Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/09/2024, 12:06
Behavioral task
behavioral1
Sample
f5aeff66124da2279c6997ebaec4d8d0N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
f5aeff66124da2279c6997ebaec4d8d0N.exe
-
Size
95KB
-
MD5
f5aeff66124da2279c6997ebaec4d8d0
-
SHA1
1e4fa8e05d9e71e68edb50ec8c3cfc947dedae6f
-
SHA256
996d8cd9a61951907cdde284a4b5f8e35b4e9584046548800c151c527c0e5319
-
SHA512
d6c8099e113a271de5d15101bc5def5cca8a3a1569ef4548327fd7cb0af3b66e61d08763d32c10d7a06838111e053f456a80e7aa36f8bb5828a65a682b2a3be9
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w801ouAsG9ZoPEudJGdXRKXREmXZD:xhOmTsF93UYfwC6GIout03Fv9KdJoQG2
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2416-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1484-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3480-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/432-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4288-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3528-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/828-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2128-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1304-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3640-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3944-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2332-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1652-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/460-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1756-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2324-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2912-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/660-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4620-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1164-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/444-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2976-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1564-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4108-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3972-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4280-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4228-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3136-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2712-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/228-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3728-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2920-531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-559-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/228-629-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/960-672-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-694-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/828-809-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2108-966-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3928-1666-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1484 thhnbn.exe 4032 btbntt.exe 3380 vdvpd.exe 3480 xxfxffx.exe 432 dpppj.exe 4288 hhbhtb.exe 3528 vddpv.exe 1784 rffxllf.exe 2876 htbtnn.exe 4580 ddpdp.exe 4848 pppvp.exe 4596 bbbbtt.exe 2996 jjvdv.exe 3032 fffrlxl.exe 852 hhhbhb.exe 4988 vdppj.exe 828 lllfxff.exe 2128 btbbbt.exe 1304 vppjv.exe 3640 xfllfxx.exe 3944 1ttnnt.exe 1824 vvvpp.exe 3500 dvvpp.exe 4920 xlfrffr.exe 2388 hhbtnn.exe 3636 jvpdv.exe 3400 vvjjv.exe 2332 rxxrlff.exe 1652 bbnnhn.exe 460 7vdvv.exe 4608 rflfffx.exe 1628 7lrxxlr.exe 1756 nthntt.exe 2324 3jvvv.exe 3988 lfrllff.exe 2912 hnnhbh.exe 1928 hthhnn.exe 660 dvdpj.exe 2328 5lxflll.exe 1444 ffxfxxx.exe 4328 1bttnn.exe 3588 9hthtt.exe 4620 vjppj.exe 4592 7dpvp.exe 3960 rrffffl.exe 3808 frxxfff.exe 3608 bnbttt.exe 1164 7dddv.exe 444 jdjpj.exe 5104 lfrrllx.exe 324 5lrllrl.exe 4944 btnttt.exe 2976 bnbtnt.exe 2600 ddjpd.exe 4588 rfxllrr.exe 3280 lrxllrr.exe 1784 tbbhtn.exe 228 jjpvv.exe 2036 ddvvv.exe 1564 xxffffl.exe 2660 xrllfff.exe 4516 tnthhh.exe 4628 thhhbh.exe 764 pvvpj.exe -
resource yara_rule behavioral2/memory/2416-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023488-4.dat upx behavioral2/memory/1484-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2416-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d2-12.dat upx behavioral2/memory/1484-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4032-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3380-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d1-11.dat upx behavioral2/files/0x00070000000234d3-23.dat upx behavioral2/memory/3480-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d4-30.dat upx behavioral2/files/0x00070000000234d5-34.dat upx behavioral2/memory/432-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d6-40.dat upx behavioral2/memory/4288-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d7-45.dat upx behavioral2/memory/3528-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d8-51.dat upx behavioral2/memory/1784-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2876-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d9-59.dat upx behavioral2/files/0x00070000000234da-63.dat upx behavioral2/memory/4580-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4848-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234db-69.dat upx behavioral2/files/0x00070000000234dc-74.dat upx behavioral2/memory/4596-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234dd-81.dat upx behavioral2/files/0x00070000000234de-88.dat upx behavioral2/memory/2996-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234df-92.dat upx behavioral2/memory/852-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3032-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e0-99.dat upx behavioral2/files/0x00070000000234e1-103.dat upx behavioral2/memory/828-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e2-109.dat upx behavioral2/memory/2128-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e3-117.dat upx behavioral2/memory/1304-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234ce-121.dat upx behavioral2/memory/3640-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e4-127.dat upx behavioral2/memory/3944-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e6-133.dat upx behavioral2/files/0x00070000000234e7-138.dat upx behavioral2/files/0x00070000000234e8-143.dat upx behavioral2/memory/4920-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e9-149.dat upx behavioral2/files/0x00070000000234eb-160.dat upx behavioral2/files/0x00070000000234ea-155.dat upx behavioral2/files/0x00070000000234ec-166.dat upx behavioral2/memory/2332-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1652-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ed-173.dat upx behavioral2/memory/460-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ee-177.dat upx behavioral2/memory/4608-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ef-183.dat upx behavioral2/memory/4608-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1756-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2324-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3988-201-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 1484 2416 f5aeff66124da2279c6997ebaec4d8d0N.exe 83 PID 2416 wrote to memory of 1484 2416 f5aeff66124da2279c6997ebaec4d8d0N.exe 83 PID 2416 wrote to memory of 1484 2416 f5aeff66124da2279c6997ebaec4d8d0N.exe 83 PID 1484 wrote to memory of 4032 1484 thhnbn.exe 84 PID 1484 wrote to memory of 4032 1484 thhnbn.exe 84 PID 1484 wrote to memory of 4032 1484 thhnbn.exe 84 PID 4032 wrote to memory of 3380 4032 btbntt.exe 85 PID 4032 wrote to memory of 3380 4032 btbntt.exe 85 PID 4032 wrote to memory of 3380 4032 btbntt.exe 85 PID 3380 wrote to memory of 3480 3380 vdvpd.exe 86 PID 3380 wrote to memory of 3480 3380 vdvpd.exe 86 PID 3380 wrote to memory of 3480 3380 vdvpd.exe 86 PID 3480 wrote to memory of 432 3480 xxfxffx.exe 87 PID 3480 wrote to memory of 432 3480 xxfxffx.exe 87 PID 3480 wrote to memory of 432 3480 xxfxffx.exe 87 PID 432 wrote to memory of 4288 432 dpppj.exe 89 PID 432 wrote to memory of 4288 432 dpppj.exe 89 PID 432 wrote to memory of 4288 432 dpppj.exe 89 PID 4288 wrote to memory of 3528 4288 hhbhtb.exe 90 PID 4288 wrote to memory of 3528 4288 hhbhtb.exe 90 PID 4288 wrote to memory of 3528 4288 hhbhtb.exe 90 PID 3528 wrote to memory of 1784 3528 vddpv.exe 91 PID 3528 wrote to memory of 1784 3528 vddpv.exe 91 PID 3528 wrote to memory of 1784 3528 vddpv.exe 91 PID 1784 wrote to memory of 2876 1784 rffxllf.exe 92 PID 1784 wrote to memory of 2876 1784 rffxllf.exe 92 PID 1784 wrote to memory of 2876 1784 rffxllf.exe 92 PID 2876 wrote to memory of 4580 2876 htbtnn.exe 93 PID 2876 wrote to memory of 4580 2876 htbtnn.exe 93 PID 2876 wrote to memory of 4580 2876 htbtnn.exe 93 PID 4580 wrote to memory of 4848 4580 ddpdp.exe 94 PID 4580 wrote to memory of 4848 4580 ddpdp.exe 94 PID 4580 wrote to memory of 4848 4580 ddpdp.exe 94 PID 4848 wrote to memory of 4596 4848 pppvp.exe 95 PID 4848 wrote to memory of 4596 4848 pppvp.exe 95 PID 4848 wrote to memory of 4596 4848 pppvp.exe 95 PID 4596 wrote to memory of 2996 4596 bbbbtt.exe 96 PID 4596 wrote to memory of 2996 4596 bbbbtt.exe 96 PID 4596 wrote to memory of 2996 4596 bbbbtt.exe 96 PID 2996 wrote to memory of 3032 2996 jjvdv.exe 98 PID 2996 wrote to memory of 3032 2996 jjvdv.exe 98 PID 2996 wrote to memory of 3032 2996 jjvdv.exe 98 PID 3032 wrote to memory of 852 3032 fffrlxl.exe 99 PID 3032 wrote to memory of 852 3032 fffrlxl.exe 99 PID 3032 wrote to memory of 852 3032 fffrlxl.exe 99 PID 852 wrote to memory of 4988 852 hhhbhb.exe 100 PID 852 wrote to memory of 4988 852 hhhbhb.exe 100 PID 852 wrote to memory of 4988 852 hhhbhb.exe 100 PID 4988 wrote to memory of 828 4988 vdppj.exe 102 PID 4988 wrote to memory of 828 4988 vdppj.exe 102 PID 4988 wrote to memory of 828 4988 vdppj.exe 102 PID 828 wrote to memory of 2128 828 lllfxff.exe 103 PID 828 wrote to memory of 2128 828 lllfxff.exe 103 PID 828 wrote to memory of 2128 828 lllfxff.exe 103 PID 2128 wrote to memory of 1304 2128 btbbbt.exe 104 PID 2128 wrote to memory of 1304 2128 btbbbt.exe 104 PID 2128 wrote to memory of 1304 2128 btbbbt.exe 104 PID 1304 wrote to memory of 3640 1304 vppjv.exe 105 PID 1304 wrote to memory of 3640 1304 vppjv.exe 105 PID 1304 wrote to memory of 3640 1304 vppjv.exe 105 PID 3640 wrote to memory of 3944 3640 xfllfxx.exe 106 PID 3640 wrote to memory of 3944 3640 xfllfxx.exe 106 PID 3640 wrote to memory of 3944 3640 xfllfxx.exe 106 PID 3944 wrote to memory of 1824 3944 1ttnnt.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5aeff66124da2279c6997ebaec4d8d0N.exe"C:\Users\Admin\AppData\Local\Temp\f5aeff66124da2279c6997ebaec4d8d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\thhnbn.exec:\thhnbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\btbntt.exec:\btbntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\vdvpd.exec:\vdvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\xxfxffx.exec:\xxfxffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\dpppj.exec:\dpppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\hhbhtb.exec:\hhbhtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\vddpv.exec:\vddpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\rffxllf.exec:\rffxllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\htbtnn.exec:\htbtnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\ddpdp.exec:\ddpdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\pppvp.exec:\pppvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\bbbbtt.exec:\bbbbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\jjvdv.exec:\jjvdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\fffrlxl.exec:\fffrlxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\hhhbhb.exec:\hhhbhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\vdppj.exec:\vdppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\lllfxff.exec:\lllfxff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\btbbbt.exec:\btbbbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\vppjv.exec:\vppjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\xfllfxx.exec:\xfllfxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\1ttnnt.exec:\1ttnnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\vvvpp.exec:\vvvpp.exe23⤵
- Executes dropped EXE
PID:1824 -
\??\c:\dvvpp.exec:\dvvpp.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3500 -
\??\c:\xlfrffr.exec:\xlfrffr.exe25⤵
- Executes dropped EXE
PID:4920 -
\??\c:\hhbtnn.exec:\hhbtnn.exe26⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jvpdv.exec:\jvpdv.exe27⤵
- Executes dropped EXE
PID:3636 -
\??\c:\vvjjv.exec:\vvjjv.exe28⤵
- Executes dropped EXE
PID:3400 -
\??\c:\rxxrlff.exec:\rxxrlff.exe29⤵
- Executes dropped EXE
PID:2332 -
\??\c:\bbnnhn.exec:\bbnnhn.exe30⤵
- Executes dropped EXE
PID:1652 -
\??\c:\7vdvv.exec:\7vdvv.exe31⤵
- Executes dropped EXE
PID:460 -
\??\c:\rflfffx.exec:\rflfffx.exe32⤵
- Executes dropped EXE
PID:4608 -
\??\c:\7lrxxlr.exec:\7lrxxlr.exe33⤵
- Executes dropped EXE
PID:1628 -
\??\c:\nthntt.exec:\nthntt.exe34⤵
- Executes dropped EXE
PID:1756 -
\??\c:\3jvvv.exec:\3jvvv.exe35⤵
- Executes dropped EXE
PID:2324 -
\??\c:\lfrllff.exec:\lfrllff.exe36⤵
- Executes dropped EXE
PID:3988 -
\??\c:\hnnhbh.exec:\hnnhbh.exe37⤵
- Executes dropped EXE
PID:2912 -
\??\c:\hthhnn.exec:\hthhnn.exe38⤵
- Executes dropped EXE
PID:1928 -
\??\c:\dvdpj.exec:\dvdpj.exe39⤵
- Executes dropped EXE
PID:660 -
\??\c:\5lxflll.exec:\5lxflll.exe40⤵
- Executes dropped EXE
PID:2328 -
\??\c:\ffxfxxx.exec:\ffxfxxx.exe41⤵
- Executes dropped EXE
PID:1444 -
\??\c:\1bttnn.exec:\1bttnn.exe42⤵
- Executes dropped EXE
PID:4328 -
\??\c:\9hthtt.exec:\9hthtt.exe43⤵
- Executes dropped EXE
PID:3588 -
\??\c:\vjppj.exec:\vjppj.exe44⤵
- Executes dropped EXE
PID:4620 -
\??\c:\7dpvp.exec:\7dpvp.exe45⤵
- Executes dropped EXE
PID:4592 -
\??\c:\rrffffl.exec:\rrffffl.exe46⤵
- Executes dropped EXE
PID:3960 -
\??\c:\frxxfff.exec:\frxxfff.exe47⤵
- Executes dropped EXE
PID:3808 -
\??\c:\bnbttt.exec:\bnbttt.exe48⤵
- Executes dropped EXE
PID:3608 -
\??\c:\7dddv.exec:\7dddv.exe49⤵
- Executes dropped EXE
PID:1164 -
\??\c:\jdjpj.exec:\jdjpj.exe50⤵
- Executes dropped EXE
PID:444 -
\??\c:\lfrrllx.exec:\lfrrllx.exe51⤵
- Executes dropped EXE
PID:5104 -
\??\c:\5lrllrl.exec:\5lrllrl.exe52⤵
- Executes dropped EXE
PID:324 -
\??\c:\btnttt.exec:\btnttt.exe53⤵
- Executes dropped EXE
PID:4944 -
\??\c:\bnbtnt.exec:\bnbtnt.exe54⤵
- Executes dropped EXE
PID:2976 -
\??\c:\ddjpd.exec:\ddjpd.exe55⤵
- Executes dropped EXE
PID:2600 -
\??\c:\rfxllrr.exec:\rfxllrr.exe56⤵
- Executes dropped EXE
PID:4588 -
\??\c:\lrxllrr.exec:\lrxllrr.exe57⤵
- Executes dropped EXE
PID:3280 -
\??\c:\tbbhtn.exec:\tbbhtn.exe58⤵
- Executes dropped EXE
PID:1784 -
\??\c:\jjpvv.exec:\jjpvv.exe59⤵
- Executes dropped EXE
PID:228 -
\??\c:\ddvvv.exec:\ddvvv.exe60⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xxffffl.exec:\xxffffl.exe61⤵
- Executes dropped EXE
PID:1564 -
\??\c:\xrllfff.exec:\xrllfff.exe62⤵
- Executes dropped EXE
PID:2660 -
\??\c:\tnthhh.exec:\tnthhh.exe63⤵
- Executes dropped EXE
PID:4516 -
\??\c:\thhhbh.exec:\thhhbh.exe64⤵
- Executes dropped EXE
PID:4628 -
\??\c:\pvvpj.exec:\pvvpj.exe65⤵
- Executes dropped EXE
PID:764 -
\??\c:\lfllfff.exec:\lfllfff.exe66⤵PID:2784
-
\??\c:\1bbbhh.exec:\1bbbhh.exe67⤵PID:996
-
\??\c:\bhnnhh.exec:\bhnnhh.exe68⤵PID:1700
-
\??\c:\ppjjd.exec:\ppjjd.exe69⤵PID:1696
-
\??\c:\9fxlrrr.exec:\9fxlrrr.exe70⤵PID:2616
-
\??\c:\fllxrrr.exec:\fllxrrr.exe71⤵PID:4480
-
\??\c:\hbnhbb.exec:\hbnhbb.exe72⤵PID:864
-
\??\c:\jpjdd.exec:\jpjdd.exe73⤵PID:4696
-
\??\c:\rlrrlll.exec:\rlrrlll.exe74⤵PID:4108
-
\??\c:\lxfflxr.exec:\lxfflxr.exe75⤵PID:3972
-
\??\c:\nbhhbn.exec:\nbhhbn.exe76⤵PID:1448
-
\??\c:\pjddv.exec:\pjddv.exe77⤵PID:2132
-
\??\c:\lfxlrrl.exec:\lfxlrrl.exe78⤵PID:4280
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe79⤵PID:2624
-
\??\c:\hnhnbt.exec:\hnhnbt.exe80⤵PID:4176
-
\??\c:\thnnbb.exec:\thnnbb.exe81⤵PID:2444
-
\??\c:\dpppj.exec:\dpppj.exe82⤵PID:2448
-
\??\c:\1jjjv.exec:\1jjjv.exe83⤵PID:3596
-
\??\c:\ffffxxx.exec:\ffffxxx.exe84⤵PID:2332
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe85⤵PID:4228
-
\??\c:\tbbhhh.exec:\tbbhhh.exe86⤵PID:2144
-
\??\c:\5jpjj.exec:\5jpjj.exe87⤵PID:2820
-
\??\c:\pppjd.exec:\pppjd.exe88⤵PID:1676
-
\??\c:\llrlffl.exec:\llrlffl.exe89⤵PID:316
-
\??\c:\rllrlrl.exec:\rllrlrl.exe90⤵PID:1160
-
\??\c:\9hhhbb.exec:\9hhhbb.exe91⤵PID:4060
-
\??\c:\nhnnnn.exec:\nhnnnn.exe92⤵PID:396
-
\??\c:\djvvp.exec:\djvvp.exe93⤵PID:3464
-
\??\c:\pdjjd.exec:\pdjjd.exe94⤵PID:2172
-
\??\c:\lfrxxff.exec:\lfrxxff.exe95⤵PID:3440
-
\??\c:\ntbttt.exec:\ntbttt.exe96⤵PID:1468
-
\??\c:\tbtnnn.exec:\tbtnnn.exe97⤵PID:4460
-
\??\c:\jdpjj.exec:\jdpjj.exe98⤵PID:4396
-
\??\c:\xfxllxx.exec:\xfxllxx.exe99⤵PID:1156
-
\??\c:\1rxxxxr.exec:\1rxxxxr.exe100⤵PID:8
-
\??\c:\ttnhbb.exec:\ttnhbb.exe101⤵PID:4284
-
\??\c:\bnntht.exec:\bnntht.exe102⤵PID:4428
-
\??\c:\pvjdd.exec:\pvjdd.exe103⤵PID:4088
-
\??\c:\vddpp.exec:\vddpp.exe104⤵PID:3964
-
\??\c:\lxflxlx.exec:\lxflxlx.exe105⤵PID:3940
-
\??\c:\hntnhn.exec:\hntnhn.exe106⤵PID:3136
-
\??\c:\thnhnh.exec:\thnhnh.exe107⤵PID:1584
-
\??\c:\djvdd.exec:\djvdd.exe108⤵PID:4408
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe109⤵PID:5060
-
\??\c:\rfxxrff.exec:\rfxxrff.exe110⤵PID:2712
-
\??\c:\nhnnnn.exec:\nhnnnn.exe111⤵PID:3652
-
\??\c:\3vdpj.exec:\3vdpj.exe112⤵PID:4400
-
\??\c:\ddvvj.exec:\ddvvj.exe113⤵PID:2236
-
\??\c:\ppvpj.exec:\ppvpj.exe114⤵PID:4136
-
\??\c:\rllxrrr.exec:\rllxrrr.exe115⤵PID:2876
-
\??\c:\hntttt.exec:\hntttt.exe116⤵PID:1784
-
\??\c:\5bhbtt.exec:\5bhbtt.exe117⤵PID:228
-
\??\c:\jjpjd.exec:\jjpjd.exe118⤵PID:3088
-
\??\c:\flrlffx.exec:\flrlffx.exe119⤵PID:3728
-
\??\c:\fllrlrl.exec:\fllrlrl.exe120⤵PID:1792
-
\??\c:\hnbbth.exec:\hnbbth.exe121⤵PID:2852
-
\??\c:\1jpdj.exec:\1jpdj.exe122⤵PID:608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-