- System Location Discovery: System Language Discovery
PID:704 -
\??\c:\xrfxxxr.exec:\xrfxxxr.exe107⤵PID:1480
-
\??\c:\tbhttn.exec:\tbhttn.exe108⤵PID:2304
-
\??\c:\tnbbbb.exec:\tnbbbb.exe109⤵PID:3012
-
\??\c:\jdvvd.exec:\jdvvd.exe110⤵PID:4884
-
\??\c:\dpvjp.exec:\dpvjp.exe111⤵PID:2368
-
\??\c:\xfrfxxr.exec:\xfrfxxr.exe112⤵PID:2868
-
\??\c:\ttbttn.exec:\ttbttn.exe113⤵PID:3376
-
\??\c:\nnhbnt.exec:\nnhbnt.exe114⤵PID:516
-
\??\c:\xfxxxxx.exec:\xfxxxxx.exe115⤵PID:2508
-
\??\c:\7llfxfx.exec:\7llfxfx.exe116⤵PID:4072
-
\??\c:\nhnhbb.exec:\nhnhbb.exe117⤵PID:4080
-
\??\c:\ppjdd.exec:\ppjdd.exe118⤵PID:2848
-
\??\c:\ffrrrfx.exec:\ffrrrfx.exe119⤵PID:2364
-
\??\c:\bbbbbb.exec:\bbbbbb.exe120⤵PID:4996
-
\??\c:\nhhtnn.exec:\nhhtnn.exe121⤵
- System Location Discovery: System Language Discovery
PID:2092 -
\??\c:\vjdpj.exec:\vjdpj.exe122⤵PID:872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-