Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 18:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2cfdca78f4dc4f9a7cbb711f38496abe86ef2f7b2471ef74d2dba7a9341b3920.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
2cfdca78f4dc4f9a7cbb711f38496abe86ef2f7b2471ef74d2dba7a9341b3920.exe
-
Size
456KB
-
MD5
a572dc39fd2c99accb9358dedb70330b
-
SHA1
26ca4a2be9fd35fdfb4790a1d57c7d6db3af1106
-
SHA256
2cfdca78f4dc4f9a7cbb711f38496abe86ef2f7b2471ef74d2dba7a9341b3920
-
SHA512
87b65a5920fe1d0a2ac3857d6b06149644b2ff609635819ad74f050b3f594df538b590b030ad3044dfb65197021da0f7824bf003b3495f53729617c0fdb58afb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRL:q7Tc2NYHUrAwfMp3CDRL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3960-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1852-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1904-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/888-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3368-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/836-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1852-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-928-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/856-953-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-1149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-1288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-1518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3960 7nnhbh.exe 4656 vdddj.exe 4876 dvpjp.exe 3508 rlxxxxx.exe 1500 nthhhn.exe 3988 hhntbh.exe 3936 xxlllrx.exe 4408 1nhhht.exe 1852 bbnntb.exe 4460 fflllrr.exe 3148 hthhtt.exe 2584 tnnhbn.exe 4856 nhnnnb.exe 4700 bbnntb.exe 2104 jvjvp.exe 2284 7rfffrr.exe 436 bbthnb.exe 4104 dvvdd.exe 3516 rlfffff.exe 4500 hnttnn.exe 3012 tnhhbb.exe 2744 ppddv.exe 4416 9lxxxfx.exe 836 xffxxff.exe 3044 ntbbbt.exe 2640 jpvdd.exe 4092 jvjjp.exe 976 xxfllrr.exe 2740 lfllfff.exe 1628 nthbbb.exe 1996 vdjjj.exe 1468 frxxxxx.exe 1904 xfllfll.exe 4360 nntttb.exe 4192 btthhb.exe 4112 jjvdp.exe 3652 lfxrrrl.exe 1776 5flllll.exe 3224 nhthbh.exe 2236 jvjjj.exe 1588 7jvvd.exe 3948 llrrrrr.exe 2508 hthbbb.exe 788 hbtnnn.exe 1836 djjjj.exe 1528 pvjpp.exe 1748 3rlflxf.exe 3368 bbbbtt.exe 5104 7bnttb.exe 1020 dddvv.exe 536 rffxfxl.exe 1296 lfrllll.exe 4060 nntnhn.exe 4980 jpvpp.exe 1228 jvdvv.exe 888 llllfff.exe 4448 tntnnn.exe 2444 vdjpd.exe 2392 pjppv.exe 4848 tnttnt.exe 4868 9ppjp.exe 4636 xxrrrll.exe 3508 nnhhth.exe 1460 9pdvd.exe -
resource yara_rule behavioral2/memory/3960-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1852-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/888-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1852-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-928-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlxrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbtn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3400 wrote to memory of 3960 3400 2cfdca78f4dc4f9a7cbb711f38496abe86ef2f7b2471ef74d2dba7a9341b3920.exe 83 PID 3400 wrote to memory of 3960 3400 2cfdca78f4dc4f9a7cbb711f38496abe86ef2f7b2471ef74d2dba7a9341b3920.exe 83 PID 3400 wrote to memory of 3960 3400 2cfdca78f4dc4f9a7cbb711f38496abe86ef2f7b2471ef74d2dba7a9341b3920.exe 83 PID 3960 wrote to memory of 4656 3960 7nnhbh.exe 84 PID 3960 wrote to memory of 4656 3960 7nnhbh.exe 84 PID 3960 wrote to memory of 4656 3960 7nnhbh.exe 84 PID 4656 wrote to memory of 4876 4656 vdddj.exe 85 PID 4656 wrote to memory of 4876 4656 vdddj.exe 85 PID 4656 wrote to memory of 4876 4656 vdddj.exe 85 PID 4876 wrote to memory of 3508 4876 dvpjp.exe 86 PID 4876 wrote to memory of 3508 4876 dvpjp.exe 86 PID 4876 wrote to memory of 3508 4876 dvpjp.exe 86 PID 3508 wrote to memory of 1500 3508 rlxxxxx.exe 87 PID 3508 wrote to memory of 1500 3508 rlxxxxx.exe 87 PID 3508 wrote to memory of 1500 3508 rlxxxxx.exe 87 PID 1500 wrote to memory of 3988 1500 nthhhn.exe 88 PID 1500 wrote to memory of 3988 1500 nthhhn.exe 88 PID 1500 wrote to memory of 3988 1500 nthhhn.exe 88 PID 3988 wrote to memory of 3936 3988 hhntbh.exe 89 PID 3988 wrote to memory of 3936 3988 hhntbh.exe 89 PID 3988 wrote to memory of 3936 3988 hhntbh.exe 89 PID 3936 wrote to memory of 4408 3936 xxlllrx.exe 90 PID 3936 wrote to memory of 4408 3936 xxlllrx.exe 90 PID 3936 wrote to memory of 4408 3936 xxlllrx.exe 90 PID 4408 wrote to memory of 1852 4408 1nhhht.exe 91 PID 4408 wrote to memory of 1852 4408 1nhhht.exe 91 PID 4408 wrote to memory of 1852 4408 1nhhht.exe 91 PID 1852 wrote to memory of 4460 1852 bbnntb.exe 92 PID 1852 wrote to memory of 4460 1852 bbnntb.exe 92 PID 1852 wrote to memory of 4460 1852 bbnntb.exe 92 PID 4460 wrote to memory of 3148 4460 fflllrr.exe 93 PID 4460 wrote to memory of 3148 4460 fflllrr.exe 93 PID 4460 wrote to memory of 3148 4460 fflllrr.exe 93 PID 3148 wrote to memory of 2584 3148 hthhtt.exe 94 PID 3148 wrote to memory of 2584 3148 hthhtt.exe 94 PID 3148 wrote to memory of 2584 3148 hthhtt.exe 94 PID 2584 wrote to memory of 4856 2584 tnnhbn.exe 95 PID 2584 wrote to memory of 4856 2584 tnnhbn.exe 95 PID 2584 wrote to memory of 4856 2584 tnnhbn.exe 95 PID 4856 wrote to memory of 4700 4856 nhnnnb.exe 96 PID 4856 wrote to memory of 4700 4856 nhnnnb.exe 96 PID 4856 wrote to memory of 4700 4856 nhnnnb.exe 96 PID 4700 wrote to memory of 2104 4700 bbnntb.exe 97 PID 4700 wrote to memory of 2104 4700 bbnntb.exe 97 PID 4700 wrote to memory of 2104 4700 bbnntb.exe 97 PID 2104 wrote to memory of 2284 2104 jvjvp.exe 98 PID 2104 wrote to memory of 2284 2104 jvjvp.exe 98 PID 2104 wrote to memory of 2284 2104 jvjvp.exe 98 PID 2284 wrote to memory of 436 2284 7rfffrr.exe 99 PID 2284 wrote to memory of 436 2284 7rfffrr.exe 99 PID 2284 wrote to memory of 436 2284 7rfffrr.exe 99 PID 436 wrote to memory of 4104 436 bbthnb.exe 100 PID 436 wrote to memory of 4104 436 bbthnb.exe 100 PID 436 wrote to memory of 4104 436 bbthnb.exe 100 PID 4104 wrote to memory of 3516 4104 dvvdd.exe 101 PID 4104 wrote to memory of 3516 4104 dvvdd.exe 101 PID 4104 wrote to memory of 3516 4104 dvvdd.exe 101 PID 3516 wrote to memory of 4500 3516 rlfffff.exe 102 PID 3516 wrote to memory of 4500 3516 rlfffff.exe 102 PID 3516 wrote to memory of 4500 3516 rlfffff.exe 102 PID 4500 wrote to memory of 3012 4500 hnttnn.exe 103 PID 4500 wrote to memory of 3012 4500 hnttnn.exe 103 PID 4500 wrote to memory of 3012 4500 hnttnn.exe 103 PID 3012 wrote to memory of 2744 3012 tnhhbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cfdca78f4dc4f9a7cbb711f38496abe86ef2f7b2471ef74d2dba7a9341b3920.exe"C:\Users\Admin\AppData\Local\Temp\2cfdca78f4dc4f9a7cbb711f38496abe86ef2f7b2471ef74d2dba7a9341b3920.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\7nnhbh.exec:\7nnhbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\vdddj.exec:\vdddj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\dvpjp.exec:\dvpjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\nthhhn.exec:\nthhhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\hhntbh.exec:\hhntbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\xxlllrx.exec:\xxlllrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\1nhhht.exec:\1nhhht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\bbnntb.exec:\bbnntb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\fflllrr.exec:\fflllrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\hthhtt.exec:\hthhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\tnnhbn.exec:\tnnhbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\nhnnnb.exec:\nhnnnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\bbnntb.exec:\bbnntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\jvjvp.exec:\jvjvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\7rfffrr.exec:\7rfffrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\bbthnb.exec:\bbthnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\dvvdd.exec:\dvvdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\rlfffff.exec:\rlfffff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\hnttnn.exec:\hnttnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\tnhhbb.exec:\tnhhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\ppddv.exec:\ppddv.exe23⤵
- Executes dropped EXE
PID:2744 -
\??\c:\9lxxxfx.exec:\9lxxxfx.exe24⤵
- Executes dropped EXE
PID:4416 -
\??\c:\xffxxff.exec:\xffxxff.exe25⤵
- Executes dropped EXE
PID:836 -
\??\c:\ntbbbt.exec:\ntbbbt.exe26⤵
- Executes dropped EXE
PID:3044 -
\??\c:\jpvdd.exec:\jpvdd.exe27⤵
- Executes dropped EXE
PID:2640 -
\??\c:\jvjjp.exec:\jvjjp.exe28⤵
- Executes dropped EXE
PID:4092 -
\??\c:\xxfllrr.exec:\xxfllrr.exe29⤵
- Executes dropped EXE
PID:976 -
\??\c:\lfllfff.exec:\lfllfff.exe30⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nthbbb.exec:\nthbbb.exe31⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vdjjj.exec:\vdjjj.exe32⤵
- Executes dropped EXE
PID:1996 -
\??\c:\frxxxxx.exec:\frxxxxx.exe33⤵
- Executes dropped EXE
PID:1468 -
\??\c:\xfllfll.exec:\xfllfll.exe34⤵
- Executes dropped EXE
PID:1904 -
\??\c:\nntttb.exec:\nntttb.exe35⤵
- Executes dropped EXE
PID:4360 -
\??\c:\btthhb.exec:\btthhb.exe36⤵
- Executes dropped EXE
PID:4192 -
\??\c:\jjvdp.exec:\jjvdp.exe37⤵
- Executes dropped EXE
PID:4112 -
\??\c:\lfxrrrl.exec:\lfxrrrl.exe38⤵
- Executes dropped EXE
PID:3652 -
\??\c:\5flllll.exec:\5flllll.exe39⤵
- Executes dropped EXE
PID:1776 -
\??\c:\nhthbh.exec:\nhthbh.exe40⤵
- Executes dropped EXE
PID:3224 -
\??\c:\jvjjj.exec:\jvjjj.exe41⤵
- Executes dropped EXE
PID:2236 -
\??\c:\7jvvd.exec:\7jvvd.exe42⤵
- Executes dropped EXE
PID:1588 -
\??\c:\llrrrrr.exec:\llrrrrr.exe43⤵
- Executes dropped EXE
PID:3948 -
\??\c:\hthbbb.exec:\hthbbb.exe44⤵
- Executes dropped EXE
PID:2508 -
\??\c:\hbtnnn.exec:\hbtnnn.exe45⤵
- Executes dropped EXE
PID:788 -
\??\c:\djjjj.exec:\djjjj.exe46⤵
- Executes dropped EXE
PID:1836 -
\??\c:\pvjpp.exec:\pvjpp.exe47⤵
- Executes dropped EXE
PID:1528 -
\??\c:\3rlflxf.exec:\3rlflxf.exe48⤵
- Executes dropped EXE
PID:1748 -
\??\c:\bbbbtt.exec:\bbbbtt.exe49⤵
- Executes dropped EXE
PID:3368 -
\??\c:\7bnttb.exec:\7bnttb.exe50⤵
- Executes dropped EXE
PID:5104 -
\??\c:\dddvv.exec:\dddvv.exe51⤵
- Executes dropped EXE
PID:1020 -
\??\c:\rffxfxl.exec:\rffxfxl.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:536 -
\??\c:\lfrllll.exec:\lfrllll.exe53⤵
- Executes dropped EXE
PID:1296 -
\??\c:\nntnhn.exec:\nntnhn.exe54⤵
- Executes dropped EXE
PID:4060 -
\??\c:\jpvpp.exec:\jpvpp.exe55⤵
- Executes dropped EXE
PID:4980 -
\??\c:\jvdvv.exec:\jvdvv.exe56⤵
- Executes dropped EXE
PID:1228 -
\??\c:\llllfff.exec:\llllfff.exe57⤵
- Executes dropped EXE
PID:888 -
\??\c:\tntnnn.exec:\tntnnn.exe58⤵
- Executes dropped EXE
PID:4448 -
\??\c:\vdjpd.exec:\vdjpd.exe59⤵
- Executes dropped EXE
PID:2444 -
\??\c:\pjppv.exec:\pjppv.exe60⤵
- Executes dropped EXE
PID:2392 -
\??\c:\tnttnt.exec:\tnttnt.exe61⤵
- Executes dropped EXE
PID:4848 -
\??\c:\9ppjp.exec:\9ppjp.exe62⤵
- Executes dropped EXE
PID:4868 -
\??\c:\xxrrrll.exec:\xxrrrll.exe63⤵
- Executes dropped EXE
PID:4636 -
\??\c:\nnhhth.exec:\nnhhth.exe64⤵
- Executes dropped EXE
PID:3508 -
\??\c:\9pdvd.exec:\9pdvd.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1460 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe66⤵PID:3536
-
\??\c:\vpppp.exec:\vpppp.exe67⤵PID:4532
-
\??\c:\pjppp.exec:\pjppp.exe68⤵PID:3700
-
\??\c:\lxlfxfr.exec:\lxlfxfr.exe69⤵PID:1260
-
\??\c:\btbhhh.exec:\btbhhh.exe70⤵PID:4996
-
\??\c:\1lrlfll.exec:\1lrlfll.exe71⤵PID:2028
-
\??\c:\9pddv.exec:\9pddv.exe72⤵PID:1852
-
\??\c:\llrlfxx.exec:\llrlfxx.exe73⤵PID:4460
-
\??\c:\bbhbbt.exec:\bbhbbt.exe74⤵PID:1052
-
\??\c:\frxfffl.exec:\frxfffl.exe75⤵PID:2584
-
\??\c:\pppdd.exec:\pppdd.exe76⤵PID:5044
-
\??\c:\5rfxfxf.exec:\5rfxfxf.exe77⤵PID:3856
-
\??\c:\5tnbbt.exec:\5tnbbt.exe78⤵
- System Location Discovery: System Language Discovery
PID:856 -
\??\c:\pdppj.exec:\pdppj.exe79⤵PID:2712
-
\??\c:\rfxrfrl.exec:\rfxrfrl.exe80⤵PID:3188
-
\??\c:\bttnnn.exec:\bttnnn.exe81⤵PID:436
-
\??\c:\tnbttt.exec:\tnbttt.exe82⤵PID:3528
-
\??\c:\dvddv.exec:\dvddv.exe83⤵PID:4188
-
\??\c:\7xxxxlr.exec:\7xxxxlr.exe84⤵PID:4548
-
\??\c:\lrflllr.exec:\lrflllr.exe85⤵PID:3408
-
\??\c:\ttbbnt.exec:\ttbbnt.exe86⤵PID:4692
-
\??\c:\jddjj.exec:\jddjj.exe87⤵PID:4488
-
\??\c:\3frrflr.exec:\3frrflr.exe88⤵PID:4472
-
\??\c:\lffffff.exec:\lffffff.exe89⤵PID:4768
-
\??\c:\bhnnnt.exec:\bhnnnt.exe90⤵PID:956
-
\??\c:\7hnntb.exec:\7hnntb.exe91⤵PID:4672
-
\??\c:\9vddp.exec:\9vddp.exe92⤵PID:4680
-
\??\c:\fxfxlll.exec:\fxfxlll.exe93⤵PID:1996
-
\??\c:\nntttb.exec:\nntttb.exe94⤵PID:4652
-
\??\c:\vdvvv.exec:\vdvvv.exe95⤵PID:3916
-
\??\c:\rxrrlll.exec:\rxrrlll.exe96⤵PID:3332
-
\??\c:\fxffxxx.exec:\fxffxxx.exe97⤵PID:4192
-
\??\c:\ntbbhn.exec:\ntbbhn.exe98⤵PID:1672
-
\??\c:\ppjjv.exec:\ppjjv.exe99⤵PID:4048
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe100⤵PID:3592
-
\??\c:\thttnt.exec:\thttnt.exe101⤵PID:2316
-
\??\c:\hhbbhn.exec:\hhbbhn.exe102⤵PID:4892
-
\??\c:\pvjjj.exec:\pvjjj.exe103⤵PID:1872
-
\??\c:\fflfxfx.exec:\fflfxfx.exe104⤵PID:548
-
\??\c:\lfrrrxx.exec:\lfrrrxx.exe105⤵PID:1048
-
\??\c:\btbttt.exec:\btbttt.exe106⤵PID:1552
-
\??\c:\pvpjj.exec:\pvpjj.exe107⤵PID:1768
-
\??\c:\xrfxfff.exec:\xrfxfff.exe108⤵PID:3944
-
\??\c:\bbhhhb.exec:\bbhhhb.exe109⤵PID:3228
-
\??\c:\ddjdv.exec:\ddjdv.exe110⤵PID:828
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe111⤵PID:1560
-
\??\c:\1xflfxx.exec:\1xflfxx.exe112⤵PID:2296
-
\??\c:\tthhnn.exec:\tthhnn.exe113⤵PID:2936
-
\??\c:\vpvpp.exec:\vpvpp.exe114⤵PID:1696
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe115⤵PID:1992
-
\??\c:\hbnnhn.exec:\hbnnhn.exe116⤵PID:1568
-
\??\c:\dvjdv.exec:\dvjdv.exe117⤵PID:4404
-
\??\c:\rlffxrr.exec:\rlffxrr.exe118⤵PID:4640
-
\??\c:\nhtnnn.exec:\nhtnnn.exe119⤵PID:3576
-
\??\c:\tbtthn.exec:\tbtthn.exe120⤵PID:2372
-
\??\c:\dpdvp.exec:\dpdvp.exe121⤵PID:2408
-
\??\c:\xxxxllr.exec:\xxxxllr.exe122⤵PID:2540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-