Analysis
-
max time kernel
149s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2024 11:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
824010abf68bd802490d8720428a49a6a4a24260bfb9f54a47d5644add0183b7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
824010abf68bd802490d8720428a49a6a4a24260bfb9f54a47d5644add0183b7.exe
-
Size
454KB
-
MD5
7ba5cf9ccf91971156e89587a374d2ef
-
SHA1
59df94ed6115acbb131c06be2da06ae8c96367d8
-
SHA256
824010abf68bd802490d8720428a49a6a4a24260bfb9f54a47d5644add0183b7
-
SHA512
a261d1bcb548a05ba2906b4738aeff1b39e032ee2a441eb1ba6bb4d923598302aaaa9ea313818e139a56b9d6f190e7fb9efc4a0895c99c21d2592f574419f503
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRJ:q7Tc2NYHUrAwfMp3CDRJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 59 IoCs
resource yara_rule behavioral2/memory/4864-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3420-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3160-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/952-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3828-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/984-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-713-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-784-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-1690-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3420 vjvvv.exe 4252 nbttnt.exe 3160 xlrrrxx.exe 5072 ttbnth.exe 3220 btnbnh.exe 952 dpdvv.exe 2984 fxllxfr.exe 4380 hbhhhb.exe 3292 nbhhtt.exe 3320 rflrrxr.exe 2620 tbbbnt.exe 1800 7ddpv.exe 2404 3xxxxfl.exe 2952 ppppp.exe 1484 9nbthh.exe 3984 ddjdv.exe 2888 ttbthb.exe 3740 lrrlxfr.exe 3228 hbtnbt.exe 4676 jjvjv.exe 3828 flrlrrx.exe 3716 hhhbbb.exe 2580 vjpdj.exe 3348 dvjvp.exe 3720 rxxrxxx.exe 1620 tbbbbb.exe 3560 rlrlfrr.exe 2412 dvjpv.exe 2608 llfxllx.exe 3640 frflxlx.exe 1596 bhhthb.exe 5064 vppjj.exe 3968 fxxxlfx.exe 3244 nbtnnh.exe 4336 pdppv.exe 388 lxfxxrl.exe 4944 9bhttt.exe 4008 dvjjd.exe 1488 hhhhnt.exe 3436 dpvvd.exe 4040 xrlxxfr.exe 1952 hnhhnn.exe 1736 3ddvv.exe 2356 rrllfff.exe 748 7hnnbh.exe 672 pdjjp.exe 1284 3lxxxff.exe 984 lflrrrx.exe 4716 bbtbtb.exe 2484 jpdpd.exe 3096 lxxrlrl.exe 5104 bbbtnh.exe 1644 djjdp.exe 2620 rlffxrf.exe 2212 bbbttn.exe 540 jjjvd.exe 2532 rxxrfrl.exe 2296 hhtttb.exe 4188 pppdv.exe 3356 fflxlrl.exe 3836 tbbhtn.exe 3984 ddpdj.exe 4720 ntthnh.exe 3564 9vvpj.exe -
resource yara_rule behavioral2/memory/4864-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3160-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4252-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/952-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3828-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/984-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-713-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hththt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlflxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbntbt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4864 wrote to memory of 3420 4864 824010abf68bd802490d8720428a49a6a4a24260bfb9f54a47d5644add0183b7.exe 84 PID 4864 wrote to memory of 3420 4864 824010abf68bd802490d8720428a49a6a4a24260bfb9f54a47d5644add0183b7.exe 84 PID 4864 wrote to memory of 3420 4864 824010abf68bd802490d8720428a49a6a4a24260bfb9f54a47d5644add0183b7.exe 84 PID 3420 wrote to memory of 4252 3420 vjvvv.exe 85 PID 3420 wrote to memory of 4252 3420 vjvvv.exe 85 PID 3420 wrote to memory of 4252 3420 vjvvv.exe 85 PID 4252 wrote to memory of 3160 4252 nbttnt.exe 86 PID 4252 wrote to memory of 3160 4252 nbttnt.exe 86 PID 4252 wrote to memory of 3160 4252 nbttnt.exe 86 PID 3160 wrote to memory of 5072 3160 xlrrrxx.exe 87 PID 3160 wrote to memory of 5072 3160 xlrrrxx.exe 87 PID 3160 wrote to memory of 5072 3160 xlrrrxx.exe 87 PID 5072 wrote to memory of 3220 5072 ttbnth.exe 88 PID 5072 wrote to memory of 3220 5072 ttbnth.exe 88 PID 5072 wrote to memory of 3220 5072 ttbnth.exe 88 PID 3220 wrote to memory of 952 3220 btnbnh.exe 89 PID 3220 wrote to memory of 952 3220 btnbnh.exe 89 PID 3220 wrote to memory of 952 3220 btnbnh.exe 89 PID 952 wrote to memory of 2984 952 dpdvv.exe 90 PID 952 wrote to memory of 2984 952 dpdvv.exe 90 PID 952 wrote to memory of 2984 952 dpdvv.exe 90 PID 2984 wrote to memory of 4380 2984 fxllxfr.exe 91 PID 2984 wrote to memory of 4380 2984 fxllxfr.exe 91 PID 2984 wrote to memory of 4380 2984 fxllxfr.exe 91 PID 4380 wrote to memory of 3292 4380 hbhhhb.exe 92 PID 4380 wrote to memory of 3292 4380 hbhhhb.exe 92 PID 4380 wrote to memory of 3292 4380 hbhhhb.exe 92 PID 3292 wrote to memory of 3320 3292 nbhhtt.exe 93 PID 3292 wrote to memory of 3320 3292 nbhhtt.exe 93 PID 3292 wrote to memory of 3320 3292 nbhhtt.exe 93 PID 3320 wrote to memory of 2620 3320 rflrrxr.exe 95 PID 3320 wrote to memory of 2620 3320 rflrrxr.exe 95 PID 3320 wrote to memory of 2620 3320 rflrrxr.exe 95 PID 2620 wrote to memory of 1800 2620 tbbbnt.exe 96 PID 2620 wrote to memory of 1800 2620 tbbbnt.exe 96 PID 2620 wrote to memory of 1800 2620 tbbbnt.exe 96 PID 1800 wrote to memory of 2404 1800 7ddpv.exe 97 PID 1800 wrote to memory of 2404 1800 7ddpv.exe 97 PID 1800 wrote to memory of 2404 1800 7ddpv.exe 97 PID 2404 wrote to memory of 2952 2404 3xxxxfl.exe 99 PID 2404 wrote to memory of 2952 2404 3xxxxfl.exe 99 PID 2404 wrote to memory of 2952 2404 3xxxxfl.exe 99 PID 2952 wrote to memory of 1484 2952 ppppp.exe 101 PID 2952 wrote to memory of 1484 2952 ppppp.exe 101 PID 2952 wrote to memory of 1484 2952 ppppp.exe 101 PID 1484 wrote to memory of 3984 1484 9nbthh.exe 102 PID 1484 wrote to memory of 3984 1484 9nbthh.exe 102 PID 1484 wrote to memory of 3984 1484 9nbthh.exe 102 PID 3984 wrote to memory of 2888 3984 ddjdv.exe 103 PID 3984 wrote to memory of 2888 3984 ddjdv.exe 103 PID 3984 wrote to memory of 2888 3984 ddjdv.exe 103 PID 2888 wrote to memory of 3740 2888 ttbthb.exe 104 PID 2888 wrote to memory of 3740 2888 ttbthb.exe 104 PID 2888 wrote to memory of 3740 2888 ttbthb.exe 104 PID 3740 wrote to memory of 3228 3740 lrrlxfr.exe 105 PID 3740 wrote to memory of 3228 3740 lrrlxfr.exe 105 PID 3740 wrote to memory of 3228 3740 lrrlxfr.exe 105 PID 3228 wrote to memory of 4676 3228 hbtnbt.exe 106 PID 3228 wrote to memory of 4676 3228 hbtnbt.exe 106 PID 3228 wrote to memory of 4676 3228 hbtnbt.exe 106 PID 4676 wrote to memory of 3828 4676 jjvjv.exe 107 PID 4676 wrote to memory of 3828 4676 jjvjv.exe 107 PID 4676 wrote to memory of 3828 4676 jjvjv.exe 107 PID 3828 wrote to memory of 3716 3828 flrlrrx.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\824010abf68bd802490d8720428a49a6a4a24260bfb9f54a47d5644add0183b7.exe"C:\Users\Admin\AppData\Local\Temp\824010abf68bd802490d8720428a49a6a4a24260bfb9f54a47d5644add0183b7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\vjvvv.exec:\vjvvv.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\nbttnt.exec:\nbttnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\xlrrrxx.exec:\xlrrrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\ttbnth.exec:\ttbnth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\btnbnh.exec:\btnbnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\dpdvv.exec:\dpdvv.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\fxllxfr.exec:\fxllxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\hbhhhb.exec:\hbhhhb.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\nbhhtt.exec:\nbhhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\rflrrxr.exec:\rflrrxr.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\tbbbnt.exec:\tbbbnt.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\7ddpv.exec:\7ddpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\3xxxxfl.exec:\3xxxxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\ppppp.exec:\ppppp.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\9nbthh.exec:\9nbthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\ddjdv.exec:\ddjdv.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\ttbthb.exec:\ttbthb.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\lrrlxfr.exec:\lrrlxfr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\hbtnbt.exec:\hbtnbt.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\jjvjv.exec:\jjvjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\flrlrrx.exec:\flrlrrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\hhhbbb.exec:\hhhbbb.exe23⤵
- Executes dropped EXE
PID:3716 -
\??\c:\vjpdj.exec:\vjpdj.exe24⤵
- Executes dropped EXE
PID:2580 -
\??\c:\dvjvp.exec:\dvjvp.exe25⤵
- Executes dropped EXE
PID:3348 -
\??\c:\rxxrxxx.exec:\rxxrxxx.exe26⤵
- Executes dropped EXE
PID:3720 -
\??\c:\tbbbbb.exec:\tbbbbb.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1620 -
\??\c:\rlrlfrr.exec:\rlrlfrr.exe28⤵
- Executes dropped EXE
PID:3560 -
\??\c:\dvjpv.exec:\dvjpv.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2412 -
\??\c:\llfxllx.exec:\llfxllx.exe30⤵
- Executes dropped EXE
PID:2608 -
\??\c:\frflxlx.exec:\frflxlx.exe31⤵
- Executes dropped EXE
PID:3640 -
\??\c:\bhhthb.exec:\bhhthb.exe32⤵
- Executes dropped EXE
PID:1596 -
\??\c:\vppjj.exec:\vppjj.exe33⤵
- Executes dropped EXE
PID:5064 -
\??\c:\fxxxlfx.exec:\fxxxlfx.exe34⤵
- Executes dropped EXE
PID:3968 -
\??\c:\nbtnnh.exec:\nbtnnh.exe35⤵
- Executes dropped EXE
PID:3244 -
\??\c:\pdppv.exec:\pdppv.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4336 -
\??\c:\lxfxxrl.exec:\lxfxxrl.exe37⤵
- Executes dropped EXE
PID:388 -
\??\c:\9bhttt.exec:\9bhttt.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4944 -
\??\c:\dvjjd.exec:\dvjjd.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4008 -
\??\c:\xxflxll.exec:\xxflxll.exe40⤵PID:3520
-
\??\c:\hhhhnt.exec:\hhhhnt.exe41⤵
- Executes dropped EXE
PID:1488 -
\??\c:\dpvvd.exec:\dpvvd.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3436 -
\??\c:\xrlxxfr.exec:\xrlxxfr.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4040 -
\??\c:\hnhhnn.exec:\hnhhnn.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1952 -
\??\c:\3ddvv.exec:\3ddvv.exe45⤵
- Executes dropped EXE
PID:1736 -
\??\c:\rrllfff.exec:\rrllfff.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2356 -
\??\c:\7hnnbh.exec:\7hnnbh.exe47⤵
- Executes dropped EXE
PID:748 -
\??\c:\pdjjp.exec:\pdjjp.exe48⤵
- Executes dropped EXE
PID:672 -
\??\c:\3lxxxff.exec:\3lxxxff.exe49⤵
- Executes dropped EXE
PID:1284 -
\??\c:\lflrrrx.exec:\lflrrrx.exe50⤵
- Executes dropped EXE
PID:984 -
\??\c:\bbtbtb.exec:\bbtbtb.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4716 -
\??\c:\jpdpd.exec:\jpdpd.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2484 -
\??\c:\lxxrlrl.exec:\lxxrlrl.exe53⤵
- Executes dropped EXE
PID:3096 -
\??\c:\bbbtnh.exec:\bbbtnh.exe54⤵
- Executes dropped EXE
PID:5104 -
\??\c:\djjdp.exec:\djjdp.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1644 -
\??\c:\rlffxrf.exec:\rlffxrf.exe56⤵
- Executes dropped EXE
PID:2620 -
\??\c:\bbbttn.exec:\bbbttn.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2212 -
\??\c:\jjjvd.exec:\jjjvd.exe58⤵
- Executes dropped EXE
PID:540 -
\??\c:\rxxrfrl.exec:\rxxrfrl.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2532 -
\??\c:\hhtttb.exec:\hhtttb.exe60⤵
- Executes dropped EXE
PID:2296 -
\??\c:\pppdv.exec:\pppdv.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4188 -
\??\c:\fflxlrl.exec:\fflxlrl.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3356 -
\??\c:\tbbhtn.exec:\tbbhtn.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3836 -
\??\c:\ddpdj.exec:\ddpdj.exe64⤵
- Executes dropped EXE
PID:3984 -
\??\c:\ntthnh.exec:\ntthnh.exe65⤵
- Executes dropped EXE
PID:4720 -
\??\c:\9vvpj.exec:\9vvpj.exe66⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3564 -
\??\c:\xxrlxxl.exec:\xxrlxxl.exe67⤵PID:3604
-
\??\c:\tththt.exec:\tththt.exe68⤵PID:3796
-
\??\c:\pddpp.exec:\pddpp.exe69⤵PID:4036
-
\??\c:\fxxrflf.exec:\fxxrflf.exe70⤵PID:4676
-
\??\c:\pvvjd.exec:\pvvjd.exe71⤵PID:4688
-
\??\c:\rxrrrlf.exec:\rxrrrlf.exe72⤵PID:1528
-
\??\c:\nhttnh.exec:\nhttnh.exe73⤵PID:4800
-
\??\c:\djpjd.exec:\djpjd.exe74⤵PID:1960
-
\??\c:\3nbtnt.exec:\3nbtnt.exe75⤵
- System Location Discovery: System Language Discovery
PID:632 -
\??\c:\pvpjd.exec:\pvpjd.exe76⤵PID:4808
-
\??\c:\7xrrrxx.exec:\7xrrrxx.exe77⤵PID:1224
-
\??\c:\ttnhbt.exec:\ttnhbt.exe78⤵PID:4472
-
\??\c:\dvddv.exec:\dvddv.exe79⤵PID:2860
-
\??\c:\rfllrrx.exec:\rfllrrx.exe80⤵PID:1232
-
\??\c:\9nnnbt.exec:\9nnnbt.exe81⤵
- System Location Discovery: System Language Discovery
PID:1380 -
\??\c:\vvjjj.exec:\vvjjj.exe82⤵PID:1596
-
\??\c:\vvvvv.exec:\vvvvv.exe83⤵PID:1016
-
\??\c:\rrxxxfl.exec:\rrxxxfl.exe84⤵PID:4892
-
\??\c:\tntttb.exec:\tntttb.exe85⤵
- System Location Discovery: System Language Discovery
PID:3216 -
\??\c:\ddvdp.exec:\ddvdp.exe86⤵
- System Location Discovery: System Language Discovery
PID:2788 -
\??\c:\lrlllrr.exec:\lrlllrr.exe87⤵
- System Location Discovery: System Language Discovery
PID:3876 -
\??\c:\xlrllrr.exec:\xlrllrr.exe88⤵PID:4308
-
\??\c:\nbtthn.exec:\nbtthn.exe89⤵PID:4316
-
\??\c:\pjjvv.exec:\pjjvv.exe90⤵PID:2320
-
\??\c:\lxlfrfl.exec:\lxlfrfl.exe91⤵
- System Location Discovery: System Language Discovery
PID:3336 -
\??\c:\hbnbbt.exec:\hbnbbt.exe92⤵PID:2136
-
\??\c:\djvpj.exec:\djvpj.exe93⤵
- System Location Discovery: System Language Discovery
PID:4040 -
\??\c:\fllrfrx.exec:\fllrfrx.exe94⤵PID:992
-
\??\c:\nnbhhh.exec:\nnbhhh.exe95⤵
- System Location Discovery: System Language Discovery
PID:3660 -
\??\c:\tnbbbb.exec:\tnbbbb.exe96⤵PID:1588
-
\??\c:\djddd.exec:\djddd.exe97⤵PID:4124
-
\??\c:\rfrrrxr.exec:\rfrrrxr.exe98⤵PID:3120
-
\??\c:\bbtnhh.exec:\bbtnhh.exe99⤵
- System Location Discovery: System Language Discovery
PID:5000 -
\??\c:\pdjdj.exec:\pdjdj.exe100⤵
- System Location Discovery: System Language Discovery
PID:3276 -
\??\c:\7lrffxx.exec:\7lrffxx.exe101⤵PID:4592
-
\??\c:\rrlllff.exec:\rrlllff.exe102⤵PID:1888
-
\??\c:\hththt.exec:\hththt.exe103⤵
- System Location Discovery: System Language Discovery
PID:3292 -
\??\c:\pvjdv.exec:\pvjdv.exe104⤵PID:3188
-
\??\c:\flxrlfr.exec:\flxrlfr.exe105⤵PID:2336
-
\??\c:\flxlfxl.exec:\flxlfxl.exe106⤵
- System Location Discovery: System Language Discovery
PID:1800 -
\??\c:\pjjjv.exec:\pjjjv.exe107⤵
- System Location Discovery: System Language Discovery
PID:2404 -
\??\c:\dpvdd.exec:\dpvdd.exe108⤵PID:1748
-
\??\c:\fxlrlrr.exec:\fxlrlrr.exe109⤵PID:2832
-
\??\c:\1nnnnt.exec:\1nnnnt.exe110⤵
- System Location Discovery: System Language Discovery
PID:4368 -
\??\c:\ppvvp.exec:\ppvvp.exe111⤵PID:1448
-
\??\c:\1rxrrrx.exec:\1rxrrrx.exe112⤵
- System Location Discovery: System Language Discovery
PID:3736 -
\??\c:\thnntt.exec:\thnntt.exe113⤵PID:2340
-
\??\c:\9jjjj.exec:\9jjjj.exe114⤵
- System Location Discovery: System Language Discovery
PID:4576 -
\??\c:\xrlrfrx.exec:\xrlrfrx.exe115⤵PID:4728
-
\??\c:\bttttt.exec:\bttttt.exe116⤵PID:448
-
\??\c:\tntnhh.exec:\tntnhh.exe117⤵
- System Location Discovery: System Language Discovery
PID:4860 -
\??\c:\jjddd.exec:\jjddd.exe118⤵PID:1296
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe119⤵PID:3720
-
\??\c:\hnnhnh.exec:\hnnhnh.exe120⤵
- System Location Discovery: System Language Discovery
PID:4992 -
\??\c:\jjjjv.exec:\jjjjv.exe121⤵PID:4344
-
\??\c:\rfllxfl.exec:\rfllxfl.exe122⤵PID:4580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-