Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2024, 22:47
Behavioral task
behavioral1
Sample
6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe
-
Size
306KB
-
MD5
743a751909e914873f686bcc7bbbe352
-
SHA1
9f51f9f603b2aabcb04c6dfcfa6df130712e5fe3
-
SHA256
6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6
-
SHA512
d1f147d9b26c74b16d17a459c4727cca3f0bb201c25fab0d5e4ef45bad92a231f2c87e8fdfd8af8cf8b511894dff1344e2afbe4b83995c163fd3f41291af24c6
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOFltH4t+IDvSXrh5g8hZVMWhi:y4wFHoS3eFp3IDvSbh5nPVdi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3100-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3688-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4676-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1064-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3852-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4448-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4800-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/756-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3056-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2580-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/244-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3568-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/952-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3224-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2656-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1736-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4776-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3168-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2880-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4112-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1860-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2668-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1908-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2264-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3044-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2164-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2420-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/800-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2532-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1932-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5072-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/732-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2024-539-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2860-546-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-601-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-629-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2788-705-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2308-733-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-822-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-856-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-1007-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-1406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1452-1945-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4564 bttthh.exe 3688 pddvj.exe 3852 xfrffff.exe 4676 9xlllll.exe 1064 nntbbn.exe 4432 nbnnnt.exe 4448 jjvvp.exe 536 rlrlflf.exe 1452 1dppj.exe 1000 pjppp.exe 4800 hbbttb.exe 116 7pppj.exe 4876 nbbbtt.exe 756 vvjdv.exe 1952 lrlfllf.exe 3276 dvvvv.exe 3056 rrrrlll.exe 4300 thnnnn.exe 4456 jjpjd.exe 2580 5rlffff.exe 244 ttnnhh.exe 4508 vjdvv.exe 3568 7ffrflf.exe 4768 5pjdv.exe 1120 lrrrrrl.exe 3892 dppjv.exe 948 5flxrrl.exe 952 ttnhtt.exe 3224 dvpjj.exe 4848 ffxrffx.exe 984 pjjdp.exe 2656 1rxrlfx.exe 1736 bbhbbb.exe 1920 jjjjj.exe 4776 5ppjv.exe 3168 5btthb.exe 2880 ntbbnn.exe 4112 rlrfrlf.exe 8 nhtnhh.exe 1860 jpdvj.exe 3724 lllfxxx.exe 4912 nhhhbt.exe 4412 nntnhb.exe 3588 rfffxxr.exe 2668 btbtnn.exe 3204 ddvpd.exe 2192 hhbthh.exe 1304 jpvpj.exe 1908 ffrlfxf.exe 4400 htnhnh.exe 2264 vpddd.exe 4612 vdppp.exe 3532 lffxxfx.exe 3660 hbhhtt.exe 3180 dpdvv.exe 3044 7xxxxff.exe 552 rflllrr.exe 1064 bnhthh.exe 3948 ppvvp.exe 1204 xflrffl.exe 2000 tbnhbb.exe 4868 pjpjj.exe 4144 jdppp.exe 3500 flrlxxf.exe -
resource yara_rule behavioral2/memory/3100-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023bae-6.dat upx behavioral2/memory/3100-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca7-10.dat upx behavioral2/memory/4564-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3688-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca8-16.dat upx behavioral2/memory/3688-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca9-22.dat upx behavioral2/memory/4676-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023caa-29.dat upx behavioral2/files/0x0007000000023cab-36.dat upx behavioral2/memory/4432-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cac-41.dat upx behavioral2/memory/4432-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4448-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1064-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3852-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cad-48.dat upx behavioral2/memory/4448-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cae-54.dat upx behavioral2/files/0x0007000000023caf-59.dat upx behavioral2/files/0x0007000000023cb0-66.dat upx behavioral2/memory/4800-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb1-70.dat upx behavioral2/memory/4800-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb2-76.dat upx behavioral2/memory/116-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb3-83.dat upx behavioral2/memory/4876-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb4-89.dat upx behavioral2/memory/756-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023ca4-95.dat upx behavioral2/memory/1952-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3276-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb5-99.dat upx behavioral2/files/0x0007000000023cb6-105.dat upx behavioral2/memory/3056-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb7-113.dat upx behavioral2/memory/4300-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb8-117.dat upx behavioral2/memory/2580-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/244-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cba-132.dat upx behavioral2/files/0x0007000000023cb9-125.dat upx behavioral2/memory/4456-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbc-135.dat upx behavioral2/memory/3568-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbd-143.dat upx behavioral2/files/0x0007000000023cbe-147.dat upx behavioral2/files/0x0007000000023cbf-151.dat upx behavioral2/memory/3892-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc0-157.dat upx behavioral2/files/0x0007000000023cc1-162.dat upx behavioral2/memory/952-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc2-169.dat upx behavioral2/files/0x0007000000023cc3-175.dat upx behavioral2/memory/3224-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc4-182.dat upx behavioral2/files/0x0007000000023cc5-186.dat upx behavioral2/memory/4848-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2656-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1736-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4776-202-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flllffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3100 wrote to memory of 4564 3100 6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe 83 PID 3100 wrote to memory of 4564 3100 6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe 83 PID 3100 wrote to memory of 4564 3100 6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe 83 PID 4564 wrote to memory of 3688 4564 bttthh.exe 84 PID 4564 wrote to memory of 3688 4564 bttthh.exe 84 PID 4564 wrote to memory of 3688 4564 bttthh.exe 84 PID 3688 wrote to memory of 3852 3688 pddvj.exe 85 PID 3688 wrote to memory of 3852 3688 pddvj.exe 85 PID 3688 wrote to memory of 3852 3688 pddvj.exe 85 PID 3852 wrote to memory of 4676 3852 xfrffff.exe 86 PID 3852 wrote to memory of 4676 3852 xfrffff.exe 86 PID 3852 wrote to memory of 4676 3852 xfrffff.exe 86 PID 4676 wrote to memory of 1064 4676 9xlllll.exe 87 PID 4676 wrote to memory of 1064 4676 9xlllll.exe 87 PID 4676 wrote to memory of 1064 4676 9xlllll.exe 87 PID 1064 wrote to memory of 4432 1064 nntbbn.exe 88 PID 1064 wrote to memory of 4432 1064 nntbbn.exe 88 PID 1064 wrote to memory of 4432 1064 nntbbn.exe 88 PID 4432 wrote to memory of 4448 4432 nbnnnt.exe 89 PID 4432 wrote to memory of 4448 4432 nbnnnt.exe 89 PID 4432 wrote to memory of 4448 4432 nbnnnt.exe 89 PID 4448 wrote to memory of 536 4448 jjvvp.exe 90 PID 4448 wrote to memory of 536 4448 jjvvp.exe 90 PID 4448 wrote to memory of 536 4448 jjvvp.exe 90 PID 536 wrote to memory of 1452 536 rlrlflf.exe 91 PID 536 wrote to memory of 1452 536 rlrlflf.exe 91 PID 536 wrote to memory of 1452 536 rlrlflf.exe 91 PID 1452 wrote to memory of 1000 1452 1dppj.exe 92 PID 1452 wrote to memory of 1000 1452 1dppj.exe 92 PID 1452 wrote to memory of 1000 1452 1dppj.exe 92 PID 1000 wrote to memory of 4800 1000 pjppp.exe 93 PID 1000 wrote to memory of 4800 1000 pjppp.exe 93 PID 1000 wrote to memory of 4800 1000 pjppp.exe 93 PID 4800 wrote to memory of 116 4800 hbbttb.exe 94 PID 4800 wrote to memory of 116 4800 hbbttb.exe 94 PID 4800 wrote to memory of 116 4800 hbbttb.exe 94 PID 116 wrote to memory of 4876 116 7pppj.exe 95 PID 116 wrote to memory of 4876 116 7pppj.exe 95 PID 116 wrote to memory of 4876 116 7pppj.exe 95 PID 4876 wrote to memory of 756 4876 nbbbtt.exe 96 PID 4876 wrote to memory of 756 4876 nbbbtt.exe 96 PID 4876 wrote to memory of 756 4876 nbbbtt.exe 96 PID 756 wrote to memory of 1952 756 vvjdv.exe 97 PID 756 wrote to memory of 1952 756 vvjdv.exe 97 PID 756 wrote to memory of 1952 756 vvjdv.exe 97 PID 1952 wrote to memory of 3276 1952 lrlfllf.exe 98 PID 1952 wrote to memory of 3276 1952 lrlfllf.exe 98 PID 1952 wrote to memory of 3276 1952 lrlfllf.exe 98 PID 3276 wrote to memory of 3056 3276 dvvvv.exe 99 PID 3276 wrote to memory of 3056 3276 dvvvv.exe 99 PID 3276 wrote to memory of 3056 3276 dvvvv.exe 99 PID 3056 wrote to memory of 4300 3056 rrrrlll.exe 100 PID 3056 wrote to memory of 4300 3056 rrrrlll.exe 100 PID 3056 wrote to memory of 4300 3056 rrrrlll.exe 100 PID 4300 wrote to memory of 4456 4300 thnnnn.exe 101 PID 4300 wrote to memory of 4456 4300 thnnnn.exe 101 PID 4300 wrote to memory of 4456 4300 thnnnn.exe 101 PID 4456 wrote to memory of 2580 4456 jjpjd.exe 102 PID 4456 wrote to memory of 2580 4456 jjpjd.exe 102 PID 4456 wrote to memory of 2580 4456 jjpjd.exe 102 PID 2580 wrote to memory of 244 2580 5rlffff.exe 103 PID 2580 wrote to memory of 244 2580 5rlffff.exe 103 PID 2580 wrote to memory of 244 2580 5rlffff.exe 103 PID 244 wrote to memory of 4508 244 ttnnhh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe"C:\Users\Admin\AppData\Local\Temp\6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\bttthh.exec:\bttthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\pddvj.exec:\pddvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\xfrffff.exec:\xfrffff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\9xlllll.exec:\9xlllll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\nntbbn.exec:\nntbbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\nbnnnt.exec:\nbnnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\jjvvp.exec:\jjvvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\rlrlflf.exec:\rlrlflf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\1dppj.exec:\1dppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\pjppp.exec:\pjppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\hbbttb.exec:\hbbttb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\7pppj.exec:\7pppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\nbbbtt.exec:\nbbbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\vvjdv.exec:\vvjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\lrlfllf.exec:\lrlfllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\dvvvv.exec:\dvvvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\rrrrlll.exec:\rrrrlll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\thnnnn.exec:\thnnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\jjpjd.exec:\jjpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\5rlffff.exec:\5rlffff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\ttnnhh.exec:\ttnnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
\??\c:\vjdvv.exec:\vjdvv.exe23⤵
- Executes dropped EXE
PID:4508 -
\??\c:\7ffrflf.exec:\7ffrflf.exe24⤵
- Executes dropped EXE
PID:3568 -
\??\c:\5pjdv.exec:\5pjdv.exe25⤵
- Executes dropped EXE
PID:4768 -
\??\c:\lrrrrrl.exec:\lrrrrrl.exe26⤵
- Executes dropped EXE
PID:1120 -
\??\c:\dppjv.exec:\dppjv.exe27⤵
- Executes dropped EXE
PID:3892 -
\??\c:\5flxrrl.exec:\5flxrrl.exe28⤵
- Executes dropped EXE
PID:948 -
\??\c:\ttnhtt.exec:\ttnhtt.exe29⤵
- Executes dropped EXE
PID:952 -
\??\c:\dvpjj.exec:\dvpjj.exe30⤵
- Executes dropped EXE
PID:3224 -
\??\c:\ffxrffx.exec:\ffxrffx.exe31⤵
- Executes dropped EXE
PID:4848 -
\??\c:\pjjdp.exec:\pjjdp.exe32⤵
- Executes dropped EXE
PID:984 -
\??\c:\1rxrlfx.exec:\1rxrlfx.exe33⤵
- Executes dropped EXE
PID:2656 -
\??\c:\bbhbbb.exec:\bbhbbb.exe34⤵
- Executes dropped EXE
PID:1736 -
\??\c:\jjjjj.exec:\jjjjj.exe35⤵
- Executes dropped EXE
PID:1920 -
\??\c:\5ppjv.exec:\5ppjv.exe36⤵
- Executes dropped EXE
PID:4776 -
\??\c:\5btthb.exec:\5btthb.exe37⤵
- Executes dropped EXE
PID:3168 -
\??\c:\ntbbnn.exec:\ntbbnn.exe38⤵
- Executes dropped EXE
PID:2880 -
\??\c:\rlrfrlf.exec:\rlrfrlf.exe39⤵
- Executes dropped EXE
PID:4112 -
\??\c:\nhtnhh.exec:\nhtnhh.exe40⤵
- Executes dropped EXE
PID:8 -
\??\c:\jpdvj.exec:\jpdvj.exe41⤵
- Executes dropped EXE
PID:1860 -
\??\c:\lllfxxx.exec:\lllfxxx.exe42⤵
- Executes dropped EXE
PID:3724 -
\??\c:\nhhhbt.exec:\nhhhbt.exe43⤵
- Executes dropped EXE
PID:4912 -
\??\c:\nntnhb.exec:\nntnhb.exe44⤵
- Executes dropped EXE
PID:4412 -
\??\c:\rfffxxr.exec:\rfffxxr.exe45⤵
- Executes dropped EXE
PID:3588 -
\??\c:\btbtnn.exec:\btbtnn.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2668 -
\??\c:\ddvpd.exec:\ddvpd.exe47⤵
- Executes dropped EXE
PID:3204 -
\??\c:\hhbthh.exec:\hhbthh.exe48⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jpvpj.exec:\jpvpj.exe49⤵
- Executes dropped EXE
PID:1304 -
\??\c:\ffrlfxf.exec:\ffrlfxf.exe50⤵
- Executes dropped EXE
PID:1908 -
\??\c:\htnhnh.exec:\htnhnh.exe51⤵
- Executes dropped EXE
PID:4400 -
\??\c:\vpddd.exec:\vpddd.exe52⤵
- Executes dropped EXE
PID:2264 -
\??\c:\vdppp.exec:\vdppp.exe53⤵
- Executes dropped EXE
PID:4612 -
\??\c:\lffxxfx.exec:\lffxxfx.exe54⤵
- Executes dropped EXE
PID:3532 -
\??\c:\hbhhtt.exec:\hbhhtt.exe55⤵
- Executes dropped EXE
PID:3660 -
\??\c:\dpdvv.exec:\dpdvv.exe56⤵
- Executes dropped EXE
PID:3180 -
\??\c:\7xxxxff.exec:\7xxxxff.exe57⤵
- Executes dropped EXE
PID:3044 -
\??\c:\rflllrr.exec:\rflllrr.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:552 -
\??\c:\bnhthh.exec:\bnhthh.exe59⤵
- Executes dropped EXE
PID:1064 -
\??\c:\ppvvp.exec:\ppvvp.exe60⤵
- Executes dropped EXE
PID:3948 -
\??\c:\xflrffl.exec:\xflrffl.exe61⤵
- Executes dropped EXE
PID:1204 -
\??\c:\tbnhbb.exec:\tbnhbb.exe62⤵
- Executes dropped EXE
PID:2000 -
\??\c:\pjpjj.exec:\pjpjj.exe63⤵
- Executes dropped EXE
PID:4868 -
\??\c:\jdppp.exec:\jdppp.exe64⤵
- Executes dropped EXE
PID:4144 -
\??\c:\flrlxxf.exec:\flrlxxf.exe65⤵
- Executes dropped EXE
PID:3500 -
\??\c:\hbtnnt.exec:\hbtnnt.exe66⤵PID:4136
-
\??\c:\pjjdv.exec:\pjjdv.exe67⤵PID:2468
-
\??\c:\vvdvp.exec:\vvdvp.exe68⤵PID:4800
-
\??\c:\lrxrllf.exec:\lrxrllf.exe69⤵PID:4560
-
\??\c:\bthtnn.exec:\bthtnn.exe70⤵PID:4608
-
\??\c:\jdjdv.exec:\jdjdv.exe71⤵PID:2628
-
\??\c:\xrfxxxr.exec:\xrfxxxr.exe72⤵PID:756
-
\??\c:\rlllffx.exec:\rlllffx.exe73⤵PID:2140
-
\??\c:\hbtttt.exec:\hbtttt.exe74⤵PID:4048
-
\??\c:\7jppp.exec:\7jppp.exe75⤵PID:1612
-
\??\c:\jvvvp.exec:\jvvvp.exe76⤵PID:3844
-
\??\c:\rlrlfff.exec:\rlrlfff.exe77⤵PID:2164
-
\??\c:\nbbttt.exec:\nbbttt.exe78⤵PID:3564
-
\??\c:\bbhbbb.exec:\bbhbbb.exe79⤵PID:1104
-
\??\c:\jpdjv.exec:\jpdjv.exe80⤵PID:1500
-
\??\c:\lffxlxl.exec:\lffxlxl.exe81⤵PID:2420
-
\??\c:\7lffxfx.exec:\7lffxfx.exe82⤵PID:800
-
\??\c:\btbttt.exec:\btbttt.exe83⤵PID:3568
-
\??\c:\dvddv.exec:\dvddv.exe84⤵PID:4452
-
\??\c:\lfffrrr.exec:\lfffrrr.exe85⤵PID:912
-
\??\c:\rlrllll.exec:\rlrllll.exe86⤵PID:1960
-
\??\c:\btnnnn.exec:\btnnnn.exe87⤵PID:4356
-
\??\c:\ddjvp.exec:\ddjvp.exe88⤵PID:3236
-
\??\c:\1jddp.exec:\1jddp.exe89⤵PID:2532
-
\??\c:\nnnhtt.exec:\nnnhtt.exe90⤵PID:2304
-
\??\c:\hnnhnn.exec:\hnnhnn.exe91⤵PID:4664
-
\??\c:\vdvjp.exec:\vdvjp.exe92⤵PID:4372
-
\??\c:\llrxrxr.exec:\llrxrxr.exe93⤵PID:5032
-
\??\c:\ffxflfl.exec:\ffxflfl.exe94⤵PID:1320
-
\??\c:\1hbthh.exec:\1hbthh.exe95⤵PID:4528
-
\??\c:\jjjvv.exec:\jjjvv.exe96⤵PID:5052
-
\??\c:\xxfrxlx.exec:\xxfrxlx.exe97⤵PID:2144
-
\??\c:\bbbttn.exec:\bbbttn.exe98⤵PID:3916
-
\??\c:\bhnnhn.exec:\bhnnhn.exe99⤵PID:2604
-
\??\c:\jjpvv.exec:\jjpvv.exe100⤵PID:2880
-
\??\c:\xxrllxx.exec:\xxrllxx.exe101⤵PID:4672
-
\??\c:\rxxlfxx.exec:\rxxlfxx.exe102⤵PID:2928
-
\??\c:\hhhnhh.exec:\hhhnhh.exe103⤵PID:2008
-
\??\c:\9nttbh.exec:\9nttbh.exe104⤵PID:1932
-
\??\c:\ddjdp.exec:\ddjdp.exe105⤵PID:4932
-
\??\c:\xxxxfff.exec:\xxxxfff.exe106⤵PID:740
-
\??\c:\1fxrllf.exec:\1fxrllf.exe107⤵PID:1304
-
\??\c:\bbtttt.exec:\bbtttt.exe108⤵PID:4332
-
\??\c:\pjddv.exec:\pjddv.exe109⤵PID:2028
-
\??\c:\9ppjd.exec:\9ppjd.exe110⤵PID:3688
-
\??\c:\flfrrll.exec:\flfrrll.exe111⤵PID:4160
-
\??\c:\tbhhnn.exec:\tbhhnn.exe112⤵PID:212
-
\??\c:\pvdjv.exec:\pvdjv.exe113⤵PID:2412
-
\??\c:\vpdvp.exec:\vpdvp.exe114⤵PID:3496
-
\??\c:\3fxrxxr.exec:\3fxrxxr.exe115⤵PID:552
-
\??\c:\nhhhbb.exec:\nhhhbb.exe116⤵PID:3120
-
\??\c:\vvpdd.exec:\vvpdd.exe117⤵PID:3596
-
\??\c:\hhnthn.exec:\hhnthn.exe118⤵PID:3448
-
\??\c:\3pjjd.exec:\3pjjd.exe119⤵PID:5072
-
\??\c:\frlrrxf.exec:\frlrrxf.exe120⤵PID:536
-
\??\c:\hnnhtb.exec:\hnnhtb.exe121⤵PID:1636
-
\??\c:\jvddd.exec:\jvddd.exe122⤵PID:4980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-