Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1912c906daf4a92d408612cc9add38d0c2e522d97218d9d34dc096b72f932840N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
1912c906daf4a92d408612cc9add38d0c2e522d97218d9d34dc096b72f932840N.exe
-
Size
454KB
-
MD5
f505569a977511e07499723fa2c2d7f0
-
SHA1
9c53ac8fb2e2ff0fd38f31917391c336a24277fc
-
SHA256
1912c906daf4a92d408612cc9add38d0c2e522d97218d9d34dc096b72f932840
-
SHA512
4edfe5afdec2ccb4de5460175f2e9beb022bb845ba3ad650f4689d22180fca4a3fd193a15a5b10dfdf4766cd90fee7203013ec25e712f2f6a22420b5422879fc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1964-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1732-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/892-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/664-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/840-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/768-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/892-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2748-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-941-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-2295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1800 rxxrrxf.exe 2428 pppjj.exe 4928 hnnntb.exe 3856 nhnnnn.exe 4076 djdvv.exe 1064 lflllrr.exe 1732 ntttnn.exe 2788 ttbbhn.exe 3096 vvvvp.exe 4488 rffflxx.exe 3692 tnbhbb.exe 1052 ntnbbn.exe 1748 ffxxrxf.exe 4252 rlllffx.exe 3136 bnbhbn.exe 3744 xlllfff.exe 1364 hhnhnn.exe 4752 thtnhb.exe 4164 dddvv.exe 5068 9frfllr.exe 2132 hnhbnn.exe 4908 jvddj.exe 2356 lrrrrrl.exe 2884 vpjdd.exe 1452 rrrrlll.exe 3232 nbhbbh.exe 1456 dvjjj.exe 4960 lrxlxlx.exe 4884 ppvvp.exe 5116 xrrrrrr.exe 4152 rrxxxff.exe 468 hhbbtb.exe 4036 dppvv.exe 2776 1nnhbb.exe 3432 dpjdp.exe 3468 3xxxxll.exe 4468 tbhntt.exe 4848 7vdvv.exe 1480 llrlfll.exe 892 nhhhbh.exe 3104 rffffff.exe 3896 bhhhhn.exe 5108 ddddv.exe 2056 lrrlxlf.exe 664 httttt.exe 2848 vvpdd.exe 2748 1rrrrrr.exe 1660 hnbbhn.exe 4720 3jppj.exe 816 7lrlfff.exe 3660 hnnhbb.exe 2428 pjddj.exe 4876 lllffff.exe 2916 ntttnt.exe 3856 9jddv.exe 1984 xxrllff.exe 2592 tbhhhh.exe 4108 hbhbbb.exe 3768 ppddj.exe 1732 lffxllf.exe 2564 5tnhbb.exe 3992 vdvdv.exe 4072 fllrlll.exe 2588 fllfxxr.exe -
resource yara_rule behavioral2/memory/1964-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1732-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4252-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/892-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/664-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4252-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/840-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/768-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/892-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2748-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2664-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-591-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1964 wrote to memory of 1800 1964 1912c906daf4a92d408612cc9add38d0c2e522d97218d9d34dc096b72f932840N.exe 83 PID 1964 wrote to memory of 1800 1964 1912c906daf4a92d408612cc9add38d0c2e522d97218d9d34dc096b72f932840N.exe 83 PID 1964 wrote to memory of 1800 1964 1912c906daf4a92d408612cc9add38d0c2e522d97218d9d34dc096b72f932840N.exe 83 PID 1800 wrote to memory of 2428 1800 rxxrrxf.exe 84 PID 1800 wrote to memory of 2428 1800 rxxrrxf.exe 84 PID 1800 wrote to memory of 2428 1800 rxxrrxf.exe 84 PID 2428 wrote to memory of 4928 2428 pppjj.exe 85 PID 2428 wrote to memory of 4928 2428 pppjj.exe 85 PID 2428 wrote to memory of 4928 2428 pppjj.exe 85 PID 4928 wrote to memory of 3856 4928 hnnntb.exe 86 PID 4928 wrote to memory of 3856 4928 hnnntb.exe 86 PID 4928 wrote to memory of 3856 4928 hnnntb.exe 86 PID 3856 wrote to memory of 4076 3856 nhnnnn.exe 87 PID 3856 wrote to memory of 4076 3856 nhnnnn.exe 87 PID 3856 wrote to memory of 4076 3856 nhnnnn.exe 87 PID 4076 wrote to memory of 1064 4076 djdvv.exe 88 PID 4076 wrote to memory of 1064 4076 djdvv.exe 88 PID 4076 wrote to memory of 1064 4076 djdvv.exe 88 PID 1064 wrote to memory of 1732 1064 lflllrr.exe 89 PID 1064 wrote to memory of 1732 1064 lflllrr.exe 89 PID 1064 wrote to memory of 1732 1064 lflllrr.exe 89 PID 1732 wrote to memory of 2788 1732 ntttnn.exe 90 PID 1732 wrote to memory of 2788 1732 ntttnn.exe 90 PID 1732 wrote to memory of 2788 1732 ntttnn.exe 90 PID 2788 wrote to memory of 3096 2788 ttbbhn.exe 91 PID 2788 wrote to memory of 3096 2788 ttbbhn.exe 91 PID 2788 wrote to memory of 3096 2788 ttbbhn.exe 91 PID 3096 wrote to memory of 4488 3096 vvvvp.exe 92 PID 3096 wrote to memory of 4488 3096 vvvvp.exe 92 PID 3096 wrote to memory of 4488 3096 vvvvp.exe 92 PID 4488 wrote to memory of 3692 4488 rffflxx.exe 93 PID 4488 wrote to memory of 3692 4488 rffflxx.exe 93 PID 4488 wrote to memory of 3692 4488 rffflxx.exe 93 PID 3692 wrote to memory of 1052 3692 tnbhbb.exe 94 PID 3692 wrote to memory of 1052 3692 tnbhbb.exe 94 PID 3692 wrote to memory of 1052 3692 tnbhbb.exe 94 PID 1052 wrote to memory of 1748 1052 ntnbbn.exe 95 PID 1052 wrote to memory of 1748 1052 ntnbbn.exe 95 PID 1052 wrote to memory of 1748 1052 ntnbbn.exe 95 PID 1748 wrote to memory of 4252 1748 ffxxrxf.exe 96 PID 1748 wrote to memory of 4252 1748 ffxxrxf.exe 96 PID 1748 wrote to memory of 4252 1748 ffxxrxf.exe 96 PID 4252 wrote to memory of 3136 4252 rlllffx.exe 97 PID 4252 wrote to memory of 3136 4252 rlllffx.exe 97 PID 4252 wrote to memory of 3136 4252 rlllffx.exe 97 PID 3136 wrote to memory of 3744 3136 bnbhbn.exe 98 PID 3136 wrote to memory of 3744 3136 bnbhbn.exe 98 PID 3136 wrote to memory of 3744 3136 bnbhbn.exe 98 PID 3744 wrote to memory of 1364 3744 xlllfff.exe 99 PID 3744 wrote to memory of 1364 3744 xlllfff.exe 99 PID 3744 wrote to memory of 1364 3744 xlllfff.exe 99 PID 1364 wrote to memory of 4752 1364 hhnhnn.exe 100 PID 1364 wrote to memory of 4752 1364 hhnhnn.exe 100 PID 1364 wrote to memory of 4752 1364 hhnhnn.exe 100 PID 4752 wrote to memory of 4164 4752 thtnhb.exe 101 PID 4752 wrote to memory of 4164 4752 thtnhb.exe 101 PID 4752 wrote to memory of 4164 4752 thtnhb.exe 101 PID 4164 wrote to memory of 5068 4164 dddvv.exe 102 PID 4164 wrote to memory of 5068 4164 dddvv.exe 102 PID 4164 wrote to memory of 5068 4164 dddvv.exe 102 PID 5068 wrote to memory of 2132 5068 9frfllr.exe 103 PID 5068 wrote to memory of 2132 5068 9frfllr.exe 103 PID 5068 wrote to memory of 2132 5068 9frfllr.exe 103 PID 2132 wrote to memory of 4908 2132 hnhbnn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\1912c906daf4a92d408612cc9add38d0c2e522d97218d9d34dc096b72f932840N.exe"C:\Users\Admin\AppData\Local\Temp\1912c906daf4a92d408612cc9add38d0c2e522d97218d9d34dc096b72f932840N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\rxxrrxf.exec:\rxxrrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\pppjj.exec:\pppjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\hnnntb.exec:\hnnntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\nhnnnn.exec:\nhnnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\djdvv.exec:\djdvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\lflllrr.exec:\lflllrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\ntttnn.exec:\ntttnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\ttbbhn.exec:\ttbbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\vvvvp.exec:\vvvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\rffflxx.exec:\rffflxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\tnbhbb.exec:\tnbhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\ntnbbn.exec:\ntnbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\ffxxrxf.exec:\ffxxrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\rlllffx.exec:\rlllffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\bnbhbn.exec:\bnbhbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\xlllfff.exec:\xlllfff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\hhnhnn.exec:\hhnhnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\thtnhb.exec:\thtnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\dddvv.exec:\dddvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\9frfllr.exec:\9frfllr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\hnhbnn.exec:\hnhbnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\jvddj.exec:\jvddj.exe23⤵
- Executes dropped EXE
PID:4908 -
\??\c:\lrrrrrl.exec:\lrrrrrl.exe24⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vpjdd.exec:\vpjdd.exe25⤵
- Executes dropped EXE
PID:2884 -
\??\c:\rrrrlll.exec:\rrrrlll.exe26⤵
- Executes dropped EXE
PID:1452 -
\??\c:\nbhbbh.exec:\nbhbbh.exe27⤵
- Executes dropped EXE
PID:3232 -
\??\c:\dvjjj.exec:\dvjjj.exe28⤵
- Executes dropped EXE
PID:1456 -
\??\c:\lrxlxlx.exec:\lrxlxlx.exe29⤵
- Executes dropped EXE
PID:4960 -
\??\c:\ppvvp.exec:\ppvvp.exe30⤵
- Executes dropped EXE
PID:4884 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe31⤵
- Executes dropped EXE
PID:5116 -
\??\c:\rrxxxff.exec:\rrxxxff.exe32⤵
- Executes dropped EXE
PID:4152 -
\??\c:\hhbbtb.exec:\hhbbtb.exe33⤵
- Executes dropped EXE
PID:468 -
\??\c:\dppvv.exec:\dppvv.exe34⤵
- Executes dropped EXE
PID:4036 -
\??\c:\1nnhbb.exec:\1nnhbb.exe35⤵
- Executes dropped EXE
PID:2776 -
\??\c:\dpjdp.exec:\dpjdp.exe36⤵
- Executes dropped EXE
PID:3432 -
\??\c:\3xxxxll.exec:\3xxxxll.exe37⤵
- Executes dropped EXE
PID:3468 -
\??\c:\tbhntt.exec:\tbhntt.exe38⤵
- Executes dropped EXE
PID:4468 -
\??\c:\7vdvv.exec:\7vdvv.exe39⤵
- Executes dropped EXE
PID:4848 -
\??\c:\llrlfll.exec:\llrlfll.exe40⤵
- Executes dropped EXE
PID:1480 -
\??\c:\nhhhbh.exec:\nhhhbh.exe41⤵
- Executes dropped EXE
PID:892 -
\??\c:\rffffff.exec:\rffffff.exe42⤵
- Executes dropped EXE
PID:3104 -
\??\c:\bhhhhn.exec:\bhhhhn.exe43⤵
- Executes dropped EXE
PID:3896 -
\??\c:\ddddv.exec:\ddddv.exe44⤵
- Executes dropped EXE
PID:5108 -
\??\c:\lrrlxlf.exec:\lrrlxlf.exe45⤵
- Executes dropped EXE
PID:2056 -
\??\c:\httttt.exec:\httttt.exe46⤵
- Executes dropped EXE
PID:664 -
\??\c:\vvpdd.exec:\vvpdd.exe47⤵
- Executes dropped EXE
PID:2848 -
\??\c:\1rrrrrr.exec:\1rrrrrr.exe48⤵
- Executes dropped EXE
PID:2748 -
\??\c:\hnbbhn.exec:\hnbbhn.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1660 -
\??\c:\3jppj.exec:\3jppj.exe50⤵
- Executes dropped EXE
PID:4720 -
\??\c:\7lrlfff.exec:\7lrlfff.exe51⤵
- Executes dropped EXE
PID:816 -
\??\c:\hnnhbb.exec:\hnnhbb.exe52⤵
- Executes dropped EXE
PID:3660 -
\??\c:\pjddj.exec:\pjddj.exe53⤵
- Executes dropped EXE
PID:2428 -
\??\c:\lllffff.exec:\lllffff.exe54⤵
- Executes dropped EXE
PID:4876 -
\??\c:\ntttnt.exec:\ntttnt.exe55⤵
- Executes dropped EXE
PID:2916 -
\??\c:\9jddv.exec:\9jddv.exe56⤵
- Executes dropped EXE
PID:3856 -
\??\c:\xxrllff.exec:\xxrllff.exe57⤵
- Executes dropped EXE
PID:1984 -
\??\c:\tbhhhh.exec:\tbhhhh.exe58⤵
- Executes dropped EXE
PID:2592 -
\??\c:\hbhbbb.exec:\hbhbbb.exe59⤵
- Executes dropped EXE
PID:4108 -
\??\c:\ppddj.exec:\ppddj.exe60⤵
- Executes dropped EXE
PID:3768 -
\??\c:\lffxllf.exec:\lffxllf.exe61⤵
- Executes dropped EXE
PID:1732 -
\??\c:\5tnhbb.exec:\5tnhbb.exe62⤵
- Executes dropped EXE
PID:2564 -
\??\c:\vdvdv.exec:\vdvdv.exe63⤵
- Executes dropped EXE
PID:3992 -
\??\c:\fllrlll.exec:\fllrlll.exe64⤵
- Executes dropped EXE
PID:4072 -
\??\c:\fllfxxr.exec:\fllfxxr.exe65⤵
- Executes dropped EXE
PID:2588 -
\??\c:\bhntbn.exec:\bhntbn.exe66⤵PID:5072
-
\??\c:\vvpjv.exec:\vvpjv.exe67⤵PID:2120
-
\??\c:\1flfffx.exec:\1flfffx.exe68⤵PID:3024
-
\??\c:\rflfrrr.exec:\rflfrrr.exe69⤵PID:4252
-
\??\c:\bbbnnh.exec:\bbbnnh.exe70⤵PID:4696
-
\??\c:\pjvjd.exec:\pjvjd.exe71⤵PID:2496
-
\??\c:\1lfrfxl.exec:\1lfrfxl.exe72⤵PID:2224
-
\??\c:\tbnnhn.exec:\tbnnhn.exe73⤵PID:4372
-
\??\c:\pdjdd.exec:\pdjdd.exe74⤵PID:3476
-
\??\c:\3xlllll.exec:\3xlllll.exe75⤵PID:4752
-
\??\c:\nbbtnn.exec:\nbbtnn.exe76⤵PID:744
-
\??\c:\5ddpj.exec:\5ddpj.exe77⤵PID:3268
-
\??\c:\7xrlllf.exec:\7xrlllf.exe78⤵PID:2160
-
\??\c:\bthbbb.exec:\bthbbb.exe79⤵PID:3712
-
\??\c:\9bbttb.exec:\9bbttb.exe80⤵PID:3848
-
\??\c:\jjvvd.exec:\jjvvd.exe81⤵PID:3960
-
\??\c:\fxxfxlr.exec:\fxxfxlr.exe82⤵PID:2884
-
\??\c:\1bbhbt.exec:\1bbhbt.exe83⤵PID:3820
-
\??\c:\ntttnt.exec:\ntttnt.exe84⤵PID:3596
-
\??\c:\dvdvp.exec:\dvdvp.exe85⤵PID:840
-
\??\c:\ffrxrfx.exec:\ffrxrfx.exe86⤵PID:2988
-
\??\c:\5tnhbh.exec:\5tnhbh.exe87⤵PID:4960
-
\??\c:\vvddd.exec:\vvddd.exe88⤵PID:4224
-
\??\c:\lllxrxr.exec:\lllxrxr.exe89⤵PID:768
-
\??\c:\5xxxxxr.exec:\5xxxxxr.exe90⤵PID:1200
-
\??\c:\hnttnt.exec:\hnttnt.exe91⤵PID:2628
-
\??\c:\ddvvp.exec:\ddvvp.exe92⤵PID:3384
-
\??\c:\rlffxfx.exec:\rlffxfx.exe93⤵PID:1968
-
\??\c:\nbtnbb.exec:\nbtnbb.exe94⤵PID:3132
-
\??\c:\djjjd.exec:\djjjd.exe95⤵PID:1648
-
\??\c:\9vpdd.exec:\9vpdd.exe96⤵PID:3280
-
\??\c:\3lxxxfl.exec:\3lxxxfl.exe97⤵PID:4740
-
\??\c:\tbbhhh.exec:\tbbhhh.exe98⤵PID:2304
-
\??\c:\pvvvp.exec:\pvvvp.exe99⤵PID:3620
-
\??\c:\lxllffx.exec:\lxllffx.exe100⤵PID:1480
-
\??\c:\lfllffx.exec:\lfllffx.exe101⤵PID:892
-
\??\c:\nntntb.exec:\nntntb.exe102⤵PID:4524
-
\??\c:\pjpjp.exec:\pjpjp.exe103⤵PID:4552
-
\??\c:\ddvjj.exec:\ddvjj.exe104⤵PID:5108
-
\??\c:\lxrllrl.exec:\lxrllrl.exe105⤵PID:5032
-
\??\c:\hnbnhb.exec:\hnbnhb.exe106⤵PID:1676
-
\??\c:\nttnhb.exec:\nttnhb.exe107⤵PID:3988
-
\??\c:\5jdvj.exec:\5jdvj.exe108⤵PID:2748
-
\??\c:\5rfxlxr.exec:\5rfxlxr.exe109⤵PID:3108
-
\??\c:\tttnnn.exec:\tttnnn.exe110⤵PID:2408
-
\??\c:\9ddvp.exec:\9ddvp.exe111⤵PID:324
-
\??\c:\1jvdp.exec:\1jvdp.exe112⤵PID:4952
-
\??\c:\fxfxxrr.exec:\fxfxxrr.exe113⤵PID:1980
-
\??\c:\frrfxrx.exec:\frrfxrx.exe114⤵PID:3140
-
\??\c:\tnthnh.exec:\tnthnh.exe115⤵PID:2452
-
\??\c:\5jdvp.exec:\5jdvp.exe116⤵PID:4472
-
\??\c:\3flxrxl.exec:\3flxrxl.exe117⤵PID:3528
-
\??\c:\xrffrfx.exec:\xrffrfx.exe118⤵PID:4320
-
\??\c:\bbnhnh.exec:\bbnhnh.exe119⤵PID:1192
-
\??\c:\pdvjj.exec:\pdvjj.exe120⤵PID:1220
-
\??\c:\3rxrxxl.exec:\3rxrxxl.exe121⤵PID:2104
-
\??\c:\bhtnhb.exec:\bhtnhb.exe122⤵PID:2564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-