Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 20:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e2141fccba45c56f96bba970b2023703604d2e9225479116dd7c7864b7c5d732N.exe
Resource
win7-20240729-en
7 signatures
120 seconds
General
-
Target
e2141fccba45c56f96bba970b2023703604d2e9225479116dd7c7864b7c5d732N.exe
-
Size
454KB
-
MD5
239124d408e5a805c3897886f2266c20
-
SHA1
90e7ec9080d3957f94256c388f89e4409511d02e
-
SHA256
e2141fccba45c56f96bba970b2023703604d2e9225479116dd7c7864b7c5d732
-
SHA512
a77fa70ce2aa3e39c66198e36c2ff797efa9b242b3f64e7b8f8cdd6b3291263e5e431d5e9e9398c4cb2d839c57aa44a9339211a43c87eb1476510424b68161ca
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeM:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2016-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/956-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3288-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-845-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-1774-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-1781-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 436 djjjj.exe 2172 nnnnhn.exe 4520 ppppj.exe 4920 1fxrlfl.exe 1660 ddddj.exe 3256 djjjd.exe 3012 htnbbh.exe 1048 hhnnnh.exe 1160 xrxrrll.exe 4872 thnhhn.exe 1772 7lrlllf.exe 4984 hhhhnn.exe 2972 vdjdd.exe 1792 7bhbbb.exe 4960 fxxxflr.exe 4548 xlxrlff.exe 2924 pddvp.exe 4464 bhnnnh.exe 4696 7xfflrf.exe 32 1dpdj.exe 3788 xfrllll.exe 3488 ffrrrrl.exe 1736 7xfllll.exe 960 3hhbbh.exe 956 xfllxxl.exe 3320 ttbbhh.exe 1876 7thhhh.exe 4068 7bnhtt.exe 4956 fxfxrrx.exe 4676 7pvpp.exe 4488 3bbbnt.exe 880 ddjjp.exe 2928 rffxrrl.exe 4028 thtttt.exe 2720 vdvvd.exe 1952 ntbbnn.exe 4204 5dvdd.exe 1424 djpjd.exe 2200 lffxxrl.exe 908 nhnbtt.exe 408 3nnhhb.exe 4076 xrxrlll.exe 2316 hbbtnb.exe 1892 hhbbhn.exe 1204 dppjp.exe 3432 rllflll.exe 3172 bbnnbb.exe 2360 pjppj.exe 4112 xflfxrl.exe 2232 hbhhbb.exe 940 djddv.exe 5000 7flfxxx.exe 4332 htnnhh.exe 4592 dpddd.exe 5044 7xffflr.exe 3324 1bhhhn.exe 2084 ppvvd.exe 4776 jjvjd.exe 1216 3xllxll.exe 3012 tnnnhh.exe 5108 hntttt.exe 3480 jdjdd.exe 3964 rrxrlll.exe 1376 dpddd.exe -
resource yara_rule behavioral2/memory/2016-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/32-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/956-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3288-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1164-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4196-594-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2016 wrote to memory of 436 2016 e2141fccba45c56f96bba970b2023703604d2e9225479116dd7c7864b7c5d732N.exe 83 PID 2016 wrote to memory of 436 2016 e2141fccba45c56f96bba970b2023703604d2e9225479116dd7c7864b7c5d732N.exe 83 PID 2016 wrote to memory of 436 2016 e2141fccba45c56f96bba970b2023703604d2e9225479116dd7c7864b7c5d732N.exe 83 PID 436 wrote to memory of 2172 436 djjjj.exe 84 PID 436 wrote to memory of 2172 436 djjjj.exe 84 PID 436 wrote to memory of 2172 436 djjjj.exe 84 PID 2172 wrote to memory of 4520 2172 nnnnhn.exe 85 PID 2172 wrote to memory of 4520 2172 nnnnhn.exe 85 PID 2172 wrote to memory of 4520 2172 nnnnhn.exe 85 PID 4520 wrote to memory of 4920 4520 ppppj.exe 86 PID 4520 wrote to memory of 4920 4520 ppppj.exe 86 PID 4520 wrote to memory of 4920 4520 ppppj.exe 86 PID 4920 wrote to memory of 1660 4920 1fxrlfl.exe 87 PID 4920 wrote to memory of 1660 4920 1fxrlfl.exe 87 PID 4920 wrote to memory of 1660 4920 1fxrlfl.exe 87 PID 1660 wrote to memory of 3256 1660 ddddj.exe 88 PID 1660 wrote to memory of 3256 1660 ddddj.exe 88 PID 1660 wrote to memory of 3256 1660 ddddj.exe 88 PID 3256 wrote to memory of 3012 3256 djjjd.exe 89 PID 3256 wrote to memory of 3012 3256 djjjd.exe 89 PID 3256 wrote to memory of 3012 3256 djjjd.exe 89 PID 3012 wrote to memory of 1048 3012 htnbbh.exe 90 PID 3012 wrote to memory of 1048 3012 htnbbh.exe 90 PID 3012 wrote to memory of 1048 3012 htnbbh.exe 90 PID 1048 wrote to memory of 1160 1048 hhnnnh.exe 91 PID 1048 wrote to memory of 1160 1048 hhnnnh.exe 91 PID 1048 wrote to memory of 1160 1048 hhnnnh.exe 91 PID 1160 wrote to memory of 4872 1160 xrxrrll.exe 92 PID 1160 wrote to memory of 4872 1160 xrxrrll.exe 92 PID 1160 wrote to memory of 4872 1160 xrxrrll.exe 92 PID 4872 wrote to memory of 1772 4872 thnhhn.exe 93 PID 4872 wrote to memory of 1772 4872 thnhhn.exe 93 PID 4872 wrote to memory of 1772 4872 thnhhn.exe 93 PID 1772 wrote to memory of 4984 1772 7lrlllf.exe 94 PID 1772 wrote to memory of 4984 1772 7lrlllf.exe 94 PID 1772 wrote to memory of 4984 1772 7lrlllf.exe 94 PID 4984 wrote to memory of 2972 4984 hhhhnn.exe 95 PID 4984 wrote to memory of 2972 4984 hhhhnn.exe 95 PID 4984 wrote to memory of 2972 4984 hhhhnn.exe 95 PID 2972 wrote to memory of 1792 2972 vdjdd.exe 96 PID 2972 wrote to memory of 1792 2972 vdjdd.exe 96 PID 2972 wrote to memory of 1792 2972 vdjdd.exe 96 PID 1792 wrote to memory of 4960 1792 7bhbbb.exe 97 PID 1792 wrote to memory of 4960 1792 7bhbbb.exe 97 PID 1792 wrote to memory of 4960 1792 7bhbbb.exe 97 PID 4960 wrote to memory of 4548 4960 fxxxflr.exe 98 PID 4960 wrote to memory of 4548 4960 fxxxflr.exe 98 PID 4960 wrote to memory of 4548 4960 fxxxflr.exe 98 PID 4548 wrote to memory of 2924 4548 xlxrlff.exe 99 PID 4548 wrote to memory of 2924 4548 xlxrlff.exe 99 PID 4548 wrote to memory of 2924 4548 xlxrlff.exe 99 PID 2924 wrote to memory of 4464 2924 pddvp.exe 100 PID 2924 wrote to memory of 4464 2924 pddvp.exe 100 PID 2924 wrote to memory of 4464 2924 pddvp.exe 100 PID 4464 wrote to memory of 4696 4464 bhnnnh.exe 101 PID 4464 wrote to memory of 4696 4464 bhnnnh.exe 101 PID 4464 wrote to memory of 4696 4464 bhnnnh.exe 101 PID 4696 wrote to memory of 32 4696 7xfflrf.exe 102 PID 4696 wrote to memory of 32 4696 7xfflrf.exe 102 PID 4696 wrote to memory of 32 4696 7xfflrf.exe 102 PID 32 wrote to memory of 3788 32 1dpdj.exe 103 PID 32 wrote to memory of 3788 32 1dpdj.exe 103 PID 32 wrote to memory of 3788 32 1dpdj.exe 103 PID 3788 wrote to memory of 3488 3788 xfrllll.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2141fccba45c56f96bba970b2023703604d2e9225479116dd7c7864b7c5d732N.exe"C:\Users\Admin\AppData\Local\Temp\e2141fccba45c56f96bba970b2023703604d2e9225479116dd7c7864b7c5d732N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\djjjj.exec:\djjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\nnnnhn.exec:\nnnnhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\ppppj.exec:\ppppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\1fxrlfl.exec:\1fxrlfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\ddddj.exec:\ddddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\djjjd.exec:\djjjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\htnbbh.exec:\htnbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\hhnnnh.exec:\hhnnnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\xrxrrll.exec:\xrxrrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\thnhhn.exec:\thnhhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\7lrlllf.exec:\7lrlllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\hhhhnn.exec:\hhhhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\vdjdd.exec:\vdjdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\7bhbbb.exec:\7bhbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\fxxxflr.exec:\fxxxflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\xlxrlff.exec:\xlxrlff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\pddvp.exec:\pddvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\bhnnnh.exec:\bhnnnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\7xfflrf.exec:\7xfflrf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\1dpdj.exec:\1dpdj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\xfrllll.exec:\xfrllll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\ffrrrrl.exec:\ffrrrrl.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3488 -
\??\c:\7xfllll.exec:\7xfllll.exe24⤵
- Executes dropped EXE
PID:1736 -
\??\c:\3hhbbh.exec:\3hhbbh.exe25⤵
- Executes dropped EXE
PID:960 -
\??\c:\xfllxxl.exec:\xfllxxl.exe26⤵
- Executes dropped EXE
PID:956 -
\??\c:\ttbbhh.exec:\ttbbhh.exe27⤵
- Executes dropped EXE
PID:3320 -
\??\c:\7thhhh.exec:\7thhhh.exe28⤵
- Executes dropped EXE
PID:1876 -
\??\c:\7bnhtt.exec:\7bnhtt.exe29⤵
- Executes dropped EXE
PID:4068 -
\??\c:\fxfxrrx.exec:\fxfxrrx.exe30⤵
- Executes dropped EXE
PID:4956 -
\??\c:\7pvpp.exec:\7pvpp.exe31⤵
- Executes dropped EXE
PID:4676 -
\??\c:\3bbbnt.exec:\3bbbnt.exe32⤵
- Executes dropped EXE
PID:4488 -
\??\c:\ddjjp.exec:\ddjjp.exe33⤵
- Executes dropped EXE
PID:880 -
\??\c:\rffxrrl.exec:\rffxrrl.exe34⤵
- Executes dropped EXE
PID:2928 -
\??\c:\thtttt.exec:\thtttt.exe35⤵
- Executes dropped EXE
PID:4028 -
\??\c:\vdvvd.exec:\vdvvd.exe36⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ntbbnn.exec:\ntbbnn.exe37⤵
- Executes dropped EXE
PID:1952 -
\??\c:\5dvdd.exec:\5dvdd.exe38⤵
- Executes dropped EXE
PID:4204 -
\??\c:\djpjd.exec:\djpjd.exe39⤵
- Executes dropped EXE
PID:1424 -
\??\c:\lffxxrl.exec:\lffxxrl.exe40⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nhnbtt.exec:\nhnbtt.exe41⤵
- Executes dropped EXE
PID:908 -
\??\c:\3nnhhb.exec:\3nnhhb.exe42⤵
- Executes dropped EXE
PID:408 -
\??\c:\xrxrlll.exec:\xrxrlll.exe43⤵
- Executes dropped EXE
PID:4076 -
\??\c:\hbbtnb.exec:\hbbtnb.exe44⤵
- Executes dropped EXE
PID:2316 -
\??\c:\hhbbhn.exec:\hhbbhn.exe45⤵
- Executes dropped EXE
PID:1892 -
\??\c:\dppjp.exec:\dppjp.exe46⤵
- Executes dropped EXE
PID:1204 -
\??\c:\rllflll.exec:\rllflll.exe47⤵
- Executes dropped EXE
PID:3432 -
\??\c:\bbnnbb.exec:\bbnnbb.exe48⤵
- Executes dropped EXE
PID:3172 -
\??\c:\pjppj.exec:\pjppj.exe49⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xflfxrl.exec:\xflfxrl.exe50⤵
- Executes dropped EXE
PID:4112 -
\??\c:\hbhhbb.exec:\hbhhbb.exe51⤵
- Executes dropped EXE
PID:2232 -
\??\c:\djddv.exec:\djddv.exe52⤵
- Executes dropped EXE
PID:940 -
\??\c:\7flfxxx.exec:\7flfxxx.exe53⤵
- Executes dropped EXE
PID:5000 -
\??\c:\htnnhh.exec:\htnnhh.exe54⤵
- Executes dropped EXE
PID:4332 -
\??\c:\dpddd.exec:\dpddd.exe55⤵
- Executes dropped EXE
PID:4592 -
\??\c:\7xffflr.exec:\7xffflr.exe56⤵
- Executes dropped EXE
PID:5044 -
\??\c:\1bhhhn.exec:\1bhhhn.exe57⤵
- Executes dropped EXE
PID:3324 -
\??\c:\ppvvd.exec:\ppvvd.exe58⤵
- Executes dropped EXE
PID:2084 -
\??\c:\jjvjd.exec:\jjvjd.exe59⤵
- Executes dropped EXE
PID:4776 -
\??\c:\3xllxll.exec:\3xllxll.exe60⤵
- Executes dropped EXE
PID:1216 -
\??\c:\tnnnhh.exec:\tnnnhh.exe61⤵
- Executes dropped EXE
PID:3012 -
\??\c:\hntttt.exec:\hntttt.exe62⤵
- Executes dropped EXE
PID:5108 -
\??\c:\jdjdd.exec:\jdjdd.exe63⤵
- Executes dropped EXE
PID:3480 -
\??\c:\rrxrlll.exec:\rrxrlll.exe64⤵
- Executes dropped EXE
PID:3964 -
\??\c:\dpddd.exec:\dpddd.exe65⤵
- Executes dropped EXE
PID:1376 -
\??\c:\9pddd.exec:\9pddd.exe66⤵PID:3128
-
\??\c:\llxxrrr.exec:\llxxrrr.exe67⤵PID:2376
-
\??\c:\bbnhbb.exec:\bbnhbb.exe68⤵PID:4916
-
\??\c:\ddpjj.exec:\ddpjj.exe69⤵PID:3104
-
\??\c:\xlfffff.exec:\xlfffff.exe70⤵PID:2880
-
\??\c:\tnbhht.exec:\tnbhht.exe71⤵PID:536
-
\??\c:\jvpjv.exec:\jvpjv.exe72⤵PID:4652
-
\??\c:\xfffflf.exec:\xfffflf.exe73⤵PID:3000
-
\??\c:\hnnnnn.exec:\hnnnnn.exe74⤵PID:4572
-
\??\c:\hbnnhh.exec:\hbnnhh.exe75⤵PID:3600
-
\??\c:\3dddv.exec:\3dddv.exe76⤵PID:2456
-
\??\c:\hnnttn.exec:\hnnttn.exe77⤵PID:4596
-
\??\c:\tnbbbb.exec:\tnbbbb.exe78⤵PID:4524
-
\??\c:\jjjjd.exec:\jjjjd.exe79⤵PID:4864
-
\??\c:\frflxrx.exec:\frflxrx.exe80⤵PID:3260
-
\??\c:\btnhnn.exec:\btnhnn.exe81⤵PID:3488
-
\??\c:\rlrlffx.exec:\rlrlffx.exe82⤵PID:2300
-
\??\c:\rrllffx.exec:\rrllffx.exe83⤵PID:3288
-
\??\c:\7tbttt.exec:\7tbttt.exe84⤵PID:4064
-
\??\c:\vpvpv.exec:\vpvpv.exe85⤵PID:3504
-
\??\c:\xfllffx.exec:\xfllffx.exe86⤵PID:1712
-
\??\c:\bttnhh.exec:\bttnhh.exe87⤵PID:2856
-
\??\c:\dddvv.exec:\dddvv.exe88⤵PID:4644
-
\??\c:\xlrlffl.exec:\xlrlffl.exe89⤵PID:5072
-
\??\c:\llrrrff.exec:\llrrrff.exe90⤵PID:4964
-
\??\c:\nhtbbh.exec:\nhtbbh.exe91⤵PID:3500
-
\??\c:\vpvpp.exec:\vpvpp.exe92⤵PID:4676
-
\??\c:\lfxxffl.exec:\lfxxffl.exe93⤵PID:876
-
\??\c:\bnbnth.exec:\bnbnth.exe94⤵PID:4296
-
\??\c:\pjdvp.exec:\pjdvp.exe95⤵PID:3728
-
\??\c:\fxxrlll.exec:\fxxrlll.exe96⤵PID:5056
-
\??\c:\htbbbh.exec:\htbbbh.exe97⤵PID:4924
-
\??\c:\9djdd.exec:\9djdd.exe98⤵PID:2220
-
\??\c:\pjvpj.exec:\pjvpj.exe99⤵PID:1852
-
\??\c:\1rxxrff.exec:\1rxxrff.exe100⤵PID:4204
-
\??\c:\3bhhhh.exec:\3bhhhh.exe101⤵PID:1424
-
\??\c:\pjppp.exec:\pjppp.exe102⤵PID:2200
-
\??\c:\9rrxrrr.exec:\9rrxrrr.exe103⤵PID:4268
-
\??\c:\nhhhbb.exec:\nhhhbb.exe104⤵PID:408
-
\??\c:\vdjdd.exec:\vdjdd.exe105⤵PID:3472
-
\??\c:\7jppj.exec:\7jppj.exe106⤵PID:1076
-
\??\c:\nnnhnn.exec:\nnnhnn.exe107⤵PID:2868
-
\??\c:\5htntt.exec:\5htntt.exe108⤵PID:2212
-
\??\c:\1lllflf.exec:\1lllflf.exe109⤵PID:4344
-
\??\c:\xrllfff.exec:\xrllfff.exe110⤵PID:5008
-
\??\c:\hbnntt.exec:\hbnntt.exe111⤵PID:2292
-
\??\c:\jvjjj.exec:\jvjjj.exe112⤵PID:4112
-
\??\c:\lxlfxxf.exec:\lxlfxxf.exe113⤵PID:2132
-
\??\c:\thnhhh.exec:\thnhhh.exe114⤵PID:2172
-
\??\c:\ddjdv.exec:\ddjdv.exe115⤵PID:2764
-
\??\c:\rlfxfff.exec:\rlfxfff.exe116⤵PID:4528
-
\??\c:\hbtntt.exec:\hbtntt.exe117⤵PID:1000
-
\??\c:\vvjdv.exec:\vvjdv.exe118⤵PID:3352
-
\??\c:\fffxrll.exec:\fffxrll.exe119⤵PID:3184
-
\??\c:\hhntnn.exec:\hhntnn.exe120⤵PID:1164
-
\??\c:\bnbtbt.exec:\bnbtbt.exe121⤵PID:616
-
\??\c:\rlrlffx.exec:\rlrlffx.exe122⤵PID:2084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-