Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 16:08
Behavioral task
behavioral1
Sample
d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe
-
Size
78KB
-
MD5
36fe4429aa9fe723066f85d27d8134f9
-
SHA1
118a2801451743b606ea3addc5a81a70bc34e7cc
-
SHA256
d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a
-
SHA512
dfb518201b9e7c2caa108ced5641eeb85d44ce0458e0b3596fc6b02f8104da88f5fafc8bfe0105547a323665e962621a5814932c2edd53426dff4e19d15eca1d
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzx8/p7kew:xhOmTsF93UYfwC6GIout03LzGFw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2372-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1320-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/756-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4796-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1996-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/940-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1052-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3124-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4748-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4588-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2640-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1044-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1708-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/540-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2356-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4548-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2624-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3620-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2816-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1440-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3888-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1032-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/376-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3168-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3232-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1572-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2268-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-479-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3780-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/944-502-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-605-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/752-612-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-628-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1040-677-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-693-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-691-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1016-931-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2728-956-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-1362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 852 bbnnbb.exe 1320 pjvjv.exe 4388 xxrrrrr.exe 4564 httbht.exe 756 pjjjp.exe 4796 jdppd.exe 1996 rrffxxx.exe 4224 tbhbnt.exe 4144 7djdj.exe 940 rrxxlrx.exe 3636 hbtbbb.exe 3984 nnnbbn.exe 1052 pvvpp.exe 2616 ffxrrlf.exe 2352 5hnhbb.exe 3124 hnthbn.exe 2500 pvvjd.exe 2328 xlxxrxr.exe 3672 lfxfxfx.exe 3456 tbtbbh.exe 4592 hbbtnt.exe 4728 5vjjv.exe 3572 llllllr.exe 2348 lfxxxxx.exe 2288 1hhhhn.exe 4748 hhtthn.exe 4588 ddjjd.exe 4816 xxffxxx.exe 4944 fllfflf.exe 1044 ddvpp.exe 2640 jdpvp.exe 4536 rxxrllf.exe 1708 hhntnt.exe 5036 pjvpj.exe 540 pjpjj.exe 2292 rrxrrrf.exe 2356 tbhbtb.exe 1692 htbtnh.exe 3152 1djdd.exe 4548 rfffflf.exe 2624 rrxxlrf.exe 1628 7hnhhb.exe 4048 bbtnnn.exe 3620 xrllllf.exe 408 nbhnnt.exe 2816 dvddp.exe 2520 frrxxxx.exe 4980 hbbbhn.exe 3368 1ntttt.exe 1440 jdvvp.exe 2752 5bbntb.exe 4836 nttbbb.exe 2088 rrrrrrr.exe 5028 7xllxfr.exe 4388 tnnnnt.exe 4424 dpvdd.exe 3888 ppvvv.exe 756 frffffl.exe 2424 ttbbbh.exe 2920 pdppj.exe 1032 fxfffrr.exe 2060 3tbbhh.exe 4768 ddpjj.exe 376 vjvdd.exe -
resource yara_rule behavioral2/memory/2372-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023cb0-4.dat upx behavioral2/memory/2372-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb1-9.dat upx behavioral2/memory/852-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb2-13.dat upx behavioral2/memory/1320-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb3-21.dat upx behavioral2/memory/4388-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb4-30.dat upx behavioral2/memory/4564-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb5-33.dat upx behavioral2/memory/756-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb6-41.dat upx behavioral2/memory/4796-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb7-46.dat upx behavioral2/memory/1996-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb8-50.dat upx behavioral2/memory/4224-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb9-56.dat upx behavioral2/memory/940-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cba-61.dat upx behavioral2/files/0x0007000000023cbb-67.dat upx behavioral2/memory/3636-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbc-76.dat upx behavioral2/memory/3984-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbd-80.dat upx behavioral2/files/0x0007000000023cbe-86.dat upx behavioral2/memory/1052-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbf-90.dat upx behavioral2/files/0x0007000000023cc0-95.dat upx behavioral2/memory/3124-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc1-101.dat upx behavioral2/memory/2328-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc3-114.dat upx behavioral2/memory/3672-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc2-108.dat upx behavioral2/memory/3456-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc5-124.dat upx behavioral2/files/0x0007000000023cc4-121.dat upx behavioral2/memory/4592-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc6-130.dat upx behavioral2/memory/4728-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc7-136.dat upx behavioral2/memory/3572-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc9-142.dat upx behavioral2/memory/2348-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cca-148.dat upx behavioral2/memory/4748-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccb-155.dat upx behavioral2/files/0x0007000000023ccc-160.dat upx behavioral2/memory/4816-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4588-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccd-166.dat upx behavioral2/files/0x0008000000023cae-172.dat upx behavioral2/files/0x0007000000023ccf-184.dat upx behavioral2/memory/2640-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cce-178.dat upx behavioral2/memory/1044-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1708-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5036-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/540-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2356-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4548-217-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fffffl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2372 wrote to memory of 852 2372 d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe 83 PID 2372 wrote to memory of 852 2372 d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe 83 PID 2372 wrote to memory of 852 2372 d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe 83 PID 852 wrote to memory of 1320 852 bbnnbb.exe 84 PID 852 wrote to memory of 1320 852 bbnnbb.exe 84 PID 852 wrote to memory of 1320 852 bbnnbb.exe 84 PID 1320 wrote to memory of 4388 1320 pjvjv.exe 85 PID 1320 wrote to memory of 4388 1320 pjvjv.exe 85 PID 1320 wrote to memory of 4388 1320 pjvjv.exe 85 PID 4388 wrote to memory of 4564 4388 xxrrrrr.exe 86 PID 4388 wrote to memory of 4564 4388 xxrrrrr.exe 86 PID 4388 wrote to memory of 4564 4388 xxrrrrr.exe 86 PID 4564 wrote to memory of 756 4564 httbht.exe 87 PID 4564 wrote to memory of 756 4564 httbht.exe 87 PID 4564 wrote to memory of 756 4564 httbht.exe 87 PID 756 wrote to memory of 4796 756 pjjjp.exe 88 PID 756 wrote to memory of 4796 756 pjjjp.exe 88 PID 756 wrote to memory of 4796 756 pjjjp.exe 88 PID 4796 wrote to memory of 1996 4796 jdppd.exe 89 PID 4796 wrote to memory of 1996 4796 jdppd.exe 89 PID 4796 wrote to memory of 1996 4796 jdppd.exe 89 PID 1996 wrote to memory of 4224 1996 rrffxxx.exe 90 PID 1996 wrote to memory of 4224 1996 rrffxxx.exe 90 PID 1996 wrote to memory of 4224 1996 rrffxxx.exe 90 PID 4224 wrote to memory of 4144 4224 tbhbnt.exe 91 PID 4224 wrote to memory of 4144 4224 tbhbnt.exe 91 PID 4224 wrote to memory of 4144 4224 tbhbnt.exe 91 PID 4144 wrote to memory of 940 4144 7djdj.exe 92 PID 4144 wrote to memory of 940 4144 7djdj.exe 92 PID 4144 wrote to memory of 940 4144 7djdj.exe 92 PID 940 wrote to memory of 3636 940 rrxxlrx.exe 93 PID 940 wrote to memory of 3636 940 rrxxlrx.exe 93 PID 940 wrote to memory of 3636 940 rrxxlrx.exe 93 PID 3636 wrote to memory of 3984 3636 hbtbbb.exe 94 PID 3636 wrote to memory of 3984 3636 hbtbbb.exe 94 PID 3636 wrote to memory of 3984 3636 hbtbbb.exe 94 PID 3984 wrote to memory of 1052 3984 nnnbbn.exe 95 PID 3984 wrote to memory of 1052 3984 nnnbbn.exe 95 PID 3984 wrote to memory of 1052 3984 nnnbbn.exe 95 PID 1052 wrote to memory of 2616 1052 pvvpp.exe 96 PID 1052 wrote to memory of 2616 1052 pvvpp.exe 96 PID 1052 wrote to memory of 2616 1052 pvvpp.exe 96 PID 2616 wrote to memory of 2352 2616 ffxrrlf.exe 97 PID 2616 wrote to memory of 2352 2616 ffxrrlf.exe 97 PID 2616 wrote to memory of 2352 2616 ffxrrlf.exe 97 PID 2352 wrote to memory of 3124 2352 5hnhbb.exe 98 PID 2352 wrote to memory of 3124 2352 5hnhbb.exe 98 PID 2352 wrote to memory of 3124 2352 5hnhbb.exe 98 PID 3124 wrote to memory of 2500 3124 hnthbn.exe 99 PID 3124 wrote to memory of 2500 3124 hnthbn.exe 99 PID 3124 wrote to memory of 2500 3124 hnthbn.exe 99 PID 2500 wrote to memory of 2328 2500 pvvjd.exe 100 PID 2500 wrote to memory of 2328 2500 pvvjd.exe 100 PID 2500 wrote to memory of 2328 2500 pvvjd.exe 100 PID 2328 wrote to memory of 3672 2328 xlxxrxr.exe 101 PID 2328 wrote to memory of 3672 2328 xlxxrxr.exe 101 PID 2328 wrote to memory of 3672 2328 xlxxrxr.exe 101 PID 3672 wrote to memory of 3456 3672 lfxfxfx.exe 102 PID 3672 wrote to memory of 3456 3672 lfxfxfx.exe 102 PID 3672 wrote to memory of 3456 3672 lfxfxfx.exe 102 PID 3456 wrote to memory of 4592 3456 tbtbbh.exe 103 PID 3456 wrote to memory of 4592 3456 tbtbbh.exe 103 PID 3456 wrote to memory of 4592 3456 tbtbbh.exe 103 PID 4592 wrote to memory of 4728 4592 hbbtnt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe"C:\Users\Admin\AppData\Local\Temp\d6daa0ae8a42440d9ad2a1daff2f2f296aca817e0a6e11f341af7b5a0017595a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\bbnnbb.exec:\bbnnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\pjvjv.exec:\pjvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\xxrrrrr.exec:\xxrrrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\httbht.exec:\httbht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\pjjjp.exec:\pjjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\jdppd.exec:\jdppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\rrffxxx.exec:\rrffxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\tbhbnt.exec:\tbhbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\7djdj.exec:\7djdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\rrxxlrx.exec:\rrxxlrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\hbtbbb.exec:\hbtbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\nnnbbn.exec:\nnnbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\pvvpp.exec:\pvvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\ffxrrlf.exec:\ffxrrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\5hnhbb.exec:\5hnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\hnthbn.exec:\hnthbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\pvvjd.exec:\pvvjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\xlxxrxr.exec:\xlxxrxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\lfxfxfx.exec:\lfxfxfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\tbtbbh.exec:\tbtbbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\hbbtnt.exec:\hbbtnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\5vjjv.exec:\5vjjv.exe23⤵
- Executes dropped EXE
PID:4728 -
\??\c:\llllllr.exec:\llllllr.exe24⤵
- Executes dropped EXE
PID:3572 -
\??\c:\lfxxxxx.exec:\lfxxxxx.exe25⤵
- Executes dropped EXE
PID:2348 -
\??\c:\1hhhhn.exec:\1hhhhn.exe26⤵
- Executes dropped EXE
PID:2288 -
\??\c:\hhtthn.exec:\hhtthn.exe27⤵
- Executes dropped EXE
PID:4748 -
\??\c:\ddjjd.exec:\ddjjd.exe28⤵
- Executes dropped EXE
PID:4588 -
\??\c:\xxffxxx.exec:\xxffxxx.exe29⤵
- Executes dropped EXE
PID:4816 -
\??\c:\fllfflf.exec:\fllfflf.exe30⤵
- Executes dropped EXE
PID:4944 -
\??\c:\ddvpp.exec:\ddvpp.exe31⤵
- Executes dropped EXE
PID:1044 -
\??\c:\jdpvp.exec:\jdpvp.exe32⤵
- Executes dropped EXE
PID:2640 -
\??\c:\rxxrllf.exec:\rxxrllf.exe33⤵
- Executes dropped EXE
PID:4536 -
\??\c:\hhntnt.exec:\hhntnt.exe34⤵
- Executes dropped EXE
PID:1708 -
\??\c:\pjvpj.exec:\pjvpj.exe35⤵
- Executes dropped EXE
PID:5036 -
\??\c:\pjpjj.exec:\pjpjj.exe36⤵
- Executes dropped EXE
PID:540 -
\??\c:\rrxrrrf.exec:\rrxrrrf.exe37⤵
- Executes dropped EXE
PID:2292 -
\??\c:\tbhbtb.exec:\tbhbtb.exe38⤵
- Executes dropped EXE
PID:2356 -
\??\c:\htbtnh.exec:\htbtnh.exe39⤵
- Executes dropped EXE
PID:1692 -
\??\c:\1djdd.exec:\1djdd.exe40⤵
- Executes dropped EXE
PID:3152 -
\??\c:\rfffflf.exec:\rfffflf.exe41⤵
- Executes dropped EXE
PID:4548 -
\??\c:\rrxxlrf.exec:\rrxxlrf.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\7hnhhb.exec:\7hnhhb.exe43⤵
- Executes dropped EXE
PID:1628 -
\??\c:\bbtnnn.exec:\bbtnnn.exe44⤵
- Executes dropped EXE
PID:4048 -
\??\c:\xrllllf.exec:\xrllllf.exe45⤵
- Executes dropped EXE
PID:3620 -
\??\c:\nbhnnt.exec:\nbhnnt.exe46⤵
- Executes dropped EXE
PID:408 -
\??\c:\dvddp.exec:\dvddp.exe47⤵
- Executes dropped EXE
PID:2816 -
\??\c:\frrxxxx.exec:\frrxxxx.exe48⤵
- Executes dropped EXE
PID:2520 -
\??\c:\hbbbhn.exec:\hbbbhn.exe49⤵
- Executes dropped EXE
PID:4980 -
\??\c:\1ntttt.exec:\1ntttt.exe50⤵
- Executes dropped EXE
PID:3368 -
\??\c:\jdvvp.exec:\jdvvp.exe51⤵
- Executes dropped EXE
PID:1440 -
\??\c:\lrrllll.exec:\lrrllll.exe52⤵PID:4400
-
\??\c:\5bbntb.exec:\5bbntb.exe53⤵
- Executes dropped EXE
PID:2752 -
\??\c:\nttbbb.exec:\nttbbb.exe54⤵
- Executes dropped EXE
PID:4836 -
\??\c:\rrrrrrr.exec:\rrrrrrr.exe55⤵
- Executes dropped EXE
PID:2088 -
\??\c:\7xllxfr.exec:\7xllxfr.exe56⤵
- Executes dropped EXE
PID:5028 -
\??\c:\tnnnnt.exec:\tnnnnt.exe57⤵
- Executes dropped EXE
PID:4388 -
\??\c:\dpvdd.exec:\dpvdd.exe58⤵
- Executes dropped EXE
PID:4424 -
\??\c:\ppvvv.exec:\ppvvv.exe59⤵
- Executes dropped EXE
PID:3888 -
\??\c:\frffffl.exec:\frffffl.exe60⤵
- Executes dropped EXE
PID:756 -
\??\c:\ttbbbh.exec:\ttbbbh.exe61⤵
- Executes dropped EXE
PID:2424 -
\??\c:\pdppj.exec:\pdppj.exe62⤵
- Executes dropped EXE
PID:2920 -
\??\c:\fxfffrr.exec:\fxfffrr.exe63⤵
- Executes dropped EXE
PID:1032 -
\??\c:\3tbbhh.exec:\3tbbhh.exe64⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ddpjj.exec:\ddpjj.exe65⤵
- Executes dropped EXE
PID:4768 -
\??\c:\vjvdd.exec:\vjvdd.exe66⤵
- Executes dropped EXE
PID:376 -
\??\c:\bhbbth.exec:\bhbbth.exe67⤵PID:5032
-
\??\c:\dvppp.exec:\dvppp.exe68⤵PID:3956
-
\??\c:\fffxrrl.exec:\fffxrrl.exe69⤵PID:3984
-
\??\c:\fxlxxrr.exec:\fxlxxrr.exe70⤵PID:1256
-
\??\c:\vvvpp.exec:\vvvpp.exe71⤵PID:4688
-
\??\c:\7rflrxx.exec:\7rflrxx.exe72⤵PID:2616
-
\??\c:\xxllllr.exec:\xxllllr.exe73⤵PID:2252
-
\??\c:\ppppp.exec:\ppppp.exe74⤵PID:2352
-
\??\c:\1pvvv.exec:\1pvvv.exe75⤵PID:1076
-
\??\c:\rlfrllf.exec:\rlfrllf.exe76⤵PID:3676
-
\??\c:\ttnnhn.exec:\ttnnhn.exe77⤵PID:2064
-
\??\c:\pvvvv.exec:\pvvvv.exe78⤵PID:2328
-
\??\c:\rxxxfll.exec:\rxxxfll.exe79⤵PID:4372
-
\??\c:\nthntt.exec:\nthntt.exe80⤵
- System Location Discovery: System Language Discovery
PID:5112 -
\??\c:\nthhhn.exec:\nthhhn.exe81⤵PID:3456
-
\??\c:\vpjjj.exec:\vpjjj.exe82⤵PID:4088
-
\??\c:\lllffll.exec:\lllffll.exe83⤵PID:452
-
\??\c:\tbtnnn.exec:\tbtnnn.exe84⤵PID:1644
-
\??\c:\jpppp.exec:\jpppp.exe85⤵PID:3572
-
\??\c:\djvvd.exec:\djvvd.exe86⤵PID:4364
-
\??\c:\rrxffll.exec:\rrxffll.exe87⤵PID:512
-
\??\c:\7tnnbh.exec:\7tnnbh.exe88⤵PID:3168
-
\??\c:\hbhhbh.exec:\hbhhbh.exe89⤵PID:4904
-
\??\c:\pjpjv.exec:\pjpjv.exe90⤵PID:3296
-
\??\c:\ffrxxxx.exec:\ffrxxxx.exe91⤵PID:4644
-
\??\c:\9bbnhh.exec:\9bbnhh.exe92⤵PID:3176
-
\??\c:\pvvdd.exec:\pvvdd.exe93⤵PID:3976
-
\??\c:\djjdv.exec:\djjdv.exe94⤵PID:1044
-
\??\c:\1rfxxxr.exec:\1rfxxxr.exe95⤵PID:2080
-
\??\c:\tbbtnn.exec:\tbbtnn.exe96⤵PID:1376
-
\??\c:\dpddd.exec:\dpddd.exe97⤵PID:3232
-
\??\c:\9rllllf.exec:\9rllllf.exe98⤵PID:1572
-
\??\c:\nhhhhn.exec:\nhhhhn.exe99⤵PID:1608
-
\??\c:\djpjj.exec:\djpjj.exe100⤵PID:3884
-
\??\c:\rrrrlfl.exec:\rrrrlfl.exe101⤵PID:3800
-
\??\c:\xrrlfff.exec:\xrrlfff.exe102⤵PID:2700
-
\??\c:\5bbnnn.exec:\5bbnnn.exe103⤵PID:2652
-
\??\c:\jvddd.exec:\jvddd.exe104⤵PID:60
-
\??\c:\jjjdv.exec:\jjjdv.exe105⤵PID:1936
-
\??\c:\9xffxrr.exec:\9xffxrr.exe106⤵PID:2624
-
\??\c:\xrflxll.exec:\xrflxll.exe107⤵PID:1628
-
\??\c:\hnnhbh.exec:\hnnhbh.exe108⤵PID:2268
-
\??\c:\jddvp.exec:\jddvp.exe109⤵PID:2576
-
\??\c:\frxlffx.exec:\frxlffx.exe110⤵PID:1776
-
\??\c:\rllfxxr.exec:\rllfxxr.exe111⤵PID:32
-
\??\c:\hnntbb.exec:\hnntbb.exe112⤵PID:4884
-
\??\c:\1nnhbb.exec:\1nnhbb.exe113⤵PID:3500
-
\??\c:\jjpjj.exec:\jjpjj.exe114⤵PID:3352
-
\??\c:\lfffxrl.exec:\lfffxrl.exe115⤵PID:1440
-
\??\c:\xrrrlll.exec:\xrrrlll.exe116⤵PID:2372
-
\??\c:\bttnhh.exec:\bttnhh.exe117⤵PID:4828
-
\??\c:\bbtnbb.exec:\bbtnbb.exe118⤵PID:4836
-
\??\c:\pjjjj.exec:\pjjjj.exe119⤵PID:4472
-
\??\c:\lxfffxx.exec:\lxfffxx.exe120⤵PID:4416
-
\??\c:\xfllrrl.exec:\xfllrrl.exe121⤵PID:2232
-
\??\c:\httthh.exec:\httthh.exe122⤵PID:2168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-