Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2025, 09:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe
-
Size
454KB
-
MD5
54cfbe2a1c7bd739fd53a7066ba9c02e
-
SHA1
7eb9ea5d7d2df34c520702a33d1f2a8ea908562c
-
SHA256
929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be
-
SHA512
70810c39f33e86dea480580f5aec356edb6c4882e0249581a7b7e4af8ac13d458a09c92b02bd9f03573f8ad2804841a9873f15b2b62337c9b5843ecb9dd91945
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1560-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2864-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3380-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3272-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/688-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/620-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1516-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1340-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2784-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2916-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/312-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-692-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-729-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-733-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-746-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-802-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-1005-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-1066-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-1517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/660-1710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2368 lffrlfx.exe 1804 nhttnn.exe 5032 jdvvj.exe 3712 nhbbtt.exe 4692 3frflfl.exe 3708 pdjdv.exe 2864 rrxrrlr.exe 4552 tnttbt.exe 3536 jvjdv.exe 2128 nnhtnn.exe 1456 hhnhbb.exe 4632 lxrlxll.exe 5044 vvpjd.exe 748 9htnhh.exe 3448 vpvjj.exe 3380 xlrlxxr.exe 3312 dvdvp.exe 5068 llrlxlf.exe 4768 tnbbbb.exe 3272 vpvvp.exe 2920 hhttnt.exe 4848 dppjj.exe 368 vdppp.exe 3740 dvdvp.exe 688 lffxrxf.exe 5088 bnthth.exe 1052 htthbt.exe 2076 pjpdv.exe 1668 xxrrrxl.exe 620 hhbbnn.exe 2908 djjvj.exe 4076 vvvdj.exe 2868 vdppj.exe 2612 lrrrlrf.exe 1780 rrffflf.exe 1516 5tbbbh.exe 1224 djpvv.exe 1792 lrxrllf.exe 2780 lllflxf.exe 5108 vjjjj.exe 3452 dvpjp.exe 1032 llxxrrr.exe 5048 ttbtnn.exe 312 tthhhh.exe 3724 ppjdv.exe 404 rlxlfff.exe 2344 ntbtnh.exe 4496 lfxxflr.exe 4264 lrrxrfx.exe 4208 htbbtb.exe 4868 dpddv.exe 4488 pdddd.exe 4780 lxrlllx.exe 3620 ttnhtt.exe 2596 dvpjj.exe 1164 lllflff.exe 1340 nbhbbt.exe 4012 7vpjd.exe 3108 7lfxrll.exe 2984 7btbbh.exe 4692 lfrlrrx.exe 3964 lfffxff.exe 4284 btbtth.exe 400 vppjp.exe -
resource yara_rule behavioral2/memory/1560-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2864-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3380-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3272-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/688-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/620-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1516-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1164-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1340-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2784-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/312-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3312-733-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-746-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1560 wrote to memory of 2368 1560 929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe 82 PID 1560 wrote to memory of 2368 1560 929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe 82 PID 1560 wrote to memory of 2368 1560 929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe 82 PID 2368 wrote to memory of 1804 2368 lffrlfx.exe 83 PID 2368 wrote to memory of 1804 2368 lffrlfx.exe 83 PID 2368 wrote to memory of 1804 2368 lffrlfx.exe 83 PID 1804 wrote to memory of 5032 1804 nhttnn.exe 84 PID 1804 wrote to memory of 5032 1804 nhttnn.exe 84 PID 1804 wrote to memory of 5032 1804 nhttnn.exe 84 PID 5032 wrote to memory of 3712 5032 jdvvj.exe 85 PID 5032 wrote to memory of 3712 5032 jdvvj.exe 85 PID 5032 wrote to memory of 3712 5032 jdvvj.exe 85 PID 3712 wrote to memory of 4692 3712 nhbbtt.exe 86 PID 3712 wrote to memory of 4692 3712 nhbbtt.exe 86 PID 3712 wrote to memory of 4692 3712 nhbbtt.exe 86 PID 4692 wrote to memory of 3708 4692 3frflfl.exe 87 PID 4692 wrote to memory of 3708 4692 3frflfl.exe 87 PID 4692 wrote to memory of 3708 4692 3frflfl.exe 87 PID 3708 wrote to memory of 2864 3708 pdjdv.exe 88 PID 3708 wrote to memory of 2864 3708 pdjdv.exe 88 PID 3708 wrote to memory of 2864 3708 pdjdv.exe 88 PID 2864 wrote to memory of 4552 2864 rrxrrlr.exe 89 PID 2864 wrote to memory of 4552 2864 rrxrrlr.exe 89 PID 2864 wrote to memory of 4552 2864 rrxrrlr.exe 89 PID 4552 wrote to memory of 3536 4552 tnttbt.exe 90 PID 4552 wrote to memory of 3536 4552 tnttbt.exe 90 PID 4552 wrote to memory of 3536 4552 tnttbt.exe 90 PID 3536 wrote to memory of 2128 3536 jvjdv.exe 91 PID 3536 wrote to memory of 2128 3536 jvjdv.exe 91 PID 3536 wrote to memory of 2128 3536 jvjdv.exe 91 PID 2128 wrote to memory of 1456 2128 nnhtnn.exe 92 PID 2128 wrote to memory of 1456 2128 nnhtnn.exe 92 PID 2128 wrote to memory of 1456 2128 nnhtnn.exe 92 PID 1456 wrote to memory of 4632 1456 hhnhbb.exe 93 PID 1456 wrote to memory of 4632 1456 hhnhbb.exe 93 PID 1456 wrote to memory of 4632 1456 hhnhbb.exe 93 PID 4632 wrote to memory of 5044 4632 lxrlxll.exe 94 PID 4632 wrote to memory of 5044 4632 lxrlxll.exe 94 PID 4632 wrote to memory of 5044 4632 lxrlxll.exe 94 PID 5044 wrote to memory of 748 5044 vvpjd.exe 95 PID 5044 wrote to memory of 748 5044 vvpjd.exe 95 PID 5044 wrote to memory of 748 5044 vvpjd.exe 95 PID 748 wrote to memory of 3448 748 9htnhh.exe 96 PID 748 wrote to memory of 3448 748 9htnhh.exe 96 PID 748 wrote to memory of 3448 748 9htnhh.exe 96 PID 3448 wrote to memory of 3380 3448 vpvjj.exe 97 PID 3448 wrote to memory of 3380 3448 vpvjj.exe 97 PID 3448 wrote to memory of 3380 3448 vpvjj.exe 97 PID 3380 wrote to memory of 3312 3380 xlrlxxr.exe 98 PID 3380 wrote to memory of 3312 3380 xlrlxxr.exe 98 PID 3380 wrote to memory of 3312 3380 xlrlxxr.exe 98 PID 3312 wrote to memory of 5068 3312 dvdvp.exe 99 PID 3312 wrote to memory of 5068 3312 dvdvp.exe 99 PID 3312 wrote to memory of 5068 3312 dvdvp.exe 99 PID 5068 wrote to memory of 4768 5068 llrlxlf.exe 100 PID 5068 wrote to memory of 4768 5068 llrlxlf.exe 100 PID 5068 wrote to memory of 4768 5068 llrlxlf.exe 100 PID 4768 wrote to memory of 3272 4768 tnbbbb.exe 101 PID 4768 wrote to memory of 3272 4768 tnbbbb.exe 101 PID 4768 wrote to memory of 3272 4768 tnbbbb.exe 101 PID 3272 wrote to memory of 2920 3272 vpvvp.exe 102 PID 3272 wrote to memory of 2920 3272 vpvvp.exe 102 PID 3272 wrote to memory of 2920 3272 vpvvp.exe 102 PID 2920 wrote to memory of 4848 2920 hhttnt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe"C:\Users\Admin\AppData\Local\Temp\929a61ee1af971d08371a7ee7379a044c641a7c8a1a3f867526f79b1231601be.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\lffrlfx.exec:\lffrlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\nhttnn.exec:\nhttnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\jdvvj.exec:\jdvvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\nhbbtt.exec:\nhbbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\3frflfl.exec:\3frflfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\pdjdv.exec:\pdjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\rrxrrlr.exec:\rrxrrlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\tnttbt.exec:\tnttbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\jvjdv.exec:\jvjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\nnhtnn.exec:\nnhtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\hhnhbb.exec:\hhnhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\lxrlxll.exec:\lxrlxll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\vvpjd.exec:\vvpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\9htnhh.exec:\9htnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\vpvjj.exec:\vpvjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\xlrlxxr.exec:\xlrlxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\dvdvp.exec:\dvdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\llrlxlf.exec:\llrlxlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\tnbbbb.exec:\tnbbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\vpvvp.exec:\vpvvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\hhttnt.exec:\hhttnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\dppjj.exec:\dppjj.exe23⤵
- Executes dropped EXE
PID:4848 -
\??\c:\vdppp.exec:\vdppp.exe24⤵
- Executes dropped EXE
PID:368 -
\??\c:\dvdvp.exec:\dvdvp.exe25⤵
- Executes dropped EXE
PID:3740 -
\??\c:\lffxrxf.exec:\lffxrxf.exe26⤵
- Executes dropped EXE
PID:688 -
\??\c:\bnthth.exec:\bnthth.exe27⤵
- Executes dropped EXE
PID:5088 -
\??\c:\htthbt.exec:\htthbt.exe28⤵
- Executes dropped EXE
PID:1052 -
\??\c:\pjpdv.exec:\pjpdv.exe29⤵
- Executes dropped EXE
PID:2076 -
\??\c:\xxrrrxl.exec:\xxrrrxl.exe30⤵
- Executes dropped EXE
PID:1668 -
\??\c:\hhbbnn.exec:\hhbbnn.exe31⤵
- Executes dropped EXE
PID:620 -
\??\c:\djjvj.exec:\djjvj.exe32⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vvvdj.exec:\vvvdj.exe33⤵
- Executes dropped EXE
PID:4076 -
\??\c:\vdppj.exec:\vdppj.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2868 -
\??\c:\lrrrlrf.exec:\lrrrlrf.exe35⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rrffflf.exec:\rrffflf.exe36⤵
- Executes dropped EXE
PID:1780 -
\??\c:\5tbbbh.exec:\5tbbbh.exe37⤵
- Executes dropped EXE
PID:1516 -
\??\c:\djpvv.exec:\djpvv.exe38⤵
- Executes dropped EXE
PID:1224 -
\??\c:\lrxrllf.exec:\lrxrllf.exe39⤵
- Executes dropped EXE
PID:1792 -
\??\c:\lllflxf.exec:\lllflxf.exe40⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vjjjj.exec:\vjjjj.exe41⤵
- Executes dropped EXE
PID:5108 -
\??\c:\dvpjp.exec:\dvpjp.exe42⤵
- Executes dropped EXE
PID:3452 -
\??\c:\llxxrrr.exec:\llxxrrr.exe43⤵
- Executes dropped EXE
PID:1032 -
\??\c:\ttbtnn.exec:\ttbtnn.exe44⤵
- Executes dropped EXE
PID:5048 -
\??\c:\tthhhh.exec:\tthhhh.exe45⤵
- Executes dropped EXE
PID:312 -
\??\c:\ppjdv.exec:\ppjdv.exe46⤵
- Executes dropped EXE
PID:3724 -
\??\c:\rlxlfff.exec:\rlxlfff.exe47⤵
- Executes dropped EXE
PID:404 -
\??\c:\ntbtnh.exec:\ntbtnh.exe48⤵
- Executes dropped EXE
PID:2344 -
\??\c:\lfxxflr.exec:\lfxxflr.exe49⤵
- Executes dropped EXE
PID:4496 -
\??\c:\lrrxrfx.exec:\lrrxrfx.exe50⤵
- Executes dropped EXE
PID:4264 -
\??\c:\htbbtb.exec:\htbbtb.exe51⤵
- Executes dropped EXE
PID:4208 -
\??\c:\dpddv.exec:\dpddv.exe52⤵
- Executes dropped EXE
PID:4868 -
\??\c:\pdddd.exec:\pdddd.exe53⤵
- Executes dropped EXE
PID:4488 -
\??\c:\lxrlllx.exec:\lxrlllx.exe54⤵
- Executes dropped EXE
PID:4780 -
\??\c:\ttnhtt.exec:\ttnhtt.exe55⤵
- Executes dropped EXE
PID:3620 -
\??\c:\dvpjj.exec:\dvpjj.exe56⤵
- Executes dropped EXE
PID:2596 -
\??\c:\lllflff.exec:\lllflff.exe57⤵
- Executes dropped EXE
PID:1164 -
\??\c:\nbhbbt.exec:\nbhbbt.exe58⤵
- Executes dropped EXE
PID:1340 -
\??\c:\7vpjd.exec:\7vpjd.exe59⤵
- Executes dropped EXE
PID:4012 -
\??\c:\7lfxrll.exec:\7lfxrll.exe60⤵
- Executes dropped EXE
PID:3108 -
\??\c:\7btbbh.exec:\7btbbh.exe61⤵
- Executes dropped EXE
PID:2984 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe62⤵
- Executes dropped EXE
PID:4692 -
\??\c:\lfffxff.exec:\lfffxff.exe63⤵
- Executes dropped EXE
PID:3964 -
\??\c:\btbtth.exec:\btbtth.exe64⤵
- Executes dropped EXE
PID:4284 -
\??\c:\vppjp.exec:\vppjp.exe65⤵
- Executes dropped EXE
PID:400 -
\??\c:\5ffxxff.exec:\5ffxxff.exe66⤵PID:2328
-
\??\c:\xxrlxxf.exec:\xxrlxxf.exe67⤵PID:3252
-
\??\c:\btbnhh.exec:\btbnhh.exe68⤵PID:1176
-
\??\c:\vjppj.exec:\vjppj.exe69⤵PID:4344
-
\??\c:\rxrrrrr.exec:\rxrrrrr.exe70⤵PID:2396
-
\??\c:\rrlxxfl.exec:\rrlxxfl.exe71⤵PID:5064
-
\??\c:\hbhbtt.exec:\hbhbtt.exe72⤵PID:1128
-
\??\c:\dpddd.exec:\dpddd.exe73⤵PID:4632
-
\??\c:\rfrlrrr.exec:\rfrlrrr.exe74⤵PID:4880
-
\??\c:\nhnnhh.exec:\nhnnhh.exe75⤵PID:5092
-
\??\c:\hbhnbn.exec:\hbhnbn.exe76⤵PID:3824
-
\??\c:\jppjd.exec:\jppjd.exe77⤵PID:100
-
\??\c:\xfllrlr.exec:\xfllrlr.exe78⤵PID:3004
-
\??\c:\nntbbb.exec:\nntbbb.exe79⤵PID:2032
-
\??\c:\5dddd.exec:\5dddd.exe80⤵PID:3044
-
\??\c:\jvvdj.exec:\jvvdj.exe81⤵PID:5068
-
\??\c:\frrxxxf.exec:\frrxxxf.exe82⤵PID:1840
-
\??\c:\1thbtb.exec:\1thbtb.exe83⤵PID:1848
-
\??\c:\pvdvv.exec:\pvdvv.exe84⤵PID:4572
-
\??\c:\ffllfff.exec:\ffllfff.exe85⤵PID:3404
-
\??\c:\9tnbtt.exec:\9tnbtt.exe86⤵PID:3916
-
\??\c:\jvjjd.exec:\jvjjd.exe87⤵PID:2308
-
\??\c:\5vvpd.exec:\5vvpd.exe88⤵PID:1776
-
\??\c:\xxrlrlr.exec:\xxrlrlr.exe89⤵PID:552
-
\??\c:\bbbtnh.exec:\bbbtnh.exe90⤵PID:1772
-
\??\c:\jdvpj.exec:\jdvpj.exe91⤵PID:4896
-
\??\c:\rffllfr.exec:\rffllfr.exe92⤵PID:3188
-
\??\c:\frxxxxx.exec:\frxxxxx.exe93⤵PID:5080
-
\??\c:\ntbnhh.exec:\ntbnhh.exe94⤵PID:2224
-
\??\c:\jvvpv.exec:\jvvpv.exe95⤵PID:1964
-
\??\c:\xxfrllf.exec:\xxfrllf.exe96⤵PID:4952
-
\??\c:\tbnhbb.exec:\tbnhbb.exe97⤵PID:4432
-
\??\c:\nthntb.exec:\nthntb.exe98⤵PID:444
-
\??\c:\vpdvd.exec:\vpdvd.exe99⤵PID:2784
-
\??\c:\xxfxllx.exec:\xxfxllx.exe100⤵PID:4100
-
\??\c:\9nhhhh.exec:\9nhhhh.exe101⤵PID:1948
-
\??\c:\dppjj.exec:\dppjj.exe102⤵PID:2916
-
\??\c:\djppj.exec:\djppj.exe103⤵PID:1136
-
\??\c:\llffrrr.exec:\llffrrr.exe104⤵PID:4204
-
\??\c:\bbbbtt.exec:\bbbbtt.exe105⤵PID:3532
-
\??\c:\jvdvp.exec:\jvdvp.exe106⤵PID:388
-
\??\c:\vppjd.exec:\vppjd.exe107⤵PID:2560
-
\??\c:\xlxrllf.exec:\xlxrllf.exe108⤵PID:5108
-
\??\c:\nbnhbt.exec:\nbnhbt.exe109⤵PID:4348
-
\??\c:\thnnnn.exec:\thnnnn.exe110⤵PID:1032
-
\??\c:\vvddd.exec:\vvddd.exe111⤵PID:5048
-
\??\c:\pvjpj.exec:\pvjpj.exe112⤵PID:312
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe113⤵PID:832
-
\??\c:\bntnbt.exec:\bntnbt.exe114⤵PID:2968
-
\??\c:\ppvpp.exec:\ppvpp.exe115⤵PID:2204
-
\??\c:\fxrlffx.exec:\fxrlffx.exe116⤵PID:4496
-
\??\c:\1xfxxff.exec:\1xfxxff.exe117⤵PID:2372
-
\??\c:\1nhtnn.exec:\1nhtnn.exe118⤵PID:4424
-
\??\c:\ddppj.exec:\ddppj.exe119⤵PID:4868
-
\??\c:\7ddjd.exec:\7ddjd.exe120⤵PID:3112
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe121⤵PID:4456
-
\??\c:\hbbtnh.exec:\hbbtnh.exe122⤵PID:1172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-