Analysis
-
max time kernel
120s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 20:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
546e1439dd3c867f02b266fe2ae415c503e90d8eaafd98cdbf05f7f3d0359852N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
546e1439dd3c867f02b266fe2ae415c503e90d8eaafd98cdbf05f7f3d0359852N.exe
-
Size
454KB
-
MD5
c80da34a9cac3fc8c942e1487343c3e0
-
SHA1
d07caa6f4423a008cbb0c8fc70ad88e07c12199b
-
SHA256
546e1439dd3c867f02b266fe2ae415c503e90d8eaafd98cdbf05f7f3d0359852
-
SHA512
700a99c680d3fa740350554320fbb08f13fc30db88482d9af9a3891a51b70f5748a3e7c825b1864adfd89af6cee352b987a63d8b571518ab51b59ac779ee0da5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbem:q7Tc2NYHUrAwfMp3CDm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3588-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1236-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2624-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/320-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/792-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1244-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1080-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1328-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/820-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-627-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-690-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-781-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-1041-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-1586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2444 rflfxrl.exe 4972 7tnhbb.exe 4420 pdjpj.exe 1236 9rfxffr.exe 1172 tnnnhb.exe 2732 jdjvv.exe 820 lxllfxr.exe 1156 nbbttt.exe 2352 nbnhbb.exe 5024 vjppj.exe 2468 xlxxrxx.exe 1968 btnbtt.exe 4544 pjvdd.exe 968 rrfxxxx.exe 4116 bhnnhh.exe 3000 ppvpp.exe 2244 llflxlf.exe 740 5ntbnn.exe 4056 dvvvp.exe 3048 xrxxfff.exe 2592 3ttnhh.exe 2948 pvdjd.exe 2188 lrfrrlr.exe 1328 pjvvj.exe 4596 lfffxff.exe 5020 nbttnn.exe 4448 1dddd.exe 4960 1llllrr.exe 1080 tnbtnn.exe 1244 jpdvv.exe 2036 jdddd.exe 3012 ffrrrxx.exe 3608 bbnnhh.exe 1564 djjpd.exe 792 xlfxxfx.exe 4716 bthnhn.exe 2596 pdjjj.exe 4856 jpdjp.exe 796 fxlfffx.exe 4256 bbhbnn.exe 2300 pdjjd.exe 320 fxxxrxx.exe 4236 fflxxrx.exe 3972 bbntth.exe 4052 ppddp.exe 2044 llxxxxf.exe 4424 nhhhht.exe 2840 vpvvd.exe 4904 fflxrlf.exe 220 tnttnn.exe 4972 pjppp.exe 4828 llxxxxx.exe 2552 bnbttb.exe 2360 jjpvp.exe 4976 dvjjj.exe 2088 lrfxrrl.exe 2624 hthhhh.exe 940 dvjdd.exe 1404 xfxxrxr.exe 2040 xflllrr.exe 3432 pdddj.exe 928 fxlxffr.exe 968 9lfxxfx.exe 4116 tbhtbb.exe -
resource yara_rule behavioral2/memory/3588-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1236-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2624-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/792-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1244-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/820-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-680-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3588 wrote to memory of 2444 3588 546e1439dd3c867f02b266fe2ae415c503e90d8eaafd98cdbf05f7f3d0359852N.exe 82 PID 3588 wrote to memory of 2444 3588 546e1439dd3c867f02b266fe2ae415c503e90d8eaafd98cdbf05f7f3d0359852N.exe 82 PID 3588 wrote to memory of 2444 3588 546e1439dd3c867f02b266fe2ae415c503e90d8eaafd98cdbf05f7f3d0359852N.exe 82 PID 2444 wrote to memory of 4972 2444 rflfxrl.exe 132 PID 2444 wrote to memory of 4972 2444 rflfxrl.exe 132 PID 2444 wrote to memory of 4972 2444 rflfxrl.exe 132 PID 4972 wrote to memory of 4420 4972 7tnhbb.exe 84 PID 4972 wrote to memory of 4420 4972 7tnhbb.exe 84 PID 4972 wrote to memory of 4420 4972 7tnhbb.exe 84 PID 4420 wrote to memory of 1236 4420 pdjpj.exe 85 PID 4420 wrote to memory of 1236 4420 pdjpj.exe 85 PID 4420 wrote to memory of 1236 4420 pdjpj.exe 85 PID 1236 wrote to memory of 1172 1236 9rfxffr.exe 86 PID 1236 wrote to memory of 1172 1236 9rfxffr.exe 86 PID 1236 wrote to memory of 1172 1236 9rfxffr.exe 86 PID 1172 wrote to memory of 2732 1172 tnnnhb.exe 87 PID 1172 wrote to memory of 2732 1172 tnnnhb.exe 87 PID 1172 wrote to memory of 2732 1172 tnnnhb.exe 87 PID 2732 wrote to memory of 820 2732 jdjvv.exe 88 PID 2732 wrote to memory of 820 2732 jdjvv.exe 88 PID 2732 wrote to memory of 820 2732 jdjvv.exe 88 PID 820 wrote to memory of 1156 820 lxllfxr.exe 89 PID 820 wrote to memory of 1156 820 lxllfxr.exe 89 PID 820 wrote to memory of 1156 820 lxllfxr.exe 89 PID 1156 wrote to memory of 2352 1156 nbbttt.exe 90 PID 1156 wrote to memory of 2352 1156 nbbttt.exe 90 PID 1156 wrote to memory of 2352 1156 nbbttt.exe 90 PID 2352 wrote to memory of 5024 2352 nbnhbb.exe 91 PID 2352 wrote to memory of 5024 2352 nbnhbb.exe 91 PID 2352 wrote to memory of 5024 2352 nbnhbb.exe 91 PID 5024 wrote to memory of 2468 5024 vjppj.exe 92 PID 5024 wrote to memory of 2468 5024 vjppj.exe 92 PID 5024 wrote to memory of 2468 5024 vjppj.exe 92 PID 2468 wrote to memory of 1968 2468 xlxxrxx.exe 93 PID 2468 wrote to memory of 1968 2468 xlxxrxx.exe 93 PID 2468 wrote to memory of 1968 2468 xlxxrxx.exe 93 PID 1968 wrote to memory of 4544 1968 btnbtt.exe 94 PID 1968 wrote to memory of 4544 1968 btnbtt.exe 94 PID 1968 wrote to memory of 4544 1968 btnbtt.exe 94 PID 4544 wrote to memory of 968 4544 pjvdd.exe 144 PID 4544 wrote to memory of 968 4544 pjvdd.exe 144 PID 4544 wrote to memory of 968 4544 pjvdd.exe 144 PID 968 wrote to memory of 4116 968 rrfxxxx.exe 145 PID 968 wrote to memory of 4116 968 rrfxxxx.exe 145 PID 968 wrote to memory of 4116 968 rrfxxxx.exe 145 PID 4116 wrote to memory of 3000 4116 bhnnhh.exe 97 PID 4116 wrote to memory of 3000 4116 bhnnhh.exe 97 PID 4116 wrote to memory of 3000 4116 bhnnhh.exe 97 PID 3000 wrote to memory of 2244 3000 ppvpp.exe 98 PID 3000 wrote to memory of 2244 3000 ppvpp.exe 98 PID 3000 wrote to memory of 2244 3000 ppvpp.exe 98 PID 2244 wrote to memory of 740 2244 llflxlf.exe 99 PID 2244 wrote to memory of 740 2244 llflxlf.exe 99 PID 2244 wrote to memory of 740 2244 llflxlf.exe 99 PID 740 wrote to memory of 4056 740 5ntbnn.exe 100 PID 740 wrote to memory of 4056 740 5ntbnn.exe 100 PID 740 wrote to memory of 4056 740 5ntbnn.exe 100 PID 4056 wrote to memory of 3048 4056 dvvvp.exe 101 PID 4056 wrote to memory of 3048 4056 dvvvp.exe 101 PID 4056 wrote to memory of 3048 4056 dvvvp.exe 101 PID 3048 wrote to memory of 2592 3048 xrxxfff.exe 102 PID 3048 wrote to memory of 2592 3048 xrxxfff.exe 102 PID 3048 wrote to memory of 2592 3048 xrxxfff.exe 102 PID 2592 wrote to memory of 2948 2592 3ttnhh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\546e1439dd3c867f02b266fe2ae415c503e90d8eaafd98cdbf05f7f3d0359852N.exe"C:\Users\Admin\AppData\Local\Temp\546e1439dd3c867f02b266fe2ae415c503e90d8eaafd98cdbf05f7f3d0359852N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\rflfxrl.exec:\rflfxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\7tnhbb.exec:\7tnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\pdjpj.exec:\pdjpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\9rfxffr.exec:\9rfxffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\tnnnhb.exec:\tnnnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\jdjvv.exec:\jdjvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\lxllfxr.exec:\lxllfxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\nbbttt.exec:\nbbttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\nbnhbb.exec:\nbnhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\vjppj.exec:\vjppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\xlxxrxx.exec:\xlxxrxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\btnbtt.exec:\btnbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\pjvdd.exec:\pjvdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\rrfxxxx.exec:\rrfxxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\bhnnhh.exec:\bhnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\ppvpp.exec:\ppvpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\llflxlf.exec:\llflxlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\5ntbnn.exec:\5ntbnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\dvvvp.exec:\dvvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\xrxxfff.exec:\xrxxfff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\3ttnhh.exec:\3ttnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\pvdjd.exec:\pvdjd.exe23⤵
- Executes dropped EXE
PID:2948 -
\??\c:\lrfrrlr.exec:\lrfrrlr.exe24⤵
- Executes dropped EXE
PID:2188 -
\??\c:\pjvvj.exec:\pjvvj.exe25⤵
- Executes dropped EXE
PID:1328 -
\??\c:\lfffxff.exec:\lfffxff.exe26⤵
- Executes dropped EXE
PID:4596 -
\??\c:\nbttnn.exec:\nbttnn.exe27⤵
- Executes dropped EXE
PID:5020 -
\??\c:\1dddd.exec:\1dddd.exe28⤵
- Executes dropped EXE
PID:4448 -
\??\c:\1llllrr.exec:\1llllrr.exe29⤵
- Executes dropped EXE
PID:4960 -
\??\c:\tnbtnn.exec:\tnbtnn.exe30⤵
- Executes dropped EXE
PID:1080 -
\??\c:\jpdvv.exec:\jpdvv.exe31⤵
- Executes dropped EXE
PID:1244 -
\??\c:\jdddd.exec:\jdddd.exe32⤵
- Executes dropped EXE
PID:2036 -
\??\c:\ffrrrxx.exec:\ffrrrxx.exe33⤵
- Executes dropped EXE
PID:3012 -
\??\c:\bbnnhh.exec:\bbnnhh.exe34⤵
- Executes dropped EXE
PID:3608 -
\??\c:\djjpd.exec:\djjpd.exe35⤵
- Executes dropped EXE
PID:1564 -
\??\c:\xlfxxfx.exec:\xlfxxfx.exe36⤵
- Executes dropped EXE
PID:792 -
\??\c:\bthnhn.exec:\bthnhn.exe37⤵
- Executes dropped EXE
PID:4716 -
\??\c:\pdjjj.exec:\pdjjj.exe38⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jpdjp.exec:\jpdjp.exe39⤵
- Executes dropped EXE
PID:4856 -
\??\c:\fxlfffx.exec:\fxlfffx.exe40⤵
- Executes dropped EXE
PID:796 -
\??\c:\bbhbnn.exec:\bbhbnn.exe41⤵
- Executes dropped EXE
PID:4256 -
\??\c:\pdjjd.exec:\pdjjd.exe42⤵
- Executes dropped EXE
PID:2300 -
\??\c:\fxxxrxx.exec:\fxxxrxx.exe43⤵
- Executes dropped EXE
PID:320 -
\??\c:\fflxxrx.exec:\fflxxrx.exe44⤵
- Executes dropped EXE
PID:4236 -
\??\c:\bbntth.exec:\bbntth.exe45⤵
- Executes dropped EXE
PID:3972 -
\??\c:\ppddp.exec:\ppddp.exe46⤵
- Executes dropped EXE
PID:4052 -
\??\c:\llxxxxf.exec:\llxxxxf.exe47⤵
- Executes dropped EXE
PID:2044 -
\??\c:\nhhhht.exec:\nhhhht.exe48⤵
- Executes dropped EXE
PID:4424 -
\??\c:\vpvvd.exec:\vpvvd.exe49⤵
- Executes dropped EXE
PID:2840 -
\??\c:\fflxrlf.exec:\fflxrlf.exe50⤵
- Executes dropped EXE
PID:4904 -
\??\c:\tnttnn.exec:\tnttnn.exe51⤵
- Executes dropped EXE
PID:220 -
\??\c:\pjppp.exec:\pjppp.exe52⤵
- Executes dropped EXE
PID:4972 -
\??\c:\llxxxxx.exec:\llxxxxx.exe53⤵
- Executes dropped EXE
PID:4828 -
\??\c:\bnbttb.exec:\bnbttb.exe54⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jjpvp.exec:\jjpvp.exe55⤵
- Executes dropped EXE
PID:2360 -
\??\c:\dvjjj.exec:\dvjjj.exe56⤵
- Executes dropped EXE
PID:4976 -
\??\c:\lrfxrrl.exec:\lrfxrrl.exe57⤵
- Executes dropped EXE
PID:2088 -
\??\c:\hthhhh.exec:\hthhhh.exe58⤵
- Executes dropped EXE
PID:2624 -
\??\c:\dvjdd.exec:\dvjdd.exe59⤵
- Executes dropped EXE
PID:940 -
\??\c:\xfxxrxr.exec:\xfxxrxr.exe60⤵
- Executes dropped EXE
PID:1404 -
\??\c:\xflllrr.exec:\xflllrr.exe61⤵
- Executes dropped EXE
PID:2040 -
\??\c:\pdddj.exec:\pdddj.exe62⤵
- Executes dropped EXE
PID:3432 -
\??\c:\fxlxffr.exec:\fxlxffr.exe63⤵
- Executes dropped EXE
PID:928 -
\??\c:\9lfxxfx.exec:\9lfxxfx.exe64⤵
- Executes dropped EXE
PID:968 -
\??\c:\tbhtbb.exec:\tbhtbb.exe65⤵
- Executes dropped EXE
PID:4116 -
\??\c:\pjdvp.exec:\pjdvp.exe66⤵PID:5012
-
\??\c:\1xlxrrr.exec:\1xlxrrr.exe67⤵PID:4456
-
\??\c:\tnttth.exec:\tnttth.exe68⤵
- System Location Discovery: System Language Discovery
PID:1092 -
\??\c:\jdjjd.exec:\jdjjd.exe69⤵PID:512
-
\??\c:\9bhnnn.exec:\9bhnnn.exe70⤵PID:4648
-
\??\c:\vpvpp.exec:\vpvpp.exe71⤵PID:3324
-
\??\c:\5rxrllr.exec:\5rxrllr.exe72⤵PID:2224
-
\??\c:\tbbbtt.exec:\tbbbtt.exe73⤵PID:1996
-
\??\c:\jpvjp.exec:\jpvjp.exe74⤵PID:1300
-
\??\c:\xllfxrr.exec:\xllfxrr.exe75⤵PID:1504
-
\??\c:\bnnhbt.exec:\bnnhbt.exe76⤵PID:5020
-
\??\c:\vvpjp.exec:\vvpjp.exe77⤵PID:944
-
\??\c:\7xrlfrl.exec:\7xrlfrl.exe78⤵PID:2376
-
\??\c:\dpvpp.exec:\dpvpp.exe79⤵PID:4112
-
\??\c:\5xrfxll.exec:\5xrfxll.exe80⤵PID:2716
-
\??\c:\hnbbbt.exec:\hnbbbt.exe81⤵PID:3480
-
\??\c:\frfffxx.exec:\frfffxx.exe82⤵PID:1096
-
\??\c:\fxffxff.exec:\fxffxff.exe83⤵PID:5112
-
\??\c:\xfffffx.exec:\xfffffx.exe84⤵PID:3016
-
\??\c:\bhbbbb.exec:\bhbbbb.exe85⤵PID:1068
-
\??\c:\vdvdd.exec:\vdvdd.exe86⤵PID:2596
-
\??\c:\vdvdv.exec:\vdvdv.exe87⤵PID:4856
-
\??\c:\dpddp.exec:\dpddp.exe88⤵PID:1592
-
\??\c:\xlllflf.exec:\xlllflf.exe89⤵PID:2112
-
\??\c:\nhhhtn.exec:\nhhhtn.exe90⤵PID:4496
-
\??\c:\rxlffff.exec:\rxlffff.exe91⤵PID:3620
-
\??\c:\bbnhnh.exec:\bbnhnh.exe92⤵PID:4292
-
\??\c:\3rrrlrr.exec:\3rrrlrr.exe93⤵PID:4408
-
\??\c:\ttnbhh.exec:\ttnbhh.exe94⤵PID:3664
-
\??\c:\1xrlflf.exec:\1xrlflf.exe95⤵PID:2576
-
\??\c:\nbnhhh.exec:\nbnhhh.exe96⤵PID:4540
-
\??\c:\hbbtnn.exec:\hbbtnn.exe97⤵PID:2840
-
\??\c:\jjddp.exec:\jjddp.exe98⤵PID:4868
-
\??\c:\vvvvv.exec:\vvvvv.exe99⤵PID:4620
-
\??\c:\xxffrxl.exec:\xxffrxl.exe100⤵PID:1360
-
\??\c:\ttnnbh.exec:\ttnnbh.exe101⤵PID:208
-
\??\c:\jddpp.exec:\jddpp.exe102⤵PID:4828
-
\??\c:\9xxffrl.exec:\9xxffrl.exe103⤵PID:4572
-
\??\c:\tnttnn.exec:\tnttnn.exe104⤵PID:3540
-
\??\c:\nntttb.exec:\nntttb.exe105⤵PID:760
-
\??\c:\lrxrfxr.exec:\lrxrfxr.exe106⤵PID:2732
-
\??\c:\lllllrr.exec:\lllllrr.exe107⤵PID:3688
-
\??\c:\tntttn.exec:\tntttn.exe108⤵PID:2936
-
\??\c:\pvvvv.exec:\pvvvv.exe109⤵PID:3124
-
\??\c:\3xxrlrl.exec:\3xxrlrl.exe110⤵PID:2512
-
\??\c:\rxfxxxr.exec:\rxfxxxr.exe111⤵PID:4324
-
\??\c:\hhtbbb.exec:\hhtbbb.exe112⤵PID:2352
-
\??\c:\jppjp.exec:\jppjp.exe113⤵PID:1544
-
\??\c:\jpdvp.exec:\jpdvp.exe114⤵PID:1168
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe115⤵PID:3188
-
\??\c:\htbbbb.exec:\htbbbb.exe116⤵PID:2604
-
\??\c:\jjvjd.exec:\jjvjd.exe117⤵PID:2040
-
\??\c:\flffxxx.exec:\flffxxx.exe118⤵PID:4400
-
\??\c:\bbbbth.exec:\bbbbth.exe119⤵PID:632
-
\??\c:\dvddv.exec:\dvddv.exe120⤵PID:1184
-
\??\c:\djjdp.exec:\djjdp.exe121⤵PID:2844
-
\??\c:\9fffxfx.exec:\9fffxfx.exe122⤵PID:968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-