Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
14097823b6a20d76c45418eaf5e1a91fdf467f22c98f596492ba01bdc5356af9N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
14097823b6a20d76c45418eaf5e1a91fdf467f22c98f596492ba01bdc5356af9N.exe
-
Size
455KB
-
MD5
8a0a8ba3d77910cd5f8174b455237330
-
SHA1
b81b3b7e1d36a7c07c8a202d4c808616440db055
-
SHA256
14097823b6a20d76c45418eaf5e1a91fdf467f22c98f596492ba01bdc5356af9
-
SHA512
601752ad0912a32af699f4bb7667efa19449765d454664a6fd9b7efa9195618b425215e2450a96b200b55322d76a7bcc3f52fdfb2f6554c008c2b484bfacdc90
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2720-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1320-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-691-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-768-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-1122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-1135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1448 3bbtnh.exe 4516 rfffxff.exe 5028 nnhbtt.exe 5016 btbbnb.exe 2432 vdvjj.exe 3396 3ddjd.exe 2920 xrxrllf.exe 2932 xxrlfxr.exe 4312 tttttb.exe 3636 9ntttn.exe 3984 1jvvp.exe 632 7htntt.exe 3372 pddvp.exe 4552 fllllff.exe 4848 nnntnn.exe 4240 vvjvj.exe 2344 bhhnth.exe 4920 3btnhh.exe 3304 5vddj.exe 4888 tthhht.exe 4148 flxxxrr.exe 1388 xlllflr.exe 3256 ttttnn.exe 1780 vvjpp.exe 1152 jppjd.exe 1880 lfffxfx.exe 3776 rxllflx.exe 3996 hhbttt.exe 3088 3jjjj.exe 1640 xffffll.exe 1708 dddpd.exe 5080 pjpvd.exe 4016 jpppp.exe 3980 fllllrr.exe 2408 vdppv.exe 1588 3fffrrl.exe 2844 hnbbbb.exe 1648 vddvv.exe 60 lrrlllx.exe 2556 ntbbhh.exe 3048 ttbthh.exe 1620 hbhbtt.exe 1240 9dddv.exe 1820 frxxffl.exe 1368 hnhbtt.exe 2576 jdvvp.exe 1720 vpvdd.exe 4992 rxrrrrr.exe 4400 llrrlll.exe 4268 5nbtbb.exe 1320 3jjdd.exe 5044 lxllfff.exe 2088 1xxrrrr.exe 4572 1hnhhh.exe 2928 vvppj.exe 2232 lflfxxr.exe 1512 xxfxlll.exe 3452 tnnnhb.exe 1032 9vpvp.exe 2016 1ppvj.exe 2024 ffllffr.exe 4144 nthhnn.exe 1424 nntttb.exe 1284 vjppj.exe -
resource yara_rule behavioral2/memory/2720-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1388-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1320-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/32-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-768-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-920-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rrrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfffxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrlxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2720 wrote to memory of 1448 2720 14097823b6a20d76c45418eaf5e1a91fdf467f22c98f596492ba01bdc5356af9N.exe 83 PID 2720 wrote to memory of 1448 2720 14097823b6a20d76c45418eaf5e1a91fdf467f22c98f596492ba01bdc5356af9N.exe 83 PID 2720 wrote to memory of 1448 2720 14097823b6a20d76c45418eaf5e1a91fdf467f22c98f596492ba01bdc5356af9N.exe 83 PID 1448 wrote to memory of 4516 1448 3bbtnh.exe 84 PID 1448 wrote to memory of 4516 1448 3bbtnh.exe 84 PID 1448 wrote to memory of 4516 1448 3bbtnh.exe 84 PID 4516 wrote to memory of 5028 4516 rfffxff.exe 85 PID 4516 wrote to memory of 5028 4516 rfffxff.exe 85 PID 4516 wrote to memory of 5028 4516 rfffxff.exe 85 PID 5028 wrote to memory of 5016 5028 nnhbtt.exe 86 PID 5028 wrote to memory of 5016 5028 nnhbtt.exe 86 PID 5028 wrote to memory of 5016 5028 nnhbtt.exe 86 PID 5016 wrote to memory of 2432 5016 btbbnb.exe 87 PID 5016 wrote to memory of 2432 5016 btbbnb.exe 87 PID 5016 wrote to memory of 2432 5016 btbbnb.exe 87 PID 2432 wrote to memory of 3396 2432 vdvjj.exe 88 PID 2432 wrote to memory of 3396 2432 vdvjj.exe 88 PID 2432 wrote to memory of 3396 2432 vdvjj.exe 88 PID 3396 wrote to memory of 2920 3396 3ddjd.exe 89 PID 3396 wrote to memory of 2920 3396 3ddjd.exe 89 PID 3396 wrote to memory of 2920 3396 3ddjd.exe 89 PID 2920 wrote to memory of 2932 2920 xrxrllf.exe 90 PID 2920 wrote to memory of 2932 2920 xrxrllf.exe 90 PID 2920 wrote to memory of 2932 2920 xrxrllf.exe 90 PID 2932 wrote to memory of 4312 2932 xxrlfxr.exe 91 PID 2932 wrote to memory of 4312 2932 xxrlfxr.exe 91 PID 2932 wrote to memory of 4312 2932 xxrlfxr.exe 91 PID 4312 wrote to memory of 3636 4312 tttttb.exe 92 PID 4312 wrote to memory of 3636 4312 tttttb.exe 92 PID 4312 wrote to memory of 3636 4312 tttttb.exe 92 PID 3636 wrote to memory of 3984 3636 9ntttn.exe 93 PID 3636 wrote to memory of 3984 3636 9ntttn.exe 93 PID 3636 wrote to memory of 3984 3636 9ntttn.exe 93 PID 3984 wrote to memory of 632 3984 1jvvp.exe 94 PID 3984 wrote to memory of 632 3984 1jvvp.exe 94 PID 3984 wrote to memory of 632 3984 1jvvp.exe 94 PID 632 wrote to memory of 3372 632 7htntt.exe 95 PID 632 wrote to memory of 3372 632 7htntt.exe 95 PID 632 wrote to memory of 3372 632 7htntt.exe 95 PID 3372 wrote to memory of 4552 3372 pddvp.exe 96 PID 3372 wrote to memory of 4552 3372 pddvp.exe 96 PID 3372 wrote to memory of 4552 3372 pddvp.exe 96 PID 4552 wrote to memory of 4848 4552 fllllff.exe 97 PID 4552 wrote to memory of 4848 4552 fllllff.exe 97 PID 4552 wrote to memory of 4848 4552 fllllff.exe 97 PID 4848 wrote to memory of 4240 4848 nnntnn.exe 98 PID 4848 wrote to memory of 4240 4848 nnntnn.exe 98 PID 4848 wrote to memory of 4240 4848 nnntnn.exe 98 PID 4240 wrote to memory of 2344 4240 vvjvj.exe 99 PID 4240 wrote to memory of 2344 4240 vvjvj.exe 99 PID 4240 wrote to memory of 2344 4240 vvjvj.exe 99 PID 2344 wrote to memory of 4920 2344 bhhnth.exe 100 PID 2344 wrote to memory of 4920 2344 bhhnth.exe 100 PID 2344 wrote to memory of 4920 2344 bhhnth.exe 100 PID 4920 wrote to memory of 3304 4920 3btnhh.exe 101 PID 4920 wrote to memory of 3304 4920 3btnhh.exe 101 PID 4920 wrote to memory of 3304 4920 3btnhh.exe 101 PID 3304 wrote to memory of 4888 3304 5vddj.exe 102 PID 3304 wrote to memory of 4888 3304 5vddj.exe 102 PID 3304 wrote to memory of 4888 3304 5vddj.exe 102 PID 4888 wrote to memory of 4148 4888 tthhht.exe 103 PID 4888 wrote to memory of 4148 4888 tthhht.exe 103 PID 4888 wrote to memory of 4148 4888 tthhht.exe 103 PID 4148 wrote to memory of 1388 4148 flxxxrr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\14097823b6a20d76c45418eaf5e1a91fdf467f22c98f596492ba01bdc5356af9N.exe"C:\Users\Admin\AppData\Local\Temp\14097823b6a20d76c45418eaf5e1a91fdf467f22c98f596492ba01bdc5356af9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\3bbtnh.exec:\3bbtnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\rfffxff.exec:\rfffxff.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\nnhbtt.exec:\nnhbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\btbbnb.exec:\btbbnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\vdvjj.exec:\vdvjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\3ddjd.exec:\3ddjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\xrxrllf.exec:\xrxrllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\xxrlfxr.exec:\xxrlfxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\tttttb.exec:\tttttb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\9ntttn.exec:\9ntttn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\1jvvp.exec:\1jvvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\7htntt.exec:\7htntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\pddvp.exec:\pddvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\fllllff.exec:\fllllff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\nnntnn.exec:\nnntnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\vvjvj.exec:\vvjvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\bhhnth.exec:\bhhnth.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\3btnhh.exec:\3btnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\5vddj.exec:\5vddj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\tthhht.exec:\tthhht.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\flxxxrr.exec:\flxxxrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\xlllflr.exec:\xlllflr.exe23⤵
- Executes dropped EXE
PID:1388 -
\??\c:\ttttnn.exec:\ttttnn.exe24⤵
- Executes dropped EXE
PID:3256 -
\??\c:\vvjpp.exec:\vvjpp.exe25⤵
- Executes dropped EXE
PID:1780 -
\??\c:\jppjd.exec:\jppjd.exe26⤵
- Executes dropped EXE
PID:1152 -
\??\c:\lfffxfx.exec:\lfffxfx.exe27⤵
- Executes dropped EXE
PID:1880 -
\??\c:\rxllflx.exec:\rxllflx.exe28⤵
- Executes dropped EXE
PID:3776 -
\??\c:\hhbttt.exec:\hhbttt.exe29⤵
- Executes dropped EXE
PID:3996 -
\??\c:\3jjjj.exec:\3jjjj.exe30⤵
- Executes dropped EXE
PID:3088 -
\??\c:\xffffll.exec:\xffffll.exe31⤵
- Executes dropped EXE
PID:1640 -
\??\c:\dddpd.exec:\dddpd.exe32⤵
- Executes dropped EXE
PID:1708 -
\??\c:\pjpvd.exec:\pjpvd.exe33⤵
- Executes dropped EXE
PID:5080 -
\??\c:\jpppp.exec:\jpppp.exe34⤵
- Executes dropped EXE
PID:4016 -
\??\c:\fllllrr.exec:\fllllrr.exe35⤵
- Executes dropped EXE
PID:3980 -
\??\c:\vdppv.exec:\vdppv.exe36⤵
- Executes dropped EXE
PID:2408 -
\??\c:\3fffrrl.exec:\3fffrrl.exe37⤵
- Executes dropped EXE
PID:1588 -
\??\c:\hnbbbb.exec:\hnbbbb.exe38⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vddvv.exec:\vddvv.exe39⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lrrlllx.exec:\lrrlllx.exe40⤵
- Executes dropped EXE
PID:60 -
\??\c:\ntbbhh.exec:\ntbbhh.exe41⤵
- Executes dropped EXE
PID:2556 -
\??\c:\ttbthh.exec:\ttbthh.exe42⤵
- Executes dropped EXE
PID:3048 -
\??\c:\hbhbtt.exec:\hbhbtt.exe43⤵
- Executes dropped EXE
PID:1620 -
\??\c:\9dddv.exec:\9dddv.exe44⤵
- Executes dropped EXE
PID:1240 -
\??\c:\frxxffl.exec:\frxxffl.exe45⤵
- Executes dropped EXE
PID:1820 -
\??\c:\hnhbtt.exec:\hnhbtt.exe46⤵
- Executes dropped EXE
PID:1368 -
\??\c:\jdvvp.exec:\jdvvp.exe47⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vpvdd.exec:\vpvdd.exe48⤵
- Executes dropped EXE
PID:1720 -
\??\c:\rxrrrrr.exec:\rxrrrrr.exe49⤵
- Executes dropped EXE
PID:4992 -
\??\c:\llrrlll.exec:\llrrlll.exe50⤵
- Executes dropped EXE
PID:4400 -
\??\c:\5nbtbb.exec:\5nbtbb.exe51⤵
- Executes dropped EXE
PID:4268 -
\??\c:\3jjdd.exec:\3jjdd.exe52⤵
- Executes dropped EXE
PID:1320 -
\??\c:\lxllfff.exec:\lxllfff.exe53⤵
- Executes dropped EXE
PID:5044 -
\??\c:\1xxrrrr.exec:\1xxrrrr.exe54⤵
- Executes dropped EXE
PID:2088 -
\??\c:\1hnhhh.exec:\1hnhhh.exe55⤵
- Executes dropped EXE
PID:4572 -
\??\c:\vvppj.exec:\vvppj.exe56⤵
- Executes dropped EXE
PID:2928 -
\??\c:\lflfxxr.exec:\lflfxxr.exe57⤵
- Executes dropped EXE
PID:2232 -
\??\c:\xxfxlll.exec:\xxfxlll.exe58⤵
- Executes dropped EXE
PID:1512 -
\??\c:\tnnnhb.exec:\tnnnhb.exe59⤵
- Executes dropped EXE
PID:3452 -
\??\c:\9vpvp.exec:\9vpvp.exe60⤵
- Executes dropped EXE
PID:1032 -
\??\c:\1ppvj.exec:\1ppvj.exe61⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ffllffr.exec:\ffllffr.exe62⤵
- Executes dropped EXE
PID:2024 -
\??\c:\nthhnn.exec:\nthhnn.exe63⤵
- Executes dropped EXE
PID:4144 -
\??\c:\nntttb.exec:\nntttb.exe64⤵
- Executes dropped EXE
PID:1424 -
\??\c:\vjppj.exec:\vjppj.exe65⤵
- Executes dropped EXE
PID:1284 -
\??\c:\rlrrlll.exec:\rlrrlll.exe66⤵PID:1248
-
\??\c:\tbttnn.exec:\tbttnn.exe67⤵PID:2860
-
\??\c:\hhhbbb.exec:\hhhbbb.exe68⤵PID:1256
-
\??\c:\vdddj.exec:\vdddj.exe69⤵PID:632
-
\??\c:\rfrrflr.exec:\rfrrflr.exe70⤵PID:2252
-
\??\c:\nnnnhh.exec:\nnnnhh.exe71⤵PID:2772
-
\??\c:\djvdj.exec:\djvdj.exe72⤵PID:320
-
\??\c:\jdvpj.exec:\jdvpj.exe73⤵PID:1076
-
\??\c:\rffxffl.exec:\rffxffl.exe74⤵PID:4824
-
\??\c:\1nhhbh.exec:\1nhhbh.exe75⤵PID:2872
-
\??\c:\9ntnhb.exec:\9ntnhb.exe76⤵PID:4480
-
\??\c:\ppvpp.exec:\ppvpp.exe77⤵PID:1704
-
\??\c:\rrfxllx.exec:\rrfxllx.exe78⤵PID:2448
-
\??\c:\bbbtnn.exec:\bbbtnn.exe79⤵PID:3860
-
\??\c:\jvvdd.exec:\jvvdd.exe80⤵PID:4148
-
\??\c:\pdppp.exec:\pdppp.exe81⤵PID:456
-
\??\c:\3xrlrrr.exec:\3xrlrrr.exe82⤵PID:2608
-
\??\c:\nnttnn.exec:\nnttnn.exe83⤵PID:1140
-
\??\c:\thhhbb.exec:\thhhbb.exe84⤵PID:4748
-
\??\c:\ppjjj.exec:\ppjjj.exe85⤵PID:3168
-
\??\c:\fllffff.exec:\fllffff.exe86⤵PID:4256
-
\??\c:\hnnhhh.exec:\hnnhhh.exe87⤵PID:1064
-
\??\c:\bbnhnt.exec:\bbnhnt.exe88⤵PID:4644
-
\??\c:\dddvv.exec:\dddvv.exe89⤵PID:4196
-
\??\c:\xllfrrf.exec:\xllfrrf.exe90⤵PID:3720
-
\??\c:\tnbttt.exec:\tnbttt.exe91⤵PID:5076
-
\??\c:\3hhhhh.exec:\3hhhhh.exe92⤵PID:1028
-
\??\c:\vdvvd.exec:\vdvvd.exe93⤵PID:4508
-
\??\c:\lffrffl.exec:\lffrffl.exe94⤵PID:3008
-
\??\c:\bbttnn.exec:\bbttnn.exe95⤵PID:4044
-
\??\c:\dvdvp.exec:\dvdvp.exe96⤵PID:5080
-
\??\c:\jjpdd.exec:\jjpdd.exe97⤵PID:2292
-
\??\c:\flxfffx.exec:\flxfffx.exe98⤵PID:1856
-
\??\c:\btbttt.exec:\btbttt.exe99⤵PID:2992
-
\??\c:\jjjjd.exec:\jjjjd.exe100⤵PID:1588
-
\??\c:\9dppp.exec:\9dppp.exe101⤵PID:2360
-
\??\c:\7fxrrrl.exec:\7fxrrrl.exe102⤵PID:3616
-
\??\c:\5bbnhn.exec:\5bbnhn.exe103⤵PID:2192
-
\??\c:\pddvp.exec:\pddvp.exe104⤵PID:1168
-
\??\c:\jvjjd.exec:\jvjjd.exe105⤵PID:4048
-
\??\c:\xlxxrff.exec:\xlxxrff.exe106⤵PID:4660
-
\??\c:\5nnhnh.exec:\5nnhnh.exe107⤵PID:5116
-
\??\c:\5jddd.exec:\5jddd.exe108⤵PID:32
-
\??\c:\ppddj.exec:\ppddj.exe109⤵PID:3516
-
\??\c:\fllllfx.exec:\fllllfx.exe110⤵PID:808
-
\??\c:\7ntttt.exec:\7ntttt.exe111⤵PID:4344
-
\??\c:\7bntnn.exec:\7bntnn.exe112⤵PID:4360
-
\??\c:\pjjvv.exec:\pjjvv.exe113⤵PID:184
-
\??\c:\ffrrxxr.exec:\ffrrxxr.exe114⤵PID:5084
-
\??\c:\hbnnnb.exec:\hbnnnb.exe115⤵PID:5060
-
\??\c:\thhbnn.exec:\thhbnn.exe116⤵PID:4112
-
\??\c:\ddppp.exec:\ddppp.exe117⤵PID:1444
-
\??\c:\9pddv.exec:\9pddv.exe118⤵PID:4960
-
\??\c:\llrllrl.exec:\llrllrl.exe119⤵PID:4424
-
\??\c:\ttbbtt.exec:\ttbbtt.exe120⤵PID:224
-
\??\c:\jjdjd.exec:\jjdjd.exe121⤵PID:2232
-
\??\c:\3lrlffr.exec:\3lrlffr.exe122⤵PID:1512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-