Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
85079048fa289beda8681ef25da162ba4ed80ae947ecaceec4c6cb0b7c3fc74dN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
85079048fa289beda8681ef25da162ba4ed80ae947ecaceec4c6cb0b7c3fc74dN.exe
-
Size
455KB
-
MD5
09e7cda1e781b1aa4d7106c8c5989ab0
-
SHA1
c6661422ee77b06b6b844644338df9dd0a172166
-
SHA256
85079048fa289beda8681ef25da162ba4ed80ae947ecaceec4c6cb0b7c3fc74d
-
SHA512
0d26a03610b840e4224b0364e3e90b48ad3f76dfa2f4650086565b339f6118444b2b2e966df42bcf92578c496bb38def95be355e29c4eed6d374d97c0cbd1238
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbel:q7Tc2NYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/3888-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3140-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1264-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2012-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/952-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2116-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1340-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3344-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3352-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3420-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/996-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1508-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-1032-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-1373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-1977-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3140 flrrrxr.exe 5060 ntnnbb.exe 2284 hbtttb.exe 1580 djpjj.exe 2832 xrfllxx.exe 3404 5fxxrrx.exe 1264 dvjdj.exe 2608 ntnttb.exe 1192 lxrrrll.exe 4684 nnnnhn.exe 4660 ppvvv.exe 2324 jjvvp.exe 2012 lxfxrlf.exe 3692 tbhttn.exe 4148 tntthb.exe 4744 pjvpp.exe 1040 xlrlllf.exe 4524 jdjjd.exe 3264 tntnnh.exe 2952 dvddp.exe 952 bhnhhb.exe 4064 rffxrxf.exe 1504 hntnhh.exe 916 vjpjd.exe 1720 lfrlfxx.exe 1640 btbtnn.exe 2060 tbhttn.exe 4512 bnbthh.exe 5000 3fffrlf.exe 3996 rrfxxxr.exe 2404 jjjdv.exe 3484 hnnhbt.exe 2604 djppj.exe 2232 lrxrffl.exe 2472 hbbthh.exe 2116 pjvpj.exe 3868 jpvjv.exe 4160 xflxllr.exe 4436 bbnhtt.exe 3420 vdjdv.exe 3728 fxlxlfr.exe 4812 9bbtbb.exe 4380 tthbtt.exe 724 djdjj.exe 1692 rffrlfr.exe 1076 xlrlfxf.exe 1000 hntnhb.exe 552 pvdvv.exe 1584 pvdvd.exe 3428 lxxlffx.exe 4312 1hbthh.exe 3960 jjdjp.exe 4144 vdjpd.exe 3988 rxxxffx.exe 2456 hhnhhh.exe 3600 jdvpv.exe 1192 pvdjd.exe 4684 xxlfxrr.exe 1864 httnbt.exe 2164 hbbnbb.exe 2032 jpvvp.exe 4824 xrffrrr.exe 4024 bnnnbb.exe 2328 djjjv.exe -
resource yara_rule behavioral2/memory/3140-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3140-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1264-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2012-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/952-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2116-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1340-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3344-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3352-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/996-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1508-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-1032-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrlrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3888 wrote to memory of 3140 3888 85079048fa289beda8681ef25da162ba4ed80ae947ecaceec4c6cb0b7c3fc74dN.exe 82 PID 3888 wrote to memory of 3140 3888 85079048fa289beda8681ef25da162ba4ed80ae947ecaceec4c6cb0b7c3fc74dN.exe 82 PID 3888 wrote to memory of 3140 3888 85079048fa289beda8681ef25da162ba4ed80ae947ecaceec4c6cb0b7c3fc74dN.exe 82 PID 3140 wrote to memory of 5060 3140 flrrrxr.exe 83 PID 3140 wrote to memory of 5060 3140 flrrrxr.exe 83 PID 3140 wrote to memory of 5060 3140 flrrrxr.exe 83 PID 5060 wrote to memory of 2284 5060 ntnnbb.exe 84 PID 5060 wrote to memory of 2284 5060 ntnnbb.exe 84 PID 5060 wrote to memory of 2284 5060 ntnnbb.exe 84 PID 2284 wrote to memory of 1580 2284 hbtttb.exe 85 PID 2284 wrote to memory of 1580 2284 hbtttb.exe 85 PID 2284 wrote to memory of 1580 2284 hbtttb.exe 85 PID 1580 wrote to memory of 2832 1580 djpjj.exe 86 PID 1580 wrote to memory of 2832 1580 djpjj.exe 86 PID 1580 wrote to memory of 2832 1580 djpjj.exe 86 PID 2832 wrote to memory of 3404 2832 xrfllxx.exe 87 PID 2832 wrote to memory of 3404 2832 xrfllxx.exe 87 PID 2832 wrote to memory of 3404 2832 xrfllxx.exe 87 PID 3404 wrote to memory of 1264 3404 5fxxrrx.exe 88 PID 3404 wrote to memory of 1264 3404 5fxxrrx.exe 88 PID 3404 wrote to memory of 1264 3404 5fxxrrx.exe 88 PID 1264 wrote to memory of 2608 1264 dvjdj.exe 89 PID 1264 wrote to memory of 2608 1264 dvjdj.exe 89 PID 1264 wrote to memory of 2608 1264 dvjdj.exe 89 PID 2608 wrote to memory of 1192 2608 ntnttb.exe 90 PID 2608 wrote to memory of 1192 2608 ntnttb.exe 90 PID 2608 wrote to memory of 1192 2608 ntnttb.exe 90 PID 1192 wrote to memory of 4684 1192 lxrrrll.exe 91 PID 1192 wrote to memory of 4684 1192 lxrrrll.exe 91 PID 1192 wrote to memory of 4684 1192 lxrrrll.exe 91 PID 4684 wrote to memory of 4660 4684 nnnnhn.exe 92 PID 4684 wrote to memory of 4660 4684 nnnnhn.exe 92 PID 4684 wrote to memory of 4660 4684 nnnnhn.exe 92 PID 4660 wrote to memory of 2324 4660 ppvvv.exe 93 PID 4660 wrote to memory of 2324 4660 ppvvv.exe 93 PID 4660 wrote to memory of 2324 4660 ppvvv.exe 93 PID 2324 wrote to memory of 2012 2324 jjvvp.exe 94 PID 2324 wrote to memory of 2012 2324 jjvvp.exe 94 PID 2324 wrote to memory of 2012 2324 jjvvp.exe 94 PID 2012 wrote to memory of 3692 2012 lxfxrlf.exe 95 PID 2012 wrote to memory of 3692 2012 lxfxrlf.exe 95 PID 2012 wrote to memory of 3692 2012 lxfxrlf.exe 95 PID 3692 wrote to memory of 4148 3692 tbhttn.exe 96 PID 3692 wrote to memory of 4148 3692 tbhttn.exe 96 PID 3692 wrote to memory of 4148 3692 tbhttn.exe 96 PID 4148 wrote to memory of 4744 4148 tntthb.exe 97 PID 4148 wrote to memory of 4744 4148 tntthb.exe 97 PID 4148 wrote to memory of 4744 4148 tntthb.exe 97 PID 4744 wrote to memory of 1040 4744 pjvpp.exe 98 PID 4744 wrote to memory of 1040 4744 pjvpp.exe 98 PID 4744 wrote to memory of 1040 4744 pjvpp.exe 98 PID 1040 wrote to memory of 4524 1040 xlrlllf.exe 99 PID 1040 wrote to memory of 4524 1040 xlrlllf.exe 99 PID 1040 wrote to memory of 4524 1040 xlrlllf.exe 99 PID 4524 wrote to memory of 3264 4524 jdjjd.exe 100 PID 4524 wrote to memory of 3264 4524 jdjjd.exe 100 PID 4524 wrote to memory of 3264 4524 jdjjd.exe 100 PID 3264 wrote to memory of 2952 3264 tntnnh.exe 101 PID 3264 wrote to memory of 2952 3264 tntnnh.exe 101 PID 3264 wrote to memory of 2952 3264 tntnnh.exe 101 PID 2952 wrote to memory of 952 2952 dvddp.exe 102 PID 2952 wrote to memory of 952 2952 dvddp.exe 102 PID 2952 wrote to memory of 952 2952 dvddp.exe 102 PID 952 wrote to memory of 4064 952 bhnhhb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\85079048fa289beda8681ef25da162ba4ed80ae947ecaceec4c6cb0b7c3fc74dN.exe"C:\Users\Admin\AppData\Local\Temp\85079048fa289beda8681ef25da162ba4ed80ae947ecaceec4c6cb0b7c3fc74dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\flrrrxr.exec:\flrrrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\ntnnbb.exec:\ntnnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\hbtttb.exec:\hbtttb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\djpjj.exec:\djpjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\xrfllxx.exec:\xrfllxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\5fxxrrx.exec:\5fxxrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\dvjdj.exec:\dvjdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\ntnttb.exec:\ntnttb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\lxrrrll.exec:\lxrrrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\nnnnhn.exec:\nnnnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\ppvvv.exec:\ppvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\jjvvp.exec:\jjvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\tbhttn.exec:\tbhttn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\tntthb.exec:\tntthb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\pjvpp.exec:\pjvpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\xlrlllf.exec:\xlrlllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\jdjjd.exec:\jdjjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\tntnnh.exec:\tntnnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\dvddp.exec:\dvddp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\bhnhhb.exec:\bhnhhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\rffxrxf.exec:\rffxrxf.exe23⤵
- Executes dropped EXE
PID:4064 -
\??\c:\hntnhh.exec:\hntnhh.exe24⤵
- Executes dropped EXE
PID:1504 -
\??\c:\vjpjd.exec:\vjpjd.exe25⤵
- Executes dropped EXE
PID:916 -
\??\c:\lfrlfxx.exec:\lfrlfxx.exe26⤵
- Executes dropped EXE
PID:1720 -
\??\c:\btbtnn.exec:\btbtnn.exe27⤵
- Executes dropped EXE
PID:1640 -
\??\c:\tbhttn.exec:\tbhttn.exe28⤵
- Executes dropped EXE
PID:2060 -
\??\c:\bnbthh.exec:\bnbthh.exe29⤵
- Executes dropped EXE
PID:4512 -
\??\c:\3fffrlf.exec:\3fffrlf.exe30⤵
- Executes dropped EXE
PID:5000 -
\??\c:\rrfxxxr.exec:\rrfxxxr.exe31⤵
- Executes dropped EXE
PID:3996 -
\??\c:\jjjdv.exec:\jjjdv.exe32⤵
- Executes dropped EXE
PID:2404 -
\??\c:\hnnhbt.exec:\hnnhbt.exe33⤵
- Executes dropped EXE
PID:3484 -
\??\c:\djppj.exec:\djppj.exe34⤵
- Executes dropped EXE
PID:2604 -
\??\c:\lrxrffl.exec:\lrxrffl.exe35⤵
- Executes dropped EXE
PID:2232 -
\??\c:\hbbthh.exec:\hbbthh.exe36⤵
- Executes dropped EXE
PID:2472 -
\??\c:\pjvpj.exec:\pjvpj.exe37⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jpvjv.exec:\jpvjv.exe38⤵
- Executes dropped EXE
PID:3868 -
\??\c:\xflxllr.exec:\xflxllr.exe39⤵
- Executes dropped EXE
PID:4160 -
\??\c:\bbnhtt.exec:\bbnhtt.exe40⤵
- Executes dropped EXE
PID:4436 -
\??\c:\vdjdv.exec:\vdjdv.exe41⤵
- Executes dropped EXE
PID:3420 -
\??\c:\fxlxlfr.exec:\fxlxlfr.exe42⤵
- Executes dropped EXE
PID:3728 -
\??\c:\9bbtbb.exec:\9bbtbb.exe43⤵
- Executes dropped EXE
PID:4812 -
\??\c:\tthbtt.exec:\tthbtt.exe44⤵
- Executes dropped EXE
PID:4380 -
\??\c:\djdjj.exec:\djdjj.exe45⤵
- Executes dropped EXE
PID:724 -
\??\c:\rffrlfr.exec:\rffrlfr.exe46⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xlrlfxf.exec:\xlrlfxf.exe47⤵
- Executes dropped EXE
PID:1076 -
\??\c:\hntnhb.exec:\hntnhb.exe48⤵
- Executes dropped EXE
PID:1000 -
\??\c:\pvdvv.exec:\pvdvv.exe49⤵
- Executes dropped EXE
PID:552 -
\??\c:\pvdvd.exec:\pvdvd.exe50⤵
- Executes dropped EXE
PID:1584 -
\??\c:\lxxlffx.exec:\lxxlffx.exe51⤵
- Executes dropped EXE
PID:3428 -
\??\c:\1hbthh.exec:\1hbthh.exe52⤵
- Executes dropped EXE
PID:4312 -
\??\c:\jjdjp.exec:\jjdjp.exe53⤵
- Executes dropped EXE
PID:3960 -
\??\c:\vdjpd.exec:\vdjpd.exe54⤵
- Executes dropped EXE
PID:4144 -
\??\c:\rxxxffx.exec:\rxxxffx.exe55⤵
- Executes dropped EXE
PID:3988 -
\??\c:\hhnhhh.exec:\hhnhhh.exe56⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jdvpv.exec:\jdvpv.exe57⤵
- Executes dropped EXE
PID:3600 -
\??\c:\pvdjd.exec:\pvdjd.exe58⤵
- Executes dropped EXE
PID:1192 -
\??\c:\xxlfxrr.exec:\xxlfxrr.exe59⤵
- Executes dropped EXE
PID:4684 -
\??\c:\httnbt.exec:\httnbt.exe60⤵
- Executes dropped EXE
PID:1864 -
\??\c:\hbbnbb.exec:\hbbnbb.exe61⤵
- Executes dropped EXE
PID:2164 -
\??\c:\jpvvp.exec:\jpvvp.exe62⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xrffrrr.exec:\xrffrrr.exe63⤵
- Executes dropped EXE
PID:4824 -
\??\c:\bnnnbb.exec:\bnnnbb.exe64⤵
- Executes dropped EXE
PID:4024 -
\??\c:\djjjv.exec:\djjjv.exe65⤵
- Executes dropped EXE
PID:2328 -
\??\c:\jppjv.exec:\jppjv.exe66⤵PID:2860
-
\??\c:\fxxrfxl.exec:\fxxrfxl.exe67⤵PID:2244
-
\??\c:\ntnnhb.exec:\ntnnhb.exe68⤵PID:2084
-
\??\c:\1hnhbb.exec:\1hnhbb.exe69⤵PID:2000
-
\??\c:\pjjpd.exec:\pjjpd.exe70⤵PID:4100
-
\??\c:\rllxllx.exec:\rllxllx.exe71⤵PID:1340
-
\??\c:\3llfxxr.exec:\3llfxxr.exe72⤵PID:3444
-
\??\c:\bhnhbb.exec:\bhnhbb.exe73⤵PID:3984
-
\??\c:\vdddp.exec:\vdddp.exe74⤵PID:3688
-
\??\c:\lfrlxfl.exec:\lfrlxfl.exe75⤵PID:3844
-
\??\c:\tnthbt.exec:\tnthbt.exe76⤵PID:1528
-
\??\c:\ttbthh.exec:\ttbthh.exe77⤵PID:1460
-
\??\c:\pddvp.exec:\pddvp.exe78⤵PID:64
-
\??\c:\rxllffr.exec:\rxllffr.exe79⤵PID:4712
-
\??\c:\tnhttn.exec:\tnhttn.exe80⤵PID:1720
-
\??\c:\pjjvp.exec:\pjjvp.exe81⤵PID:3084
-
\??\c:\frxrxxr.exec:\frxrxxr.exe82⤵PID:2076
-
\??\c:\thtnnn.exec:\thtnnn.exe83⤵PID:1008
-
\??\c:\jjjjd.exec:\jjjjd.exe84⤵PID:2144
-
\??\c:\ppdvd.exec:\ppdvd.exe85⤵PID:3344
-
\??\c:\lrrrfxl.exec:\lrrrfxl.exe86⤵
- System Location Discovery: System Language Discovery
PID:532 -
\??\c:\nhhnnh.exec:\nhhnnh.exe87⤵PID:3132
-
\??\c:\vdjdd.exec:\vdjdd.exe88⤵
- System Location Discovery: System Language Discovery
PID:2656 -
\??\c:\rfxlxll.exec:\rfxlxll.exe89⤵PID:2476
-
\??\c:\bbbbnn.exec:\bbbbnn.exe90⤵PID:4208
-
\??\c:\dvvpv.exec:\dvvpv.exe91⤵PID:1472
-
\??\c:\llxxffr.exec:\llxxffr.exe92⤵PID:3652
-
\??\c:\lfxrfff.exec:\lfxrfff.exe93⤵PID:4700
-
\??\c:\bhtttt.exec:\bhtttt.exe94⤵PID:3352
-
\??\c:\vvdjd.exec:\vvdjd.exe95⤵PID:2116
-
\??\c:\frxrffx.exec:\frxrffx.exe96⤵PID:3108
-
\??\c:\bhtbnt.exec:\bhtbnt.exe97⤵PID:4160
-
\??\c:\ppdvd.exec:\ppdvd.exe98⤵PID:4436
-
\??\c:\lrxxlll.exec:\lrxxlll.exe99⤵PID:3420
-
\??\c:\fflfxfx.exec:\fflfxfx.exe100⤵PID:1812
-
\??\c:\jpvjj.exec:\jpvjj.exe101⤵PID:1960
-
\??\c:\xxrrxxl.exec:\xxrrxxl.exe102⤵PID:4632
-
\??\c:\xrrlllf.exec:\xrrlllf.exe103⤵PID:1748
-
\??\c:\hbbtnh.exec:\hbbtnh.exe104⤵PID:2296
-
\??\c:\ddvpj.exec:\ddvpj.exe105⤵PID:2520
-
\??\c:\frxfxxr.exec:\frxfxxr.exe106⤵PID:4496
-
\??\c:\hbnhbb.exec:\hbnhbb.exe107⤵PID:584
-
\??\c:\ttbtnn.exec:\ttbtnn.exe108⤵PID:4008
-
\??\c:\jjppj.exec:\jjppj.exe109⤵PID:3392
-
\??\c:\rxlfxxl.exec:\rxlfxxl.exe110⤵PID:4584
-
\??\c:\hhhhtt.exec:\hhhhtt.exe111⤵PID:3428
-
\??\c:\nthhnn.exec:\nthhnn.exe112⤵PID:1784
-
\??\c:\djvvp.exec:\djvvp.exe113⤵PID:4016
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe114⤵PID:1264
-
\??\c:\hhtnhh.exec:\hhtnhh.exe115⤵PID:4144
-
\??\c:\hbbbnn.exec:\hbbbnn.exe116⤵PID:1312
-
\??\c:\vjvpj.exec:\vjvpj.exe117⤵PID:3336
-
\??\c:\frfxrrl.exec:\frfxrrl.exe118⤵PID:4264
-
\??\c:\hnbntb.exec:\hnbntb.exe119⤵PID:4040
-
\??\c:\tttbnb.exec:\tttbnb.exe120⤵PID:708
-
\??\c:\dpvpp.exec:\dpvpp.exe121⤵PID:3628
-
\??\c:\lfllllf.exec:\lfllllf.exe122⤵PID:4960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-