Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 14:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c01a20f70c987c2415a0cd0c73a90a014b38ee26ff78c30ee455d19f22cb0f5.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
7c01a20f70c987c2415a0cd0c73a90a014b38ee26ff78c30ee455d19f22cb0f5.exe
-
Size
454KB
-
MD5
7b0c9c367910c90454a69fb8b17421f5
-
SHA1
e7e20e03f5d4772b4e1859a787805f3ae49d9f13
-
SHA256
7c01a20f70c987c2415a0cd0c73a90a014b38ee26ff78c30ee455d19f22cb0f5
-
SHA512
7927fafebf36e08ec19eff9c3d723b1f5bee78bc90c7ea4f9a876a134eada76f66311e91f8f14ac79d2443e610a8c4934899ca70cb9671997178169a1dd6e200
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe3:q7Tc2NYHUrAwfMp3CD3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4716-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1012-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1856-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4244-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2668-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-822-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-889-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-1271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/804-1622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-1650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2752 tnnnnh.exe 4836 3pddv.exe 3644 jdvpj.exe 4572 lxllfrl.exe 3276 9ttnnn.exe 4796 llxrllx.exe 1032 bnhhbb.exe 3188 5fllxrf.exe 1208 tntnhh.exe 3636 hbbttt.exe 3984 vvpjd.exe 1012 jvdvv.exe 2616 3lrlllf.exe 4784 xrffxrl.exe 3116 9vpjj.exe 1944 rlffxxx.exe 5012 nnnhbb.exe 4920 7fxxrrl.exe 3304 hhthhb.exe 2448 7rrlfxr.exe 4148 nhbttn.exe 1388 jdvpd.exe 456 ppjdd.exe 5096 7xfxllf.exe 4748 3thhbb.exe 4256 7pppj.exe 3108 hbthbh.exe 3996 vvvpp.exe 2212 9bntnh.exe 1640 pdvpj.exe 1016 hhnntt.exe 3008 vpppd.exe 4044 hbbtnn.exe 3432 xrlfxrl.exe 1856 1hbbnh.exe 1692 ppddv.exe 3152 xxxrlll.exe 4548 ddddd.exe 3616 djvvj.exe 1628 fllrrrx.exe 1168 ttbbhn.exe 4384 pvpjp.exe 1240 xffxxrr.exe 3324 nnhhbh.exe 4884 dddjj.exe 2896 frxxxlf.exe 4244 nbnntb.exe 1440 jpjvd.exe 2512 7rlllxr.exe 3912 hnnnnn.exe 2752 vjjdp.exe 4836 xfffxxr.exe 4472 5thhtn.exe 2168 jpppv.exe 2928 5frlrlx.exe 3888 7hhhbb.exe 3396 rrflxff.exe 3780 ntttbb.exe 1032 btnnnn.exe 3488 dvjjj.exe 3928 nnhbbh.exe 3192 tbnnnn.exe 4452 5vjpv.exe 2516 7rxrxfl.exe -
resource yara_rule behavioral2/memory/4716-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1388-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1856-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2668-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-889-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-1019-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-1026-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrflxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1llfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fllrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffrrx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4716 wrote to memory of 2752 4716 7c01a20f70c987c2415a0cd0c73a90a014b38ee26ff78c30ee455d19f22cb0f5.exe 84 PID 4716 wrote to memory of 2752 4716 7c01a20f70c987c2415a0cd0c73a90a014b38ee26ff78c30ee455d19f22cb0f5.exe 84 PID 4716 wrote to memory of 2752 4716 7c01a20f70c987c2415a0cd0c73a90a014b38ee26ff78c30ee455d19f22cb0f5.exe 84 PID 2752 wrote to memory of 4836 2752 tnnnnh.exe 85 PID 2752 wrote to memory of 4836 2752 tnnnnh.exe 85 PID 2752 wrote to memory of 4836 2752 tnnnnh.exe 85 PID 4836 wrote to memory of 3644 4836 3pddv.exe 86 PID 4836 wrote to memory of 3644 4836 3pddv.exe 86 PID 4836 wrote to memory of 3644 4836 3pddv.exe 86 PID 3644 wrote to memory of 4572 3644 jdvpj.exe 87 PID 3644 wrote to memory of 4572 3644 jdvpj.exe 87 PID 3644 wrote to memory of 4572 3644 jdvpj.exe 87 PID 4572 wrote to memory of 3276 4572 lxllfrl.exe 88 PID 4572 wrote to memory of 3276 4572 lxllfrl.exe 88 PID 4572 wrote to memory of 3276 4572 lxllfrl.exe 88 PID 3276 wrote to memory of 4796 3276 9ttnnn.exe 89 PID 3276 wrote to memory of 4796 3276 9ttnnn.exe 89 PID 3276 wrote to memory of 4796 3276 9ttnnn.exe 89 PID 4796 wrote to memory of 1032 4796 llxrllx.exe 90 PID 4796 wrote to memory of 1032 4796 llxrllx.exe 90 PID 4796 wrote to memory of 1032 4796 llxrllx.exe 90 PID 1032 wrote to memory of 3188 1032 bnhhbb.exe 91 PID 1032 wrote to memory of 3188 1032 bnhhbb.exe 91 PID 1032 wrote to memory of 3188 1032 bnhhbb.exe 91 PID 3188 wrote to memory of 1208 3188 5fllxrf.exe 92 PID 3188 wrote to memory of 1208 3188 5fllxrf.exe 92 PID 3188 wrote to memory of 1208 3188 5fllxrf.exe 92 PID 1208 wrote to memory of 3636 1208 tntnhh.exe 93 PID 1208 wrote to memory of 3636 1208 tntnhh.exe 93 PID 1208 wrote to memory of 3636 1208 tntnhh.exe 93 PID 3636 wrote to memory of 3984 3636 hbbttt.exe 94 PID 3636 wrote to memory of 3984 3636 hbbttt.exe 94 PID 3636 wrote to memory of 3984 3636 hbbttt.exe 94 PID 3984 wrote to memory of 1012 3984 vvpjd.exe 95 PID 3984 wrote to memory of 1012 3984 vvpjd.exe 95 PID 3984 wrote to memory of 1012 3984 vvpjd.exe 95 PID 1012 wrote to memory of 2616 1012 jvdvv.exe 96 PID 1012 wrote to memory of 2616 1012 jvdvv.exe 96 PID 1012 wrote to memory of 2616 1012 jvdvv.exe 96 PID 2616 wrote to memory of 4784 2616 3lrlllf.exe 97 PID 2616 wrote to memory of 4784 2616 3lrlllf.exe 97 PID 2616 wrote to memory of 4784 2616 3lrlllf.exe 97 PID 4784 wrote to memory of 3116 4784 xrffxrl.exe 98 PID 4784 wrote to memory of 3116 4784 xrffxrl.exe 98 PID 4784 wrote to memory of 3116 4784 xrffxrl.exe 98 PID 3116 wrote to memory of 1944 3116 9vpjj.exe 99 PID 3116 wrote to memory of 1944 3116 9vpjj.exe 99 PID 3116 wrote to memory of 1944 3116 9vpjj.exe 99 PID 1944 wrote to memory of 5012 1944 rlffxxx.exe 100 PID 1944 wrote to memory of 5012 1944 rlffxxx.exe 100 PID 1944 wrote to memory of 5012 1944 rlffxxx.exe 100 PID 5012 wrote to memory of 4920 5012 nnnhbb.exe 101 PID 5012 wrote to memory of 4920 5012 nnnhbb.exe 101 PID 5012 wrote to memory of 4920 5012 nnnhbb.exe 101 PID 4920 wrote to memory of 3304 4920 7fxxrrl.exe 102 PID 4920 wrote to memory of 3304 4920 7fxxrrl.exe 102 PID 4920 wrote to memory of 3304 4920 7fxxrrl.exe 102 PID 3304 wrote to memory of 2448 3304 hhthhb.exe 103 PID 3304 wrote to memory of 2448 3304 hhthhb.exe 103 PID 3304 wrote to memory of 2448 3304 hhthhb.exe 103 PID 2448 wrote to memory of 4148 2448 7rrlfxr.exe 104 PID 2448 wrote to memory of 4148 2448 7rrlfxr.exe 104 PID 2448 wrote to memory of 4148 2448 7rrlfxr.exe 104 PID 4148 wrote to memory of 1388 4148 nhbttn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c01a20f70c987c2415a0cd0c73a90a014b38ee26ff78c30ee455d19f22cb0f5.exe"C:\Users\Admin\AppData\Local\Temp\7c01a20f70c987c2415a0cd0c73a90a014b38ee26ff78c30ee455d19f22cb0f5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\tnnnnh.exec:\tnnnnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\3pddv.exec:\3pddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\jdvpj.exec:\jdvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\lxllfrl.exec:\lxllfrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\9ttnnn.exec:\9ttnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\llxrllx.exec:\llxrllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\bnhhbb.exec:\bnhhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\5fllxrf.exec:\5fllxrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\tntnhh.exec:\tntnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\hbbttt.exec:\hbbttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\vvpjd.exec:\vvpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\jvdvv.exec:\jvdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\3lrlllf.exec:\3lrlllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\xrffxrl.exec:\xrffxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\9vpjj.exec:\9vpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\rlffxxx.exec:\rlffxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\nnnhbb.exec:\nnnhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\7fxxrrl.exec:\7fxxrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\hhthhb.exec:\hhthhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\7rrlfxr.exec:\7rrlfxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\nhbttn.exec:\nhbttn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\jdvpd.exec:\jdvpd.exe23⤵
- Executes dropped EXE
PID:1388 -
\??\c:\ppjdd.exec:\ppjdd.exe24⤵
- Executes dropped EXE
PID:456 -
\??\c:\7xfxllf.exec:\7xfxllf.exe25⤵
- Executes dropped EXE
PID:5096 -
\??\c:\3thhbb.exec:\3thhbb.exe26⤵
- Executes dropped EXE
PID:4748 -
\??\c:\7pppj.exec:\7pppj.exe27⤵
- Executes dropped EXE
PID:4256 -
\??\c:\hbthbh.exec:\hbthbh.exe28⤵
- Executes dropped EXE
PID:3108 -
\??\c:\vvvpp.exec:\vvvpp.exe29⤵
- Executes dropped EXE
PID:3996 -
\??\c:\9bntnh.exec:\9bntnh.exe30⤵
- Executes dropped EXE
PID:2212 -
\??\c:\pdvpj.exec:\pdvpj.exe31⤵
- Executes dropped EXE
PID:1640 -
\??\c:\hhnntt.exec:\hhnntt.exe32⤵
- Executes dropped EXE
PID:1016 -
\??\c:\vpppd.exec:\vpppd.exe33⤵
- Executes dropped EXE
PID:3008 -
\??\c:\hbbtnn.exec:\hbbtnn.exe34⤵
- Executes dropped EXE
PID:4044 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe35⤵
- Executes dropped EXE
PID:3432 -
\??\c:\1hbbnh.exec:\1hbbnh.exe36⤵
- Executes dropped EXE
PID:1856 -
\??\c:\ppddv.exec:\ppddv.exe37⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xxxrlll.exec:\xxxrlll.exe38⤵
- Executes dropped EXE
PID:3152 -
\??\c:\ddddd.exec:\ddddd.exe39⤵
- Executes dropped EXE
PID:4548 -
\??\c:\djvvj.exec:\djvvj.exe40⤵
- Executes dropped EXE
PID:3616 -
\??\c:\fllrrrx.exec:\fllrrrx.exe41⤵
- Executes dropped EXE
PID:1628 -
\??\c:\ttbbhn.exec:\ttbbhn.exe42⤵
- Executes dropped EXE
PID:1168 -
\??\c:\pvpjp.exec:\pvpjp.exe43⤵
- Executes dropped EXE
PID:4384 -
\??\c:\xffxxrr.exec:\xffxxrr.exe44⤵
- Executes dropped EXE
PID:1240 -
\??\c:\nnhhbh.exec:\nnhhbh.exe45⤵
- Executes dropped EXE
PID:3324 -
\??\c:\dddjj.exec:\dddjj.exe46⤵
- Executes dropped EXE
PID:4884 -
\??\c:\frxxxlf.exec:\frxxxlf.exe47⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nbnntb.exec:\nbnntb.exe48⤵
- Executes dropped EXE
PID:4244 -
\??\c:\jpjvd.exec:\jpjvd.exe49⤵
- Executes dropped EXE
PID:1440 -
\??\c:\lflflll.exec:\lflflll.exe50⤵PID:3924
-
\??\c:\7rlllxr.exec:\7rlllxr.exe51⤵
- Executes dropped EXE
PID:2512 -
\??\c:\hnnnnn.exec:\hnnnnn.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3912 -
\??\c:\vjjdp.exec:\vjjdp.exe53⤵
- Executes dropped EXE
PID:2752 -
\??\c:\xfffxxr.exec:\xfffxxr.exe54⤵
- Executes dropped EXE
PID:4836 -
\??\c:\5thhtn.exec:\5thhtn.exe55⤵
- Executes dropped EXE
PID:4472 -
\??\c:\jpppv.exec:\jpppv.exe56⤵
- Executes dropped EXE
PID:2168 -
\??\c:\5frlrlx.exec:\5frlrlx.exe57⤵
- Executes dropped EXE
PID:2928 -
\??\c:\7hhhbb.exec:\7hhhbb.exe58⤵
- Executes dropped EXE
PID:3888 -
\??\c:\rrflxff.exec:\rrflxff.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3396 -
\??\c:\ntttbb.exec:\ntttbb.exe60⤵
- Executes dropped EXE
PID:3780 -
\??\c:\btnnnn.exec:\btnnnn.exe61⤵
- Executes dropped EXE
PID:1032 -
\??\c:\dvjjj.exec:\dvjjj.exe62⤵
- Executes dropped EXE
PID:3488 -
\??\c:\nnhbbh.exec:\nnhbbh.exe63⤵
- Executes dropped EXE
PID:3928 -
\??\c:\tbnnnn.exec:\tbnnnn.exe64⤵
- Executes dropped EXE
PID:3192 -
\??\c:\5vjpv.exec:\5vjpv.exe65⤵
- Executes dropped EXE
PID:4452 -
\??\c:\7rxrxfl.exec:\7rxrxfl.exe66⤵
- Executes dropped EXE
PID:2516 -
\??\c:\3bnhhh.exec:\3bnhhh.exe67⤵PID:4264
-
\??\c:\vjppv.exec:\vjppv.exe68⤵PID:3120
-
\??\c:\5lfxrrl.exec:\5lfxrrl.exe69⤵PID:4892
-
\??\c:\rlxxrlf.exec:\rlxxrlf.exe70⤵PID:5056
-
\??\c:\hhtnhh.exec:\hhtnhh.exe71⤵PID:584
-
\??\c:\jpvvp.exec:\jpvvp.exe72⤵PID:3640
-
\??\c:\9rlfxxx.exec:\9rlfxxx.exe73⤵PID:3116
-
\??\c:\nhbtnn.exec:\nhbtnn.exe74⤵PID:1944
-
\??\c:\hnbbtt.exec:\hnbbtt.exe75⤵PID:4984
-
\??\c:\ddpjj.exec:\ddpjj.exe76⤵PID:5048
-
\??\c:\llfxrrl.exec:\llfxrrl.exe77⤵PID:2872
-
\??\c:\nntntn.exec:\nntntn.exe78⤵PID:3016
-
\??\c:\7jjjd.exec:\7jjjd.exe79⤵PID:2448
-
\??\c:\7lxxxll.exec:\7lxxxll.exe80⤵PID:4088
-
\??\c:\xffflll.exec:\xffflll.exe81⤵PID:3356
-
\??\c:\nnnnhn.exec:\nnnnhn.exe82⤵PID:3612
-
\??\c:\9vvvp.exec:\9vvvp.exe83⤵PID:4580
-
\??\c:\vpppd.exec:\vpppd.exe84⤵PID:2692
-
\??\c:\xfffxrl.exec:\xfffxrl.exe85⤵PID:3296
-
\??\c:\tnhbnh.exec:\tnhbnh.exe86⤵PID:1616
-
\??\c:\lflfxfx.exec:\lflfxfx.exe87⤵PID:1412
-
\??\c:\xfxrfrl.exec:\xfxrfrl.exe88⤵PID:4708
-
\??\c:\nnnhbb.exec:\nnnhbb.exe89⤵PID:3976
-
\??\c:\bhhbtt.exec:\bhhbtt.exe90⤵PID:5076
-
\??\c:\dvvpp.exec:\dvvpp.exe91⤵PID:2668
-
\??\c:\llfrlfx.exec:\llfrlfx.exe92⤵PID:1864
-
\??\c:\9bnhhh.exec:\9bnhhh.exe93⤵PID:4132
-
\??\c:\9dpjd.exec:\9dpjd.exe94⤵PID:4076
-
\??\c:\flrllff.exec:\flrllff.exe95⤵PID:3008
-
\??\c:\nntnhb.exec:\nntnhb.exe96⤵PID:1772
-
\??\c:\tnhbhb.exec:\tnhbhb.exe97⤵PID:4084
-
\??\c:\dpdpd.exec:\dpdpd.exe98⤵PID:3768
-
\??\c:\xrxrlfx.exec:\xrxrlfx.exe99⤵PID:1676
-
\??\c:\ttbbhh.exec:\ttbbhh.exe100⤵PID:2652
-
\??\c:\dppjd.exec:\dppjd.exe101⤵PID:60
-
\??\c:\rlllfff.exec:\rlllfff.exe102⤵PID:4448
-
\??\c:\3xllxxx.exec:\3xllxxx.exe103⤵PID:3616
-
\??\c:\nhhbtt.exec:\nhhbtt.exe104⤵PID:1620
-
\??\c:\jjjdv.exec:\jjjdv.exe105⤵PID:1168
-
\??\c:\rrfxxfx.exec:\rrfxxfx.exe106⤵PID:4672
-
\??\c:\nbtnhb.exec:\nbtnhb.exe107⤵PID:1580
-
\??\c:\1nhhht.exec:\1nhhht.exe108⤵PID:3584
-
\??\c:\vppjd.exec:\vppjd.exe109⤵PID:684
-
\??\c:\lrrrrrx.exec:\lrrrrrx.exe110⤵PID:2896
-
\??\c:\bntnhb.exec:\bntnhb.exe111⤵PID:4360
-
\??\c:\9djpj.exec:\9djpj.exe112⤵PID:1824
-
\??\c:\llrlxxx.exec:\llrlxxx.exe113⤵PID:3140
-
\??\c:\nhnbbt.exec:\nhnbbt.exe114⤵PID:5060
-
\??\c:\hntnbb.exec:\hntnbb.exe115⤵PID:4516
-
\??\c:\9dpjd.exec:\9dpjd.exe116⤵PID:4540
-
\??\c:\3lxxrlf.exec:\3lxxrlf.exe117⤵PID:3644
-
\??\c:\9bbtnn.exec:\9bbtnn.exe118⤵PID:388
-
\??\c:\tthtbn.exec:\tthtbn.exe119⤵PID:3252
-
\??\c:\pppdv.exec:\pppdv.exe120⤵PID:4948
-
\??\c:\fxrlffx.exec:\fxrlffx.exe121⤵PID:1040
-
\??\c:\frrfrlx.exec:\frrfrlx.exe122⤵PID:4224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-