Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 03:07
Behavioral task
behavioral1
Sample
a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe
-
Size
331KB
-
MD5
958137e15ddb683bdab8ef037d82db90
-
SHA1
0ae6dd802f6b7e43f069b94c3d3894f5f5d3896b
-
SHA256
a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420
-
SHA512
938fe091f9a99a6429b75a3dbab82d71a37cd38fe83c0985ec1fb8b09629c11652ac5be42c964197ba76e2f63cbe53f9d90b3ed45840135121656d7bf39468bf
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tB:94wFHoStJdSjylh2b77BoTMA9gX59sT5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2092-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/616-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2864-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1348-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4124-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2920-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1272-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4632-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/228-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2972-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2660-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2476-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4116-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4092-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2712-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4128-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1656-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4176-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4488-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1668-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/960-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2236-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/832-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4208-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4448-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1036-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2120-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4868-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1496-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/916-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2980-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1556-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2684-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1364-460-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/916-475-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3176-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-579-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3296-706-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-714-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3068-776-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/912-1068-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2092 jjppj.exe 616 3rlfxxr.exe 2864 6820082.exe 3892 2626222.exe 1348 btbbbb.exe 3208 082004.exe 2196 08444.exe 4124 640444.exe 4352 btbtnn.exe 1272 3tnntt.exe 2920 nhthnn.exe 2972 046488.exe 4632 5fxrrlf.exe 3672 024068.exe 228 dvdvp.exe 3028 88606.exe 2660 dpvpj.exe 2060 4660062.exe 3224 4244488.exe 2028 808826.exe 4208 2282644.exe 2476 2444882.exe 832 bnbttn.exe 5020 vdjvp.exe 872 xlfxrlf.exe 4148 262202.exe 3712 dddvp.exe 3176 e80840.exe 4432 044844.exe 3592 pdddv.exe 4604 tnhhbt.exe 1932 44008.exe 3520 7bhhnn.exe 4116 fxxrlff.exe 4296 a0660.exe 2236 jpdvj.exe 4968 64826.exe 960 06260.exe 1668 5xrfrrf.exe 4092 c622082.exe 1204 o404260.exe 4660 pdpjv.exe 3780 e04666.exe 1448 m0604.exe 3436 a4220.exe 4956 ntnhbb.exe 4176 600000.exe 4768 s8882.exe 1656 e88040.exe 2108 xrxfrrl.exe 1160 rlfffff.exe 2552 e02084.exe 2712 4860044.exe 1852 8888404.exe 4128 c808824.exe 632 c422826.exe 1776 224466.exe 4488 i400048.exe 4100 4048260.exe 2040 nbttbb.exe 2384 604266.exe 4924 062826.exe 4456 s4486.exe 4448 xrrrllr.exe -
resource yara_rule behavioral2/memory/4948-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b3e-3.dat upx behavioral2/memory/2092-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4948-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b91-9.dat upx behavioral2/files/0x000a000000023b9b-11.dat upx behavioral2/memory/616-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2864-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9d-19.dat upx behavioral2/files/0x000a000000023b9e-23.dat upx behavioral2/memory/1348-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3208-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9f-29.dat upx behavioral2/files/0x000a000000023ba0-33.dat upx behavioral2/memory/3208-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba1-38.dat upx behavioral2/files/0x000a000000023ba2-42.dat upx behavioral2/memory/4124-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023ba3-47.dat upx behavioral2/memory/4352-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023ba4-52.dat upx behavioral2/memory/2920-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023ba5-58.dat upx behavioral2/memory/1272-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000d000000023b93-62.dat upx behavioral2/files/0x000a000000023bad-68.dat upx behavioral2/memory/3672-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4632-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3672-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/228-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000e000000023bb4-74.dat upx behavioral2/memory/2972-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bbd-79.dat upx behavioral2/files/0x0009000000023bc2-84.dat upx behavioral2/memory/2660-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023bc3-88.dat upx behavioral2/memory/2660-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023bc4-94.dat upx behavioral2/files/0x000e000000023bc8-97.dat upx behavioral2/memory/2028-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bcd-108.dat upx behavioral2/memory/2476-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bd0-122.dat upx behavioral2/files/0x0008000000023bff-127.dat upx behavioral2/files/0x0008000000023c00-132.dat upx behavioral2/memory/4116-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4092-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2712-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4128-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1776-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4488-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1656-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4176-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4956-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3436-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4488-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1668-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/960-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2236-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c09-154.dat upx behavioral2/memory/4604-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c04-149.dat upx behavioral2/files/0x0008000000023c03-145.dat upx behavioral2/files/0x0008000000023c02-141.dat upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4224824.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s4486.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e04666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m4682.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60026.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28486.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2448448.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4480426.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4948 wrote to memory of 2092 4948 a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe 82 PID 4948 wrote to memory of 2092 4948 a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe 82 PID 4948 wrote to memory of 2092 4948 a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe 82 PID 2092 wrote to memory of 616 2092 jjppj.exe 83 PID 2092 wrote to memory of 616 2092 jjppj.exe 83 PID 2092 wrote to memory of 616 2092 jjppj.exe 83 PID 616 wrote to memory of 2864 616 3rlfxxr.exe 84 PID 616 wrote to memory of 2864 616 3rlfxxr.exe 84 PID 616 wrote to memory of 2864 616 3rlfxxr.exe 84 PID 2864 wrote to memory of 3892 2864 6820082.exe 85 PID 2864 wrote to memory of 3892 2864 6820082.exe 85 PID 2864 wrote to memory of 3892 2864 6820082.exe 85 PID 3892 wrote to memory of 1348 3892 2626222.exe 86 PID 3892 wrote to memory of 1348 3892 2626222.exe 86 PID 3892 wrote to memory of 1348 3892 2626222.exe 86 PID 1348 wrote to memory of 3208 1348 btbbbb.exe 87 PID 1348 wrote to memory of 3208 1348 btbbbb.exe 87 PID 1348 wrote to memory of 3208 1348 btbbbb.exe 87 PID 3208 wrote to memory of 2196 3208 082004.exe 88 PID 3208 wrote to memory of 2196 3208 082004.exe 88 PID 3208 wrote to memory of 2196 3208 082004.exe 88 PID 2196 wrote to memory of 4124 2196 08444.exe 89 PID 2196 wrote to memory of 4124 2196 08444.exe 89 PID 2196 wrote to memory of 4124 2196 08444.exe 89 PID 4124 wrote to memory of 4352 4124 640444.exe 90 PID 4124 wrote to memory of 4352 4124 640444.exe 90 PID 4124 wrote to memory of 4352 4124 640444.exe 90 PID 4352 wrote to memory of 1272 4352 btbtnn.exe 91 PID 4352 wrote to memory of 1272 4352 btbtnn.exe 91 PID 4352 wrote to memory of 1272 4352 btbtnn.exe 91 PID 1272 wrote to memory of 2920 1272 3tnntt.exe 92 PID 1272 wrote to memory of 2920 1272 3tnntt.exe 92 PID 1272 wrote to memory of 2920 1272 3tnntt.exe 92 PID 2920 wrote to memory of 2972 2920 nhthnn.exe 93 PID 2920 wrote to memory of 2972 2920 nhthnn.exe 93 PID 2920 wrote to memory of 2972 2920 nhthnn.exe 93 PID 2972 wrote to memory of 4632 2972 046488.exe 94 PID 2972 wrote to memory of 4632 2972 046488.exe 94 PID 2972 wrote to memory of 4632 2972 046488.exe 94 PID 4632 wrote to memory of 3672 4632 5fxrrlf.exe 95 PID 4632 wrote to memory of 3672 4632 5fxrrlf.exe 95 PID 4632 wrote to memory of 3672 4632 5fxrrlf.exe 95 PID 3672 wrote to memory of 228 3672 024068.exe 96 PID 3672 wrote to memory of 228 3672 024068.exe 96 PID 3672 wrote to memory of 228 3672 024068.exe 96 PID 228 wrote to memory of 3028 228 dvdvp.exe 97 PID 228 wrote to memory of 3028 228 dvdvp.exe 97 PID 228 wrote to memory of 3028 228 dvdvp.exe 97 PID 3028 wrote to memory of 2660 3028 88606.exe 98 PID 3028 wrote to memory of 2660 3028 88606.exe 98 PID 3028 wrote to memory of 2660 3028 88606.exe 98 PID 2660 wrote to memory of 2060 2660 dpvpj.exe 99 PID 2660 wrote to memory of 2060 2660 dpvpj.exe 99 PID 2660 wrote to memory of 2060 2660 dpvpj.exe 99 PID 2060 wrote to memory of 3224 2060 4660062.exe 100 PID 2060 wrote to memory of 3224 2060 4660062.exe 100 PID 2060 wrote to memory of 3224 2060 4660062.exe 100 PID 3224 wrote to memory of 2028 3224 4244488.exe 101 PID 3224 wrote to memory of 2028 3224 4244488.exe 101 PID 3224 wrote to memory of 2028 3224 4244488.exe 101 PID 2028 wrote to memory of 4208 2028 808826.exe 102 PID 2028 wrote to memory of 4208 2028 808826.exe 102 PID 2028 wrote to memory of 4208 2028 808826.exe 102 PID 4208 wrote to memory of 2476 4208 2282644.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe"C:\Users\Admin\AppData\Local\Temp\a2fc275d335e5ec9de13b543500fa370e97d1269147be07220779d678b266420.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\jjppj.exec:\jjppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\3rlfxxr.exec:\3rlfxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
\??\c:\6820082.exec:\6820082.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\2626222.exec:\2626222.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\btbbbb.exec:\btbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\082004.exec:\082004.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\08444.exec:\08444.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\640444.exec:\640444.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\btbtnn.exec:\btbtnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\3tnntt.exec:\3tnntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\nhthnn.exec:\nhthnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\046488.exec:\046488.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\5fxrrlf.exec:\5fxrrlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\024068.exec:\024068.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\dvdvp.exec:\dvdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\88606.exec:\88606.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\dpvpj.exec:\dpvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\4660062.exec:\4660062.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\4244488.exec:\4244488.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\808826.exec:\808826.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\2282644.exec:\2282644.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\2444882.exec:\2444882.exe23⤵
- Executes dropped EXE
PID:2476 -
\??\c:\bnbttn.exec:\bnbttn.exe24⤵
- Executes dropped EXE
PID:832 -
\??\c:\vdjvp.exec:\vdjvp.exe25⤵
- Executes dropped EXE
PID:5020 -
\??\c:\xlfxrlf.exec:\xlfxrlf.exe26⤵
- Executes dropped EXE
PID:872 -
\??\c:\262202.exec:\262202.exe27⤵
- Executes dropped EXE
PID:4148 -
\??\c:\dddvp.exec:\dddvp.exe28⤵
- Executes dropped EXE
PID:3712 -
\??\c:\e80840.exec:\e80840.exe29⤵
- Executes dropped EXE
PID:3176 -
\??\c:\044844.exec:\044844.exe30⤵
- Executes dropped EXE
PID:4432 -
\??\c:\pdddv.exec:\pdddv.exe31⤵
- Executes dropped EXE
PID:3592 -
\??\c:\tnhhbt.exec:\tnhhbt.exe32⤵
- Executes dropped EXE
PID:4604 -
\??\c:\44008.exec:\44008.exe33⤵
- Executes dropped EXE
PID:1932 -
\??\c:\7bhhnn.exec:\7bhhnn.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3520 -
\??\c:\fxxrlff.exec:\fxxrlff.exe35⤵
- Executes dropped EXE
PID:4116 -
\??\c:\a0660.exec:\a0660.exe36⤵
- Executes dropped EXE
PID:4296 -
\??\c:\jpdvj.exec:\jpdvj.exe37⤵
- Executes dropped EXE
PID:2236 -
\??\c:\64826.exec:\64826.exe38⤵
- Executes dropped EXE
PID:4968 -
\??\c:\06260.exec:\06260.exe39⤵
- Executes dropped EXE
PID:960 -
\??\c:\5xrfrrf.exec:\5xrfrrf.exe40⤵
- Executes dropped EXE
PID:1668 -
\??\c:\c622082.exec:\c622082.exe41⤵
- Executes dropped EXE
PID:4092 -
\??\c:\o404260.exec:\o404260.exe42⤵
- Executes dropped EXE
PID:1204 -
\??\c:\pdpjv.exec:\pdpjv.exe43⤵
- Executes dropped EXE
PID:4660 -
\??\c:\e04666.exec:\e04666.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3780 -
\??\c:\m0604.exec:\m0604.exe45⤵
- Executes dropped EXE
PID:1448 -
\??\c:\a4220.exec:\a4220.exe46⤵
- Executes dropped EXE
PID:3436 -
\??\c:\ntnhbb.exec:\ntnhbb.exe47⤵
- Executes dropped EXE
PID:4956 -
\??\c:\600000.exec:\600000.exe48⤵
- Executes dropped EXE
PID:4176 -
\??\c:\s8882.exec:\s8882.exe49⤵
- Executes dropped EXE
PID:4768 -
\??\c:\e88040.exec:\e88040.exe50⤵
- Executes dropped EXE
PID:1656 -
\??\c:\xrxfrrl.exec:\xrxfrrl.exe51⤵
- Executes dropped EXE
PID:2108 -
\??\c:\rlfffff.exec:\rlfffff.exe52⤵
- Executes dropped EXE
PID:1160 -
\??\c:\e02084.exec:\e02084.exe53⤵
- Executes dropped EXE
PID:2552 -
\??\c:\4860044.exec:\4860044.exe54⤵
- Executes dropped EXE
PID:2712 -
\??\c:\8888404.exec:\8888404.exe55⤵
- Executes dropped EXE
PID:1852 -
\??\c:\c808824.exec:\c808824.exe56⤵
- Executes dropped EXE
PID:4128 -
\??\c:\c422826.exec:\c422826.exe57⤵
- Executes dropped EXE
PID:632 -
\??\c:\224466.exec:\224466.exe58⤵
- Executes dropped EXE
PID:1776 -
\??\c:\i400048.exec:\i400048.exe59⤵
- Executes dropped EXE
PID:4488 -
\??\c:\4048260.exec:\4048260.exe60⤵
- Executes dropped EXE
PID:4100 -
\??\c:\nbttbb.exec:\nbttbb.exe61⤵
- Executes dropped EXE
PID:2040 -
\??\c:\604266.exec:\604266.exe62⤵
- Executes dropped EXE
PID:2384 -
\??\c:\062826.exec:\062826.exe63⤵
- Executes dropped EXE
PID:4924 -
\??\c:\s4486.exec:\s4486.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4456 -
\??\c:\xrrrllr.exec:\xrrrllr.exe65⤵
- Executes dropped EXE
PID:4448 -
\??\c:\2088628.exec:\2088628.exe66⤵PID:4712
-
\??\c:\280048.exec:\280048.exe67⤵PID:448
-
\??\c:\nhnhhh.exec:\nhnhhh.exe68⤵PID:1036
-
\??\c:\o804888.exec:\o804888.exe69⤵PID:2120
-
\??\c:\66640.exec:\66640.exe70⤵PID:1228
-
\??\c:\htnhtn.exec:\htnhtn.exe71⤵PID:1512
-
\??\c:\6404822.exec:\6404822.exe72⤵PID:3892
-
\??\c:\62888.exec:\62888.exe73⤵PID:1784
-
\??\c:\bnbtnt.exec:\bnbtnt.exe74⤵PID:4664
-
\??\c:\rrxrxxf.exec:\rrxrxxf.exe75⤵PID:5064
-
\??\c:\jpppp.exec:\jpppp.exe76⤵PID:1092
-
\??\c:\xxxrffx.exec:\xxxrffx.exe77⤵PID:756
-
\??\c:\7vdpj.exec:\7vdpj.exe78⤵PID:2296
-
\??\c:\2048822.exec:\2048822.exe79⤵PID:3640
-
\??\c:\5tnhtt.exec:\5tnhtt.exe80⤵PID:4868
-
\??\c:\4822262.exec:\4822262.exe81⤵PID:5104
-
\??\c:\046048.exec:\046048.exe82⤵PID:3456
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe83⤵PID:532
-
\??\c:\k24626.exec:\k24626.exe84⤵PID:1424
-
\??\c:\tnhbtt.exec:\tnhbtt.exe85⤵PID:1496
-
\??\c:\s8604.exec:\s8604.exe86⤵PID:3872
-
\??\c:\bnbttt.exec:\bnbttt.exe87⤵PID:4088
-
\??\c:\42204.exec:\42204.exe88⤵PID:2548
-
\??\c:\0282282.exec:\0282282.exe89⤵PID:220
-
\??\c:\vpddv.exec:\vpddv.exe90⤵PID:228
-
\??\c:\pvvvj.exec:\pvvvj.exe91⤵PID:3028
-
\??\c:\840860.exec:\840860.exe92⤵PID:3280
-
\??\c:\bhbtnn.exec:\bhbtnn.exe93⤵PID:3772
-
\??\c:\9hhttn.exec:\9hhttn.exe94⤵PID:4624
-
\??\c:\48802.exec:\48802.exe95⤵PID:2504
-
\??\c:\84666.exec:\84666.exe96⤵PID:4040
-
\??\c:\3nbbtn.exec:\3nbbtn.exe97⤵PID:916
-
\??\c:\222082.exec:\222082.exe98⤵PID:3756
-
\??\c:\k66206.exec:\k66206.exe99⤵PID:2164
-
\??\c:\40260.exec:\40260.exe100⤵PID:1200
-
\??\c:\6622600.exec:\6622600.exe101⤵PID:1052
-
\??\c:\i622664.exec:\i622664.exe102⤵PID:2980
-
\??\c:\a4082.exec:\a4082.exe103⤵PID:2360
-
\??\c:\82220.exec:\82220.exe104⤵PID:4372
-
\??\c:\008462.exec:\008462.exe105⤵PID:3592
-
\??\c:\62004.exec:\62004.exe106⤵PID:4604
-
\??\c:\0686486.exec:\0686486.exe107⤵PID:3552
-
\??\c:\jdjpv.exec:\jdjpv.exe108⤵PID:4300
-
\??\c:\k44482.exec:\k44482.exe109⤵PID:4116
-
\??\c:\rlxrxrr.exec:\rlxrxrr.exe110⤵PID:2816
-
\??\c:\488822.exec:\488822.exe111⤵PID:5024
-
\??\c:\tnbnnb.exec:\tnbnnb.exe112⤵PID:960
-
\??\c:\6026662.exec:\6026662.exe113⤵PID:3112
-
\??\c:\3xrlxxr.exec:\3xrlxxr.exe114⤵PID:4092
-
\??\c:\6006622.exec:\6006622.exe115⤵PID:3572
-
\??\c:\4060442.exec:\4060442.exe116⤵PID:1556
-
\??\c:\08826.exec:\08826.exe117⤵PID:3624
-
\??\c:\pvvpd.exec:\pvvpd.exe118⤵PID:3436
-
\??\c:\m0482.exec:\m0482.exe119⤵PID:2880
-
\??\c:\u420408.exec:\u420408.exe120⤵PID:1032
-
\??\c:\3bhbnn.exec:\3bhbnn.exe121⤵PID:1948
-
\??\c:\3pvjj.exec:\3pvjj.exe122⤵PID:3340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-