Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 11:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c2b46f50968a84485d51357c6c87f94bc69a6ab5f75927aef308c032b07fa02N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
7c2b46f50968a84485d51357c6c87f94bc69a6ab5f75927aef308c032b07fa02N.exe
-
Size
454KB
-
MD5
5db897e4c7d22614fd9383802f491330
-
SHA1
8bff6c547acac65881a8525109c7cf119b4219d9
-
SHA256
7c2b46f50968a84485d51357c6c87f94bc69a6ab5f75927aef308c032b07fa02
-
SHA512
0cd5f773ee55a79b4b99408e714140aa92752117d6b67b026391fe9c548b5e0d58688fb7eaff2d9974dbf8c213dcfeeef005c690c3cfade0eccb14818b4eac5b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet:q7Tc2NYHUrAwfMp3CDt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2168-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/936-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2812-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3380-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1412-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2196-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/720-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/652-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2092-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1852-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2748-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3900-740-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-757-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-785-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-1601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 872 lxfrlfx.exe 2596 ntnhtn.exe 4628 pdjvv.exe 3172 jvjvj.exe 2288 1jdvp.exe 4668 tnthtn.exe 3148 xxxxrlx.exe 2692 btbnbb.exe 1424 ttbnhb.exe 3992 1xxrffr.exe 936 btnhtt.exe 1432 rxxlxxl.exe 1268 jvdvj.exe 3640 ttbtnh.exe 4872 nhnhtb.exe 1312 rflfrlx.exe 3568 httnbt.exe 4508 vpvvp.exe 2760 pdvvj.exe 4580 vjpjd.exe 4612 vjpdd.exe 5024 lflxlfr.exe 2812 jvdvd.exe 3132 vppjv.exe 4696 ttbbnh.exe 3032 btthbb.exe 920 jdvjd.exe 3380 rlrfrll.exe 32 5rrfrxl.exe 412 rrrlfxx.exe 3344 frrfrlx.exe 1640 7rfrfxl.exe 1624 bnnbth.exe 4024 5ttnbb.exe 1848 rffxxxr.exe 4744 1frlffx.exe 640 tbhbtt.exe 1412 nbhbnh.exe 4484 3pjvp.exe 2144 hhnbnt.exe 876 jvjvd.exe 768 frxlfrl.exe 3416 rflfrlf.exe 2732 pvdvj.exe 2196 9fxlfxl.exe 4348 bbbtht.exe 2484 9vppj.exe 1440 lxfxrrl.exe 4456 hhbbtt.exe 2040 ttbtnn.exe 3856 frfrffl.exe 4932 1bnbnn.exe 720 tntnht.exe 2680 ppvjp.exe 2820 frrrrrr.exe 2916 tnnhhb.exe 1732 pvddp.exe 1380 rffrxrx.exe 868 1thbtb.exe 2840 7ttnhh.exe 5108 ddjjd.exe 3148 lxxrffr.exe 1376 nnttht.exe 2880 9vpjd.exe -
resource yara_rule behavioral2/memory/2168-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/936-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1432-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3380-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1412-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/768-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/720-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/652-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2092-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1852-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2748-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1100-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3900-740-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-757-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlfrlf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2168 wrote to memory of 872 2168 7c2b46f50968a84485d51357c6c87f94bc69a6ab5f75927aef308c032b07fa02N.exe 82 PID 2168 wrote to memory of 872 2168 7c2b46f50968a84485d51357c6c87f94bc69a6ab5f75927aef308c032b07fa02N.exe 82 PID 2168 wrote to memory of 872 2168 7c2b46f50968a84485d51357c6c87f94bc69a6ab5f75927aef308c032b07fa02N.exe 82 PID 872 wrote to memory of 2596 872 lxfrlfx.exe 83 PID 872 wrote to memory of 2596 872 lxfrlfx.exe 83 PID 872 wrote to memory of 2596 872 lxfrlfx.exe 83 PID 2596 wrote to memory of 4628 2596 ntnhtn.exe 84 PID 2596 wrote to memory of 4628 2596 ntnhtn.exe 84 PID 2596 wrote to memory of 4628 2596 ntnhtn.exe 84 PID 4628 wrote to memory of 3172 4628 pdjvv.exe 85 PID 4628 wrote to memory of 3172 4628 pdjvv.exe 85 PID 4628 wrote to memory of 3172 4628 pdjvv.exe 85 PID 3172 wrote to memory of 2288 3172 jvjvj.exe 86 PID 3172 wrote to memory of 2288 3172 jvjvj.exe 86 PID 3172 wrote to memory of 2288 3172 jvjvj.exe 86 PID 2288 wrote to memory of 4668 2288 1jdvp.exe 87 PID 2288 wrote to memory of 4668 2288 1jdvp.exe 87 PID 2288 wrote to memory of 4668 2288 1jdvp.exe 87 PID 4668 wrote to memory of 3148 4668 tnthtn.exe 88 PID 4668 wrote to memory of 3148 4668 tnthtn.exe 88 PID 4668 wrote to memory of 3148 4668 tnthtn.exe 88 PID 3148 wrote to memory of 2692 3148 xxxxrlx.exe 89 PID 3148 wrote to memory of 2692 3148 xxxxrlx.exe 89 PID 3148 wrote to memory of 2692 3148 xxxxrlx.exe 89 PID 2692 wrote to memory of 1424 2692 btbnbb.exe 90 PID 2692 wrote to memory of 1424 2692 btbnbb.exe 90 PID 2692 wrote to memory of 1424 2692 btbnbb.exe 90 PID 1424 wrote to memory of 3992 1424 ttbnhb.exe 91 PID 1424 wrote to memory of 3992 1424 ttbnhb.exe 91 PID 1424 wrote to memory of 3992 1424 ttbnhb.exe 91 PID 3992 wrote to memory of 936 3992 1xxrffr.exe 92 PID 3992 wrote to memory of 936 3992 1xxrffr.exe 92 PID 3992 wrote to memory of 936 3992 1xxrffr.exe 92 PID 936 wrote to memory of 1432 936 btnhtt.exe 93 PID 936 wrote to memory of 1432 936 btnhtt.exe 93 PID 936 wrote to memory of 1432 936 btnhtt.exe 93 PID 1432 wrote to memory of 1268 1432 rxxlxxl.exe 94 PID 1432 wrote to memory of 1268 1432 rxxlxxl.exe 94 PID 1432 wrote to memory of 1268 1432 rxxlxxl.exe 94 PID 1268 wrote to memory of 3640 1268 jvdvj.exe 95 PID 1268 wrote to memory of 3640 1268 jvdvj.exe 95 PID 1268 wrote to memory of 3640 1268 jvdvj.exe 95 PID 3640 wrote to memory of 4872 3640 ttbtnh.exe 96 PID 3640 wrote to memory of 4872 3640 ttbtnh.exe 96 PID 3640 wrote to memory of 4872 3640 ttbtnh.exe 96 PID 4872 wrote to memory of 1312 4872 nhnhtb.exe 97 PID 4872 wrote to memory of 1312 4872 nhnhtb.exe 97 PID 4872 wrote to memory of 1312 4872 nhnhtb.exe 97 PID 1312 wrote to memory of 3568 1312 rflfrlx.exe 98 PID 1312 wrote to memory of 3568 1312 rflfrlx.exe 98 PID 1312 wrote to memory of 3568 1312 rflfrlx.exe 98 PID 3568 wrote to memory of 4508 3568 httnbt.exe 99 PID 3568 wrote to memory of 4508 3568 httnbt.exe 99 PID 3568 wrote to memory of 4508 3568 httnbt.exe 99 PID 4508 wrote to memory of 2760 4508 vpvvp.exe 100 PID 4508 wrote to memory of 2760 4508 vpvvp.exe 100 PID 4508 wrote to memory of 2760 4508 vpvvp.exe 100 PID 2760 wrote to memory of 4580 2760 pdvvj.exe 101 PID 2760 wrote to memory of 4580 2760 pdvvj.exe 101 PID 2760 wrote to memory of 4580 2760 pdvvj.exe 101 PID 4580 wrote to memory of 4612 4580 vjpjd.exe 102 PID 4580 wrote to memory of 4612 4580 vjpjd.exe 102 PID 4580 wrote to memory of 4612 4580 vjpjd.exe 102 PID 4612 wrote to memory of 5024 4612 vjpdd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c2b46f50968a84485d51357c6c87f94bc69a6ab5f75927aef308c032b07fa02N.exe"C:\Users\Admin\AppData\Local\Temp\7c2b46f50968a84485d51357c6c87f94bc69a6ab5f75927aef308c032b07fa02N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\lxfrlfx.exec:\lxfrlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\ntnhtn.exec:\ntnhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\pdjvv.exec:\pdjvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\jvjvj.exec:\jvjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\1jdvp.exec:\1jdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\tnthtn.exec:\tnthtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\xxxxrlx.exec:\xxxxrlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\btbnbb.exec:\btbnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\ttbnhb.exec:\ttbnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\1xxrffr.exec:\1xxrffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\btnhtt.exec:\btnhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\rxxlxxl.exec:\rxxlxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\jvdvj.exec:\jvdvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\ttbtnh.exec:\ttbtnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\nhnhtb.exec:\nhnhtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\rflfrlx.exec:\rflfrlx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\httnbt.exec:\httnbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\vpvvp.exec:\vpvvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\pdvvj.exec:\pdvvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\vjpjd.exec:\vjpjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\vjpdd.exec:\vjpdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\lflxlfr.exec:\lflxlfr.exe23⤵
- Executes dropped EXE
PID:5024 -
\??\c:\jvdvd.exec:\jvdvd.exe24⤵
- Executes dropped EXE
PID:2812 -
\??\c:\vppjv.exec:\vppjv.exe25⤵
- Executes dropped EXE
PID:3132 -
\??\c:\ttbbnh.exec:\ttbbnh.exe26⤵
- Executes dropped EXE
PID:4696 -
\??\c:\btthbb.exec:\btthbb.exe27⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jdvjd.exec:\jdvjd.exe28⤵
- Executes dropped EXE
PID:920 -
\??\c:\rlrfrll.exec:\rlrfrll.exe29⤵
- Executes dropped EXE
PID:3380 -
\??\c:\5rrfrxl.exec:\5rrfrxl.exe30⤵
- Executes dropped EXE
PID:32 -
\??\c:\rrrlfxx.exec:\rrrlfxx.exe31⤵
- Executes dropped EXE
PID:412 -
\??\c:\frrfrlx.exec:\frrfrlx.exe32⤵
- Executes dropped EXE
PID:3344 -
\??\c:\7rfrfxl.exec:\7rfrfxl.exe33⤵
- Executes dropped EXE
PID:1640 -
\??\c:\bnnbth.exec:\bnnbth.exe34⤵
- Executes dropped EXE
PID:1624 -
\??\c:\5ttnbb.exec:\5ttnbb.exe35⤵
- Executes dropped EXE
PID:4024 -
\??\c:\rffxxxr.exec:\rffxxxr.exe36⤵
- Executes dropped EXE
PID:1848 -
\??\c:\1frlffx.exec:\1frlffx.exe37⤵
- Executes dropped EXE
PID:4744 -
\??\c:\tbhbtt.exec:\tbhbtt.exe38⤵
- Executes dropped EXE
PID:640 -
\??\c:\nbhbnh.exec:\nbhbnh.exe39⤵
- Executes dropped EXE
PID:1412 -
\??\c:\3pjvp.exec:\3pjvp.exe40⤵
- Executes dropped EXE
PID:4484 -
\??\c:\hhnbnt.exec:\hhnbnt.exe41⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jvjvd.exec:\jvjvd.exe42⤵
- Executes dropped EXE
PID:876 -
\??\c:\frxlfrl.exec:\frxlfrl.exe43⤵
- Executes dropped EXE
PID:768 -
\??\c:\rflfrlf.exec:\rflfrlf.exe44⤵
- Executes dropped EXE
PID:3416 -
\??\c:\pvdvj.exec:\pvdvj.exe45⤵
- Executes dropped EXE
PID:2732 -
\??\c:\9fxlfxl.exec:\9fxlfxl.exe46⤵
- Executes dropped EXE
PID:2196 -
\??\c:\bbbtht.exec:\bbbtht.exe47⤵
- Executes dropped EXE
PID:4348 -
\??\c:\9vppj.exec:\9vppj.exe48⤵
- Executes dropped EXE
PID:2484 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe49⤵
- Executes dropped EXE
PID:1440 -
\??\c:\hhbbtt.exec:\hhbbtt.exe50⤵
- Executes dropped EXE
PID:4456 -
\??\c:\ttbtnn.exec:\ttbtnn.exe51⤵
- Executes dropped EXE
PID:2040 -
\??\c:\1dddv.exec:\1dddv.exe52⤵PID:3660
-
\??\c:\frfrffl.exec:\frfrffl.exe53⤵
- Executes dropped EXE
PID:3856 -
\??\c:\1bnbnn.exec:\1bnbnn.exe54⤵
- Executes dropped EXE
PID:4932 -
\??\c:\tntnht.exec:\tntnht.exe55⤵
- Executes dropped EXE
PID:720 -
\??\c:\ppvjp.exec:\ppvjp.exe56⤵
- Executes dropped EXE
PID:2680 -
\??\c:\frrrrrr.exec:\frrrrrr.exe57⤵
- Executes dropped EXE
PID:2820 -
\??\c:\tnnhhb.exec:\tnnhhb.exe58⤵
- Executes dropped EXE
PID:2916 -
\??\c:\pvddp.exec:\pvddp.exe59⤵
- Executes dropped EXE
PID:1732 -
\??\c:\rffrxrx.exec:\rffrxrx.exe60⤵
- Executes dropped EXE
PID:1380 -
\??\c:\1thbtb.exec:\1thbtb.exe61⤵
- Executes dropped EXE
PID:868 -
\??\c:\7ttnhh.exec:\7ttnhh.exe62⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ddjjd.exec:\ddjjd.exe63⤵
- Executes dropped EXE
PID:5108 -
\??\c:\lxxrffr.exec:\lxxrffr.exe64⤵
- Executes dropped EXE
PID:3148 -
\??\c:\nnttht.exec:\nnttht.exe65⤵
- Executes dropped EXE
PID:1376 -
\??\c:\9vpjd.exec:\9vpjd.exe66⤵
- Executes dropped EXE
PID:2880 -
\??\c:\3rxrxrx.exec:\3rxrxrx.exe67⤵PID:3912
-
\??\c:\hnbtbh.exec:\hnbtbh.exe68⤵PID:4940
-
\??\c:\vjvdd.exec:\vjvdd.exe69⤵PID:4200
-
\??\c:\dppjd.exec:\dppjd.exe70⤵PID:1608
-
\??\c:\1lrrlll.exec:\1lrrlll.exe71⤵PID:1976
-
\??\c:\nnnthh.exec:\nnnthh.exe72⤵PID:1268
-
\??\c:\dpvpj.exec:\dpvpj.exe73⤵PID:652
-
\??\c:\frrlffx.exec:\frrlffx.exe74⤵PID:5008
-
\??\c:\1lrlffx.exec:\1lrlffx.exe75⤵PID:3852
-
\??\c:\ddjdj.exec:\ddjdj.exe76⤵PID:4676
-
\??\c:\3vvpd.exec:\3vvpd.exe77⤵PID:4356
-
\??\c:\lrrfrrf.exec:\lrrfrrf.exe78⤵PID:3692
-
\??\c:\9nhbtn.exec:\9nhbtn.exe79⤵PID:2772
-
\??\c:\5vvjd.exec:\5vvjd.exe80⤵PID:400
-
\??\c:\3jjvp.exec:\3jjvp.exe81⤵PID:2924
-
\??\c:\flllfxl.exec:\flllfxl.exe82⤵PID:1648
-
\??\c:\bnthhb.exec:\bnthhb.exe83⤵PID:4612
-
\??\c:\nbhbtt.exec:\nbhbtt.exe84⤵PID:5024
-
\??\c:\vdvdp.exec:\vdvdp.exe85⤵PID:2092
-
\??\c:\rrxxlll.exec:\rrxxlll.exe86⤵PID:1176
-
\??\c:\5hbtnn.exec:\5hbtnn.exe87⤵PID:3132
-
\??\c:\vjjdv.exec:\vjjdv.exe88⤵PID:3932
-
\??\c:\pjjdp.exec:\pjjdp.exe89⤵PID:956
-
\??\c:\rlrrrxr.exec:\rlrrrxr.exe90⤵PID:2980
-
\??\c:\nbhbtt.exec:\nbhbtt.exe91⤵PID:2480
-
\??\c:\9hthnn.exec:\9hthnn.exe92⤵PID:4852
-
\??\c:\pjdvj.exec:\pjdvj.exe93⤵PID:3356
-
\??\c:\xrrxrxf.exec:\xrrxrxf.exe94⤵PID:4304
-
\??\c:\3thtnt.exec:\3thtnt.exe95⤵PID:3064
-
\??\c:\dpvpj.exec:\dpvpj.exe96⤵PID:3344
-
\??\c:\vvpjv.exec:\vvpjv.exe97⤵PID:4260
-
\??\c:\lxlfffr.exec:\lxlfffr.exe98⤵PID:3788
-
\??\c:\hbhbtn.exec:\hbhbtn.exe99⤵PID:3520
-
\??\c:\dpdvp.exec:\dpdvp.exe100⤵PID:1852
-
\??\c:\ffxrlfx.exec:\ffxrlfx.exe101⤵PID:1876
-
\??\c:\rlrlxxf.exec:\rlrlxxf.exe102⤵PID:640
-
\??\c:\nhttbt.exec:\nhttbt.exe103⤵PID:5048
-
\??\c:\jdpjv.exec:\jdpjv.exe104⤵PID:4468
-
\??\c:\pddvp.exec:\pddvp.exe105⤵PID:3732
-
\??\c:\fxllfff.exec:\fxllfff.exe106⤵PID:3672
-
\??\c:\fxlfxxf.exec:\fxlfxxf.exe107⤵PID:2100
-
\??\c:\hhbhbh.exec:\hhbhbh.exe108⤵PID:2748
-
\??\c:\9dvjd.exec:\9dvjd.exe109⤵PID:3416
-
\??\c:\fxlfffx.exec:\fxlfffx.exe110⤵PID:2732
-
\??\c:\fllfffx.exec:\fllfffx.exe111⤵PID:3508
-
\??\c:\3bthnh.exec:\3bthnh.exe112⤵PID:4680
-
\??\c:\ddjdv.exec:\ddjdv.exe113⤵PID:4856
-
\??\c:\xrllxxr.exec:\xrllxxr.exe114⤵PID:840
-
\??\c:\fxxfxrx.exec:\fxxfxrx.exe115⤵PID:4384
-
\??\c:\bhnbtn.exec:\bhnbtn.exe116⤵
- System Location Discovery: System Language Discovery
PID:4512 -
\??\c:\1jpjj.exec:\1jpjj.exe117⤵PID:1972
-
\??\c:\rxfrlfx.exec:\rxfrlfx.exe118⤵PID:2592
-
\??\c:\lxfxlfx.exec:\lxfxlfx.exe119⤵PID:4004
-
\??\c:\9tnhbb.exec:\9tnhbb.exe120⤵PID:4936
-
\??\c:\dvjdd.exec:\dvjdd.exe121⤵PID:2828
-
\??\c:\xlllfxx.exec:\xlllfxx.exe122⤵PID:2832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-