Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2024, 01:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe
-
Size
453KB
-
MD5
f0669a0ecc6efac4e3159d57b9ce7ee9
-
SHA1
6e9abbd2a5e52fb8dd8023332cc7f593c2bf6798
-
SHA256
926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5
-
SHA512
3b46cfe494247febf41d5d9edd315ab01e0081eb21a7d678e44378a10434eae33d53b35295d481cf9ccae7cd32fa497f9869be5dbc974339d88eb48e01bcdaf0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4656-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/828-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1272-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1244-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1516-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-678-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-706-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-1040-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-1556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-1765-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/956-1904-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2872 682064.exe 3144 u802648.exe 828 thtbnn.exe 3988 40086.exe 208 1dvpj.exe 2432 httnhb.exe 4264 ttnnhb.exe 4788 9ppjd.exe 2964 vdvjv.exe 1520 42264.exe 1272 440860.exe 1332 tttnnt.exe 2724 66260.exe 2684 22448.exe 1128 vpddp.exe 3672 xrxrxxf.exe 3648 08086.exe 1828 jdpjv.exe 4032 7bbtnn.exe 3592 pjjjj.exe 4936 6622844.exe 4680 fxxxrrl.exe 924 q64844.exe 220 2660444.exe 2908 bnttnn.exe 4648 8404808.exe 4604 462682.exe 2868 rxfrfxl.exe 2552 0626082.exe 3148 jpvjd.exe 1192 xlrlrrr.exe 3784 84666.exe 1804 284888.exe 4480 nbhbhh.exe 2444 lffxxrr.exe 2856 c248222.exe 5112 26600.exe 4504 82488.exe 1908 9jjjd.exe 1532 4200006.exe 672 464488.exe 436 62822.exe 1844 fllfrrr.exe 4924 jpvpv.exe 4988 2626444.exe 1096 c882244.exe 5056 ppjpp.exe 4672 rlxxrrr.exe 4364 llllllf.exe 4608 6064882.exe 3744 20268.exe 4020 nbhhhh.exe 4844 1dvpp.exe 2524 vjpjv.exe 4824 c664882.exe 3512 c882608.exe 5032 264844.exe 4104 llffxxx.exe 3644 bbbbtt.exe 2432 rlxrllr.exe 5008 bntnhh.exe 3112 26866.exe 2964 jpppj.exe 3896 xffxrrl.exe -
resource yara_rule behavioral2/memory/4656-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/828-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1272-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1272-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1244-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1516-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-816-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-1040-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 062266.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 264844.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u064826.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0022004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2660882.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4000822.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ffxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g2482.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4656 wrote to memory of 2872 4656 926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe 83 PID 4656 wrote to memory of 2872 4656 926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe 83 PID 4656 wrote to memory of 2872 4656 926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe 83 PID 2872 wrote to memory of 3144 2872 682064.exe 84 PID 2872 wrote to memory of 3144 2872 682064.exe 84 PID 2872 wrote to memory of 3144 2872 682064.exe 84 PID 3144 wrote to memory of 828 3144 u802648.exe 85 PID 3144 wrote to memory of 828 3144 u802648.exe 85 PID 3144 wrote to memory of 828 3144 u802648.exe 85 PID 828 wrote to memory of 3988 828 thtbnn.exe 86 PID 828 wrote to memory of 3988 828 thtbnn.exe 86 PID 828 wrote to memory of 3988 828 thtbnn.exe 86 PID 3988 wrote to memory of 208 3988 40086.exe 87 PID 3988 wrote to memory of 208 3988 40086.exe 87 PID 3988 wrote to memory of 208 3988 40086.exe 87 PID 208 wrote to memory of 2432 208 1dvpj.exe 88 PID 208 wrote to memory of 2432 208 1dvpj.exe 88 PID 208 wrote to memory of 2432 208 1dvpj.exe 88 PID 2432 wrote to memory of 4264 2432 httnhb.exe 89 PID 2432 wrote to memory of 4264 2432 httnhb.exe 89 PID 2432 wrote to memory of 4264 2432 httnhb.exe 89 PID 4264 wrote to memory of 4788 4264 ttnnhb.exe 90 PID 4264 wrote to memory of 4788 4264 ttnnhb.exe 90 PID 4264 wrote to memory of 4788 4264 ttnnhb.exe 90 PID 4788 wrote to memory of 2964 4788 9ppjd.exe 91 PID 4788 wrote to memory of 2964 4788 9ppjd.exe 91 PID 4788 wrote to memory of 2964 4788 9ppjd.exe 91 PID 2964 wrote to memory of 1520 2964 vdvjv.exe 92 PID 2964 wrote to memory of 1520 2964 vdvjv.exe 92 PID 2964 wrote to memory of 1520 2964 vdvjv.exe 92 PID 1520 wrote to memory of 1272 1520 42264.exe 93 PID 1520 wrote to memory of 1272 1520 42264.exe 93 PID 1520 wrote to memory of 1272 1520 42264.exe 93 PID 1272 wrote to memory of 1332 1272 440860.exe 94 PID 1272 wrote to memory of 1332 1272 440860.exe 94 PID 1272 wrote to memory of 1332 1272 440860.exe 94 PID 1332 wrote to memory of 2724 1332 tttnnt.exe 95 PID 1332 wrote to memory of 2724 1332 tttnnt.exe 95 PID 1332 wrote to memory of 2724 1332 tttnnt.exe 95 PID 2724 wrote to memory of 2684 2724 66260.exe 96 PID 2724 wrote to memory of 2684 2724 66260.exe 96 PID 2724 wrote to memory of 2684 2724 66260.exe 96 PID 2684 wrote to memory of 1128 2684 22448.exe 97 PID 2684 wrote to memory of 1128 2684 22448.exe 97 PID 2684 wrote to memory of 1128 2684 22448.exe 97 PID 1128 wrote to memory of 3672 1128 vpddp.exe 98 PID 1128 wrote to memory of 3672 1128 vpddp.exe 98 PID 1128 wrote to memory of 3672 1128 vpddp.exe 98 PID 3672 wrote to memory of 3648 3672 xrxrxxf.exe 99 PID 3672 wrote to memory of 3648 3672 xrxrxxf.exe 99 PID 3672 wrote to memory of 3648 3672 xrxrxxf.exe 99 PID 3648 wrote to memory of 1828 3648 08086.exe 100 PID 3648 wrote to memory of 1828 3648 08086.exe 100 PID 3648 wrote to memory of 1828 3648 08086.exe 100 PID 1828 wrote to memory of 4032 1828 jdpjv.exe 101 PID 1828 wrote to memory of 4032 1828 jdpjv.exe 101 PID 1828 wrote to memory of 4032 1828 jdpjv.exe 101 PID 4032 wrote to memory of 3592 4032 7bbtnn.exe 102 PID 4032 wrote to memory of 3592 4032 7bbtnn.exe 102 PID 4032 wrote to memory of 3592 4032 7bbtnn.exe 102 PID 3592 wrote to memory of 4936 3592 pjjjj.exe 103 PID 3592 wrote to memory of 4936 3592 pjjjj.exe 103 PID 3592 wrote to memory of 4936 3592 pjjjj.exe 103 PID 4936 wrote to memory of 4680 4936 6622844.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe"C:\Users\Admin\AppData\Local\Temp\926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\682064.exec:\682064.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\u802648.exec:\u802648.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\thtbnn.exec:\thtbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\40086.exec:\40086.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\1dvpj.exec:\1dvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\httnhb.exec:\httnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\ttnnhb.exec:\ttnnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\9ppjd.exec:\9ppjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\vdvjv.exec:\vdvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\42264.exec:\42264.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\440860.exec:\440860.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\tttnnt.exec:\tttnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\66260.exec:\66260.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\22448.exec:\22448.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\vpddp.exec:\vpddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\xrxrxxf.exec:\xrxrxxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\08086.exec:\08086.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\jdpjv.exec:\jdpjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\7bbtnn.exec:\7bbtnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\pjjjj.exec:\pjjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\6622844.exec:\6622844.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe23⤵
- Executes dropped EXE
PID:4680 -
\??\c:\q64844.exec:\q64844.exe24⤵
- Executes dropped EXE
PID:924 -
\??\c:\2660444.exec:\2660444.exe25⤵
- Executes dropped EXE
PID:220 -
\??\c:\bnttnn.exec:\bnttnn.exe26⤵
- Executes dropped EXE
PID:2908 -
\??\c:\8404808.exec:\8404808.exe27⤵
- Executes dropped EXE
PID:4648 -
\??\c:\462682.exec:\462682.exe28⤵
- Executes dropped EXE
PID:4604 -
\??\c:\rxfrfxl.exec:\rxfrfxl.exe29⤵
- Executes dropped EXE
PID:2868 -
\??\c:\0626082.exec:\0626082.exe30⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jpvjd.exec:\jpvjd.exe31⤵
- Executes dropped EXE
PID:3148 -
\??\c:\xlrlrrr.exec:\xlrlrrr.exe32⤵
- Executes dropped EXE
PID:1192 -
\??\c:\84666.exec:\84666.exe33⤵
- Executes dropped EXE
PID:3784 -
\??\c:\284888.exec:\284888.exe34⤵
- Executes dropped EXE
PID:1804 -
\??\c:\nbhbhh.exec:\nbhbhh.exe35⤵
- Executes dropped EXE
PID:4480 -
\??\c:\lffxxrr.exec:\lffxxrr.exe36⤵
- Executes dropped EXE
PID:2444 -
\??\c:\c248222.exec:\c248222.exe37⤵
- Executes dropped EXE
PID:2856 -
\??\c:\26600.exec:\26600.exe38⤵
- Executes dropped EXE
PID:5112 -
\??\c:\82488.exec:\82488.exe39⤵
- Executes dropped EXE
PID:4504 -
\??\c:\9jjjd.exec:\9jjjd.exe40⤵
- Executes dropped EXE
PID:1908 -
\??\c:\4200006.exec:\4200006.exe41⤵
- Executes dropped EXE
PID:1532 -
\??\c:\464488.exec:\464488.exe42⤵
- Executes dropped EXE
PID:672 -
\??\c:\62822.exec:\62822.exe43⤵
- Executes dropped EXE
PID:436 -
\??\c:\fllfrrr.exec:\fllfrrr.exe44⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jpvpv.exec:\jpvpv.exe45⤵
- Executes dropped EXE
PID:4924 -
\??\c:\2626444.exec:\2626444.exe46⤵
- Executes dropped EXE
PID:4988 -
\??\c:\c882244.exec:\c882244.exe47⤵
- Executes dropped EXE
PID:1096 -
\??\c:\ppjpp.exec:\ppjpp.exe48⤵
- Executes dropped EXE
PID:5056 -
\??\c:\rlxxrrr.exec:\rlxxrrr.exe49⤵
- Executes dropped EXE
PID:4672 -
\??\c:\llllllf.exec:\llllllf.exe50⤵
- Executes dropped EXE
PID:4364 -
\??\c:\6064882.exec:\6064882.exe51⤵
- Executes dropped EXE
PID:4608 -
\??\c:\20268.exec:\20268.exe52⤵
- Executes dropped EXE
PID:3744 -
\??\c:\nbhhhh.exec:\nbhhhh.exe53⤵
- Executes dropped EXE
PID:4020 -
\??\c:\1dvpp.exec:\1dvpp.exe54⤵
- Executes dropped EXE
PID:4844 -
\??\c:\vjpjv.exec:\vjpjv.exe55⤵
- Executes dropped EXE
PID:2524 -
\??\c:\c664882.exec:\c664882.exe56⤵
- Executes dropped EXE
PID:4824 -
\??\c:\c882608.exec:\c882608.exe57⤵
- Executes dropped EXE
PID:3512 -
\??\c:\264844.exec:\264844.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5032 -
\??\c:\llffxxx.exec:\llffxxx.exe59⤵
- Executes dropped EXE
PID:4104 -
\??\c:\bbbbtt.exec:\bbbbtt.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3644 -
\??\c:\rlxrllr.exec:\rlxrllr.exe61⤵
- Executes dropped EXE
PID:2432 -
\??\c:\bntnhh.exec:\bntnhh.exe62⤵
- Executes dropped EXE
PID:5008 -
\??\c:\26866.exec:\26866.exe63⤵
- Executes dropped EXE
PID:3112 -
\??\c:\jpppj.exec:\jpppj.exe64⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xffxrrl.exec:\xffxrrl.exe65⤵
- Executes dropped EXE
PID:3896 -
\??\c:\06862.exec:\06862.exe66⤵PID:3316
-
\??\c:\2684040.exec:\2684040.exe67⤵PID:1332
-
\??\c:\628444.exec:\628444.exe68⤵PID:5004
-
\??\c:\62082.exec:\62082.exe69⤵PID:1016
-
\??\c:\pjdvp.exec:\pjdvp.exe70⤵PID:2656
-
\??\c:\4882060.exec:\4882060.exe71⤵PID:1168
-
\??\c:\vdpjd.exec:\vdpjd.exe72⤵PID:632
-
\??\c:\4204288.exec:\4204288.exe73⤵PID:4944
-
\??\c:\5fxrlrl.exec:\5fxrlrl.exe74⤵PID:2612
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe75⤵PID:3592
-
\??\c:\66826.exec:\66826.exe76⤵PID:4832
-
\??\c:\bhtnhn.exec:\bhtnhn.exe77⤵PID:4936
-
\??\c:\u064826.exec:\u064826.exe78⤵
- System Location Discovery: System Language Discovery
PID:2592 -
\??\c:\8266066.exec:\8266066.exe79⤵PID:3464
-
\??\c:\8228000.exec:\8228000.exe80⤵PID:4276
-
\??\c:\llllfff.exec:\llllfff.exe81⤵PID:1512
-
\??\c:\bbhhnn.exec:\bbhhnn.exe82⤵PID:464
-
\??\c:\e00088.exec:\e00088.exe83⤵PID:3960
-
\??\c:\84660.exec:\84660.exe84⤵PID:1244
-
\??\c:\bntthh.exec:\bntthh.exe85⤵PID:2276
-
\??\c:\vpvpj.exec:\vpvpj.exe86⤵PID:404
-
\??\c:\tnnhhh.exec:\tnnhhh.exe87⤵PID:3784
-
\??\c:\60400.exec:\60400.exe88⤵PID:4284
-
\??\c:\djpjj.exec:\djpjj.exe89⤵PID:4992
-
\??\c:\thhbtt.exec:\thhbtt.exe90⤵PID:2720
-
\??\c:\400264.exec:\400264.exe91⤵PID:1516
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe92⤵PID:2928
-
\??\c:\2882282.exec:\2882282.exe93⤵PID:3952
-
\??\c:\nhnbth.exec:\nhnbth.exe94⤵PID:3620
-
\??\c:\o244844.exec:\o244844.exe95⤵PID:1628
-
\??\c:\5vddv.exec:\5vddv.exe96⤵PID:3152
-
\??\c:\68804.exec:\68804.exe97⤵PID:1160
-
\??\c:\tttntb.exec:\tttntb.exe98⤵PID:4924
-
\??\c:\5ffxrrr.exec:\5ffxrrr.exe99⤵
- System Location Discovery: System Language Discovery
PID:3588 -
\??\c:\nbtnnn.exec:\nbtnnn.exe100⤵PID:4840
-
\??\c:\bntbnn.exec:\bntbnn.exe101⤵PID:4340
-
\??\c:\224888.exec:\224888.exe102⤵PID:2748
-
\??\c:\vpvjd.exec:\vpvjd.exe103⤵PID:1972
-
\??\c:\tnbttt.exec:\tnbttt.exe104⤵PID:532
-
\??\c:\g0642.exec:\g0642.exe105⤵PID:3744
-
\??\c:\04064.exec:\04064.exe106⤵PID:3368
-
\??\c:\ddppp.exec:\ddppp.exe107⤵PID:1624
-
\??\c:\lllfrrl.exec:\lllfrrl.exe108⤵PID:852
-
\??\c:\840486.exec:\840486.exe109⤵PID:1176
-
\??\c:\2626004.exec:\2626004.exe110⤵PID:4700
-
\??\c:\2060266.exec:\2060266.exe111⤵PID:3856
-
\??\c:\xrxfffx.exec:\xrxfffx.exe112⤵PID:3400
-
\??\c:\4086026.exec:\4086026.exe113⤵PID:1840
-
\??\c:\pjpjj.exec:\pjpjj.exe114⤵PID:4828
-
\??\c:\rlllfff.exec:\rlllfff.exe115⤵PID:4216
-
\??\c:\pvjdv.exec:\pvjdv.exe116⤵PID:4708
-
\??\c:\084848.exec:\084848.exe117⤵PID:2160
-
\??\c:\jdddp.exec:\jdddp.exe118⤵PID:876
-
\??\c:\fxlfxxf.exec:\fxlfxxf.exe119⤵PID:4896
-
\??\c:\flfxffl.exec:\flfxffl.exe120⤵PID:100
-
\??\c:\2248400.exec:\2248400.exe121⤵PID:3984
-
\??\c:\lllxxxl.exec:\lllxxxl.exe122⤵PID:2408
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-