Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2024, 22:33
Behavioral task
behavioral1
Sample
5937caad0b58a1d3374f0aa1c5671874ff972bef6245e96422c3f1cca78b0ffd.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
5937caad0b58a1d3374f0aa1c5671874ff972bef6245e96422c3f1cca78b0ffd.exe
-
Size
97KB
-
MD5
01fa27dde01ea5f76ed1dbabf83524d4
-
SHA1
fe2cbd96dd8027dd3e1f2c250eadf1c8651a515e
-
SHA256
5937caad0b58a1d3374f0aa1c5671874ff972bef6245e96422c3f1cca78b0ffd
-
SHA512
1bc7d841afe6ddb1cf4e05f0b80cd933402a5effbc30da853af227b5f679442d26a605cad59b992357f2a1fbb853d66537255af1ca6bf6d76e37c688bafe989e
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzgP:8cm4FmowdHoSgWrXUgP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1964-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3124-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2112-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3904-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2308-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4064-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4116-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1748-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2680-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3388-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2704-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3824-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/336-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4060-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3856-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4440-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/912-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/976-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4076-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1136-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1108-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2112-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3740-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/628-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1624-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1732-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4232-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1220-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1428-455-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3412-519-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4156-544-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2576-601-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-618-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-975-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-1341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4716 hnbthh.exe 3124 jppdv.exe 5116 rxffxrr.exe 2112 httbbb.exe 3904 9vvdp.exe 4576 3lfxrfx.exe 2308 bthhbt.exe 4064 dvpjd.exe 4116 flxrlxr.exe 2680 tnhbtt.exe 1748 jpvpd.exe 2204 lfrlfff.exe 60 tbhhbh.exe 2376 dpppj.exe 2872 bbtnbb.exe 3388 ttbtnn.exe 4384 dpvpp.exe 2140 xrlfrrl.exe 2044 rfxrxxr.exe 2704 thbbtn.exe 3740 1jppp.exe 3824 1vvpd.exe 336 ffrrllf.exe 4600 btbhbh.exe 4060 ppjjj.exe 3856 fllflfx.exe 3420 htbbtt.exe 2608 pvjdd.exe 4452 lfxxrrl.exe 4724 ttnnnt.exe 4440 nbtnnn.exe 912 jpjjd.exe 3380 fflfxff.exe 64 1bttnn.exe 976 vpjdv.exe 4076 xxllrxr.exe 1136 3frlllf.exe 2100 ttttnn.exe 4352 9vddj.exe 1196 fxffxff.exe 1108 tntbbb.exe 4836 ttthht.exe 1696 ppjdv.exe 1872 lllrrxx.exe 3868 7ttnhn.exe 3728 bbbbbh.exe 1868 jjvjp.exe 1960 rlfxfll.exe 4236 3rffxxx.exe 4584 nnbbtb.exe 3756 5djjd.exe 3460 7lxrllf.exe 4400 xrxxllx.exe 2128 hbbnhh.exe 1216 vdppj.exe 4276 dvdpj.exe 3720 rfllfll.exe 5068 bbtttt.exe 4640 pdvpj.exe 4580 ddjvj.exe 4344 lxxxrrl.exe 2112 hhbthn.exe 3904 vdjpp.exe 4920 xrxrrrr.exe -
resource yara_rule behavioral2/memory/1964-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023c1f-3.dat upx behavioral2/memory/1964-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023cab-8.dat upx behavioral2/memory/4716-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023caf-11.dat upx behavioral2/memory/3124-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5116-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2112-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb0-19.dat upx behavioral2/files/0x0007000000023cb1-24.dat upx behavioral2/memory/2112-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb2-29.dat upx behavioral2/memory/3904-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb3-34.dat upx behavioral2/memory/4576-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb4-39.dat upx behavioral2/memory/2308-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb6-44.dat upx behavioral2/memory/4064-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4116-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb7-49.dat upx behavioral2/files/0x0007000000023cb8-54.dat upx behavioral2/memory/1748-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2680-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb9-61.dat upx behavioral2/memory/2204-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cba-65.dat upx behavioral2/files/0x0007000000023cbb-69.dat upx behavioral2/memory/60-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbc-74.dat upx behavioral2/memory/2376-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2872-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbd-81.dat upx behavioral2/files/0x0007000000023cbe-85.dat upx behavioral2/memory/3388-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4384-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc0-90.dat upx behavioral2/files/0x0007000000023cc1-94.dat upx behavioral2/memory/2140-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2044-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc2-101.dat upx behavioral2/memory/2704-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc3-106.dat upx behavioral2/files/0x0007000000023cc4-110.dat upx behavioral2/memory/3824-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc5-114.dat upx behavioral2/files/0x0007000000023cc6-119.dat upx behavioral2/memory/336-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4600-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023cac-124.dat upx behavioral2/memory/4060-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc7-128.dat upx behavioral2/files/0x0007000000023cc8-134.dat upx behavioral2/memory/3856-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc9-138.dat upx behavioral2/files/0x0007000000023cca-142.dat upx behavioral2/memory/4452-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccb-147.dat upx behavioral2/files/0x0007000000023ccc-151.dat upx behavioral2/files/0x0007000000023ccd-156.dat upx behavioral2/memory/4440-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/912-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/976-167-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfffrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1964 wrote to memory of 4716 1964 5937caad0b58a1d3374f0aa1c5671874ff972bef6245e96422c3f1cca78b0ffd.exe 83 PID 1964 wrote to memory of 4716 1964 5937caad0b58a1d3374f0aa1c5671874ff972bef6245e96422c3f1cca78b0ffd.exe 83 PID 1964 wrote to memory of 4716 1964 5937caad0b58a1d3374f0aa1c5671874ff972bef6245e96422c3f1cca78b0ffd.exe 83 PID 4716 wrote to memory of 3124 4716 hnbthh.exe 84 PID 4716 wrote to memory of 3124 4716 hnbthh.exe 84 PID 4716 wrote to memory of 3124 4716 hnbthh.exe 84 PID 3124 wrote to memory of 5116 3124 jppdv.exe 85 PID 3124 wrote to memory of 5116 3124 jppdv.exe 85 PID 3124 wrote to memory of 5116 3124 jppdv.exe 85 PID 5116 wrote to memory of 2112 5116 rxffxrr.exe 86 PID 5116 wrote to memory of 2112 5116 rxffxrr.exe 86 PID 5116 wrote to memory of 2112 5116 rxffxrr.exe 86 PID 2112 wrote to memory of 3904 2112 httbbb.exe 87 PID 2112 wrote to memory of 3904 2112 httbbb.exe 87 PID 2112 wrote to memory of 3904 2112 httbbb.exe 87 PID 3904 wrote to memory of 4576 3904 9vvdp.exe 88 PID 3904 wrote to memory of 4576 3904 9vvdp.exe 88 PID 3904 wrote to memory of 4576 3904 9vvdp.exe 88 PID 4576 wrote to memory of 2308 4576 3lfxrfx.exe 89 PID 4576 wrote to memory of 2308 4576 3lfxrfx.exe 89 PID 4576 wrote to memory of 2308 4576 3lfxrfx.exe 89 PID 2308 wrote to memory of 4064 2308 bthhbt.exe 90 PID 2308 wrote to memory of 4064 2308 bthhbt.exe 90 PID 2308 wrote to memory of 4064 2308 bthhbt.exe 90 PID 4064 wrote to memory of 4116 4064 dvpjd.exe 91 PID 4064 wrote to memory of 4116 4064 dvpjd.exe 91 PID 4064 wrote to memory of 4116 4064 dvpjd.exe 91 PID 4116 wrote to memory of 2680 4116 flxrlxr.exe 92 PID 4116 wrote to memory of 2680 4116 flxrlxr.exe 92 PID 4116 wrote to memory of 2680 4116 flxrlxr.exe 92 PID 2680 wrote to memory of 1748 2680 tnhbtt.exe 93 PID 2680 wrote to memory of 1748 2680 tnhbtt.exe 93 PID 2680 wrote to memory of 1748 2680 tnhbtt.exe 93 PID 1748 wrote to memory of 2204 1748 jpvpd.exe 94 PID 1748 wrote to memory of 2204 1748 jpvpd.exe 94 PID 1748 wrote to memory of 2204 1748 jpvpd.exe 94 PID 2204 wrote to memory of 60 2204 lfrlfff.exe 95 PID 2204 wrote to memory of 60 2204 lfrlfff.exe 95 PID 2204 wrote to memory of 60 2204 lfrlfff.exe 95 PID 60 wrote to memory of 2376 60 tbhhbh.exe 96 PID 60 wrote to memory of 2376 60 tbhhbh.exe 96 PID 60 wrote to memory of 2376 60 tbhhbh.exe 96 PID 2376 wrote to memory of 2872 2376 dpppj.exe 97 PID 2376 wrote to memory of 2872 2376 dpppj.exe 97 PID 2376 wrote to memory of 2872 2376 dpppj.exe 97 PID 2872 wrote to memory of 3388 2872 bbtnbb.exe 98 PID 2872 wrote to memory of 3388 2872 bbtnbb.exe 98 PID 2872 wrote to memory of 3388 2872 bbtnbb.exe 98 PID 3388 wrote to memory of 4384 3388 ttbtnn.exe 99 PID 3388 wrote to memory of 4384 3388 ttbtnn.exe 99 PID 3388 wrote to memory of 4384 3388 ttbtnn.exe 99 PID 4384 wrote to memory of 2140 4384 dpvpp.exe 100 PID 4384 wrote to memory of 2140 4384 dpvpp.exe 100 PID 4384 wrote to memory of 2140 4384 dpvpp.exe 100 PID 2140 wrote to memory of 2044 2140 xrlfrrl.exe 101 PID 2140 wrote to memory of 2044 2140 xrlfrrl.exe 101 PID 2140 wrote to memory of 2044 2140 xrlfrrl.exe 101 PID 2044 wrote to memory of 2704 2044 rfxrxxr.exe 102 PID 2044 wrote to memory of 2704 2044 rfxrxxr.exe 102 PID 2044 wrote to memory of 2704 2044 rfxrxxr.exe 102 PID 2704 wrote to memory of 3740 2704 thbbtn.exe 103 PID 2704 wrote to memory of 3740 2704 thbbtn.exe 103 PID 2704 wrote to memory of 3740 2704 thbbtn.exe 103 PID 3740 wrote to memory of 3824 3740 1jppp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\5937caad0b58a1d3374f0aa1c5671874ff972bef6245e96422c3f1cca78b0ffd.exe"C:\Users\Admin\AppData\Local\Temp\5937caad0b58a1d3374f0aa1c5671874ff972bef6245e96422c3f1cca78b0ffd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\hnbthh.exec:\hnbthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\jppdv.exec:\jppdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\rxffxrr.exec:\rxffxrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\httbbb.exec:\httbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\9vvdp.exec:\9vvdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\3lfxrfx.exec:\3lfxrfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\bthhbt.exec:\bthhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\dvpjd.exec:\dvpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\flxrlxr.exec:\flxrlxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\tnhbtt.exec:\tnhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\jpvpd.exec:\jpvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\lfrlfff.exec:\lfrlfff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\tbhhbh.exec:\tbhhbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\dpppj.exec:\dpppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\bbtnbb.exec:\bbtnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\ttbtnn.exec:\ttbtnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\dpvpp.exec:\dpvpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\rfxrxxr.exec:\rfxrxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\thbbtn.exec:\thbbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\1jppp.exec:\1jppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\1vvpd.exec:\1vvpd.exe23⤵
- Executes dropped EXE
PID:3824 -
\??\c:\ffrrllf.exec:\ffrrllf.exe24⤵
- Executes dropped EXE
PID:336 -
\??\c:\btbhbh.exec:\btbhbh.exe25⤵
- Executes dropped EXE
PID:4600 -
\??\c:\ppjjj.exec:\ppjjj.exe26⤵
- Executes dropped EXE
PID:4060 -
\??\c:\fllflfx.exec:\fllflfx.exe27⤵
- Executes dropped EXE
PID:3856 -
\??\c:\htbbtt.exec:\htbbtt.exe28⤵
- Executes dropped EXE
PID:3420 -
\??\c:\pvjdd.exec:\pvjdd.exe29⤵
- Executes dropped EXE
PID:2608 -
\??\c:\lfxxrrl.exec:\lfxxrrl.exe30⤵
- Executes dropped EXE
PID:4452 -
\??\c:\ttnnnt.exec:\ttnnnt.exe31⤵
- Executes dropped EXE
PID:4724 -
\??\c:\nbtnnn.exec:\nbtnnn.exe32⤵
- Executes dropped EXE
PID:4440 -
\??\c:\jpjjd.exec:\jpjjd.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:912 -
\??\c:\fflfxff.exec:\fflfxff.exe34⤵
- Executes dropped EXE
PID:3380 -
\??\c:\1bttnn.exec:\1bttnn.exe35⤵
- Executes dropped EXE
PID:64 -
\??\c:\vpjdv.exec:\vpjdv.exe36⤵
- Executes dropped EXE
PID:976 -
\??\c:\xxllrxr.exec:\xxllrxr.exe37⤵
- Executes dropped EXE
PID:4076 -
\??\c:\3frlllf.exec:\3frlllf.exe38⤵
- Executes dropped EXE
PID:1136 -
\??\c:\ttttnn.exec:\ttttnn.exe39⤵
- Executes dropped EXE
PID:2100 -
\??\c:\9vddj.exec:\9vddj.exe40⤵
- Executes dropped EXE
PID:4352 -
\??\c:\fxffxff.exec:\fxffxff.exe41⤵
- Executes dropped EXE
PID:1196 -
\??\c:\tntbbb.exec:\tntbbb.exe42⤵
- Executes dropped EXE
PID:1108 -
\??\c:\ttthht.exec:\ttthht.exe43⤵
- Executes dropped EXE
PID:4836 -
\??\c:\ppjdv.exec:\ppjdv.exe44⤵
- Executes dropped EXE
PID:1696 -
\??\c:\lllrrxx.exec:\lllrrxx.exe45⤵
- Executes dropped EXE
PID:1872 -
\??\c:\7ttnhn.exec:\7ttnhn.exe46⤵
- Executes dropped EXE
PID:3868 -
\??\c:\bbbbbh.exec:\bbbbbh.exe47⤵
- Executes dropped EXE
PID:3728 -
\??\c:\jjvjp.exec:\jjvjp.exe48⤵
- Executes dropped EXE
PID:1868 -
\??\c:\rlfxfll.exec:\rlfxfll.exe49⤵
- Executes dropped EXE
PID:1960 -
\??\c:\3rffxxx.exec:\3rffxxx.exe50⤵
- Executes dropped EXE
PID:4236 -
\??\c:\nnbbtb.exec:\nnbbtb.exe51⤵
- Executes dropped EXE
PID:4584 -
\??\c:\5djjd.exec:\5djjd.exe52⤵
- Executes dropped EXE
PID:3756 -
\??\c:\7lxrllf.exec:\7lxrllf.exe53⤵
- Executes dropped EXE
PID:3460 -
\??\c:\xrxxllx.exec:\xrxxllx.exe54⤵
- Executes dropped EXE
PID:4400 -
\??\c:\hbbnhh.exec:\hbbnhh.exe55⤵
- Executes dropped EXE
PID:2128 -
\??\c:\vdppj.exec:\vdppj.exe56⤵
- Executes dropped EXE
PID:1216 -
\??\c:\dvdpj.exec:\dvdpj.exe57⤵
- Executes dropped EXE
PID:4276 -
\??\c:\rfllfll.exec:\rfllfll.exe58⤵
- Executes dropped EXE
PID:3720 -
\??\c:\bbtttt.exec:\bbtttt.exe59⤵
- Executes dropped EXE
PID:5068 -
\??\c:\pdvpj.exec:\pdvpj.exe60⤵
- Executes dropped EXE
PID:4640 -
\??\c:\ddjvj.exec:\ddjvj.exe61⤵
- Executes dropped EXE
PID:4580 -
\??\c:\lxxxrrl.exec:\lxxxrrl.exe62⤵
- Executes dropped EXE
PID:4344 -
\??\c:\hhbthn.exec:\hhbthn.exe63⤵
- Executes dropped EXE
PID:2112 -
\??\c:\vdjpp.exec:\vdjpp.exe64⤵
- Executes dropped EXE
PID:3904 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe65⤵
- Executes dropped EXE
PID:4920 -
\??\c:\ttnnhh.exec:\ttnnhh.exe66⤵PID:4576
-
\??\c:\dvpvv.exec:\dvpvv.exe67⤵PID:1940
-
\??\c:\fxllfff.exec:\fxllfff.exe68⤵PID:1304
-
\??\c:\tnbtht.exec:\tnbtht.exe69⤵PID:3488
-
\??\c:\jvjdd.exec:\jvjdd.exe70⤵PID:2272
-
\??\c:\ddvvd.exec:\ddvvd.exe71⤵PID:404
-
\??\c:\llrrlll.exec:\llrrlll.exe72⤵PID:320
-
\??\c:\nnttnt.exec:\nnttnt.exe73⤵PID:3496
-
\??\c:\ppdvp.exec:\ppdvp.exe74⤵PID:112
-
\??\c:\5jjdp.exec:\5jjdp.exe75⤵PID:3612
-
\??\c:\xlfffll.exec:\xlfffll.exe76⤵PID:2152
-
\??\c:\9hnttb.exec:\9hnttb.exe77⤵PID:1048
-
\??\c:\nnnttt.exec:\nnnttt.exe78⤵PID:316
-
\??\c:\rxfflrx.exec:\rxfflrx.exe79⤵PID:2872
-
\??\c:\hnntth.exec:\hnntth.exe80⤵PID:1816
-
\??\c:\nhbbnn.exec:\nhbbnn.exe81⤵PID:3448
-
\??\c:\jpvjd.exec:\jpvjd.exe82⤵PID:3168
-
\??\c:\xxflfll.exec:\xxflfll.exe83⤵PID:2288
-
\??\c:\rrfffff.exec:\rrfffff.exe84⤵PID:2140
-
\??\c:\nhbbnn.exec:\nhbbnn.exe85⤵PID:1596
-
\??\c:\dppvj.exec:\dppvj.exe86⤵PID:4832
-
\??\c:\pdppp.exec:\pdppp.exe87⤵PID:3648
-
\??\c:\lxllflx.exec:\lxllflx.exe88⤵PID:2380
-
\??\c:\xxrxllf.exec:\xxrxllf.exe89⤵PID:3740
-
\??\c:\tttnnn.exec:\tttnnn.exe90⤵PID:3824
-
\??\c:\jjdpd.exec:\jjdpd.exe91⤵PID:4092
-
\??\c:\vjpjd.exec:\vjpjd.exe92⤵PID:3292
-
\??\c:\lfllfff.exec:\lfllfff.exe93⤵PID:4412
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe94⤵PID:4756
-
\??\c:\hnbtth.exec:\hnbtth.exe95⤵PID:2260
-
\??\c:\3pvpp.exec:\3pvpp.exe96⤵PID:5044
-
\??\c:\bhhhhh.exec:\bhhhhh.exe97⤵PID:2516
-
\??\c:\ttnhhn.exec:\ttnhhn.exe98⤵PID:1392
-
\??\c:\pvvpp.exec:\pvvpp.exe99⤵PID:4900
-
\??\c:\vpjvj.exec:\vpjvj.exe100⤵PID:4540
-
\??\c:\xrrlrrr.exec:\xrrlrrr.exe101⤵PID:2408
-
\??\c:\rlfllxr.exec:\rlfllxr.exe102⤵PID:2644
-
\??\c:\7ntnnn.exec:\7ntnnn.exe103⤵PID:2100
-
\??\c:\pjvpv.exec:\pjvpv.exe104⤵PID:3692
-
\??\c:\llffxxx.exec:\llffxxx.exe105⤵PID:2312
-
\??\c:\flffffr.exec:\flffffr.exe106⤵PID:2004
-
\??\c:\tntntn.exec:\tntntn.exe107⤵PID:2576
-
\??\c:\vpvvj.exec:\vpvvj.exe108⤵PID:4912
-
\??\c:\xxxrrlf.exec:\xxxrrlf.exe109⤵PID:4336
-
\??\c:\fxfxfff.exec:\fxfxfff.exe110⤵PID:2076
-
\??\c:\dvddd.exec:\dvddd.exe111⤵PID:4188
-
\??\c:\lrrfrff.exec:\lrrfrff.exe112⤵PID:812
-
\??\c:\7lfxxxx.exec:\7lfxxxx.exe113⤵PID:412
-
\??\c:\3nnnhn.exec:\3nnnhn.exe114⤵PID:4444
-
\??\c:\pdjjd.exec:\pdjjd.exe115⤵PID:2820
-
\??\c:\lfxrllf.exec:\lfxrllf.exe116⤵PID:456
-
\??\c:\xllfffl.exec:\xllfffl.exe117⤵PID:872
-
\??\c:\tbhbnn.exec:\tbhbnn.exe118⤵PID:1680
-
\??\c:\tbhnhh.exec:\tbhnhh.exe119⤵PID:2340
-
\??\c:\jjdjd.exec:\jjdjd.exe120⤵PID:4340
-
\??\c:\llfffff.exec:\llfffff.exe121⤵PID:4020
-
\??\c:\hthnnn.exec:\hthnnn.exe122⤵PID:4348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-