Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23-07-2024 22:25
Behavioral task
behavioral1
Sample
661f1cef50d83b1541d44241852f4608900ceccf8c4bf7b62a655d98b477d6e9.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
General
-
Target
661f1cef50d83b1541d44241852f4608900ceccf8c4bf7b62a655d98b477d6e9.exe
-
Size
443KB
-
MD5
6b0e18cd2ac168883f8181ea6bfe5f1b
-
SHA1
8a3e8acef761c2e6a45aa71f603509a2bb29f036
-
SHA256
661f1cef50d83b1541d44241852f4608900ceccf8c4bf7b62a655d98b477d6e9
-
SHA512
677cc2e2b9a48861052de131d1f210d73c9e039481cd2b147b31e436dfd46b6041b0659ec91acf7621b0149c3c66fa889a12591583c571240ca9234087950de5
-
SSDEEP
12288:M4wFHoSpg4wFHonR/nPF2LnFL4wF04wFK4wFK4wluAS:UrR/nPRS
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3956-7-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3956-15-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4720-6-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3260-19-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1860-34-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1860-29-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3512-28-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3604-42-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4004-44-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4004-48-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4788-231-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4720-247-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4904-286-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1040-308-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4876-413-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4476-490-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2564-519-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/664-539-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1520-535-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1588-530-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1404-527-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3232-523-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/804-514-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3036-511-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2344-506-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1632-494-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4884-473-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4128-470-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2696-454-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1860-450-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4000-442-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/964-439-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3676-432-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3700-397-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4520-384-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/316-380-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4752-372-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3796-366-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3880-359-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3440-354-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4916-344-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2808-341-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4512-337-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1396-330-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4884-326-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4128-322-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3172-318-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1812-300-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1524-294-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/564-290-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3604-281-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2024-277-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4348-274-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2800-269-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1384-266-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1600-262-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/540-258-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2880-253-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1916-243-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4120-239-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2664-234-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4064-227-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4260-223-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1640-218-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3956 422042.exe 3260 ffffxxx.exe 3512 4028824.exe 1860 frfllxr.exe 3604 2240288.exe 4004 ntbnhb.exe 564 1fxlrfr.exe 5028 406022.exe 2692 42468.exe 1812 8802882.exe 3508 tnbbnn.exe 4036 xlllfff.exe 2696 llllfff.exe 1768 7fxlfrl.exe 3660 s4602.exe 2680 66222.exe 4128 bhtbtb.exe 2344 480400.exe 3648 djppj.exe 4736 6440400.exe 3196 020060.exe 3944 8024602.exe 4784 220244.exe 412 44626.exe 1588 xllxxff.exe 4936 tttbbb.exe 3568 pddpp.exe 992 ntbtth.exe 2168 c042424.exe 4576 hhnhtt.exe 4488 7lrxfrl.exe 3972 flfxxrl.exe 3988 804460.exe 2448 9bbbth.exe 4472 048686.exe 1640 rfllrfx.exe 4260 htbbhb.exe 4064 xxxxrrr.exe 4788 860686.exe 2664 hnnnht.exe 4120 026200.exe 1916 lffrfxr.exe 4720 hnbbbb.exe 3640 ttnbnb.exe 2880 9ntnhn.exe 540 2680422.exe 1600 nhnhbb.exe 1384 lllffll.exe 2800 662402.exe 4348 k40226.exe 2024 c028220.exe 3604 8448820.exe 4904 68002.exe 564 ttbbnh.exe 1524 208662.exe 4956 u682664.exe 1812 44888.exe 4580 vdvdd.exe 1040 pvppd.exe 3916 8466082.exe 2236 048088.exe 3172 bbtnhb.exe 4128 pjvvp.exe 4884 5dddd.exe -
resource yara_rule behavioral2/memory/4720-0-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000a0000000234b0-3.dat upx behavioral2/memory/3956-7-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3956-15-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3260-13-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x00070000000234b8-11.dat upx behavioral2/memory/4720-6-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x00070000000234b9-17.dat upx behavioral2/memory/3260-19-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3512-22-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x00070000000234ba-25.dat upx behavioral2/files/0x00070000000234bb-31.dat upx behavioral2/memory/1860-34-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3604-35-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1860-29-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3512-28-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x00070000000234bc-38.dat upx behavioral2/memory/3604-42-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4004-44-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4004-48-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x00070000000234bd-47.dat upx behavioral2/memory/564-49-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x00070000000234bf-59.dat upx behavioral2/files/0x00070000000234c1-72.dat upx behavioral2/files/0x00070000000234c4-91.dat upx behavioral2/files/0x00070000000234cb-131.dat upx behavioral2/files/0x00070000000234d0-161.dat upx behavioral2/memory/4788-231-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4720-247-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4904-286-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1040-308-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4876-413-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4476-490-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2564-519-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/664-539-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1520-535-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1588-530-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1404-527-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3232-523-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/804-514-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3036-511-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2344-506-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1632-494-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4884-473-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4128-470-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2696-454-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1860-450-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4000-442-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/964-439-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3676-432-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3700-397-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4520-384-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/316-380-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4752-372-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3796-366-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3880-359-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3440-354-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4916-344-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2808-341-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4512-337-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1396-330-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4884-326-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4128-322-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3172-318-0x0000000000400000-0x000000000048C000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44808.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 661f1cef50d83b1541d44241852f4608900ceccf8c4bf7b62a655d98b477d6e9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2240288.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 622620.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4720 wrote to memory of 3956 4720 661f1cef50d83b1541d44241852f4608900ceccf8c4bf7b62a655d98b477d6e9.exe 84 PID 4720 wrote to memory of 3956 4720 661f1cef50d83b1541d44241852f4608900ceccf8c4bf7b62a655d98b477d6e9.exe 84 PID 4720 wrote to memory of 3956 4720 661f1cef50d83b1541d44241852f4608900ceccf8c4bf7b62a655d98b477d6e9.exe 84 PID 3956 wrote to memory of 3260 3956 422042.exe 85 PID 3956 wrote to memory of 3260 3956 422042.exe 85 PID 3956 wrote to memory of 3260 3956 422042.exe 85 PID 3260 wrote to memory of 3512 3260 ffffxxx.exe 86 PID 3260 wrote to memory of 3512 3260 ffffxxx.exe 86 PID 3260 wrote to memory of 3512 3260 ffffxxx.exe 86 PID 3512 wrote to memory of 1860 3512 4028824.exe 185 PID 3512 wrote to memory of 1860 3512 4028824.exe 185 PID 3512 wrote to memory of 1860 3512 4028824.exe 185 PID 1860 wrote to memory of 3604 1860 frfllxr.exe 137 PID 1860 wrote to memory of 3604 1860 frfllxr.exe 137 PID 1860 wrote to memory of 3604 1860 frfllxr.exe 137 PID 3604 wrote to memory of 4004 3604 2240288.exe 91 PID 3604 wrote to memory of 4004 3604 2240288.exe 91 PID 3604 wrote to memory of 4004 3604 2240288.exe 91 PID 4004 wrote to memory of 564 4004 ntbnhb.exe 139 PID 4004 wrote to memory of 564 4004 ntbnhb.exe 139 PID 4004 wrote to memory of 564 4004 ntbnhb.exe 139 PID 564 wrote to memory of 5028 564 1fxlrfr.exe 93 PID 564 wrote to memory of 5028 564 1fxlrfr.exe 93 PID 564 wrote to memory of 5028 564 1fxlrfr.exe 93 PID 5028 wrote to memory of 2692 5028 406022.exe 94 PID 5028 wrote to memory of 2692 5028 406022.exe 94 PID 5028 wrote to memory of 2692 5028 406022.exe 94 PID 2692 wrote to memory of 1812 2692 42468.exe 142 PID 2692 wrote to memory of 1812 2692 42468.exe 142 PID 2692 wrote to memory of 1812 2692 42468.exe 142 PID 1812 wrote to memory of 3508 1812 8802882.exe 96 PID 1812 wrote to memory of 3508 1812 8802882.exe 96 PID 1812 wrote to memory of 3508 1812 8802882.exe 96 PID 3508 wrote to memory of 4036 3508 tnbbnn.exe 97 PID 3508 wrote to memory of 4036 3508 tnbbnn.exe 97 PID 3508 wrote to memory of 4036 3508 tnbbnn.exe 97 PID 4036 wrote to memory of 2696 4036 xlllfff.exe 186 PID 4036 wrote to memory of 2696 4036 xlllfff.exe 186 PID 4036 wrote to memory of 2696 4036 xlllfff.exe 186 PID 2696 wrote to memory of 1768 2696 llllfff.exe 99 PID 2696 wrote to memory of 1768 2696 llllfff.exe 99 PID 2696 wrote to memory of 1768 2696 llllfff.exe 99 PID 1768 wrote to memory of 3660 1768 7fxlfrl.exe 100 PID 1768 wrote to memory of 3660 1768 7fxlfrl.exe 100 PID 1768 wrote to memory of 3660 1768 7fxlfrl.exe 100 PID 3660 wrote to memory of 2680 3660 s4602.exe 101 PID 3660 wrote to memory of 2680 3660 s4602.exe 101 PID 3660 wrote to memory of 2680 3660 s4602.exe 101 PID 2680 wrote to memory of 4128 2680 66222.exe 148 PID 2680 wrote to memory of 4128 2680 66222.exe 148 PID 2680 wrote to memory of 4128 2680 66222.exe 148 PID 4128 wrote to memory of 2344 4128 bhtbtb.exe 103 PID 4128 wrote to memory of 2344 4128 bhtbtb.exe 103 PID 4128 wrote to memory of 2344 4128 bhtbtb.exe 103 PID 2344 wrote to memory of 3648 2344 480400.exe 104 PID 2344 wrote to memory of 3648 2344 480400.exe 104 PID 2344 wrote to memory of 3648 2344 480400.exe 104 PID 3648 wrote to memory of 4736 3648 djppj.exe 105 PID 3648 wrote to memory of 4736 3648 djppj.exe 105 PID 3648 wrote to memory of 4736 3648 djppj.exe 105 PID 4736 wrote to memory of 3196 4736 6440400.exe 106 PID 4736 wrote to memory of 3196 4736 6440400.exe 106 PID 4736 wrote to memory of 3196 4736 6440400.exe 106 PID 3196 wrote to memory of 3944 3196 020060.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\661f1cef50d83b1541d44241852f4608900ceccf8c4bf7b62a655d98b477d6e9.exe"C:\Users\Admin\AppData\Local\Temp\661f1cef50d83b1541d44241852f4608900ceccf8c4bf7b62a655d98b477d6e9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\422042.exec:\422042.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\ffffxxx.exec:\ffffxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\4028824.exec:\4028824.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\frfllxr.exec:\frfllxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\2240288.exec:\2240288.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\ntbnhb.exec:\ntbnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\1fxlrfr.exec:\1fxlrfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\406022.exec:\406022.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\42468.exec:\42468.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\8802882.exec:\8802882.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\tnbbnn.exec:\tnbbnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\xlllfff.exec:\xlllfff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\llllfff.exec:\llllfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\7fxlfrl.exec:\7fxlfrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\s4602.exec:\s4602.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\66222.exec:\66222.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\bhtbtb.exec:\bhtbtb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\480400.exec:\480400.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\djppj.exec:\djppj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\6440400.exec:\6440400.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\020060.exec:\020060.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\8024602.exec:\8024602.exe23⤵
- Executes dropped EXE
PID:3944 -
\??\c:\220244.exec:\220244.exe24⤵
- Executes dropped EXE
PID:4784 -
\??\c:\44626.exec:\44626.exe25⤵
- Executes dropped EXE
PID:412 -
\??\c:\xllxxff.exec:\xllxxff.exe26⤵
- Executes dropped EXE
PID:1588 -
\??\c:\tttbbb.exec:\tttbbb.exe27⤵
- Executes dropped EXE
PID:4936 -
\??\c:\pddpp.exec:\pddpp.exe28⤵
- Executes dropped EXE
PID:3568 -
\??\c:\ntbtth.exec:\ntbtth.exe29⤵
- Executes dropped EXE
PID:992 -
\??\c:\c042424.exec:\c042424.exe30⤵
- Executes dropped EXE
PID:2168 -
\??\c:\hhnhtt.exec:\hhnhtt.exe31⤵
- Executes dropped EXE
PID:4576 -
\??\c:\7lrxfrl.exec:\7lrxfrl.exe32⤵
- Executes dropped EXE
PID:4488 -
\??\c:\flfxxrl.exec:\flfxxrl.exe33⤵
- Executes dropped EXE
PID:3972 -
\??\c:\804460.exec:\804460.exe34⤵
- Executes dropped EXE
PID:3988 -
\??\c:\9bbbth.exec:\9bbbth.exe35⤵
- Executes dropped EXE
PID:2448 -
\??\c:\048686.exec:\048686.exe36⤵
- Executes dropped EXE
PID:4472 -
\??\c:\rfllrfx.exec:\rfllrfx.exe37⤵
- Executes dropped EXE
PID:1640 -
\??\c:\htbbhb.exec:\htbbhb.exe38⤵
- Executes dropped EXE
PID:4260 -
\??\c:\xxxxrrr.exec:\xxxxrrr.exe39⤵
- Executes dropped EXE
PID:4064 -
\??\c:\860686.exec:\860686.exe40⤵
- Executes dropped EXE
PID:4788 -
\??\c:\hnnnht.exec:\hnnnht.exe41⤵
- Executes dropped EXE
PID:2664 -
\??\c:\026200.exec:\026200.exe42⤵
- Executes dropped EXE
PID:4120 -
\??\c:\lffrfxr.exec:\lffrfxr.exe43⤵
- Executes dropped EXE
PID:1916 -
\??\c:\hnbbbb.exec:\hnbbbb.exe44⤵
- Executes dropped EXE
PID:4720 -
\??\c:\ttnbnb.exec:\ttnbnb.exe45⤵
- Executes dropped EXE
PID:3640 -
\??\c:\9ntnhn.exec:\9ntnhn.exe46⤵
- Executes dropped EXE
PID:2880 -
\??\c:\2680422.exec:\2680422.exe47⤵
- Executes dropped EXE
PID:540 -
\??\c:\nhnhbb.exec:\nhnhbb.exe48⤵
- Executes dropped EXE
PID:1600 -
\??\c:\lllffll.exec:\lllffll.exe49⤵
- Executes dropped EXE
PID:1384 -
\??\c:\662402.exec:\662402.exe50⤵
- Executes dropped EXE
PID:2800 -
\??\c:\k40226.exec:\k40226.exe51⤵
- Executes dropped EXE
PID:4348 -
\??\c:\c028220.exec:\c028220.exe52⤵
- Executes dropped EXE
PID:2024 -
\??\c:\8448820.exec:\8448820.exe53⤵
- Executes dropped EXE
PID:3604 -
\??\c:\68002.exec:\68002.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4904 -
\??\c:\ttbbnh.exec:\ttbbnh.exe55⤵
- Executes dropped EXE
PID:564 -
\??\c:\208662.exec:\208662.exe56⤵
- Executes dropped EXE
PID:1524 -
\??\c:\u682664.exec:\u682664.exe57⤵
- Executes dropped EXE
PID:4956 -
\??\c:\44888.exec:\44888.exe58⤵
- Executes dropped EXE
PID:1812 -
\??\c:\vdvdd.exec:\vdvdd.exe59⤵
- Executes dropped EXE
PID:4580 -
\??\c:\pvppd.exec:\pvppd.exe60⤵
- Executes dropped EXE
PID:1040 -
\??\c:\8466082.exec:\8466082.exe61⤵
- Executes dropped EXE
PID:3916 -
\??\c:\048088.exec:\048088.exe62⤵
- Executes dropped EXE
PID:2236 -
\??\c:\bbtnhb.exec:\bbtnhb.exe63⤵
- Executes dropped EXE
PID:3172 -
\??\c:\pjvvp.exec:\pjvvp.exe64⤵
- Executes dropped EXE
PID:4128 -
\??\c:\5dddd.exec:\5dddd.exe65⤵
- Executes dropped EXE
PID:4884 -
\??\c:\m8006.exec:\m8006.exe66⤵PID:1396
-
\??\c:\m0824.exec:\m0824.exe67⤵PID:784
-
\??\c:\vpvdd.exec:\vpvdd.exe68⤵PID:4512
-
\??\c:\rrxxxfl.exec:\rrxxxfl.exe69⤵PID:2808
-
\??\c:\262222.exec:\262222.exe70⤵PID:4916
-
\??\c:\660006.exec:\660006.exe71⤵PID:4628
-
\??\c:\bnntnt.exec:\bnntnt.exe72⤵PID:4936
-
\??\c:\nhnhhb.exec:\nhnhhb.exe73⤵PID:3440
-
\??\c:\66000.exec:\66000.exe74⤵PID:3880
-
\??\c:\22482.exec:\22482.exe75⤵PID:1648
-
\??\c:\hbtnnn.exec:\hbtnnn.exe76⤵PID:3796
-
\??\c:\004040.exec:\004040.exe77⤵PID:548
-
\??\c:\rrxrlrl.exec:\rrxrlrl.exe78⤵PID:4752
-
\??\c:\2886608.exec:\2886608.exe79⤵PID:388
-
\??\c:\xlrlffx.exec:\xlrlffx.exe80⤵PID:316
-
\??\c:\0248220.exec:\0248220.exe81⤵PID:4520
-
\??\c:\e08662.exec:\e08662.exe82⤵PID:4996
-
\??\c:\ntthnt.exec:\ntthnt.exe83⤵PID:4064
-
\??\c:\22822.exec:\22822.exe84⤵PID:4072
-
\??\c:\6042608.exec:\6042608.exe85⤵PID:3700
-
\??\c:\jpvdv.exec:\jpvdv.exe86⤵PID:3504
-
\??\c:\266048.exec:\266048.exe87⤵PID:4600
-
\??\c:\ppjpv.exec:\ppjpv.exe88⤵PID:1184
-
\??\c:\6428442.exec:\6428442.exe89⤵PID:4732
-
\??\c:\q02880.exec:\q02880.exe90⤵PID:4876
-
\??\c:\486660.exec:\486660.exe91⤵PID:540
-
\??\c:\bnbttn.exec:\bnbttn.exe92⤵PID:1208
-
\??\c:\264648.exec:\264648.exe93⤵PID:4380
-
\??\c:\8264084.exec:\8264084.exe94⤵PID:468
-
\??\c:\hhnnbh.exec:\hhnnbh.exe95⤵PID:1480
-
\??\c:\44422.exec:\44422.exe96⤵PID:3676
-
\??\c:\888604.exec:\888604.exe97⤵PID:4700
-
\??\c:\02664.exec:\02664.exe98⤵PID:964
-
\??\c:\jpvpv.exec:\jpvpv.exe99⤵PID:4000
-
\??\c:\djpdp.exec:\djpdp.exe100⤵PID:936
-
\??\c:\044860.exec:\044860.exe101⤵PID:1860
-
\??\c:\82806.exec:\82806.exe102⤵PID:2696
-
\??\c:\bnbtnb.exec:\bnbtnb.exe103⤵PID:1900
-
\??\c:\48048.exec:\48048.exe104⤵PID:1768
-
\??\c:\rfrllff.exec:\rfrllff.exe105⤵PID:4440
-
\??\c:\4888488.exec:\4888488.exe106⤵PID:3172
-
\??\c:\llxrlxr.exec:\llxrlxr.exe107⤵PID:4128
-
\??\c:\4886868.exec:\4886868.exe108⤵PID:4884
-
\??\c:\vjppp.exec:\vjppp.exe109⤵PID:4252
-
\??\c:\024444.exec:\024444.exe110⤵PID:1832
-
\??\c:\frfffll.exec:\frfffll.exe111⤵PID:3944
-
\??\c:\pjppj.exec:\pjppj.exe112⤵PID:4960
-
\??\c:\rrfffxx.exec:\rrfffxx.exe113⤵PID:4476
-
\??\c:\jppjj.exec:\jppjj.exe114⤵PID:1632
-
\??\c:\m2482.exec:\m2482.exe115⤵PID:3392
-
\??\c:\lrfffll.exec:\lrfffll.exe116⤵PID:2904
-
\??\c:\tthhbb.exec:\tthhbb.exe117⤵PID:1956
-
\??\c:\pdjjj.exec:\pdjjj.exe118⤵PID:2344
-
\??\c:\rrfxllx.exec:\rrfxllx.exe119⤵PID:3036
-
\??\c:\bthnnn.exec:\bthnnn.exe120⤵PID:804
-
\??\c:\1pvdv.exec:\1pvdv.exe121⤵PID:2564
-
\??\c:\jjdpp.exec:\jjdpp.exe122⤵PID:3232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-