Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 19:54
Behavioral task
behavioral1
Sample
13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe
Resource
win7-20240903-en
General
-
Target
13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe
-
Size
332KB
-
MD5
f66e32ae53325232d1d14d721fbc2f6b
-
SHA1
0686dc81ac94ace7db64d89e7eff3c847f01f036
-
SHA256
13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1
-
SHA512
55cff182fdfcd5c58a40fb92fcd91f8a7f91f749c109e4e14a1e0ae39896ff236eb3c386b00acbf520be2ab9970be8c99cfbeaaa1e2c3572358193f4b7177fde
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeR:R4wFHoSHYHUrAwfMp3CDR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2520-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1728-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3660-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1704-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/972-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3668-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2176-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1536-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3960-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1192-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1632-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2404-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2124-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1880-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/904-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1716-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3016-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4200-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4796-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3680-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3528-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3640-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3444-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1180-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1916-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2736-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3656-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3440-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1812-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3732-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3144-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1732-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1728-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2640-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2820-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3136-675-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/64-734-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1160-807-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-850-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nbtntt.exe5vvjv.exexxrllff.exe7httnt.exehttttb.exevppjd.exevjppj.exentbtnn.exejdjvv.exelxlxxxf.exe9nhbnn.exepdjdv.exe1llfxxx.exejddvv.exepjjvd.exepjpjd.exe1dddv.exevjvpd.exerfxrlfr.exejvvjd.exepjdjd.exetnnthb.exebhtnhb.exerxrlxff.exe9rlxlrr.exehttnhh.exedddvp.exe1lllfff.exetnnhtn.exe1vdvj.exellxlflf.exebttbtt.exedvdvp.exedvvpd.exelfrlxff.exelffrlfx.exenbhttb.exejppdv.exepdjdj.exe7lfllll.exennthbh.exentttnn.exevjjjv.exe1ffrrxx.exeffrrllr.exebthbtn.exepjpjp.exerfxllfx.exefrxfxlf.exepjvvd.exeffllxrx.exenhhbbb.exe1hbttn.exexrlfxrx.exexrlrllf.exetnbbhb.exedjvjd.exerxlfrrl.exenttbtt.exe7nnhnn.exevdpjd.exefxxxrll.exe3flxxff.exe3bbbhn.exepid Process 4284 nbtntt.exe 1728 5vvjv.exe 3660 xxrllff.exe 2348 7httnt.exe 1704 httttb.exe 972 vppjd.exe 3668 vjppj.exe 2176 ntbtnn.exe 2868 jdjvv.exe 4316 lxlxxxf.exe 1536 9nhbnn.exe 3960 pdjdv.exe 1192 1llfxxx.exe 4400 jddvv.exe 1612 pjjvd.exe 4940 pjpjd.exe 2404 1dddv.exe 1632 vjvpd.exe 3184 rfxrlfr.exe 2084 jvvjd.exe 3696 pjdjd.exe 1196 tnnthb.exe 2124 bhtnhb.exe 1880 rxrlxff.exe 904 9rlxlrr.exe 2996 httnhh.exe 1716 dddvp.exe 3016 1lllfff.exe 812 tnnhtn.exe 4364 1vdvj.exe 3548 llxlflf.exe 4784 bttbtt.exe 4200 dvdvp.exe 4160 dvvpd.exe 3440 lfrlxff.exe 1352 lffrlfx.exe 4980 nbhttb.exe 4796 jppdv.exe 3680 pdjdj.exe 1640 7lfllll.exe 4976 nnthbh.exe 4912 ntttnn.exe 4580 vjjjv.exe 3528 1ffrrxx.exe 4960 ffrrllr.exe 3468 bthbtn.exe 3260 pjpjp.exe 4520 rfxllfx.exe 3028 frxfxlf.exe 216 pjvvd.exe 4816 ffllxrx.exe 3640 nhhbbb.exe 3176 1hbttn.exe 4936 xrlfxrx.exe 2348 xrlrllf.exe 556 tnbbhb.exe 5000 djvjd.exe 3980 rxlfrrl.exe 3368 nttbtt.exe 540 7nnhnn.exe 3952 vdpjd.exe 3252 fxxxrll.exe 4788 3flxxff.exe 3508 3bbbhn.exe -
Processes:
resource yara_rule behavioral2/memory/2520-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b54-3.dat upx behavioral2/memory/2520-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b68-8.dat upx behavioral2/memory/1728-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4284-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b69-11.dat upx behavioral2/files/0x000a000000023b6a-19.dat upx behavioral2/memory/2348-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3660-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b6b-24.dat upx behavioral2/memory/2348-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b6c-29.dat upx behavioral2/memory/1704-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/972-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b6d-34.dat upx behavioral2/files/0x000a000000023b6e-39.dat upx behavioral2/memory/3668-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b6f-44.dat upx behavioral2/memory/2176-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b70-49.dat upx behavioral2/memory/2868-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b71-55.dat upx behavioral2/memory/1536-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4316-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b72-61.dat upx behavioral2/files/0x000a000000023b73-64.dat upx behavioral2/memory/3960-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1192-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b74-69.dat upx behavioral2/memory/4400-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b75-75.dat upx behavioral2/files/0x000a000000023b76-80.dat upx behavioral2/memory/1612-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b65-84.dat upx behavioral2/files/0x000a000000023b77-90.dat upx behavioral2/memory/4940-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1632-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2404-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b78-96.dat upx behavioral2/files/0x000a000000023b79-99.dat upx behavioral2/files/0x000a000000023b7a-104.dat upx behavioral2/files/0x000a000000023b7b-107.dat upx behavioral2/memory/3696-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7c-113.dat upx behavioral2/files/0x000a000000023b7d-117.dat upx behavioral2/memory/2124-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7e-123.dat upx behavioral2/memory/1880-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b7f-128.dat upx behavioral2/memory/904-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b80-132.dat upx behavioral2/files/0x0031000000023b81-137.dat upx behavioral2/memory/1716-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3016-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b82-140.dat upx behavioral2/files/0x000a000000023b83-146.dat upx behavioral2/files/0x000a000000023b84-149.dat upx behavioral2/files/0x000a000000023b85-153.dat upx behavioral2/memory/3548-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4784-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4200-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4796-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3680-175-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
hhnnnn.exe9rlxlrr.exepvjdp.exellrlrrl.exevddpj.exehhnhbt.exepdjdj.exehbbbht.exepjjdd.exedvpjj.exe1bnhbb.exenttnhh.exevpvvv.exe9tnhbb.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rlxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exenbtntt.exe5vvjv.exexxrllff.exe7httnt.exehttttb.exevppjd.exevjppj.exentbtnn.exejdjvv.exelxlxxxf.exe9nhbnn.exepdjdv.exe1llfxxx.exejddvv.exepjjvd.exepjpjd.exe1dddv.exevjvpd.exerfxrlfr.exejvvjd.exepjdjd.exedescription pid Process procid_target PID 2520 wrote to memory of 4284 2520 13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe 84 PID 2520 wrote to memory of 4284 2520 13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe 84 PID 2520 wrote to memory of 4284 2520 13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe 84 PID 4284 wrote to memory of 1728 4284 nbtntt.exe 85 PID 4284 wrote to memory of 1728 4284 nbtntt.exe 85 PID 4284 wrote to memory of 1728 4284 nbtntt.exe 85 PID 1728 wrote to memory of 3660 1728 5vvjv.exe 86 PID 1728 wrote to memory of 3660 1728 5vvjv.exe 86 PID 1728 wrote to memory of 3660 1728 5vvjv.exe 86 PID 3660 wrote to memory of 2348 3660 xxrllff.exe 87 PID 3660 wrote to memory of 2348 3660 xxrllff.exe 87 PID 3660 wrote to memory of 2348 3660 xxrllff.exe 87 PID 2348 wrote to memory of 1704 2348 7httnt.exe 88 PID 2348 wrote to memory of 1704 2348 7httnt.exe 88 PID 2348 wrote to memory of 1704 2348 7httnt.exe 88 PID 1704 wrote to memory of 972 1704 httttb.exe 89 PID 1704 wrote to memory of 972 1704 httttb.exe 89 PID 1704 wrote to memory of 972 1704 httttb.exe 89 PID 972 wrote to memory of 3668 972 vppjd.exe 90 PID 972 wrote to memory of 3668 972 vppjd.exe 90 PID 972 wrote to memory of 3668 972 vppjd.exe 90 PID 3668 wrote to memory of 2176 3668 vjppj.exe 91 PID 3668 wrote to memory of 2176 3668 vjppj.exe 91 PID 3668 wrote to memory of 2176 3668 vjppj.exe 91 PID 2176 wrote to memory of 2868 2176 ntbtnn.exe 92 PID 2176 wrote to memory of 2868 2176 ntbtnn.exe 92 PID 2176 wrote to memory of 2868 2176 ntbtnn.exe 92 PID 2868 wrote to memory of 4316 2868 jdjvv.exe 93 PID 2868 wrote to memory of 4316 2868 jdjvv.exe 93 PID 2868 wrote to memory of 4316 2868 jdjvv.exe 93 PID 4316 wrote to memory of 1536 4316 lxlxxxf.exe 94 PID 4316 wrote to memory of 1536 4316 lxlxxxf.exe 94 PID 4316 wrote to memory of 1536 4316 lxlxxxf.exe 94 PID 1536 wrote to memory of 3960 1536 9nhbnn.exe 95 PID 1536 wrote to memory of 3960 1536 9nhbnn.exe 95 PID 1536 wrote to memory of 3960 1536 9nhbnn.exe 95 PID 3960 wrote to memory of 1192 3960 pdjdv.exe 96 PID 3960 wrote to memory of 1192 3960 pdjdv.exe 96 PID 3960 wrote to memory of 1192 3960 pdjdv.exe 96 PID 1192 wrote to memory of 4400 1192 1llfxxx.exe 97 PID 1192 wrote to memory of 4400 1192 1llfxxx.exe 97 PID 1192 wrote to memory of 4400 1192 1llfxxx.exe 97 PID 4400 wrote to memory of 1612 4400 jddvv.exe 98 PID 4400 wrote to memory of 1612 4400 jddvv.exe 98 PID 4400 wrote to memory of 1612 4400 jddvv.exe 98 PID 1612 wrote to memory of 4940 1612 pjjvd.exe 99 PID 1612 wrote to memory of 4940 1612 pjjvd.exe 99 PID 1612 wrote to memory of 4940 1612 pjjvd.exe 99 PID 4940 wrote to memory of 2404 4940 pjpjd.exe 100 PID 4940 wrote to memory of 2404 4940 pjpjd.exe 100 PID 4940 wrote to memory of 2404 4940 pjpjd.exe 100 PID 2404 wrote to memory of 1632 2404 1dddv.exe 101 PID 2404 wrote to memory of 1632 2404 1dddv.exe 101 PID 2404 wrote to memory of 1632 2404 1dddv.exe 101 PID 1632 wrote to memory of 3184 1632 vjvpd.exe 102 PID 1632 wrote to memory of 3184 1632 vjvpd.exe 102 PID 1632 wrote to memory of 3184 1632 vjvpd.exe 102 PID 3184 wrote to memory of 2084 3184 rfxrlfr.exe 103 PID 3184 wrote to memory of 2084 3184 rfxrlfr.exe 103 PID 3184 wrote to memory of 2084 3184 rfxrlfr.exe 103 PID 2084 wrote to memory of 3696 2084 jvvjd.exe 104 PID 2084 wrote to memory of 3696 2084 jvvjd.exe 104 PID 2084 wrote to memory of 3696 2084 jvvjd.exe 104 PID 3696 wrote to memory of 1196 3696 pjdjd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe"C:\Users\Admin\AppData\Local\Temp\13c96d1e32de79d2a280712f67183e62f8dfd1b18e2fc609ed8e9da9a0e556e1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\nbtntt.exec:\nbtntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\5vvjv.exec:\5vvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\xxrllff.exec:\xxrllff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\7httnt.exec:\7httnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\httttb.exec:\httttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\vppjd.exec:\vppjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\vjppj.exec:\vjppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\ntbtnn.exec:\ntbtnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\jdjvv.exec:\jdjvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\lxlxxxf.exec:\lxlxxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\9nhbnn.exec:\9nhbnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\pdjdv.exec:\pdjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\1llfxxx.exec:\1llfxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\jddvv.exec:\jddvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\pjjvd.exec:\pjjvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\pjpjd.exec:\pjpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\1dddv.exec:\1dddv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\vjvpd.exec:\vjvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\rfxrlfr.exec:\rfxrlfr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\jvvjd.exec:\jvvjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\pjdjd.exec:\pjdjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\tnnthb.exec:\tnnthb.exe23⤵
- Executes dropped EXE
PID:1196 -
\??\c:\bhtnhb.exec:\bhtnhb.exe24⤵
- Executes dropped EXE
PID:2124 -
\??\c:\rxrlxff.exec:\rxrlxff.exe25⤵
- Executes dropped EXE
PID:1880 -
\??\c:\9rlxlrr.exec:\9rlxlrr.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:904 -
\??\c:\httnhh.exec:\httnhh.exe27⤵
- Executes dropped EXE
PID:2996 -
\??\c:\dddvp.exec:\dddvp.exe28⤵
- Executes dropped EXE
PID:1716 -
\??\c:\1lllfff.exec:\1lllfff.exe29⤵
- Executes dropped EXE
PID:3016 -
\??\c:\tnnhtn.exec:\tnnhtn.exe30⤵
- Executes dropped EXE
PID:812 -
\??\c:\1vdvj.exec:\1vdvj.exe31⤵
- Executes dropped EXE
PID:4364 -
\??\c:\llxlflf.exec:\llxlflf.exe32⤵
- Executes dropped EXE
PID:3548 -
\??\c:\bttbtt.exec:\bttbtt.exe33⤵
- Executes dropped EXE
PID:4784 -
\??\c:\dvdvp.exec:\dvdvp.exe34⤵
- Executes dropped EXE
PID:4200 -
\??\c:\dvvpd.exec:\dvvpd.exe35⤵
- Executes dropped EXE
PID:4160 -
\??\c:\lfrlxff.exec:\lfrlxff.exe36⤵
- Executes dropped EXE
PID:3440 -
\??\c:\lffrlfx.exec:\lffrlfx.exe37⤵
- Executes dropped EXE
PID:1352 -
\??\c:\nbhttb.exec:\nbhttb.exe38⤵
- Executes dropped EXE
PID:4980 -
\??\c:\jppdv.exec:\jppdv.exe39⤵
- Executes dropped EXE
PID:4796 -
\??\c:\pdjdj.exec:\pdjdj.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3680 -
\??\c:\7lfllll.exec:\7lfllll.exe41⤵
- Executes dropped EXE
PID:1640 -
\??\c:\nnthbh.exec:\nnthbh.exe42⤵
- Executes dropped EXE
PID:4976 -
\??\c:\ntttnn.exec:\ntttnn.exe43⤵
- Executes dropped EXE
PID:4912 -
\??\c:\vjjjv.exec:\vjjjv.exe44⤵
- Executes dropped EXE
PID:4580 -
\??\c:\1ffrrxx.exec:\1ffrrxx.exe45⤵
- Executes dropped EXE
PID:3528 -
\??\c:\ffrrllr.exec:\ffrrllr.exe46⤵
- Executes dropped EXE
PID:4960 -
\??\c:\bthbtn.exec:\bthbtn.exe47⤵
- Executes dropped EXE
PID:3468 -
\??\c:\pjpjp.exec:\pjpjp.exe48⤵
- Executes dropped EXE
PID:3260 -
\??\c:\rfxllfx.exec:\rfxllfx.exe49⤵
- Executes dropped EXE
PID:4520 -
\??\c:\frxfxlf.exec:\frxfxlf.exe50⤵
- Executes dropped EXE
PID:3028 -
\??\c:\pjvvd.exec:\pjvvd.exe51⤵
- Executes dropped EXE
PID:216 -
\??\c:\ffllxrx.exec:\ffllxrx.exe52⤵
- Executes dropped EXE
PID:4816 -
\??\c:\nhhbbb.exec:\nhhbbb.exe53⤵
- Executes dropped EXE
PID:3640 -
\??\c:\1hbttn.exec:\1hbttn.exe54⤵
- Executes dropped EXE
PID:3176 -
\??\c:\xrlfxrx.exec:\xrlfxrx.exe55⤵
- Executes dropped EXE
PID:4936 -
\??\c:\xrlrllf.exec:\xrlrllf.exe56⤵
- Executes dropped EXE
PID:2348 -
\??\c:\tnbbhb.exec:\tnbbhb.exe57⤵
- Executes dropped EXE
PID:556 -
\??\c:\djvjd.exec:\djvjd.exe58⤵
- Executes dropped EXE
PID:5000 -
\??\c:\rxlfrrl.exec:\rxlfrrl.exe59⤵
- Executes dropped EXE
PID:3980 -
\??\c:\nttbtt.exec:\nttbtt.exe60⤵
- Executes dropped EXE
PID:3368 -
\??\c:\7nnhnn.exec:\7nnhnn.exe61⤵
- Executes dropped EXE
PID:540 -
\??\c:\vdpjd.exec:\vdpjd.exe62⤵
- Executes dropped EXE
PID:3952 -
\??\c:\fxxxrll.exec:\fxxxrll.exe63⤵
- Executes dropped EXE
PID:3252 -
\??\c:\3flxxff.exec:\3flxxff.exe64⤵
- Executes dropped EXE
PID:4788 -
\??\c:\3bbbhn.exec:\3bbbhn.exe65⤵
- Executes dropped EXE
PID:3508 -
\??\c:\1djvj.exec:\1djvj.exe66⤵PID:3196
-
\??\c:\pdddv.exec:\pdddv.exe67⤵PID:2300
-
\??\c:\rflfxxr.exec:\rflfxxr.exe68⤵PID:5108
-
\??\c:\3nnnnn.exec:\3nnnnn.exe69⤵PID:1900
-
\??\c:\dvvpp.exec:\dvvpp.exe70⤵PID:3480
-
\??\c:\pvvvp.exec:\pvvvp.exe71⤵PID:1344
-
\??\c:\flxlxxr.exec:\flxlxxr.exe72⤵PID:624
-
\??\c:\5nbbhn.exec:\5nbbhn.exe73⤵PID:3436
-
\??\c:\bnthbt.exec:\bnthbt.exe74⤵PID:232
-
\??\c:\vdjdp.exec:\vdjdp.exe75⤵PID:3520
-
\??\c:\ffrrffl.exec:\ffrrffl.exe76⤵PID:212
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe77⤵PID:3444
-
\??\c:\bbtnnb.exec:\bbtnnb.exe78⤵PID:8
-
\??\c:\vvpjd.exec:\vvpjd.exe79⤵PID:3184
-
\??\c:\vpjvp.exec:\vpjvp.exe80⤵PID:4780
-
\??\c:\xrllxrr.exec:\xrllxrr.exe81⤵PID:3808
-
\??\c:\xlxfrrr.exec:\xlxfrrr.exe82⤵PID:4944
-
\??\c:\hhbtnn.exec:\hhbtnn.exe83⤵PID:3924
-
\??\c:\pddjd.exec:\pddjd.exe84⤵PID:1180
-
\??\c:\pvdvd.exec:\pvdvd.exe85⤵PID:4292
-
\??\c:\5frrllx.exec:\5frrllx.exe86⤵PID:2780
-
\??\c:\3bnhhh.exec:\3bnhhh.exe87⤵PID:944
-
\??\c:\hhnbth.exec:\hhnbth.exe88⤵PID:1916
-
\??\c:\pjvvv.exec:\pjvvv.exe89⤵PID:1672
-
\??\c:\1lxrfrl.exec:\1lxrfrl.exe90⤵PID:2872
-
\??\c:\lrffxfl.exec:\lrffxfl.exe91⤵PID:852
-
\??\c:\bbbtnn.exec:\bbbtnn.exe92⤵PID:2372
-
\??\c:\bnnnhh.exec:\bnnnhh.exe93⤵PID:2724
-
\??\c:\jdjpj.exec:\jdjpj.exe94⤵PID:2736
-
\??\c:\xlfxrff.exec:\xlfxrff.exe95⤵PID:5048
-
\??\c:\ttbttt.exec:\ttbttt.exe96⤵PID:3656
-
\??\c:\bhhbbb.exec:\bhhbbb.exe97⤵PID:440
-
\??\c:\vvvvp.exec:\vvvvp.exe98⤵PID:2256
-
\??\c:\vvjjd.exec:\vvjjd.exe99⤵PID:4160
-
\??\c:\ffxrlrl.exec:\ffxrlrl.exe100⤵PID:3440
-
\??\c:\tnnnhh.exec:\tnnnhh.exe101⤵PID:1352
-
\??\c:\3hnhbt.exec:\3hnhbt.exe102⤵PID:4980
-
\??\c:\ddjjd.exec:\ddjjd.exe103⤵PID:2992
-
\??\c:\jdpjj.exec:\jdpjj.exe104⤵PID:3680
-
\??\c:\xrlfxlf.exec:\xrlfxlf.exe105⤵PID:1812
-
\??\c:\1hhhbn.exec:\1hhhbn.exe106⤵PID:4720
-
\??\c:\ppppd.exec:\ppppd.exe107⤵PID:5080
-
\??\c:\pvvjd.exec:\pvvjd.exe108⤵PID:1092
-
\??\c:\rflfrrr.exec:\rflfrrr.exe109⤵PID:688
-
\??\c:\hhtnhb.exec:\hhtnhb.exe110⤵PID:4552
-
\??\c:\7ppjv.exec:\7ppjv.exe111⤵PID:4524
-
\??\c:\ddjdv.exec:\ddjdv.exe112⤵PID:3432
-
\??\c:\3xfxllf.exec:\3xfxllf.exe113⤵PID:3088
-
\??\c:\9xllrrx.exec:\9xllrrx.exe114⤵PID:3372
-
\??\c:\7bbtnn.exec:\7bbtnn.exe115⤵PID:1728
-
\??\c:\bnhhtt.exec:\bnhhtt.exe116⤵PID:2420
-
\??\c:\jjvpd.exec:\jjvpd.exe117⤵PID:4472
-
\??\c:\xxrrlff.exec:\xxrrlff.exe118⤵PID:4936
-
\??\c:\rfxrrrl.exec:\rfxrrrl.exe119⤵PID:2348
-
\??\c:\nbtttn.exec:\nbtttn.exe120⤵PID:1704
-
\??\c:\jjpjj.exec:\jjpjj.exe121⤵PID:2684
-
\??\c:\3ddvp.exec:\3ddvp.exe122⤵PID:4564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-