Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
87dfff389a97b2d52f921e849deffb54d70bdc572274d81b047c9cae89ada1c7N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
87dfff389a97b2d52f921e849deffb54d70bdc572274d81b047c9cae89ada1c7N.exe
-
Size
454KB
-
MD5
cce11e888e24fb2b5fcad09d624f10d0
-
SHA1
4dd12cc2a9e7b20e687f490889b02e3d1d15014b
-
SHA256
87dfff389a97b2d52f921e849deffb54d70bdc572274d81b047c9cae89ada1c7
-
SHA512
80ea6af43a410ca0d19063ddba57b1aef0247280c7929f7beab22c6d0a305bad8adc01ff5e373d9fa81b965c81f339964d2b964e716b98643e25a37ee551d525
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeq:q7Tc2NYHUrAwfMp3CDq
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/556-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3880-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3752-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-675-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/656-716-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-994-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3052 hbbbtn.exe 5068 xrfxrlf.exe 3088 tbnbtn.exe 964 hnnthn.exe 4864 xxxrrrl.exe 3704 tnnbnh.exe 4468 1htnhh.exe 3748 vdjjj.exe 1832 pjjpj.exe 1488 rflfxfr.exe 4816 7jpjj.exe 1392 7tttnn.exe 4416 nnbtbt.exe 4896 vjvdd.exe 4620 thbhhh.exe 1956 pdjvp.exe 4368 1pvjd.exe 5080 5xxrfff.exe 736 pdpjv.exe 2372 thbhtn.exe 528 dvvpj.exe 3108 lrxrlfx.exe 1868 hhtnbb.exe 1716 vvpjj.exe 4324 lllrxrf.exe 4652 hnnnhb.exe 5108 vddvp.exe 3880 5vvpj.exe 2184 3rrlxxl.exe 3176 ttttnn.exe 1800 djpjd.exe 3752 lrxllfx.exe 5092 lfffxfx.exe 4392 5llxrxr.exe 4300 hthhnn.exe 828 jvjvp.exe 3080 xfrlffx.exe 1008 rllfxrl.exe 2940 tthbtn.exe 592 jpjpd.exe 668 rrrrllf.exe 4040 rrllrxf.exe 60 nhbnhb.exe 2564 jjjdd.exe 3940 xxxrfll.exe 1656 3nnhhh.exe 3976 bbbttn.exe 4088 1lfxxrr.exe 2744 xxxrlff.exe 4520 tthbhh.exe 5032 3vvpj.exe 3452 lllfxrl.exe 2972 bbtbnt.exe 3052 5tbtnn.exe 4328 dvvjj.exe 3348 xxllffr.exe 3648 ntnnnn.exe 2848 nhhbbb.exe 2352 ppjvp.exe 4272 xllfrxr.exe 2832 7bbbtt.exe 3056 1djjp.exe 4468 xrrfxrl.exe 2292 nhhbbb.exe -
resource yara_rule behavioral2/memory/556-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3704-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/828-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/656-716-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 556 wrote to memory of 3052 556 87dfff389a97b2d52f921e849deffb54d70bdc572274d81b047c9cae89ada1c7N.exe 82 PID 556 wrote to memory of 3052 556 87dfff389a97b2d52f921e849deffb54d70bdc572274d81b047c9cae89ada1c7N.exe 82 PID 556 wrote to memory of 3052 556 87dfff389a97b2d52f921e849deffb54d70bdc572274d81b047c9cae89ada1c7N.exe 82 PID 3052 wrote to memory of 5068 3052 hbbbtn.exe 83 PID 3052 wrote to memory of 5068 3052 hbbbtn.exe 83 PID 3052 wrote to memory of 5068 3052 hbbbtn.exe 83 PID 5068 wrote to memory of 3088 5068 xrfxrlf.exe 84 PID 5068 wrote to memory of 3088 5068 xrfxrlf.exe 84 PID 5068 wrote to memory of 3088 5068 xrfxrlf.exe 84 PID 3088 wrote to memory of 964 3088 tbnbtn.exe 85 PID 3088 wrote to memory of 964 3088 tbnbtn.exe 85 PID 3088 wrote to memory of 964 3088 tbnbtn.exe 85 PID 964 wrote to memory of 4864 964 hnnthn.exe 86 PID 964 wrote to memory of 4864 964 hnnthn.exe 86 PID 964 wrote to memory of 4864 964 hnnthn.exe 86 PID 4864 wrote to memory of 3704 4864 xxxrrrl.exe 87 PID 4864 wrote to memory of 3704 4864 xxxrrrl.exe 87 PID 4864 wrote to memory of 3704 4864 xxxrrrl.exe 87 PID 3704 wrote to memory of 4468 3704 tnnbnh.exe 88 PID 3704 wrote to memory of 4468 3704 tnnbnh.exe 88 PID 3704 wrote to memory of 4468 3704 tnnbnh.exe 88 PID 4468 wrote to memory of 3748 4468 1htnhh.exe 89 PID 4468 wrote to memory of 3748 4468 1htnhh.exe 89 PID 4468 wrote to memory of 3748 4468 1htnhh.exe 89 PID 3748 wrote to memory of 1832 3748 vdjjj.exe 90 PID 3748 wrote to memory of 1832 3748 vdjjj.exe 90 PID 3748 wrote to memory of 1832 3748 vdjjj.exe 90 PID 1832 wrote to memory of 1488 1832 pjjpj.exe 91 PID 1832 wrote to memory of 1488 1832 pjjpj.exe 91 PID 1832 wrote to memory of 1488 1832 pjjpj.exe 91 PID 1488 wrote to memory of 4816 1488 rflfxfr.exe 92 PID 1488 wrote to memory of 4816 1488 rflfxfr.exe 92 PID 1488 wrote to memory of 4816 1488 rflfxfr.exe 92 PID 4816 wrote to memory of 1392 4816 7jpjj.exe 93 PID 4816 wrote to memory of 1392 4816 7jpjj.exe 93 PID 4816 wrote to memory of 1392 4816 7jpjj.exe 93 PID 1392 wrote to memory of 4416 1392 7tttnn.exe 94 PID 1392 wrote to memory of 4416 1392 7tttnn.exe 94 PID 1392 wrote to memory of 4416 1392 7tttnn.exe 94 PID 4416 wrote to memory of 4896 4416 nnbtbt.exe 95 PID 4416 wrote to memory of 4896 4416 nnbtbt.exe 95 PID 4416 wrote to memory of 4896 4416 nnbtbt.exe 95 PID 4896 wrote to memory of 4620 4896 vjvdd.exe 96 PID 4896 wrote to memory of 4620 4896 vjvdd.exe 96 PID 4896 wrote to memory of 4620 4896 vjvdd.exe 96 PID 4620 wrote to memory of 1956 4620 thbhhh.exe 97 PID 4620 wrote to memory of 1956 4620 thbhhh.exe 97 PID 4620 wrote to memory of 1956 4620 thbhhh.exe 97 PID 1956 wrote to memory of 4368 1956 pdjvp.exe 98 PID 1956 wrote to memory of 4368 1956 pdjvp.exe 98 PID 1956 wrote to memory of 4368 1956 pdjvp.exe 98 PID 4368 wrote to memory of 5080 4368 1pvjd.exe 99 PID 4368 wrote to memory of 5080 4368 1pvjd.exe 99 PID 4368 wrote to memory of 5080 4368 1pvjd.exe 99 PID 5080 wrote to memory of 736 5080 5xxrfff.exe 100 PID 5080 wrote to memory of 736 5080 5xxrfff.exe 100 PID 5080 wrote to memory of 736 5080 5xxrfff.exe 100 PID 736 wrote to memory of 2372 736 pdpjv.exe 101 PID 736 wrote to memory of 2372 736 pdpjv.exe 101 PID 736 wrote to memory of 2372 736 pdpjv.exe 101 PID 2372 wrote to memory of 528 2372 thbhtn.exe 102 PID 2372 wrote to memory of 528 2372 thbhtn.exe 102 PID 2372 wrote to memory of 528 2372 thbhtn.exe 102 PID 528 wrote to memory of 3108 528 dvvpj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\87dfff389a97b2d52f921e849deffb54d70bdc572274d81b047c9cae89ada1c7N.exe"C:\Users\Admin\AppData\Local\Temp\87dfff389a97b2d52f921e849deffb54d70bdc572274d81b047c9cae89ada1c7N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\hbbbtn.exec:\hbbbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\xrfxrlf.exec:\xrfxrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\tbnbtn.exec:\tbnbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\hnnthn.exec:\hnnthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\xxxrrrl.exec:\xxxrrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\tnnbnh.exec:\tnnbnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\1htnhh.exec:\1htnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\vdjjj.exec:\vdjjj.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\pjjpj.exec:\pjjpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\rflfxfr.exec:\rflfxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\7jpjj.exec:\7jpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\7tttnn.exec:\7tttnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\nnbtbt.exec:\nnbtbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\vjvdd.exec:\vjvdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\thbhhh.exec:\thbhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\pdjvp.exec:\pdjvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\1pvjd.exec:\1pvjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\5xxrfff.exec:\5xxrfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\pdpjv.exec:\pdpjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\thbhtn.exec:\thbhtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\dvvpj.exec:\dvvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe23⤵
- Executes dropped EXE
PID:3108 -
\??\c:\hhtnbb.exec:\hhtnbb.exe24⤵
- Executes dropped EXE
PID:1868 -
\??\c:\vvpjj.exec:\vvpjj.exe25⤵
- Executes dropped EXE
PID:1716 -
\??\c:\lllrxrf.exec:\lllrxrf.exe26⤵
- Executes dropped EXE
PID:4324 -
\??\c:\hnnnhb.exec:\hnnnhb.exe27⤵
- Executes dropped EXE
PID:4652 -
\??\c:\vddvp.exec:\vddvp.exe28⤵
- Executes dropped EXE
PID:5108 -
\??\c:\5vvpj.exec:\5vvpj.exe29⤵
- Executes dropped EXE
PID:3880 -
\??\c:\3rrlxxl.exec:\3rrlxxl.exe30⤵
- Executes dropped EXE
PID:2184 -
\??\c:\ttttnn.exec:\ttttnn.exe31⤵
- Executes dropped EXE
PID:3176 -
\??\c:\djpjd.exec:\djpjd.exe32⤵
- Executes dropped EXE
PID:1800 -
\??\c:\lrxllfx.exec:\lrxllfx.exe33⤵
- Executes dropped EXE
PID:3752 -
\??\c:\lfffxfx.exec:\lfffxfx.exe34⤵
- Executes dropped EXE
PID:5092 -
\??\c:\5llxrxr.exec:\5llxrxr.exe35⤵
- Executes dropped EXE
PID:4392 -
\??\c:\hthhnn.exec:\hthhnn.exe36⤵
- Executes dropped EXE
PID:4300 -
\??\c:\jvjvp.exec:\jvjvp.exe37⤵
- Executes dropped EXE
PID:828 -
\??\c:\xfrlffx.exec:\xfrlffx.exe38⤵
- Executes dropped EXE
PID:3080 -
\??\c:\rllfxrl.exec:\rllfxrl.exe39⤵
- Executes dropped EXE
PID:1008 -
\??\c:\tthbtn.exec:\tthbtn.exe40⤵
- Executes dropped EXE
PID:2940 -
\??\c:\jpjpd.exec:\jpjpd.exe41⤵
- Executes dropped EXE
PID:592 -
\??\c:\rrrrllf.exec:\rrrrllf.exe42⤵
- Executes dropped EXE
PID:668 -
\??\c:\rrllrxf.exec:\rrllrxf.exe43⤵
- Executes dropped EXE
PID:4040 -
\??\c:\nhbnhb.exec:\nhbnhb.exe44⤵
- Executes dropped EXE
PID:60 -
\??\c:\jjjdd.exec:\jjjdd.exe45⤵
- Executes dropped EXE
PID:2564 -
\??\c:\xxxrfll.exec:\xxxrfll.exe46⤵
- Executes dropped EXE
PID:3940 -
\??\c:\3nnhhh.exec:\3nnhhh.exe47⤵
- Executes dropped EXE
PID:1656 -
\??\c:\bbbttn.exec:\bbbttn.exe48⤵
- Executes dropped EXE
PID:3976 -
\??\c:\1lfxxrr.exec:\1lfxxrr.exe49⤵
- Executes dropped EXE
PID:4088 -
\??\c:\xxxrlff.exec:\xxxrlff.exe50⤵
- Executes dropped EXE
PID:2744 -
\??\c:\tthbhh.exec:\tthbhh.exe51⤵
- Executes dropped EXE
PID:4520 -
\??\c:\3vvpj.exec:\3vvpj.exe52⤵
- Executes dropped EXE
PID:5032 -
\??\c:\lllfxrl.exec:\lllfxrl.exe53⤵
- Executes dropped EXE
PID:3452 -
\??\c:\bbtbnt.exec:\bbtbnt.exe54⤵
- Executes dropped EXE
PID:2972 -
\??\c:\5tbtnn.exec:\5tbtnn.exe55⤵
- Executes dropped EXE
PID:3052 -
\??\c:\dvvjj.exec:\dvvjj.exe56⤵
- Executes dropped EXE
PID:4328 -
\??\c:\xxllffr.exec:\xxllffr.exe57⤵
- Executes dropped EXE
PID:3348 -
\??\c:\ntnnnn.exec:\ntnnnn.exe58⤵
- Executes dropped EXE
PID:3648 -
\??\c:\nhhbbb.exec:\nhhbbb.exe59⤵
- Executes dropped EXE
PID:2848 -
\??\c:\ppjvp.exec:\ppjvp.exe60⤵
- Executes dropped EXE
PID:2352 -
\??\c:\xllfrxr.exec:\xllfrxr.exe61⤵
- Executes dropped EXE
PID:4272 -
\??\c:\7bbbtt.exec:\7bbbtt.exe62⤵
- Executes dropped EXE
PID:2832 -
\??\c:\1djjp.exec:\1djjp.exe63⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xrrfxrl.exec:\xrrfxrl.exe64⤵
- Executes dropped EXE
PID:4468 -
\??\c:\nhhbbb.exec:\nhhbbb.exe65⤵
- Executes dropped EXE
PID:2292 -
\??\c:\3hhtnn.exec:\3hhtnn.exe66⤵PID:5004
-
\??\c:\jvvpd.exec:\jvvpd.exe67⤵PID:3212
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe68⤵PID:1752
-
\??\c:\9hhbtt.exec:\9hhbtt.exe69⤵PID:4008
-
\??\c:\jvdvp.exec:\jvdvp.exe70⤵PID:392
-
\??\c:\xfrfllr.exec:\xfrfllr.exe71⤵PID:1736
-
\??\c:\hbhbbb.exec:\hbhbbb.exe72⤵PID:3068
-
\??\c:\5vdvv.exec:\5vdvv.exe73⤵PID:4416
-
\??\c:\rllrflr.exec:\rllrflr.exe74⤵PID:2952
-
\??\c:\7rxrxxr.exec:\7rxrxxr.exe75⤵PID:2760
-
\??\c:\thnhbb.exec:\thnhbb.exe76⤵PID:3248
-
\??\c:\vpjjd.exec:\vpjjd.exe77⤵PID:4472
-
\??\c:\xlrlfff.exec:\xlrlfff.exe78⤵PID:3972
-
\??\c:\lxxrrll.exec:\lxxrrll.exe79⤵PID:3896
-
\??\c:\hbttnn.exec:\hbttnn.exe80⤵PID:4728
-
\??\c:\vjjvd.exec:\vjjvd.exe81⤵PID:3392
-
\??\c:\xlfrrlf.exec:\xlfrrlf.exe82⤵PID:3960
-
\??\c:\7hnhbb.exec:\7hnhbb.exe83⤵PID:2244
-
\??\c:\nhnnhh.exec:\nhnnhh.exe84⤵
- System Location Discovery: System Language Discovery
PID:2864 -
\??\c:\djvdv.exec:\djvdv.exe85⤵PID:368
-
\??\c:\rlflfxr.exec:\rlflfxr.exe86⤵PID:4020
-
\??\c:\lrxrlff.exec:\lrxrlff.exe87⤵PID:1716
-
\??\c:\nnnhhn.exec:\nnnhhn.exe88⤵PID:5076
-
\??\c:\pppvv.exec:\pppvv.exe89⤵PID:3616
-
\??\c:\7xrlfrl.exec:\7xrlfrl.exe90⤵PID:4648
-
\??\c:\nthbtn.exec:\nthbtn.exe91⤵PID:960
-
\??\c:\jdvjd.exec:\jdvjd.exe92⤵PID:5116
-
\??\c:\vjjdp.exec:\vjjdp.exe93⤵PID:2080
-
\??\c:\lxxrllx.exec:\lxxrllx.exe94⤵PID:1156
-
\??\c:\bnbtbb.exec:\bnbtbb.exe95⤵PID:872
-
\??\c:\vdvjj.exec:\vdvjj.exe96⤵PID:1240
-
\??\c:\xrrlrrx.exec:\xrrlrrx.exe97⤵PID:228
-
\??\c:\nhbbhn.exec:\nhbbhn.exe98⤵PID:3980
-
\??\c:\tnbtnn.exec:\tnbtnn.exe99⤵PID:1508
-
\??\c:\pjppj.exec:\pjppj.exe100⤵PID:1792
-
\??\c:\rrfxxlf.exec:\rrfxxlf.exe101⤵PID:828
-
\??\c:\ttnhhh.exec:\ttnhhh.exe102⤵PID:3080
-
\??\c:\ppjjd.exec:\ppjjd.exe103⤵PID:1008
-
\??\c:\flxrlll.exec:\flxrlll.exe104⤵PID:2940
-
\??\c:\fxxrrlf.exec:\fxxrrlf.exe105⤵PID:3776
-
\??\c:\tnbbhn.exec:\tnbbhn.exe106⤵PID:4212
-
\??\c:\pjvvd.exec:\pjvvd.exe107⤵PID:3784
-
\??\c:\rrxxrrl.exec:\rrxxrrl.exe108⤵PID:4432
-
\??\c:\hhnhhb.exec:\hhnhhb.exe109⤵PID:2836
-
\??\c:\pddvp.exec:\pddvp.exe110⤵PID:3940
-
\??\c:\xxlfllr.exec:\xxlfllr.exe111⤵PID:2828
-
\??\c:\xxfxxfx.exec:\xxfxxfx.exe112⤵PID:1396
-
\??\c:\ttbtnn.exec:\ttbtnn.exe113⤵PID:4088
-
\??\c:\dpvvp.exec:\dpvvp.exe114⤵PID:2744
-
\??\c:\lxxllfr.exec:\lxxllfr.exe115⤵PID:4484
-
\??\c:\nbhttn.exec:\nbhttn.exe116⤵PID:3540
-
\??\c:\jjpjv.exec:\jjpjv.exe117⤵PID:1068
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe118⤵PID:5068
-
\??\c:\ttthbn.exec:\ttthbn.exe119⤵
- System Location Discovery: System Language Discovery
PID:4876 -
\??\c:\hbtnnn.exec:\hbtnnn.exe120⤵PID:804
-
\??\c:\vdpjd.exec:\vdpjd.exe121⤵PID:3088
-
\??\c:\rxfrllf.exec:\rxfrllf.exe122⤵PID:4060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-