Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2024, 21:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3210c3918d8a2e5314503f462ae9452330b2b7eb91c70f7ffab4e5a0d00f9569.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
3210c3918d8a2e5314503f462ae9452330b2b7eb91c70f7ffab4e5a0d00f9569.exe
-
Size
454KB
-
MD5
03db74dc8c7e7bdbe52708f3c26456dd
-
SHA1
4a93d11b06893b905e96550d5371e7d2e4e39c2e
-
SHA256
3210c3918d8a2e5314503f462ae9452330b2b7eb91c70f7ffab4e5a0d00f9569
-
SHA512
51c1e8fae242707ed0ff46a97b1de176e10cf4e61b104e5af6dde84c3ab96f412d60ade0980bdf924f0b4147bf26eca8cc5b86ec22443e441f33a2479bf3da80
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbebs:q7Tc2NYHUrAwfMp3CDbs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2168-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/992-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/652-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4244-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2480-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/768-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3380-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/332-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3788-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/744-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-627-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-691-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-914-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-1499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-1680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2320 nnbtnh.exe 5020 xfrlxrr.exe 3652 thnhbb.exe 2736 jjpdj.exe 628 thnhhn.exe 3776 9lfrffr.exe 1088 jvjvp.exe 1092 5tbtbb.exe 2880 xfxrrxx.exe 992 dvdpp.exe 4940 pvdvv.exe 5052 vpjjp.exe 1444 tnhhbb.exe 3280 dpvpj.exe 652 ffxrffr.exe 220 7bhtbh.exe 4244 9xfrfff.exe 1620 flrflrr.exe 2764 dvpjp.exe 1916 3ppvv.exe 3300 dpvjd.exe 4800 lrflrrx.exe 4952 lfrrrrr.exe 2172 bhtnhb.exe 1196 ddjjv.exe 3932 pjvpj.exe 3124 9flfxxr.exe 2480 xrlfxxr.exe 2240 hthbhb.exe 3600 jdjvp.exe 1352 vpjdj.exe 1204 pdpjd.exe 4024 jdjdd.exe 1828 fxxlffx.exe 1812 rllxrlr.exe 2800 vppdv.exe 4360 dvvpp.exe 1688 frrllll.exe 1576 nbhbhn.exe 4608 vdddp.exe 768 jddvj.exe 3236 fxlfxrl.exe 4544 nhhtnh.exe 4496 tntnhn.exe 1820 vpvdp.exe 4348 flrllfx.exe 4912 bntnnh.exe 2484 jddvv.exe 3484 rfxrrrx.exe 2104 nnnbtb.exe 2056 dpvvp.exe 2592 lxfxrlf.exe 636 nbbbbn.exe 2596 vpvjd.exe 2832 djvjd.exe 4988 xflffxl.exe 3656 3nnbtt.exe 3604 3jjvp.exe 3616 1rxlxfx.exe 1304 9nnbbb.exe 3776 vdvvp.exe 1612 vjpdv.exe 1424 lfrfxrl.exe 2000 3xxrrrl.exe -
resource yara_rule behavioral2/memory/2168-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/992-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/652-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3300-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/768-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3380-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/332-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3788-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/744-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-914-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2320 2168 3210c3918d8a2e5314503f462ae9452330b2b7eb91c70f7ffab4e5a0d00f9569.exe 82 PID 2168 wrote to memory of 2320 2168 3210c3918d8a2e5314503f462ae9452330b2b7eb91c70f7ffab4e5a0d00f9569.exe 82 PID 2168 wrote to memory of 2320 2168 3210c3918d8a2e5314503f462ae9452330b2b7eb91c70f7ffab4e5a0d00f9569.exe 82 PID 2320 wrote to memory of 5020 2320 nnbtnh.exe 83 PID 2320 wrote to memory of 5020 2320 nnbtnh.exe 83 PID 2320 wrote to memory of 5020 2320 nnbtnh.exe 83 PID 5020 wrote to memory of 3652 5020 xfrlxrr.exe 84 PID 5020 wrote to memory of 3652 5020 xfrlxrr.exe 84 PID 5020 wrote to memory of 3652 5020 xfrlxrr.exe 84 PID 3652 wrote to memory of 2736 3652 thnhbb.exe 85 PID 3652 wrote to memory of 2736 3652 thnhbb.exe 85 PID 3652 wrote to memory of 2736 3652 thnhbb.exe 85 PID 2736 wrote to memory of 628 2736 jjpdj.exe 86 PID 2736 wrote to memory of 628 2736 jjpdj.exe 86 PID 2736 wrote to memory of 628 2736 jjpdj.exe 86 PID 628 wrote to memory of 3776 628 thnhhn.exe 87 PID 628 wrote to memory of 3776 628 thnhhn.exe 87 PID 628 wrote to memory of 3776 628 thnhhn.exe 87 PID 3776 wrote to memory of 1088 3776 9lfrffr.exe 88 PID 3776 wrote to memory of 1088 3776 9lfrffr.exe 88 PID 3776 wrote to memory of 1088 3776 9lfrffr.exe 88 PID 1088 wrote to memory of 1092 1088 jvjvp.exe 89 PID 1088 wrote to memory of 1092 1088 jvjvp.exe 89 PID 1088 wrote to memory of 1092 1088 jvjvp.exe 89 PID 1092 wrote to memory of 2880 1092 5tbtbb.exe 90 PID 1092 wrote to memory of 2880 1092 5tbtbb.exe 90 PID 1092 wrote to memory of 2880 1092 5tbtbb.exe 90 PID 2880 wrote to memory of 992 2880 xfxrrxx.exe 91 PID 2880 wrote to memory of 992 2880 xfxrrxx.exe 91 PID 2880 wrote to memory of 992 2880 xfxrrxx.exe 91 PID 992 wrote to memory of 4940 992 dvdpp.exe 92 PID 992 wrote to memory of 4940 992 dvdpp.exe 92 PID 992 wrote to memory of 4940 992 dvdpp.exe 92 PID 4940 wrote to memory of 5052 4940 pvdvv.exe 93 PID 4940 wrote to memory of 5052 4940 pvdvv.exe 93 PID 4940 wrote to memory of 5052 4940 pvdvv.exe 93 PID 5052 wrote to memory of 1444 5052 vpjjp.exe 94 PID 5052 wrote to memory of 1444 5052 vpjjp.exe 94 PID 5052 wrote to memory of 1444 5052 vpjjp.exe 94 PID 1444 wrote to memory of 3280 1444 tnhhbb.exe 95 PID 1444 wrote to memory of 3280 1444 tnhhbb.exe 95 PID 1444 wrote to memory of 3280 1444 tnhhbb.exe 95 PID 3280 wrote to memory of 652 3280 dpvpj.exe 96 PID 3280 wrote to memory of 652 3280 dpvpj.exe 96 PID 3280 wrote to memory of 652 3280 dpvpj.exe 96 PID 652 wrote to memory of 220 652 ffxrffr.exe 97 PID 652 wrote to memory of 220 652 ffxrffr.exe 97 PID 652 wrote to memory of 220 652 ffxrffr.exe 97 PID 220 wrote to memory of 4244 220 7bhtbh.exe 98 PID 220 wrote to memory of 4244 220 7bhtbh.exe 98 PID 220 wrote to memory of 4244 220 7bhtbh.exe 98 PID 4244 wrote to memory of 1620 4244 9xfrfff.exe 99 PID 4244 wrote to memory of 1620 4244 9xfrfff.exe 99 PID 4244 wrote to memory of 1620 4244 9xfrfff.exe 99 PID 1620 wrote to memory of 2764 1620 flrflrr.exe 100 PID 1620 wrote to memory of 2764 1620 flrflrr.exe 100 PID 1620 wrote to memory of 2764 1620 flrflrr.exe 100 PID 2764 wrote to memory of 1916 2764 dvpjp.exe 101 PID 2764 wrote to memory of 1916 2764 dvpjp.exe 101 PID 2764 wrote to memory of 1916 2764 dvpjp.exe 101 PID 1916 wrote to memory of 3300 1916 3ppvv.exe 102 PID 1916 wrote to memory of 3300 1916 3ppvv.exe 102 PID 1916 wrote to memory of 3300 1916 3ppvv.exe 102 PID 3300 wrote to memory of 4800 3300 dpvjd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\3210c3918d8a2e5314503f462ae9452330b2b7eb91c70f7ffab4e5a0d00f9569.exe"C:\Users\Admin\AppData\Local\Temp\3210c3918d8a2e5314503f462ae9452330b2b7eb91c70f7ffab4e5a0d00f9569.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\nnbtnh.exec:\nnbtnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\xfrlxrr.exec:\xfrlxrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\thnhbb.exec:\thnhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\jjpdj.exec:\jjpdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\thnhhn.exec:\thnhhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\9lfrffr.exec:\9lfrffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\jvjvp.exec:\jvjvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\5tbtbb.exec:\5tbtbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\xfxrrxx.exec:\xfxrrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\dvdpp.exec:\dvdpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\pvdvv.exec:\pvdvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\vpjjp.exec:\vpjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\tnhhbb.exec:\tnhhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\dpvpj.exec:\dpvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\ffxrffr.exec:\ffxrffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\7bhtbh.exec:\7bhtbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\9xfrfff.exec:\9xfrfff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\flrflrr.exec:\flrflrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\dvpjp.exec:\dvpjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\3ppvv.exec:\3ppvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\dpvjd.exec:\dpvjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\lrflrrx.exec:\lrflrrx.exe23⤵
- Executes dropped EXE
PID:4800 -
\??\c:\lfrrrrr.exec:\lfrrrrr.exe24⤵
- Executes dropped EXE
PID:4952 -
\??\c:\bhtnhb.exec:\bhtnhb.exe25⤵
- Executes dropped EXE
PID:2172 -
\??\c:\ddjjv.exec:\ddjjv.exe26⤵
- Executes dropped EXE
PID:1196 -
\??\c:\pjvpj.exec:\pjvpj.exe27⤵
- Executes dropped EXE
PID:3932 -
\??\c:\9flfxxr.exec:\9flfxxr.exe28⤵
- Executes dropped EXE
PID:3124 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe29⤵
- Executes dropped EXE
PID:2480 -
\??\c:\hthbhb.exec:\hthbhb.exe30⤵
- Executes dropped EXE
PID:2240 -
\??\c:\jdjvp.exec:\jdjvp.exe31⤵
- Executes dropped EXE
PID:3600 -
\??\c:\vpjdj.exec:\vpjdj.exe32⤵
- Executes dropped EXE
PID:1352 -
\??\c:\pdpjd.exec:\pdpjd.exe33⤵
- Executes dropped EXE
PID:1204 -
\??\c:\jdjdd.exec:\jdjdd.exe34⤵
- Executes dropped EXE
PID:4024 -
\??\c:\fxxlffx.exec:\fxxlffx.exe35⤵
- Executes dropped EXE
PID:1828 -
\??\c:\rllxrlr.exec:\rllxrlr.exe36⤵
- Executes dropped EXE
PID:1812 -
\??\c:\vppdv.exec:\vppdv.exe37⤵
- Executes dropped EXE
PID:2800 -
\??\c:\dvvpp.exec:\dvvpp.exe38⤵
- Executes dropped EXE
PID:4360 -
\??\c:\frrllll.exec:\frrllll.exe39⤵
- Executes dropped EXE
PID:1688 -
\??\c:\nbhbhn.exec:\nbhbhn.exe40⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vdddp.exec:\vdddp.exe41⤵
- Executes dropped EXE
PID:4608 -
\??\c:\jddvj.exec:\jddvj.exe42⤵
- Executes dropped EXE
PID:768 -
\??\c:\fxlfxrl.exec:\fxlfxrl.exe43⤵
- Executes dropped EXE
PID:3236 -
\??\c:\nhhtnh.exec:\nhhtnh.exe44⤵
- Executes dropped EXE
PID:4544 -
\??\c:\tntnhn.exec:\tntnhn.exe45⤵
- Executes dropped EXE
PID:4496 -
\??\c:\vpvdp.exec:\vpvdp.exe46⤵
- Executes dropped EXE
PID:1820 -
\??\c:\flrllfx.exec:\flrllfx.exe47⤵
- Executes dropped EXE
PID:4348 -
\??\c:\bntnnh.exec:\bntnnh.exe48⤵
- Executes dropped EXE
PID:4912 -
\??\c:\jddvv.exec:\jddvv.exe49⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rfxrrrx.exec:\rfxrrrx.exe50⤵
- Executes dropped EXE
PID:3484 -
\??\c:\nnnbtb.exec:\nnnbtb.exe51⤵
- Executes dropped EXE
PID:2104 -
\??\c:\dpvvp.exec:\dpvvp.exe52⤵
- Executes dropped EXE
PID:2056 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe53⤵
- Executes dropped EXE
PID:2592 -
\??\c:\nbbbbn.exec:\nbbbbn.exe54⤵
- Executes dropped EXE
PID:636 -
\??\c:\vpvjd.exec:\vpvjd.exe55⤵
- Executes dropped EXE
PID:2596 -
\??\c:\djvjd.exec:\djvjd.exe56⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xflffxl.exec:\xflffxl.exe57⤵
- Executes dropped EXE
PID:4988 -
\??\c:\3nnbtt.exec:\3nnbtt.exe58⤵
- Executes dropped EXE
PID:3656 -
\??\c:\3jjvp.exec:\3jjvp.exe59⤵
- Executes dropped EXE
PID:3604 -
\??\c:\1rxlxfx.exec:\1rxlxfx.exe60⤵
- Executes dropped EXE
PID:3616 -
\??\c:\9nnbbb.exec:\9nnbbb.exe61⤵
- Executes dropped EXE
PID:1304 -
\??\c:\vdvvp.exec:\vdvvp.exe62⤵
- Executes dropped EXE
PID:3776 -
\??\c:\vjpdv.exec:\vjpdv.exe63⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lfrfxrl.exec:\lfrfxrl.exe64⤵
- Executes dropped EXE
PID:1424 -
\??\c:\3xxrrrl.exec:\3xxrrrl.exe65⤵
- Executes dropped EXE
PID:2000 -
\??\c:\1hhbbt.exec:\1hhbbt.exe66⤵PID:2880
-
\??\c:\7pvjd.exec:\7pvjd.exe67⤵PID:348
-
\??\c:\9rrlrrl.exec:\9rrlrrl.exe68⤵PID:1680
-
\??\c:\llxrlff.exec:\llxrlff.exe69⤵PID:2932
-
\??\c:\9tthbb.exec:\9tthbb.exe70⤵PID:2352
-
\??\c:\dvvpd.exec:\dvvpd.exe71⤵PID:4204
-
\??\c:\rlrfrrl.exec:\rlrfrrl.exe72⤵PID:396
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe73⤵PID:4968
-
\??\c:\7tttnn.exec:\7tttnn.exe74⤵PID:3488
-
\??\c:\1jjdv.exec:\1jjdv.exe75⤵PID:3568
-
\??\c:\5rlfxxl.exec:\5rlfxxl.exe76⤵PID:4356
-
\??\c:\httnhh.exec:\httnhh.exe77⤵PID:1620
-
\??\c:\hbbnhb.exec:\hbbnhb.exe78⤵PID:1708
-
\??\c:\3vpjd.exec:\3vpjd.exe79⤵PID:1700
-
\??\c:\lflfxrl.exec:\lflfxrl.exe80⤵PID:812
-
\??\c:\7nntnb.exec:\7nntnb.exe81⤵PID:3096
-
\??\c:\hbtnhh.exec:\hbtnhh.exe82⤵PID:2636
-
\??\c:\dppjd.exec:\dppjd.exe83⤵PID:4576
-
\??\c:\5rlfxxr.exec:\5rlfxxr.exe84⤵PID:3548
-
\??\c:\5lxlrrl.exec:\5lxlrrl.exe85⤵PID:620
-
\??\c:\bntnnh.exec:\bntnnh.exe86⤵PID:1100
-
\??\c:\pppdv.exec:\pppdv.exe87⤵PID:920
-
\??\c:\xllfrlf.exec:\xllfrlf.exe88⤵PID:748
-
\??\c:\nbhbnn.exec:\nbhbnn.exe89⤵PID:3380
-
\??\c:\bbnhnn.exec:\bbnhnn.exe90⤵PID:1764
-
\??\c:\vpjdv.exec:\vpjdv.exe91⤵PID:2480
-
\??\c:\xxlxfxf.exec:\xxlxfxf.exe92⤵PID:332
-
\??\c:\nbbtnh.exec:\nbbtnh.exe93⤵PID:1640
-
\??\c:\thtttb.exec:\thtttb.exe94⤵PID:3884
-
\??\c:\vvddj.exec:\vvddj.exe95⤵PID:1624
-
\??\c:\rffxrlf.exec:\rffxrlf.exe96⤵PID:3788
-
\??\c:\tthbbb.exec:\tthbbb.exe97⤵PID:1756
-
\??\c:\jpvpj.exec:\jpvpj.exe98⤵PID:1876
-
\??\c:\rxfxxxr.exec:\rxfxxxr.exe99⤵PID:3452
-
\??\c:\tbhbbh.exec:\tbhbbh.exe100⤵PID:2884
-
\??\c:\thnhbb.exec:\thnhbb.exe101⤵PID:4484
-
\??\c:\dpddd.exec:\dpddd.exe102⤵PID:4412
-
\??\c:\ffrlrrx.exec:\ffrlrrx.exe103⤵PID:1792
-
\??\c:\nhthnt.exec:\nhthnt.exe104⤵PID:1576
-
\??\c:\3nbtnn.exec:\3nbtnn.exe105⤵PID:2576
-
\??\c:\jdvpj.exec:\jdvpj.exe106⤵PID:768
-
\??\c:\rflxrlf.exec:\rflxrlf.exe107⤵PID:3236
-
\??\c:\bbthtb.exec:\bbthtb.exe108⤵PID:1932
-
\??\c:\hnbtbb.exec:\hnbtbb.exe109⤵PID:3916
-
\??\c:\9jddd.exec:\9jddd.exe110⤵PID:4460
-
\??\c:\rlrlflf.exec:\rlrlflf.exe111⤵PID:464
-
\??\c:\bthnnn.exec:\bthnnn.exe112⤵PID:3048
-
\??\c:\1hhtnn.exec:\1hhtnn.exe113⤵PID:2040
-
\??\c:\1vvdd.exec:\1vvdd.exe114⤵PID:4504
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe115⤵PID:3660
-
\??\c:\rfllrrx.exec:\rfllrrx.exe116⤵PID:3060
-
\??\c:\9tnnhh.exec:\9tnnhh.exe117⤵PID:2620
-
\??\c:\jdvjj.exec:\jdvjj.exe118⤵PID:4828
-
\??\c:\lrrxrll.exec:\lrrxrll.exe119⤵PID:4628
-
\??\c:\thnhtt.exec:\thnhtt.exe120⤵PID:4068
-
\??\c:\hbnbht.exec:\hbnbht.exe121⤵PID:1732
-
\??\c:\jjvjp.exec:\jjvjp.exe122⤵PID:664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-