Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 03:51
Behavioral task
behavioral1
Sample
414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe
Resource
win7-20240903-en
General
-
Target
414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe
-
Size
88KB
-
MD5
b335a746c82b1ce3728cab35dc3b1e64
-
SHA1
a8091ef3d90b56035109605127d618063f88afdf
-
SHA256
414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d
-
SHA512
357c1783a91ebc7cafe5188dafa5888f4bbc9c7c406c30484aee71e046acfd3ab2a7e651c2276b33c14cd6bcb8f8f731be6b1a6321287af6e930ffb1b153855b
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8yaVskCzYBbKd+XsWgADf1tE7hW1AI:9hOmTsF93UYfwC6GIoutyaVszyKd+XYE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1816-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1752-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3232-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3520-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3580-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4128-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1704-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2648-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2116-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2860-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4572-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1260-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1420-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3200-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4024-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4660-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/736-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/528-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/312-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2716-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/320-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3232-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3580-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3908-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1992-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1680-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1736-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3100-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2444-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/760-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4732-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/620-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1752-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-490-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-501-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-523-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/748-548-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-582-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/392-589-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3788-668-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1820-747-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4660-793-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1892-800-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3312-822-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1752-844-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3908-881-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2196-933-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-978-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vvjdp.exetbnbtt.exelrxllll.exerrxxflr.exelfrlfxr.exennhhhn.exelrffxxr.exehhthnb.exenttnnb.exepvvjp.exexrfffff.exehntbhh.exepvppj.exefflrrrr.exentbbtb.exehhnnnb.exedjvvv.exerrfllrx.exettttnt.exe5nbbbh.exevpppj.exe1rfffff.exerlfxxxr.exebntbbb.exedpjjj.exenbhhbh.exevvvvj.exeflflffr.exerlrxxll.exebhnhth.exejjppd.exexllffff.exelxxfxxx.exetnnnnn.exettnntt.exejdvvp.exehnhnht.exejvvvj.exexrxxxxr.exenhhntt.exe5jvjj.exejppjj.exefflrxxf.exetttttb.exehhnbnt.exejdjjd.exelxlflll.exexrxxxff.exettttbh.exehbnttb.exefrxfxfx.exehhbbtt.exeddvvv.exe9llxrfl.exehntnnh.exejvjdp.exeppddj.exethbttt.exehbbbnn.exevpjvv.exenhhbbh.exe5nnntt.exejpjpp.exerffrxxl.exepid Process 1928 vvjdp.exe 4764 tbnbtt.exe 1752 lrxllll.exe 3232 rrxxflr.exe 3520 lfrlfxr.exe 3580 nnhhhn.exe 4128 lrffxxr.exe 1804 hhthnb.exe 2992 nttnnb.exe 1704 pvvjp.exe 4788 xrfffff.exe 2648 hntbhh.exe 2116 pvppj.exe 2860 fflrrrr.exe 4572 ntbbtb.exe 3168 hhnnnb.exe 1260 djvvv.exe 3456 rrfllrx.exe 4964 ttttnt.exe 3776 5nbbbh.exe 3600 vpppj.exe 1608 1rfffff.exe 1412 rlfxxxr.exe 1420 bntbbb.exe 2388 dpjjj.exe 3200 nbhhbh.exe 4292 vvvvj.exe 2392 flflffr.exe 5024 rlrxxll.exe 396 bhnhth.exe 2864 jjppd.exe 1788 xllffff.exe 3156 lxxfxxx.exe 4588 tnnnnn.exe 2360 ttnntt.exe 3140 jdvvp.exe 4024 hnhnht.exe 3152 jvvvj.exe 5008 xrxxxxr.exe 3128 nhhntt.exe 4640 5jvjj.exe 2712 jppjj.exe 1336 fflrxxf.exe 4660 tttttb.exe 4452 hhnbnt.exe 736 jdjjd.exe 5084 lxlflll.exe 528 xrxxxff.exe 5012 ttttbh.exe 3480 hbnttb.exe 380 frxfxfx.exe 312 hhbbtt.exe 1744 ddvvv.exe 4332 9llxrfl.exe 632 hntnnh.exe 1928 jvjdp.exe 2716 ppddj.exe 4700 thbttt.exe 320 hbbbnn.exe 3232 vpjvv.exe 3852 nhhbbh.exe 3580 5nnntt.exe 1980 jpjpp.exe 3176 rffrxxl.exe -
Processes:
resource yara_rule behavioral2/memory/1816-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023c6d-4.dat upx behavioral2/files/0x0009000000023ccc-10.dat upx behavioral2/memory/1816-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1928-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd2-13.dat upx behavioral2/memory/1752-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd3-22.dat upx behavioral2/memory/1752-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4764-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd5-30.dat upx behavioral2/memory/3232-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd6-34.dat upx behavioral2/memory/3520-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd7-40.dat upx behavioral2/memory/3580-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd8-46.dat upx behavioral2/memory/4128-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd9-52.dat upx behavioral2/memory/1804-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cda-58.dat upx behavioral2/files/0x0007000000023cdb-63.dat upx behavioral2/memory/1704-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cdc-69.dat upx behavioral2/memory/2648-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cdd-74.dat upx behavioral2/files/0x0007000000023cde-80.dat upx behavioral2/memory/2116-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cdf-86.dat upx behavioral2/memory/2860-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce0-95.dat upx behavioral2/memory/4572-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce1-99.dat upx behavioral2/files/0x0007000000023ce2-103.dat upx behavioral2/memory/1260-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce3-109.dat upx behavioral2/files/0x0007000000023ce4-114.dat upx behavioral2/memory/4964-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce6-121.dat upx behavioral2/memory/3600-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce7-128.dat upx behavioral2/memory/3776-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023ccf-132.dat upx behavioral2/memory/1608-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce8-139.dat upx behavioral2/memory/1420-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce9-144.dat upx behavioral2/files/0x0007000000023cea-150.dat upx behavioral2/memory/3200-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ceb-156.dat upx behavioral2/files/0x0007000000023cec-161.dat upx behavioral2/memory/4292-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ced-166.dat upx behavioral2/memory/5024-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cee-172.dat upx behavioral2/files/0x0007000000023cef-179.dat upx behavioral2/memory/396-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cf0-183.dat upx behavioral2/memory/4024-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4640-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4660-227-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/736-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/528-241-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/312-254-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
nhhbbh.exexxxlllr.exebbnnnt.exevpdjj.exexrxffll.exeddvpp.exedjpvp.exehbbbnn.exe5hntnt.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exevvjdp.exetbnbtt.exelrxllll.exerrxxflr.exelfrlfxr.exennhhhn.exelrffxxr.exehhthnb.exenttnnb.exepvvjp.exexrfffff.exehntbhh.exepvppj.exefflrrrr.exentbbtb.exehhnnnb.exedjvvv.exerrfllrx.exettttnt.exe5nbbbh.exevpppj.exedescription pid Process procid_target PID 1816 wrote to memory of 1928 1816 414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe 82 PID 1816 wrote to memory of 1928 1816 414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe 82 PID 1816 wrote to memory of 1928 1816 414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe 82 PID 1928 wrote to memory of 4764 1928 vvjdp.exe 83 PID 1928 wrote to memory of 4764 1928 vvjdp.exe 83 PID 1928 wrote to memory of 4764 1928 vvjdp.exe 83 PID 4764 wrote to memory of 1752 4764 tbnbtt.exe 84 PID 4764 wrote to memory of 1752 4764 tbnbtt.exe 84 PID 4764 wrote to memory of 1752 4764 tbnbtt.exe 84 PID 1752 wrote to memory of 3232 1752 lrxllll.exe 85 PID 1752 wrote to memory of 3232 1752 lrxllll.exe 85 PID 1752 wrote to memory of 3232 1752 lrxllll.exe 85 PID 3232 wrote to memory of 3520 3232 rrxxflr.exe 86 PID 3232 wrote to memory of 3520 3232 rrxxflr.exe 86 PID 3232 wrote to memory of 3520 3232 rrxxflr.exe 86 PID 3520 wrote to memory of 3580 3520 lfrlfxr.exe 87 PID 3520 wrote to memory of 3580 3520 lfrlfxr.exe 87 PID 3520 wrote to memory of 3580 3520 lfrlfxr.exe 87 PID 3580 wrote to memory of 4128 3580 nnhhhn.exe 88 PID 3580 wrote to memory of 4128 3580 nnhhhn.exe 88 PID 3580 wrote to memory of 4128 3580 nnhhhn.exe 88 PID 4128 wrote to memory of 1804 4128 lrffxxr.exe 89 PID 4128 wrote to memory of 1804 4128 lrffxxr.exe 89 PID 4128 wrote to memory of 1804 4128 lrffxxr.exe 89 PID 1804 wrote to memory of 2992 1804 hhthnb.exe 90 PID 1804 wrote to memory of 2992 1804 hhthnb.exe 90 PID 1804 wrote to memory of 2992 1804 hhthnb.exe 90 PID 2992 wrote to memory of 1704 2992 nttnnb.exe 91 PID 2992 wrote to memory of 1704 2992 nttnnb.exe 91 PID 2992 wrote to memory of 1704 2992 nttnnb.exe 91 PID 1704 wrote to memory of 4788 1704 pvvjp.exe 92 PID 1704 wrote to memory of 4788 1704 pvvjp.exe 92 PID 1704 wrote to memory of 4788 1704 pvvjp.exe 92 PID 4788 wrote to memory of 2648 4788 xrfffff.exe 93 PID 4788 wrote to memory of 2648 4788 xrfffff.exe 93 PID 4788 wrote to memory of 2648 4788 xrfffff.exe 93 PID 2648 wrote to memory of 2116 2648 hntbhh.exe 94 PID 2648 wrote to memory of 2116 2648 hntbhh.exe 94 PID 2648 wrote to memory of 2116 2648 hntbhh.exe 94 PID 2116 wrote to memory of 2860 2116 pvppj.exe 95 PID 2116 wrote to memory of 2860 2116 pvppj.exe 95 PID 2116 wrote to memory of 2860 2116 pvppj.exe 95 PID 2860 wrote to memory of 4572 2860 fflrrrr.exe 96 PID 2860 wrote to memory of 4572 2860 fflrrrr.exe 96 PID 2860 wrote to memory of 4572 2860 fflrrrr.exe 96 PID 4572 wrote to memory of 3168 4572 ntbbtb.exe 97 PID 4572 wrote to memory of 3168 4572 ntbbtb.exe 97 PID 4572 wrote to memory of 3168 4572 ntbbtb.exe 97 PID 3168 wrote to memory of 1260 3168 hhnnnb.exe 98 PID 3168 wrote to memory of 1260 3168 hhnnnb.exe 98 PID 3168 wrote to memory of 1260 3168 hhnnnb.exe 98 PID 1260 wrote to memory of 3456 1260 djvvv.exe 99 PID 1260 wrote to memory of 3456 1260 djvvv.exe 99 PID 1260 wrote to memory of 3456 1260 djvvv.exe 99 PID 3456 wrote to memory of 4964 3456 rrfllrx.exe 100 PID 3456 wrote to memory of 4964 3456 rrfllrx.exe 100 PID 3456 wrote to memory of 4964 3456 rrfllrx.exe 100 PID 4964 wrote to memory of 3776 4964 ttttnt.exe 101 PID 4964 wrote to memory of 3776 4964 ttttnt.exe 101 PID 4964 wrote to memory of 3776 4964 ttttnt.exe 101 PID 3776 wrote to memory of 3600 3776 5nbbbh.exe 102 PID 3776 wrote to memory of 3600 3776 5nbbbh.exe 102 PID 3776 wrote to memory of 3600 3776 5nbbbh.exe 102 PID 3600 wrote to memory of 1608 3600 vpppj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe"C:\Users\Admin\AppData\Local\Temp\414544bf9d6d4f8f475e6209f028fee379caa1752659ce5996d521a50119a51d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\vvjdp.exec:\vvjdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\tbnbtt.exec:\tbnbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\lrxllll.exec:\lrxllll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\rrxxflr.exec:\rrxxflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\lfrlfxr.exec:\lfrlfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\nnhhhn.exec:\nnhhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\lrffxxr.exec:\lrffxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\hhthnb.exec:\hhthnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\nttnnb.exec:\nttnnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\pvvjp.exec:\pvvjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\xrfffff.exec:\xrfffff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\hntbhh.exec:\hntbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\pvppj.exec:\pvppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\fflrrrr.exec:\fflrrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\ntbbtb.exec:\ntbbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\hhnnnb.exec:\hhnnnb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\djvvv.exec:\djvvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\rrfllrx.exec:\rrfllrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\ttttnt.exec:\ttttnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\5nbbbh.exec:\5nbbbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\vpppj.exec:\vpppj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\1rfffff.exec:\1rfffff.exe23⤵
- Executes dropped EXE
PID:1608 -
\??\c:\rlfxxxr.exec:\rlfxxxr.exe24⤵
- Executes dropped EXE
PID:1412 -
\??\c:\bntbbb.exec:\bntbbb.exe25⤵
- Executes dropped EXE
PID:1420 -
\??\c:\dpjjj.exec:\dpjjj.exe26⤵
- Executes dropped EXE
PID:2388 -
\??\c:\nbhhbh.exec:\nbhhbh.exe27⤵
- Executes dropped EXE
PID:3200 -
\??\c:\vvvvj.exec:\vvvvj.exe28⤵
- Executes dropped EXE
PID:4292 -
\??\c:\flflffr.exec:\flflffr.exe29⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rlrxxll.exec:\rlrxxll.exe30⤵
- Executes dropped EXE
PID:5024 -
\??\c:\bhnhth.exec:\bhnhth.exe31⤵
- Executes dropped EXE
PID:396 -
\??\c:\jjppd.exec:\jjppd.exe32⤵
- Executes dropped EXE
PID:2864 -
\??\c:\xllffff.exec:\xllffff.exe33⤵
- Executes dropped EXE
PID:1788 -
\??\c:\lxxfxxx.exec:\lxxfxxx.exe34⤵
- Executes dropped EXE
PID:3156 -
\??\c:\tnnnnn.exec:\tnnnnn.exe35⤵
- Executes dropped EXE
PID:4588 -
\??\c:\ttnntt.exec:\ttnntt.exe36⤵
- Executes dropped EXE
PID:2360 -
\??\c:\jdvvp.exec:\jdvvp.exe37⤵
- Executes dropped EXE
PID:3140 -
\??\c:\hnhnht.exec:\hnhnht.exe38⤵
- Executes dropped EXE
PID:4024 -
\??\c:\jvvvj.exec:\jvvvj.exe39⤵
- Executes dropped EXE
PID:3152 -
\??\c:\xrxxxxr.exec:\xrxxxxr.exe40⤵
- Executes dropped EXE
PID:5008 -
\??\c:\nhhntt.exec:\nhhntt.exe41⤵
- Executes dropped EXE
PID:3128 -
\??\c:\5jvjj.exec:\5jvjj.exe42⤵
- Executes dropped EXE
PID:4640 -
\??\c:\jppjj.exec:\jppjj.exe43⤵
- Executes dropped EXE
PID:2712 -
\??\c:\fflrxxf.exec:\fflrxxf.exe44⤵
- Executes dropped EXE
PID:1336 -
\??\c:\tttttb.exec:\tttttb.exe45⤵
- Executes dropped EXE
PID:4660 -
\??\c:\hhnbnt.exec:\hhnbnt.exe46⤵
- Executes dropped EXE
PID:4452 -
\??\c:\jdjjd.exec:\jdjjd.exe47⤵
- Executes dropped EXE
PID:736 -
\??\c:\lxlflll.exec:\lxlflll.exe48⤵
- Executes dropped EXE
PID:5084 -
\??\c:\xrxxxff.exec:\xrxxxff.exe49⤵
- Executes dropped EXE
PID:528 -
\??\c:\ttttbh.exec:\ttttbh.exe50⤵
- Executes dropped EXE
PID:5012 -
\??\c:\hbnttb.exec:\hbnttb.exe51⤵
- Executes dropped EXE
PID:3480 -
\??\c:\frxfxfx.exec:\frxfxfx.exe52⤵
- Executes dropped EXE
PID:380 -
\??\c:\hhbbtt.exec:\hhbbtt.exe53⤵
- Executes dropped EXE
PID:312 -
\??\c:\ddvvv.exec:\ddvvv.exe54⤵
- Executes dropped EXE
PID:1744 -
\??\c:\9llxrfl.exec:\9llxrfl.exe55⤵
- Executes dropped EXE
PID:4332 -
\??\c:\hntnnh.exec:\hntnnh.exe56⤵
- Executes dropped EXE
PID:632 -
\??\c:\jvjdp.exec:\jvjdp.exe57⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ppddj.exec:\ppddj.exe58⤵
- Executes dropped EXE
PID:2716 -
\??\c:\thbttt.exec:\thbttt.exe59⤵
- Executes dropped EXE
PID:4700 -
\??\c:\hbbbnn.exec:\hbbbnn.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:320 -
\??\c:\vpjvv.exec:\vpjvv.exe61⤵
- Executes dropped EXE
PID:3232 -
\??\c:\nhhbbh.exec:\nhhbbh.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3852 -
\??\c:\5nnntt.exec:\5nnntt.exe63⤵
- Executes dropped EXE
PID:3580 -
\??\c:\jpjpp.exec:\jpjpp.exe64⤵
- Executes dropped EXE
PID:1980 -
\??\c:\rffrxxl.exec:\rffrxxl.exe65⤵
- Executes dropped EXE
PID:3176 -
\??\c:\pjvvd.exec:\pjvvd.exe66⤵PID:2472
-
\??\c:\dvjpv.exec:\dvjpv.exe67⤵PID:1684
-
\??\c:\fffllrx.exec:\fffllrx.exe68⤵PID:3544
-
\??\c:\tttbbn.exec:\tttbbn.exe69⤵PID:3396
-
\??\c:\pdppv.exec:\pdppv.exe70⤵PID:1468
-
\??\c:\vvpjv.exec:\vvpjv.exe71⤵PID:3516
-
\??\c:\ffxffrl.exec:\ffxffrl.exe72⤵PID:2960
-
\??\c:\1fllxrl.exec:\1fllxrl.exe73⤵PID:3908
-
\??\c:\7hbbnn.exec:\7hbbnn.exe74⤵PID:2860
-
\??\c:\jvdvj.exec:\jvdvj.exe75⤵PID:1992
-
\??\c:\frxrlrr.exec:\frxrlrr.exe76⤵PID:1680
-
\??\c:\bbnnnt.exec:\bbnnnt.exe77⤵
- System Location Discovery: System Language Discovery
PID:4276 -
\??\c:\ddjpp.exec:\ddjpp.exe78⤵PID:1736
-
\??\c:\7rxrrxf.exec:\7rxrrxf.exe79⤵PID:3884
-
\??\c:\hbhntb.exec:\hbhntb.exe80⤵PID:3264
-
\??\c:\jdpvp.exec:\jdpvp.exe81⤵PID:1484
-
\??\c:\pdppp.exec:\pdppp.exe82⤵PID:5052
-
\??\c:\frlfrlr.exec:\frlfrlr.exe83⤵PID:4872
-
\??\c:\bthntb.exec:\bthntb.exe84⤵PID:3100
-
\??\c:\tbbttt.exec:\tbbttt.exe85⤵PID:1452
-
\??\c:\ppdpd.exec:\ppdpd.exe86⤵PID:3464
-
\??\c:\vddvd.exec:\vddvd.exe87⤵PID:4084
-
\??\c:\lrllrxx.exec:\lrllrxx.exe88⤵PID:2400
-
\??\c:\tnbbth.exec:\tnbbth.exe89⤵PID:2444
-
\??\c:\tnttnn.exec:\tnttnn.exe90⤵PID:2948
-
\??\c:\xrffxxx.exec:\xrffxxx.exe91⤵PID:680
-
\??\c:\bhbbhn.exec:\bhbbhn.exe92⤵PID:760
-
\??\c:\9thhnb.exec:\9thhnb.exe93⤵PID:3120
-
\??\c:\jdpjj.exec:\jdpjj.exe94⤵PID:4732
-
\??\c:\rrfllfx.exec:\rrfllfx.exe95⤵PID:440
-
\??\c:\bnbhnt.exec:\bnbhnt.exe96⤵PID:620
-
\??\c:\bbhhhh.exec:\bbhhhh.exe97⤵PID:4020
-
\??\c:\vvddv.exec:\vvddv.exe98⤵PID:4184
-
\??\c:\xrfrrxx.exec:\xrfrrxx.exe99⤵PID:4720
-
\??\c:\frflflr.exec:\frflflr.exe100⤵PID:3756
-
\??\c:\hnnhth.exec:\hnnhth.exe101⤵PID:3476
-
\??\c:\pvvpp.exec:\pvvpp.exe102⤵PID:456
-
\??\c:\vvvjd.exec:\vvvjd.exe103⤵PID:2712
-
\??\c:\llflxff.exec:\llflxff.exe104⤵PID:1828
-
\??\c:\rfffrrr.exec:\rfffrrr.exe105⤵PID:4888
-
\??\c:\thtntt.exec:\thtntt.exe106⤵PID:1844
-
\??\c:\pvjdj.exec:\pvjdj.exe107⤵PID:2112
-
\??\c:\llrlrll.exec:\llrlrll.exe108⤵PID:1244
-
\??\c:\llllxxf.exec:\llllxxf.exe109⤵PID:1568
-
\??\c:\nbttbh.exec:\nbttbh.exe110⤵PID:692
-
\??\c:\jdvpj.exec:\jdvpj.exe111⤵PID:4880
-
\??\c:\ddjjj.exec:\ddjjj.exe112⤵PID:1620
-
\??\c:\3rfrxfx.exec:\3rfrxfx.exe113⤵PID:312
-
\??\c:\hhbnnb.exec:\hhbnnb.exe114⤵PID:1744
-
\??\c:\1vjjj.exec:\1vjjj.exe115⤵PID:2408
-
\??\c:\ppvdj.exec:\ppvdj.exe116⤵PID:4848
-
\??\c:\frffrrf.exec:\frffrrf.exe117⤵PID:3164
-
\??\c:\nbthbh.exec:\nbthbh.exe118⤵PID:1504
-
\??\c:\tthhnt.exec:\tthhnt.exe119⤵PID:1752
-
\??\c:\pvpjj.exec:\pvpjj.exe120⤵PID:3700
-
\??\c:\fxfxfll.exec:\fxfxfll.exe121⤵PID:4528
-
\??\c:\thnhhh.exec:\thnhhh.exe122⤵PID:5000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-