Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9e7e88b3d13c8297b1d21a1c48994e982a1e6363faf8d0ec06d29e1f25741623.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9e7e88b3d13c8297b1d21a1c48994e982a1e6363faf8d0ec06d29e1f25741623.exe
-
Size
455KB
-
MD5
dc1ccc0b7646ff639241be8f902519fe
-
SHA1
9b32f1c391f41af1373a3656bbbf742f0dc2f76a
-
SHA256
9e7e88b3d13c8297b1d21a1c48994e982a1e6363faf8d0ec06d29e1f25741623
-
SHA512
7712b1d0c4d8a541e6c59125c4b6723c29d7c7b3ad12701f31646c97056fcd036ecdd78e4c284e0273e4355bc76e3f9f19667f9dffb8d7d2c8d127ab2ce6b916
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeow:q7Tc2NYHUrAwfMp3CDR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3116-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2044-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3160-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3272-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/700-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2332-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-736-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-779-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-810-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-853-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-872-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-918-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-1128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-1796-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2044 nhhbbh.exe 3116 vjdvp.exe 3728 rflxrrx.exe 2344 9bntnt.exe 3200 9xxlxxl.exe 1060 hbtnbt.exe 4312 vjddv.exe 4552 pvjdp.exe 4748 xlrfxxr.exe 1696 pjvvp.exe 3272 tnthbn.exe 1936 hnthbt.exe 3160 djvpp.exe 724 btttnn.exe 4036 jjjjd.exe 3244 llffxxl.exe 2000 hbhhhh.exe 2596 9dvpj.exe 4984 pppdd.exe 3248 nnnhbb.exe 4444 nhtnhh.exe 1576 jvvvj.exe 688 rlxxxfr.exe 4532 7lxxlrx.exe 5096 9bnhtn.exe 1072 ppddj.exe 3488 vpjjj.exe 1660 frrxxrx.exe 3156 nhbnhn.exe 4576 tbbbbb.exe 3940 vjpvp.exe 60 lrxxrxx.exe 2924 fxrlffl.exe 2656 tbhbbb.exe 1168 ppppp.exe 4068 jdjjj.exe 4768 xrllffr.exe 3772 btbbbb.exe 4332 nthbbb.exe 4024 dvddd.exe 400 3jjdv.exe 2272 ffrrrrr.exe 3356 hhnnnh.exe 1824 3bhhhn.exe 4300 3ddvd.exe 5116 1xrrrxx.exe 760 fflffxl.exe 2044 nnbbbb.exe 3636 pjjdd.exe 3324 jdjjj.exe 2760 llfflll.exe 3864 bbnttb.exe 1712 5thbhh.exe 1932 vpvvv.exe 3200 xffrrrf.exe 3532 5nnhtt.exe 4732 5frrlrr.exe 4812 bhttnt.exe 4656 djvpv.exe 1900 vvjjj.exe 2884 xflllfl.exe 4132 tnhnnh.exe 924 1vvvp.exe 4464 rxrllll.exe -
resource yara_rule behavioral2/memory/3116-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2044-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3272-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3160-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3160-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3272-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/700-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2332-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-736-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-779-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-810-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-853-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-872-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflffxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4804 wrote to memory of 2044 4804 9e7e88b3d13c8297b1d21a1c48994e982a1e6363faf8d0ec06d29e1f25741623.exe 83 PID 4804 wrote to memory of 2044 4804 9e7e88b3d13c8297b1d21a1c48994e982a1e6363faf8d0ec06d29e1f25741623.exe 83 PID 4804 wrote to memory of 2044 4804 9e7e88b3d13c8297b1d21a1c48994e982a1e6363faf8d0ec06d29e1f25741623.exe 83 PID 2044 wrote to memory of 3116 2044 nhhbbh.exe 84 PID 2044 wrote to memory of 3116 2044 nhhbbh.exe 84 PID 2044 wrote to memory of 3116 2044 nhhbbh.exe 84 PID 3116 wrote to memory of 3728 3116 vjdvp.exe 85 PID 3116 wrote to memory of 3728 3116 vjdvp.exe 85 PID 3116 wrote to memory of 3728 3116 vjdvp.exe 85 PID 3728 wrote to memory of 2344 3728 rflxrrx.exe 86 PID 3728 wrote to memory of 2344 3728 rflxrrx.exe 86 PID 3728 wrote to memory of 2344 3728 rflxrrx.exe 86 PID 2344 wrote to memory of 3200 2344 9bntnt.exe 137 PID 2344 wrote to memory of 3200 2344 9bntnt.exe 137 PID 2344 wrote to memory of 3200 2344 9bntnt.exe 137 PID 3200 wrote to memory of 1060 3200 9xxlxxl.exe 88 PID 3200 wrote to memory of 1060 3200 9xxlxxl.exe 88 PID 3200 wrote to memory of 1060 3200 9xxlxxl.exe 88 PID 1060 wrote to memory of 4312 1060 hbtnbt.exe 89 PID 1060 wrote to memory of 4312 1060 hbtnbt.exe 89 PID 1060 wrote to memory of 4312 1060 hbtnbt.exe 89 PID 4312 wrote to memory of 4552 4312 vjddv.exe 90 PID 4312 wrote to memory of 4552 4312 vjddv.exe 90 PID 4312 wrote to memory of 4552 4312 vjddv.exe 90 PID 4552 wrote to memory of 4748 4552 pvjdp.exe 91 PID 4552 wrote to memory of 4748 4552 pvjdp.exe 91 PID 4552 wrote to memory of 4748 4552 pvjdp.exe 91 PID 4748 wrote to memory of 1696 4748 xlrfxxr.exe 92 PID 4748 wrote to memory of 1696 4748 xlrfxxr.exe 92 PID 4748 wrote to memory of 1696 4748 xlrfxxr.exe 92 PID 1696 wrote to memory of 3272 1696 pjvvp.exe 93 PID 1696 wrote to memory of 3272 1696 pjvvp.exe 93 PID 1696 wrote to memory of 3272 1696 pjvvp.exe 93 PID 3272 wrote to memory of 1936 3272 tnthbn.exe 94 PID 3272 wrote to memory of 1936 3272 tnthbn.exe 94 PID 3272 wrote to memory of 1936 3272 tnthbn.exe 94 PID 1936 wrote to memory of 3160 1936 hnthbt.exe 95 PID 1936 wrote to memory of 3160 1936 hnthbt.exe 95 PID 1936 wrote to memory of 3160 1936 hnthbt.exe 95 PID 3160 wrote to memory of 724 3160 djvpp.exe 96 PID 3160 wrote to memory of 724 3160 djvpp.exe 96 PID 3160 wrote to memory of 724 3160 djvpp.exe 96 PID 724 wrote to memory of 4036 724 btttnn.exe 97 PID 724 wrote to memory of 4036 724 btttnn.exe 97 PID 724 wrote to memory of 4036 724 btttnn.exe 97 PID 4036 wrote to memory of 3244 4036 jjjjd.exe 98 PID 4036 wrote to memory of 3244 4036 jjjjd.exe 98 PID 4036 wrote to memory of 3244 4036 jjjjd.exe 98 PID 3244 wrote to memory of 2000 3244 llffxxl.exe 99 PID 3244 wrote to memory of 2000 3244 llffxxl.exe 99 PID 3244 wrote to memory of 2000 3244 llffxxl.exe 99 PID 2000 wrote to memory of 2596 2000 hbhhhh.exe 100 PID 2000 wrote to memory of 2596 2000 hbhhhh.exe 100 PID 2000 wrote to memory of 2596 2000 hbhhhh.exe 100 PID 2596 wrote to memory of 4984 2596 9dvpj.exe 101 PID 2596 wrote to memory of 4984 2596 9dvpj.exe 101 PID 2596 wrote to memory of 4984 2596 9dvpj.exe 101 PID 4984 wrote to memory of 3248 4984 pppdd.exe 102 PID 4984 wrote to memory of 3248 4984 pppdd.exe 102 PID 4984 wrote to memory of 3248 4984 pppdd.exe 102 PID 3248 wrote to memory of 4444 3248 nnnhbb.exe 103 PID 3248 wrote to memory of 4444 3248 nnnhbb.exe 103 PID 3248 wrote to memory of 4444 3248 nnnhbb.exe 103 PID 4444 wrote to memory of 1576 4444 nhtnhh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e7e88b3d13c8297b1d21a1c48994e982a1e6363faf8d0ec06d29e1f25741623.exe"C:\Users\Admin\AppData\Local\Temp\9e7e88b3d13c8297b1d21a1c48994e982a1e6363faf8d0ec06d29e1f25741623.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\nhhbbh.exec:\nhhbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\vjdvp.exec:\vjdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\rflxrrx.exec:\rflxrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\9bntnt.exec:\9bntnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\9xxlxxl.exec:\9xxlxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\hbtnbt.exec:\hbtnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\vjddv.exec:\vjddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\pvjdp.exec:\pvjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\xlrfxxr.exec:\xlrfxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\pjvvp.exec:\pjvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\tnthbn.exec:\tnthbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\hnthbt.exec:\hnthbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\djvpp.exec:\djvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\btttnn.exec:\btttnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
\??\c:\jjjjd.exec:\jjjjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\llffxxl.exec:\llffxxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\hbhhhh.exec:\hbhhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\9dvpj.exec:\9dvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\pppdd.exec:\pppdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\nnnhbb.exec:\nnnhbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\nhtnhh.exec:\nhtnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\jvvvj.exec:\jvvvj.exe23⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rlxxxfr.exec:\rlxxxfr.exe24⤵
- Executes dropped EXE
PID:688 -
\??\c:\7lxxlrx.exec:\7lxxlrx.exe25⤵
- Executes dropped EXE
PID:4532 -
\??\c:\9bnhtn.exec:\9bnhtn.exe26⤵
- Executes dropped EXE
PID:5096 -
\??\c:\ppddj.exec:\ppddj.exe27⤵
- Executes dropped EXE
PID:1072 -
\??\c:\vpjjj.exec:\vpjjj.exe28⤵
- Executes dropped EXE
PID:3488 -
\??\c:\frrxxrx.exec:\frrxxrx.exe29⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nhbnhn.exec:\nhbnhn.exe30⤵
- Executes dropped EXE
PID:3156 -
\??\c:\tbbbbb.exec:\tbbbbb.exe31⤵
- Executes dropped EXE
PID:4576 -
\??\c:\vjpvp.exec:\vjpvp.exe32⤵
- Executes dropped EXE
PID:3940 -
\??\c:\lrxxrxx.exec:\lrxxrxx.exe33⤵
- Executes dropped EXE
PID:60 -
\??\c:\fxrlffl.exec:\fxrlffl.exe34⤵
- Executes dropped EXE
PID:2924 -
\??\c:\tbhbbb.exec:\tbhbbb.exe35⤵
- Executes dropped EXE
PID:2656 -
\??\c:\ppppp.exec:\ppppp.exe36⤵
- Executes dropped EXE
PID:1168 -
\??\c:\jdjjj.exec:\jdjjj.exe37⤵
- Executes dropped EXE
PID:4068 -
\??\c:\xrllffr.exec:\xrllffr.exe38⤵
- Executes dropped EXE
PID:4768 -
\??\c:\btbbbb.exec:\btbbbb.exe39⤵
- Executes dropped EXE
PID:3772 -
\??\c:\nthbbb.exec:\nthbbb.exe40⤵
- Executes dropped EXE
PID:4332 -
\??\c:\dvddd.exec:\dvddd.exe41⤵
- Executes dropped EXE
PID:4024 -
\??\c:\3jjdv.exec:\3jjdv.exe42⤵
- Executes dropped EXE
PID:400 -
\??\c:\ffrrrrr.exec:\ffrrrrr.exe43⤵
- Executes dropped EXE
PID:2272 -
\??\c:\hhnnnh.exec:\hhnnnh.exe44⤵
- Executes dropped EXE
PID:3356 -
\??\c:\3bhhhn.exec:\3bhhhn.exe45⤵
- Executes dropped EXE
PID:1824 -
\??\c:\3ddvd.exec:\3ddvd.exe46⤵
- Executes dropped EXE
PID:4300 -
\??\c:\1xrrrxx.exec:\1xrrrxx.exe47⤵
- Executes dropped EXE
PID:5116 -
\??\c:\fflffxl.exec:\fflffxl.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:760 -
\??\c:\nnbbbb.exec:\nnbbbb.exe49⤵
- Executes dropped EXE
PID:2044 -
\??\c:\pjjdd.exec:\pjjdd.exe50⤵
- Executes dropped EXE
PID:3636 -
\??\c:\jdjjj.exec:\jdjjj.exe51⤵
- Executes dropped EXE
PID:3324 -
\??\c:\llfflll.exec:\llfflll.exe52⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bbnttb.exec:\bbnttb.exe53⤵
- Executes dropped EXE
PID:3864 -
\??\c:\5thbhh.exec:\5thbhh.exe54⤵
- Executes dropped EXE
PID:1712 -
\??\c:\vpvvv.exec:\vpvvv.exe55⤵
- Executes dropped EXE
PID:1932 -
\??\c:\xffrrrf.exec:\xffrrrf.exe56⤵
- Executes dropped EXE
PID:3200 -
\??\c:\5nnhtt.exec:\5nnhtt.exe57⤵
- Executes dropped EXE
PID:3532 -
\??\c:\5frrlrr.exec:\5frrlrr.exe58⤵
- Executes dropped EXE
PID:4732 -
\??\c:\bhttnt.exec:\bhttnt.exe59⤵
- Executes dropped EXE
PID:4812 -
\??\c:\djvpv.exec:\djvpv.exe60⤵
- Executes dropped EXE
PID:4656 -
\??\c:\vvjjj.exec:\vvjjj.exe61⤵
- Executes dropped EXE
PID:1900 -
\??\c:\xflllfl.exec:\xflllfl.exe62⤵
- Executes dropped EXE
PID:2884 -
\??\c:\tnhnnh.exec:\tnhnnh.exe63⤵
- Executes dropped EXE
PID:4132 -
\??\c:\1vvvp.exec:\1vvvp.exe64⤵
- Executes dropped EXE
PID:924 -
\??\c:\rxrllll.exec:\rxrllll.exe65⤵
- Executes dropped EXE
PID:4464 -
\??\c:\htthbn.exec:\htthbn.exe66⤵PID:4860
-
\??\c:\fxrfxll.exec:\fxrfxll.exe67⤵PID:5088
-
\??\c:\thtnnn.exec:\thtnnn.exe68⤵PID:2320
-
\??\c:\jvjvd.exec:\jvjvd.exe69⤵PID:1480
-
\??\c:\lfrlxxr.exec:\lfrlxxr.exe70⤵PID:920
-
\??\c:\thtttt.exec:\thtttt.exe71⤵PID:4412
-
\??\c:\3jppd.exec:\3jppd.exe72⤵PID:1292
-
\??\c:\7rxrlll.exec:\7rxrlll.exe73⤵PID:4816
-
\??\c:\9fllrxf.exec:\9fllrxf.exe74⤵PID:3768
-
\??\c:\5bntnt.exec:\5bntnt.exe75⤵PID:1576
-
\??\c:\xlrrllr.exec:\xlrrllr.exe76⤵PID:3328
-
\??\c:\1hhbtt.exec:\1hhbtt.exe77⤵PID:2688
-
\??\c:\dpvjd.exec:\dpvjd.exe78⤵PID:1020
-
\??\c:\frxrrll.exec:\frxrrll.exe79⤵PID:1320
-
\??\c:\9nnnbt.exec:\9nnnbt.exe80⤵PID:880
-
\??\c:\1djvv.exec:\1djvv.exe81⤵PID:3820
-
\??\c:\llxxrll.exec:\llxxrll.exe82⤵PID:700
-
\??\c:\bhnhhh.exec:\bhnhhh.exe83⤵PID:60
-
\??\c:\pvjdd.exec:\pvjdd.exe84⤵PID:2724
-
\??\c:\fffffff.exec:\fffffff.exe85⤵PID:1168
-
\??\c:\nbtnbh.exec:\nbtnbh.exe86⤵PID:3028
-
\??\c:\1lrrlrl.exec:\1lrrlrl.exe87⤵PID:4240
-
\??\c:\nbhhhn.exec:\nbhhhn.exe88⤵PID:4644
-
\??\c:\jvdvv.exec:\jvdvv.exe89⤵PID:5080
-
\??\c:\hbttbb.exec:\hbttbb.exe90⤵PID:2004
-
\??\c:\jjddd.exec:\jjddd.exe91⤵PID:2936
-
\??\c:\nttnnt.exec:\nttnnt.exe92⤵PID:2272
-
\??\c:\pvddj.exec:\pvddj.exe93⤵PID:4292
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe94⤵PID:4848
-
\??\c:\btbhhh.exec:\btbhhh.exe95⤵PID:4300
-
\??\c:\dpjvj.exec:\dpjvj.exe96⤵PID:4108
-
\??\c:\7rxrllr.exec:\7rxrllr.exe97⤵PID:2508
-
\??\c:\3thbnn.exec:\3thbnn.exe98⤵PID:3116
-
\??\c:\bnbnnb.exec:\bnbnnb.exe99⤵PID:396
-
\??\c:\pjpjd.exec:\pjpjd.exe100⤵PID:3724
-
\??\c:\xfrxflx.exec:\xfrxflx.exe101⤵PID:3520
-
\??\c:\nntnnn.exec:\nntnnn.exe102⤵PID:3756
-
\??\c:\3pdvp.exec:\3pdvp.exe103⤵PID:3256
-
\??\c:\fxrrrxr.exec:\fxrrrxr.exe104⤵PID:4840
-
\??\c:\jdpjj.exec:\jdpjj.exe105⤵PID:2644
-
\??\c:\bhtnnh.exec:\bhtnnh.exe106⤵PID:1820
-
\??\c:\1dvjd.exec:\1dvjd.exe107⤵PID:5084
-
\??\c:\5rxxrxr.exec:\5rxxrxr.exe108⤵PID:4408
-
\??\c:\ttnnhn.exec:\ttnnhn.exe109⤵PID:3004
-
\??\c:\nthbtn.exec:\nthbtn.exe110⤵PID:4496
-
\??\c:\ddvpj.exec:\ddvpj.exe111⤵PID:2284
-
\??\c:\1rxxrff.exec:\1rxxrff.exe112⤵PID:392
-
\??\c:\tbhhht.exec:\tbhhht.exe113⤵PID:3924
-
\??\c:\jvvpj.exec:\jvvpj.exe114⤵PID:3496
-
\??\c:\ddjjd.exec:\ddjjd.exe115⤵PID:1048
-
\??\c:\xrfrlfx.exec:\xrfrlfx.exe116⤵PID:4276
-
\??\c:\bbtnnn.exec:\bbtnnn.exe117⤵PID:516
-
\??\c:\vvvpj.exec:\vvvpj.exe118⤵PID:2768
-
\??\c:\rrffrrl.exec:\rrffrrl.exe119⤵PID:4748
-
\??\c:\thbbbh.exec:\thbbbh.exe120⤵PID:3128
-
\??\c:\ttbttt.exec:\ttbttt.exe121⤵PID:1708
-
\??\c:\pjddj.exec:\pjddj.exe122⤵PID:1936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-