Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9fe96390c662c6a0beb0400021a0992121c60850c3ff747092885e99054b1044.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9fe96390c662c6a0beb0400021a0992121c60850c3ff747092885e99054b1044.exe
-
Size
456KB
-
MD5
176eced5095c86332092a002acc2418e
-
SHA1
8b9b9d78a68c148f802f833ef3458b658e973773
-
SHA256
9fe96390c662c6a0beb0400021a0992121c60850c3ff747092885e99054b1044
-
SHA512
115c0ae096f7bb97e643f7bc51f467880c9b271cf2f0a2019e142cae3c4c69657210f1bfebba7b69da4f940cfe720503684c274890d5823827ecdbd9af9d5113
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAben:q7Tc2NYHUrAwfMp3CDn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2600-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/752-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1340-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2704-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1348-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/700-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-673-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-887-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-973-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-1055-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2560-1382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-1971-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3076 pppjv.exe 752 lxlfxxx.exe 3692 nhnhbb.exe 3080 rrlffrr.exe 1440 jpdvp.exe 2168 jdvpj.exe 1220 ffxxrxr.exe 5088 pjdvp.exe 4204 nnthbb.exe 2172 bnnnhh.exe 2856 9vdvv.exe 4064 xxxrrfx.exe 2996 xrlflll.exe 1340 1llfffx.exe 4724 bhbhth.exe 2448 dppjd.exe 5052 xfrrxfx.exe 1532 nhbtbt.exe 4560 bbbhhb.exe 4920 dppdp.exe 1964 rxrflrx.exe 2080 thbtnh.exe 3124 pvpdv.exe 3364 tnnnhh.exe 2384 htbtnn.exe 1500 fffxrxr.exe 2724 bhhbbt.exe 2808 lrxrlfx.exe 2556 xllfxrl.exe 1484 bnttnn.exe 924 dpjjd.exe 1572 9xxxrxr.exe 3048 rxrxrrl.exe 1360 tnnbtt.exe 2464 jppvp.exe 2704 dvdvp.exe 3648 xrrlrrx.exe 3444 bttnht.exe 1040 nnbhbb.exe 4824 pjjjd.exe 3036 ffxrlfx.exe 2476 fllfxxr.exe 4412 hbtnnh.exe 1472 dppjj.exe 4104 rfflfff.exe 4356 3hnbbb.exe 3804 xxxxrff.exe 2708 tnttnn.exe 4596 lfxxllf.exe 1180 5jddd.exe 4132 frxxxfl.exe 3672 nbnnhb.exe 3068 dpdpp.exe 2820 hthhhb.exe 2364 ppdvj.exe 3424 fxxrflf.exe 4276 jvvpj.exe 2188 rflffff.exe 2696 fxllrrx.exe 4668 3nttnn.exe 5088 pdjdd.exe 4460 rxxrfxf.exe 4992 rlrrllf.exe 812 hbnnbb.exe -
resource yara_rule behavioral2/memory/2600-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/752-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1340-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2704-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1348-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/700-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-831-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-840-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnnhh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2600 wrote to memory of 3076 2600 9fe96390c662c6a0beb0400021a0992121c60850c3ff747092885e99054b1044.exe 82 PID 2600 wrote to memory of 3076 2600 9fe96390c662c6a0beb0400021a0992121c60850c3ff747092885e99054b1044.exe 82 PID 2600 wrote to memory of 3076 2600 9fe96390c662c6a0beb0400021a0992121c60850c3ff747092885e99054b1044.exe 82 PID 3076 wrote to memory of 752 3076 pppjv.exe 83 PID 3076 wrote to memory of 752 3076 pppjv.exe 83 PID 3076 wrote to memory of 752 3076 pppjv.exe 83 PID 752 wrote to memory of 3692 752 lxlfxxx.exe 84 PID 752 wrote to memory of 3692 752 lxlfxxx.exe 84 PID 752 wrote to memory of 3692 752 lxlfxxx.exe 84 PID 3692 wrote to memory of 3080 3692 nhnhbb.exe 85 PID 3692 wrote to memory of 3080 3692 nhnhbb.exe 85 PID 3692 wrote to memory of 3080 3692 nhnhbb.exe 85 PID 3080 wrote to memory of 1440 3080 rrlffrr.exe 86 PID 3080 wrote to memory of 1440 3080 rrlffrr.exe 86 PID 3080 wrote to memory of 1440 3080 rrlffrr.exe 86 PID 1440 wrote to memory of 2168 1440 jpdvp.exe 87 PID 1440 wrote to memory of 2168 1440 jpdvp.exe 87 PID 1440 wrote to memory of 2168 1440 jpdvp.exe 87 PID 2168 wrote to memory of 1220 2168 jdvpj.exe 88 PID 2168 wrote to memory of 1220 2168 jdvpj.exe 88 PID 2168 wrote to memory of 1220 2168 jdvpj.exe 88 PID 1220 wrote to memory of 5088 1220 ffxxrxr.exe 89 PID 1220 wrote to memory of 5088 1220 ffxxrxr.exe 89 PID 1220 wrote to memory of 5088 1220 ffxxrxr.exe 89 PID 5088 wrote to memory of 4204 5088 pjdvp.exe 90 PID 5088 wrote to memory of 4204 5088 pjdvp.exe 90 PID 5088 wrote to memory of 4204 5088 pjdvp.exe 90 PID 4204 wrote to memory of 2172 4204 nnthbb.exe 91 PID 4204 wrote to memory of 2172 4204 nnthbb.exe 91 PID 4204 wrote to memory of 2172 4204 nnthbb.exe 91 PID 2172 wrote to memory of 2856 2172 bnnnhh.exe 92 PID 2172 wrote to memory of 2856 2172 bnnnhh.exe 92 PID 2172 wrote to memory of 2856 2172 bnnnhh.exe 92 PID 2856 wrote to memory of 4064 2856 9vdvv.exe 93 PID 2856 wrote to memory of 4064 2856 9vdvv.exe 93 PID 2856 wrote to memory of 4064 2856 9vdvv.exe 93 PID 4064 wrote to memory of 2996 4064 xxxrrfx.exe 94 PID 4064 wrote to memory of 2996 4064 xxxrrfx.exe 94 PID 4064 wrote to memory of 2996 4064 xxxrrfx.exe 94 PID 2996 wrote to memory of 1340 2996 xrlflll.exe 95 PID 2996 wrote to memory of 1340 2996 xrlflll.exe 95 PID 2996 wrote to memory of 1340 2996 xrlflll.exe 95 PID 1340 wrote to memory of 4724 1340 1llfffx.exe 96 PID 1340 wrote to memory of 4724 1340 1llfffx.exe 96 PID 1340 wrote to memory of 4724 1340 1llfffx.exe 96 PID 4724 wrote to memory of 2448 4724 bhbhth.exe 97 PID 4724 wrote to memory of 2448 4724 bhbhth.exe 97 PID 4724 wrote to memory of 2448 4724 bhbhth.exe 97 PID 2448 wrote to memory of 5052 2448 dppjd.exe 98 PID 2448 wrote to memory of 5052 2448 dppjd.exe 98 PID 2448 wrote to memory of 5052 2448 dppjd.exe 98 PID 5052 wrote to memory of 1532 5052 xfrrxfx.exe 99 PID 5052 wrote to memory of 1532 5052 xfrrxfx.exe 99 PID 5052 wrote to memory of 1532 5052 xfrrxfx.exe 99 PID 1532 wrote to memory of 4560 1532 nhbtbt.exe 100 PID 1532 wrote to memory of 4560 1532 nhbtbt.exe 100 PID 1532 wrote to memory of 4560 1532 nhbtbt.exe 100 PID 4560 wrote to memory of 4920 4560 bbbhhb.exe 101 PID 4560 wrote to memory of 4920 4560 bbbhhb.exe 101 PID 4560 wrote to memory of 4920 4560 bbbhhb.exe 101 PID 4920 wrote to memory of 1964 4920 dppdp.exe 102 PID 4920 wrote to memory of 1964 4920 dppdp.exe 102 PID 4920 wrote to memory of 1964 4920 dppdp.exe 102 PID 1964 wrote to memory of 2080 1964 rxrflrx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fe96390c662c6a0beb0400021a0992121c60850c3ff747092885e99054b1044.exe"C:\Users\Admin\AppData\Local\Temp\9fe96390c662c6a0beb0400021a0992121c60850c3ff747092885e99054b1044.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\pppjv.exec:\pppjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\nhnhbb.exec:\nhnhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\rrlffrr.exec:\rrlffrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\jpdvp.exec:\jpdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\jdvpj.exec:\jdvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\ffxxrxr.exec:\ffxxrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\pjdvp.exec:\pjdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\nnthbb.exec:\nnthbb.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\bnnnhh.exec:\bnnnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\9vdvv.exec:\9vdvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\xxxrrfx.exec:\xxxrrfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\xrlflll.exec:\xrlflll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\1llfffx.exec:\1llfffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\bhbhth.exec:\bhbhth.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\dppjd.exec:\dppjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\xfrrxfx.exec:\xfrrxfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\nhbtbt.exec:\nhbtbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\bbbhhb.exec:\bbbhhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\dppdp.exec:\dppdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\rxrflrx.exec:\rxrflrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\thbtnh.exec:\thbtnh.exe23⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pvpdv.exec:\pvpdv.exe24⤵
- Executes dropped EXE
PID:3124 -
\??\c:\tnnnhh.exec:\tnnnhh.exe25⤵
- Executes dropped EXE
PID:3364 -
\??\c:\htbtnn.exec:\htbtnn.exe26⤵
- Executes dropped EXE
PID:2384 -
\??\c:\fffxrxr.exec:\fffxrxr.exe27⤵
- Executes dropped EXE
PID:1500 -
\??\c:\bhhbbt.exec:\bhhbbt.exe28⤵
- Executes dropped EXE
PID:2724 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe29⤵
- Executes dropped EXE
PID:2808 -
\??\c:\xllfxrl.exec:\xllfxrl.exe30⤵
- Executes dropped EXE
PID:2556 -
\??\c:\bnttnn.exec:\bnttnn.exe31⤵
- Executes dropped EXE
PID:1484 -
\??\c:\dpjjd.exec:\dpjjd.exe32⤵
- Executes dropped EXE
PID:924 -
\??\c:\9xxxrxr.exec:\9xxxrxr.exe33⤵
- Executes dropped EXE
PID:1572 -
\??\c:\rxrxrrl.exec:\rxrxrrl.exe34⤵
- Executes dropped EXE
PID:3048 -
\??\c:\tnnbtt.exec:\tnnbtt.exe35⤵
- Executes dropped EXE
PID:1360 -
\??\c:\jppvp.exec:\jppvp.exe36⤵
- Executes dropped EXE
PID:2464 -
\??\c:\dvdvp.exec:\dvdvp.exe37⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xrrlrrx.exec:\xrrlrrx.exe38⤵
- Executes dropped EXE
PID:3648 -
\??\c:\bttnht.exec:\bttnht.exe39⤵
- Executes dropped EXE
PID:3444 -
\??\c:\nnbhbb.exec:\nnbhbb.exe40⤵
- Executes dropped EXE
PID:1040 -
\??\c:\pjjjd.exec:\pjjjd.exe41⤵
- Executes dropped EXE
PID:4824 -
\??\c:\ffxrlfx.exec:\ffxrlfx.exe42⤵
- Executes dropped EXE
PID:3036 -
\??\c:\fllfxxr.exec:\fllfxxr.exe43⤵
- Executes dropped EXE
PID:2476 -
\??\c:\hbtnnh.exec:\hbtnnh.exe44⤵
- Executes dropped EXE
PID:4412 -
\??\c:\dppjj.exec:\dppjj.exe45⤵
- Executes dropped EXE
PID:1472 -
\??\c:\rfflfff.exec:\rfflfff.exe46⤵
- Executes dropped EXE
PID:4104 -
\??\c:\3hnbbb.exec:\3hnbbb.exe47⤵
- Executes dropped EXE
PID:4356 -
\??\c:\xxxxrff.exec:\xxxxrff.exe48⤵
- Executes dropped EXE
PID:3804 -
\??\c:\tnttnn.exec:\tnttnn.exe49⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lfxxllf.exec:\lfxxllf.exe50⤵
- Executes dropped EXE
PID:4596 -
\??\c:\5jddd.exec:\5jddd.exe51⤵
- Executes dropped EXE
PID:1180 -
\??\c:\frxxxfl.exec:\frxxxfl.exe52⤵
- Executes dropped EXE
PID:4132 -
\??\c:\nbnnhb.exec:\nbnnhb.exe53⤵
- Executes dropped EXE
PID:3672 -
\??\c:\dpdpp.exec:\dpdpp.exe54⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hthhhb.exec:\hthhhb.exe55⤵
- Executes dropped EXE
PID:2820 -
\??\c:\ppdvj.exec:\ppdvj.exe56⤵
- Executes dropped EXE
PID:2364 -
\??\c:\fxxrflf.exec:\fxxrflf.exe57⤵
- Executes dropped EXE
PID:3424 -
\??\c:\jvvpj.exec:\jvvpj.exe58⤵
- Executes dropped EXE
PID:4276 -
\??\c:\rflffff.exec:\rflffff.exe59⤵
- Executes dropped EXE
PID:2188 -
\??\c:\fxllrrx.exec:\fxllrrx.exe60⤵
- Executes dropped EXE
PID:2696 -
\??\c:\3nttnn.exec:\3nttnn.exe61⤵
- Executes dropped EXE
PID:4668 -
\??\c:\pdjdd.exec:\pdjdd.exe62⤵
- Executes dropped EXE
PID:5088 -
\??\c:\rxxrfxf.exec:\rxxrfxf.exe63⤵
- Executes dropped EXE
PID:4460 -
\??\c:\rlrrllf.exec:\rlrrllf.exe64⤵
- Executes dropped EXE
PID:4992 -
\??\c:\hbnnbb.exec:\hbnnbb.exe65⤵
- Executes dropped EXE
PID:812 -
\??\c:\jddvv.exec:\jddvv.exe66⤵PID:4064
-
\??\c:\fxfrrll.exec:\fxfrrll.exe67⤵PID:3096
-
\??\c:\3ttnhh.exec:\3ttnhh.exe68⤵PID:1348
-
\??\c:\pjdvp.exec:\pjdvp.exe69⤵PID:3240
-
\??\c:\pdjdd.exec:\pdjdd.exe70⤵
- System Location Discovery: System Language Discovery
PID:5016 -
\??\c:\fxlrxrf.exec:\fxlrxrf.exe71⤵PID:5012
-
\??\c:\dvvpd.exec:\dvvpd.exe72⤵PID:1332
-
\??\c:\llfrllf.exec:\llfrllf.exe73⤵PID:5084
-
\??\c:\1nhbbb.exec:\1nhbbb.exe74⤵PID:400
-
\??\c:\pdpvv.exec:\pdpvv.exe75⤵PID:3060
-
\??\c:\fllllll.exec:\fllllll.exe76⤵PID:2020
-
\??\c:\fxfxfll.exec:\fxfxfll.exe77⤵PID:4488
-
\??\c:\nnthbb.exec:\nnthbb.exe78⤵PID:1812
-
\??\c:\dvvpj.exec:\dvvpj.exe79⤵PID:4308
-
\??\c:\flrflxf.exec:\flrflxf.exe80⤵PID:1196
-
\??\c:\tnnnnh.exec:\tnnnnh.exe81⤵PID:3988
-
\??\c:\nhbbnh.exec:\nhbbnh.exe82⤵PID:2080
-
\??\c:\jjjjp.exec:\jjjjp.exe83⤵PID:3156
-
\??\c:\rrrlfxf.exec:\rrrlfxf.exe84⤵PID:1464
-
\??\c:\3bbbtt.exec:\3bbbtt.exe85⤵PID:388
-
\??\c:\vpjdv.exec:\vpjdv.exe86⤵PID:4964
-
\??\c:\pdppv.exec:\pdppv.exe87⤵PID:4800
-
\??\c:\rxfxxxr.exec:\rxfxxxr.exe88⤵PID:4912
-
\??\c:\bthbhb.exec:\bthbhb.exe89⤵PID:212
-
\??\c:\1ddvj.exec:\1ddvj.exe90⤵PID:1100
-
\??\c:\xrlffxx.exec:\xrlffxx.exe91⤵PID:4416
-
\??\c:\9hnbbh.exec:\9hnbbh.exe92⤵PID:2100
-
\??\c:\9pjjp.exec:\9pjjp.exe93⤵PID:4112
-
\??\c:\ffxrfxr.exec:\ffxrfxr.exe94⤵PID:1116
-
\??\c:\fflfxxr.exec:\fflfxxr.exe95⤵PID:3668
-
\??\c:\hnbbbn.exec:\hnbbbn.exe96⤵PID:464
-
\??\c:\djdpj.exec:\djdpj.exe97⤵PID:3776
-
\??\c:\fxlrlfr.exec:\fxlrlfr.exe98⤵PID:4288
-
\??\c:\hnhbnn.exec:\hnhbnn.exe99⤵PID:532
-
\??\c:\jvpdp.exec:\jvpdp.exe100⤵PID:4748
-
\??\c:\vjjdv.exec:\vjjdv.exe101⤵PID:1028
-
\??\c:\xllfxxr.exec:\xllfxxr.exe102⤵PID:1360
-
\??\c:\httnnh.exec:\httnnh.exe103⤵PID:3924
-
\??\c:\ttbtbb.exec:\ttbtbb.exe104⤵PID:1216
-
\??\c:\pvvpd.exec:\pvvpd.exe105⤵PID:2232
-
\??\c:\fllxrxx.exec:\fllxrxx.exe106⤵PID:2816
-
\??\c:\1hnhhn.exec:\1hnhhn.exe107⤵
- System Location Discovery: System Language Discovery
PID:2016 -
\??\c:\dvjjd.exec:\dvjjd.exe108⤵PID:3052
-
\??\c:\jddjp.exec:\jddjp.exe109⤵PID:4812
-
\??\c:\lrrlxrf.exec:\lrrlxrf.exe110⤵PID:4788
-
\??\c:\bttnhh.exec:\bttnhh.exe111⤵PID:4240
-
\??\c:\7vpvp.exec:\7vpvp.exe112⤵PID:4412
-
\??\c:\rfffllr.exec:\rfffllr.exe113⤵PID:2256
-
\??\c:\thnhnb.exec:\thnhnb.exe114⤵PID:5020
-
\??\c:\vppjd.exec:\vppjd.exe115⤵PID:3580
-
\??\c:\pddvp.exec:\pddvp.exe116⤵PID:2908
-
\??\c:\fxrllll.exec:\fxrllll.exe117⤵PID:3324
-
\??\c:\nbbbbb.exec:\nbbbbb.exe118⤵PID:2868
-
\??\c:\1djpj.exec:\1djpj.exe119⤵PID:3352
-
\??\c:\rrxrlff.exec:\rrxrlff.exe120⤵PID:1180
-
\??\c:\ttttnn.exec:\ttttnn.exe121⤵PID:980
-
\??\c:\hhbttn.exec:\hhbttn.exe122⤵PID:4500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-