Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2024, 20:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1978cd7f48af420d15f520cdfa9d443b363afd3dc4f05d8ab4abb38c098e8f76.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
1978cd7f48af420d15f520cdfa9d443b363afd3dc4f05d8ab4abb38c098e8f76.exe
-
Size
454KB
-
MD5
cd85dba726b3975f6586cfb7a5001734
-
SHA1
01e7194421d130bf64c54fd0b2aabf62a5591e97
-
SHA256
1978cd7f48af420d15f520cdfa9d443b363afd3dc4f05d8ab4abb38c098e8f76
-
SHA512
2b9821672d98550b3a2fa15869c983afc71c50d580c8c6e4eafd8d105f3b16b8d52b6a505389d005fbda53e2cb81e856ce1fda9723e2abfe83cfa212fcc0f553
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeH:q7Tc2NYHUrAwfMp3CDH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/436-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/244-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1136-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1384-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3408-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/712-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/856-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-683-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-774-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-1242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2748-1258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-1513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-1604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3392 3nhbbt.exe 2952 fxfxrrl.exe 4812 bhhthh.exe 4904 lfffxrr.exe 1700 9hhbtn.exe 3964 tnhbtn.exe 4820 ddpvd.exe 1992 9llfrrl.exe 1500 lfffxxr.exe 2708 thnhbb.exe 4308 jvdvj.exe 3260 3rxlrrl.exe 2676 5thbhn.exe 3228 vvvvp.exe 1960 djvjv.exe 916 1frlffx.exe 1952 9pvpp.exe 2760 pjddp.exe 712 3rrlffx.exe 4896 7nnnbb.exe 3768 vvvpp.exe 3240 vpppj.exe 2252 xllffxr.exe 3268 hbbtbn.exe 3576 jvppd.exe 2076 7rlfffx.exe 3132 tnhbbn.exe 4304 3hhbtt.exe 848 xrxffrr.exe 4440 1hhhhh.exe 3796 vvjjd.exe 1964 9pjdv.exe 3500 lxrrfff.exe 4088 htbtnn.exe 1432 dvdvp.exe 4272 xxrfxrf.exe 1600 tnnhhh.exe 1636 9rxrlll.exe 3328 bnhbnn.exe 2632 jvjvv.exe 2396 5pvpd.exe 1124 xxllxxx.exe 920 bttthn.exe 2748 vvvvv.exe 4036 vpvpj.exe 400 xflxrlf.exe 2884 hhbnht.exe 2244 bbhbnt.exe 244 djdvp.exe 1900 lxfrfxr.exe 2388 5rrffxf.exe 4524 btnhnn.exe 2796 tbbnhb.exe 3108 vdjvj.exe 2984 xlrllfl.exe 628 hbbhbb.exe 516 3bbbtt.exe 2136 jjpjp.exe 4212 xfxrxxx.exe 1136 xfxrfxx.exe 4324 btbbth.exe 3016 3htttb.exe 1992 jppdp.exe 2180 3rfxllx.exe -
resource yara_rule behavioral2/memory/3392-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/244-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1136-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1384-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3408-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/848-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2252-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/712-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/856-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1568-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-593-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 436 wrote to memory of 3392 436 1978cd7f48af420d15f520cdfa9d443b363afd3dc4f05d8ab4abb38c098e8f76.exe 82 PID 436 wrote to memory of 3392 436 1978cd7f48af420d15f520cdfa9d443b363afd3dc4f05d8ab4abb38c098e8f76.exe 82 PID 436 wrote to memory of 3392 436 1978cd7f48af420d15f520cdfa9d443b363afd3dc4f05d8ab4abb38c098e8f76.exe 82 PID 3392 wrote to memory of 2952 3392 3nhbbt.exe 83 PID 3392 wrote to memory of 2952 3392 3nhbbt.exe 83 PID 3392 wrote to memory of 2952 3392 3nhbbt.exe 83 PID 2952 wrote to memory of 4812 2952 fxfxrrl.exe 84 PID 2952 wrote to memory of 4812 2952 fxfxrrl.exe 84 PID 2952 wrote to memory of 4812 2952 fxfxrrl.exe 84 PID 4812 wrote to memory of 4904 4812 bhhthh.exe 85 PID 4812 wrote to memory of 4904 4812 bhhthh.exe 85 PID 4812 wrote to memory of 4904 4812 bhhthh.exe 85 PID 4904 wrote to memory of 1700 4904 lfffxrr.exe 86 PID 4904 wrote to memory of 1700 4904 lfffxrr.exe 86 PID 4904 wrote to memory of 1700 4904 lfffxrr.exe 86 PID 1700 wrote to memory of 3964 1700 9hhbtn.exe 87 PID 1700 wrote to memory of 3964 1700 9hhbtn.exe 87 PID 1700 wrote to memory of 3964 1700 9hhbtn.exe 87 PID 3964 wrote to memory of 4820 3964 tnhbtn.exe 88 PID 3964 wrote to memory of 4820 3964 tnhbtn.exe 88 PID 3964 wrote to memory of 4820 3964 tnhbtn.exe 88 PID 4820 wrote to memory of 1992 4820 ddpvd.exe 89 PID 4820 wrote to memory of 1992 4820 ddpvd.exe 89 PID 4820 wrote to memory of 1992 4820 ddpvd.exe 89 PID 1992 wrote to memory of 1500 1992 9llfrrl.exe 90 PID 1992 wrote to memory of 1500 1992 9llfrrl.exe 90 PID 1992 wrote to memory of 1500 1992 9llfrrl.exe 90 PID 1500 wrote to memory of 2708 1500 lfffxxr.exe 91 PID 1500 wrote to memory of 2708 1500 lfffxxr.exe 91 PID 1500 wrote to memory of 2708 1500 lfffxxr.exe 91 PID 2708 wrote to memory of 4308 2708 thnhbb.exe 92 PID 2708 wrote to memory of 4308 2708 thnhbb.exe 92 PID 2708 wrote to memory of 4308 2708 thnhbb.exe 92 PID 4308 wrote to memory of 3260 4308 jvdvj.exe 93 PID 4308 wrote to memory of 3260 4308 jvdvj.exe 93 PID 4308 wrote to memory of 3260 4308 jvdvj.exe 93 PID 3260 wrote to memory of 2676 3260 3rxlrrl.exe 94 PID 3260 wrote to memory of 2676 3260 3rxlrrl.exe 94 PID 3260 wrote to memory of 2676 3260 3rxlrrl.exe 94 PID 2676 wrote to memory of 3228 2676 5thbhn.exe 95 PID 2676 wrote to memory of 3228 2676 5thbhn.exe 95 PID 2676 wrote to memory of 3228 2676 5thbhn.exe 95 PID 3228 wrote to memory of 1960 3228 vvvvp.exe 96 PID 3228 wrote to memory of 1960 3228 vvvvp.exe 96 PID 3228 wrote to memory of 1960 3228 vvvvp.exe 96 PID 1960 wrote to memory of 916 1960 djvjv.exe 97 PID 1960 wrote to memory of 916 1960 djvjv.exe 97 PID 1960 wrote to memory of 916 1960 djvjv.exe 97 PID 916 wrote to memory of 1952 916 1frlffx.exe 98 PID 916 wrote to memory of 1952 916 1frlffx.exe 98 PID 916 wrote to memory of 1952 916 1frlffx.exe 98 PID 1952 wrote to memory of 2760 1952 9pvpp.exe 99 PID 1952 wrote to memory of 2760 1952 9pvpp.exe 99 PID 1952 wrote to memory of 2760 1952 9pvpp.exe 99 PID 2760 wrote to memory of 712 2760 pjddp.exe 100 PID 2760 wrote to memory of 712 2760 pjddp.exe 100 PID 2760 wrote to memory of 712 2760 pjddp.exe 100 PID 712 wrote to memory of 4896 712 3rrlffx.exe 101 PID 712 wrote to memory of 4896 712 3rrlffx.exe 101 PID 712 wrote to memory of 4896 712 3rrlffx.exe 101 PID 4896 wrote to memory of 3768 4896 7nnnbb.exe 102 PID 4896 wrote to memory of 3768 4896 7nnnbb.exe 102 PID 4896 wrote to memory of 3768 4896 7nnnbb.exe 102 PID 3768 wrote to memory of 3240 3768 vvvpp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\1978cd7f48af420d15f520cdfa9d443b363afd3dc4f05d8ab4abb38c098e8f76.exe"C:\Users\Admin\AppData\Local\Temp\1978cd7f48af420d15f520cdfa9d443b363afd3dc4f05d8ab4abb38c098e8f76.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\3nhbbt.exec:\3nhbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\bhhthh.exec:\bhhthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\lfffxrr.exec:\lfffxrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\9hhbtn.exec:\9hhbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\tnhbtn.exec:\tnhbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\ddpvd.exec:\ddpvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\9llfrrl.exec:\9llfrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\lfffxxr.exec:\lfffxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\thnhbb.exec:\thnhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\jvdvj.exec:\jvdvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\3rxlrrl.exec:\3rxlrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\5thbhn.exec:\5thbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\vvvvp.exec:\vvvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\djvjv.exec:\djvjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\1frlffx.exec:\1frlffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\9pvpp.exec:\9pvpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\pjddp.exec:\pjddp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\3rrlffx.exec:\3rrlffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
\??\c:\7nnnbb.exec:\7nnnbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\vvvpp.exec:\vvvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\vpppj.exec:\vpppj.exe23⤵
- Executes dropped EXE
PID:3240 -
\??\c:\xllffxr.exec:\xllffxr.exe24⤵
- Executes dropped EXE
PID:2252 -
\??\c:\hbbtbn.exec:\hbbtbn.exe25⤵
- Executes dropped EXE
PID:3268 -
\??\c:\jvppd.exec:\jvppd.exe26⤵
- Executes dropped EXE
PID:3576 -
\??\c:\7rlfffx.exec:\7rlfffx.exe27⤵
- Executes dropped EXE
PID:2076 -
\??\c:\tnhbbn.exec:\tnhbbn.exe28⤵
- Executes dropped EXE
PID:3132 -
\??\c:\3hhbtt.exec:\3hhbtt.exe29⤵
- Executes dropped EXE
PID:4304 -
\??\c:\xrxffrr.exec:\xrxffrr.exe30⤵
- Executes dropped EXE
PID:848 -
\??\c:\1hhhhh.exec:\1hhhhh.exe31⤵
- Executes dropped EXE
PID:4440 -
\??\c:\vvjjd.exec:\vvjjd.exe32⤵
- Executes dropped EXE
PID:3796 -
\??\c:\9pjdv.exec:\9pjdv.exe33⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lxrrfff.exec:\lxrrfff.exe34⤵
- Executes dropped EXE
PID:3500 -
\??\c:\htbtnn.exec:\htbtnn.exe35⤵
- Executes dropped EXE
PID:4088 -
\??\c:\dvdvp.exec:\dvdvp.exe36⤵
- Executes dropped EXE
PID:1432 -
\??\c:\xxrfxrf.exec:\xxrfxrf.exe37⤵
- Executes dropped EXE
PID:4272 -
\??\c:\tnnhhh.exec:\tnnhhh.exe38⤵
- Executes dropped EXE
PID:1600 -
\??\c:\9rxrlll.exec:\9rxrlll.exe39⤵
- Executes dropped EXE
PID:1636 -
\??\c:\bnhbnn.exec:\bnhbnn.exe40⤵
- Executes dropped EXE
PID:3328 -
\??\c:\jvjvv.exec:\jvjvv.exe41⤵
- Executes dropped EXE
PID:2632 -
\??\c:\5pvpd.exec:\5pvpd.exe42⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xxllxxx.exec:\xxllxxx.exe43⤵
- Executes dropped EXE
PID:1124 -
\??\c:\bttthn.exec:\bttthn.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:920 -
\??\c:\vvvvv.exec:\vvvvv.exe45⤵
- Executes dropped EXE
PID:2748 -
\??\c:\vpvpj.exec:\vpvpj.exe46⤵
- Executes dropped EXE
PID:4036 -
\??\c:\xflxrlf.exec:\xflxrlf.exe47⤵
- Executes dropped EXE
PID:400 -
\??\c:\hhbnht.exec:\hhbnht.exe48⤵
- Executes dropped EXE
PID:2884 -
\??\c:\bbhbnt.exec:\bbhbnt.exe49⤵
- Executes dropped EXE
PID:2244 -
\??\c:\djdvp.exec:\djdvp.exe50⤵
- Executes dropped EXE
PID:244 -
\??\c:\lxfrfxr.exec:\lxfrfxr.exe51⤵
- Executes dropped EXE
PID:1900 -
\??\c:\5rrffxf.exec:\5rrffxf.exe52⤵
- Executes dropped EXE
PID:2388 -
\??\c:\btnhnn.exec:\btnhnn.exe53⤵
- Executes dropped EXE
PID:4524 -
\??\c:\tbbnhb.exec:\tbbnhb.exe54⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vdjvj.exec:\vdjvj.exe55⤵
- Executes dropped EXE
PID:3108 -
\??\c:\xlrllfl.exec:\xlrllfl.exe56⤵
- Executes dropped EXE
PID:2984 -
\??\c:\hbbhbb.exec:\hbbhbb.exe57⤵
- Executes dropped EXE
PID:628 -
\??\c:\3bbbtt.exec:\3bbbtt.exe58⤵
- Executes dropped EXE
PID:516 -
\??\c:\jjpjp.exec:\jjpjp.exe59⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xfxrxxx.exec:\xfxrxxx.exe60⤵
- Executes dropped EXE
PID:4212 -
\??\c:\xfxrfxx.exec:\xfxrfxx.exe61⤵
- Executes dropped EXE
PID:1136 -
\??\c:\btbbth.exec:\btbbth.exe62⤵
- Executes dropped EXE
PID:4324 -
\??\c:\3htttb.exec:\3htttb.exe63⤵
- Executes dropped EXE
PID:3016 -
\??\c:\jppdp.exec:\jppdp.exe64⤵
- Executes dropped EXE
PID:1992 -
\??\c:\3rfxllx.exec:\3rfxllx.exe65⤵
- Executes dropped EXE
PID:2180 -
\??\c:\tnnhnh.exec:\tnnhnh.exe66⤵PID:3408
-
\??\c:\hbtnhh.exec:\hbtnhh.exe67⤵PID:1228
-
\??\c:\dpjdd.exec:\dpjdd.exe68⤵PID:5064
-
\??\c:\dvdpj.exec:\dvdpj.exe69⤵PID:1384
-
\??\c:\9rrlffx.exec:\9rrlffx.exe70⤵PID:3896
-
\??\c:\5nnthb.exec:\5nnthb.exe71⤵PID:4612
-
\??\c:\ddjvj.exec:\ddjvj.exe72⤵PID:3752
-
\??\c:\dppdp.exec:\dppdp.exe73⤵PID:1176
-
\??\c:\lxxrrrl.exec:\lxxrrrl.exe74⤵PID:4412
-
\??\c:\rllxrlf.exec:\rllxrlf.exe75⤵PID:1840
-
\??\c:\tbtnhh.exec:\tbtnhh.exe76⤵PID:1188
-
\??\c:\ppvjv.exec:\ppvjv.exe77⤵PID:1380
-
\??\c:\jpddj.exec:\jpddj.exe78⤵PID:1932
-
\??\c:\xxxrlll.exec:\xxxrlll.exe79⤵PID:2688
-
\??\c:\nnnbbt.exec:\nnnbbt.exe80⤵PID:3936
-
\??\c:\bttbth.exec:\bttbth.exe81⤵PID:4044
-
\??\c:\pjpjj.exec:\pjpjj.exe82⤵PID:3240
-
\??\c:\1pdvv.exec:\1pdvv.exe83⤵PID:4364
-
\??\c:\frlxlfr.exec:\frlxlfr.exe84⤵PID:3664
-
\??\c:\7nnhhb.exec:\7nnhhb.exe85⤵
- System Location Discovery: System Language Discovery
PID:1608 -
\??\c:\bttnhh.exec:\bttnhh.exe86⤵PID:2704
-
\??\c:\jddvd.exec:\jddvd.exe87⤵PID:804
-
\??\c:\vvppp.exec:\vvppp.exe88⤵PID:456
-
\??\c:\fxrrfff.exec:\fxrrfff.exe89⤵PID:3920
-
\??\c:\1nnnbt.exec:\1nnnbt.exe90⤵PID:4304
-
\??\c:\bntnhh.exec:\bntnhh.exe91⤵PID:3344
-
\??\c:\ppppd.exec:\ppppd.exe92⤵PID:4440
-
\??\c:\7fffxxr.exec:\7fffxxr.exe93⤵PID:3288
-
\??\c:\llfrllf.exec:\llfrllf.exe94⤵PID:1964
-
\??\c:\nbtbnb.exec:\nbtbnb.exe95⤵PID:1068
-
\??\c:\pddpd.exec:\pddpd.exe96⤵PID:2440
-
\??\c:\pvdpj.exec:\pvdpj.exe97⤵PID:856
-
\??\c:\rffrrll.exec:\rffrrll.exe98⤵PID:1432
-
\??\c:\bhhtnh.exec:\bhhtnh.exe99⤵PID:4780
-
\??\c:\vpvdv.exec:\vpvdv.exe100⤵PID:432
-
\??\c:\pvdvp.exec:\pvdvp.exe101⤵PID:4568
-
\??\c:\lfffxxx.exec:\lfffxxx.exe102⤵PID:448
-
\??\c:\bbnnbt.exec:\bbnnbt.exe103⤵PID:2464
-
\??\c:\tnnhtt.exec:\tnnhtt.exe104⤵PID:864
-
\??\c:\jdjjd.exec:\jdjjd.exe105⤵PID:2620
-
\??\c:\7llffll.exec:\7llffll.exe106⤵PID:2584
-
\??\c:\9vpdd.exec:\9vpdd.exe107⤵PID:1612
-
\??\c:\lfllxxx.exec:\lfllxxx.exe108⤵PID:3064
-
\??\c:\hbttnn.exec:\hbttnn.exe109⤵PID:3364
-
\??\c:\3vvvj.exec:\3vvvj.exe110⤵PID:3996
-
\??\c:\bnhthb.exec:\bnhthb.exe111⤵PID:2556
-
\??\c:\dvvpd.exec:\dvvpd.exe112⤵PID:4944
-
\??\c:\rxfxrxf.exec:\rxfxrxf.exe113⤵PID:4956
-
\??\c:\3xxrlll.exec:\3xxrlll.exe114⤵PID:5092
-
\??\c:\jdpjv.exec:\jdpjv.exe115⤵PID:1576
-
\??\c:\djjvp.exec:\djjvp.exe116⤵PID:1900
-
\??\c:\xrfxfrx.exec:\xrfxfrx.exe117⤵
- System Location Discovery: System Language Discovery
PID:2388 -
\??\c:\1rrrllf.exec:\1rrrllf.exe118⤵PID:2904
-
\??\c:\bthhtt.exec:\bthhtt.exe119⤵PID:436
-
\??\c:\lfflrxf.exec:\lfflrxf.exe120⤵PID:4552
-
\??\c:\rrxrxrx.exec:\rrxrxrx.exe121⤵PID:3624
-
\??\c:\hhnhbt.exec:\hhnhbt.exe122⤵PID:2692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-