Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 03:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe
Resource
win7-20240708-en
7 signatures
150 seconds
General
-
Target
adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe
-
Size
454KB
-
MD5
20b111875971d37c6362dd0f4099814d
-
SHA1
5623bd2fcc32c842c3518127c31d0acd7681f260
-
SHA256
adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a
-
SHA512
0c1ebd0b3434877e217a34696bd6c77a32df28337b60d436caada2d811b88cbb788b3c08a7b08aa8fa8c60205d54a7a10d800243799cf42428257191378b49ee
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3788-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/684-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1408-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/672-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/896-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2492-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/756-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-824-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-834-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-1075-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-1508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2528 vpppp.exe 1144 btbttt.exe 3136 dddvv.exe 1168 3xrlflr.exe 4396 bnbbtt.exe 1204 ppppj.exe 1452 7xxfxrl.exe 4924 nhnhbb.exe 684 7jppj.exe 4128 rxrrllf.exe 1984 hbbbtt.exe 3308 ffxrffr.exe 4572 ttnhbb.exe 2820 fllflll.exe 1748 thbbtn.exe 764 jjjdd.exe 2808 jppvp.exe 3088 bbhbnh.exe 1736 fxxrrll.exe 4124 5dddv.exe 3200 thnnnt.exe 872 5fxrlfx.exe 3768 ffxlfxl.exe 1752 7thbtn.exe 1408 nthhbb.exe 3572 flfrlfx.exe 1900 jpjdp.exe 4404 rflxrxr.exe 4612 rrflflf.exe 3940 hnthbn.exe 1912 bbnhtt.exe 1440 hhbtnh.exe 2696 bhttbb.exe 4556 rxlxllx.exe 3108 xrllrxl.exe 3900 tnnnhb.exe 3464 3dvpj.exe 1392 llrlrrl.exe 2948 7hhbtt.exe 4964 pjdpd.exe 4272 vvdvj.exe 672 frrlffx.exe 4100 hnhhhh.exe 2344 dppjd.exe 2544 htbtnt.exe 3256 vjpdj.exe 2084 rrxxxxx.exe 3148 rxrllff.exe 896 1bbbtb.exe 4500 3djjj.exe 376 flffxxx.exe 2492 rlfxxxr.exe 1860 hhntnn.exe 3104 3jjdd.exe 2248 rlxxfrr.exe 3340 rrxxxxr.exe 4520 bbbttt.exe 2368 pdpvv.exe 2440 1ddpj.exe 2576 rrlxxxx.exe 756 hhnhtt.exe 4936 9dpjj.exe 4924 3dvvv.exe 2220 fxxrllf.exe -
resource yara_rule behavioral2/memory/3788-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/684-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1408-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/672-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/896-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2492-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-824-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfxrl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3788 wrote to memory of 2528 3788 adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe 83 PID 3788 wrote to memory of 2528 3788 adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe 83 PID 3788 wrote to memory of 2528 3788 adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe 83 PID 2528 wrote to memory of 1144 2528 vpppp.exe 84 PID 2528 wrote to memory of 1144 2528 vpppp.exe 84 PID 2528 wrote to memory of 1144 2528 vpppp.exe 84 PID 1144 wrote to memory of 3136 1144 btbttt.exe 85 PID 1144 wrote to memory of 3136 1144 btbttt.exe 85 PID 1144 wrote to memory of 3136 1144 btbttt.exe 85 PID 3136 wrote to memory of 1168 3136 dddvv.exe 86 PID 3136 wrote to memory of 1168 3136 dddvv.exe 86 PID 3136 wrote to memory of 1168 3136 dddvv.exe 86 PID 1168 wrote to memory of 4396 1168 3xrlflr.exe 87 PID 1168 wrote to memory of 4396 1168 3xrlflr.exe 87 PID 1168 wrote to memory of 4396 1168 3xrlflr.exe 87 PID 4396 wrote to memory of 1204 4396 bnbbtt.exe 88 PID 4396 wrote to memory of 1204 4396 bnbbtt.exe 88 PID 4396 wrote to memory of 1204 4396 bnbbtt.exe 88 PID 1204 wrote to memory of 1452 1204 ppppj.exe 89 PID 1204 wrote to memory of 1452 1204 ppppj.exe 89 PID 1204 wrote to memory of 1452 1204 ppppj.exe 89 PID 1452 wrote to memory of 4924 1452 7xxfxrl.exe 90 PID 1452 wrote to memory of 4924 1452 7xxfxrl.exe 90 PID 1452 wrote to memory of 4924 1452 7xxfxrl.exe 90 PID 4924 wrote to memory of 684 4924 nhnhbb.exe 91 PID 4924 wrote to memory of 684 4924 nhnhbb.exe 91 PID 4924 wrote to memory of 684 4924 nhnhbb.exe 91 PID 684 wrote to memory of 4128 684 7jppj.exe 92 PID 684 wrote to memory of 4128 684 7jppj.exe 92 PID 684 wrote to memory of 4128 684 7jppj.exe 92 PID 4128 wrote to memory of 1984 4128 rxrrllf.exe 93 PID 4128 wrote to memory of 1984 4128 rxrrllf.exe 93 PID 4128 wrote to memory of 1984 4128 rxrrllf.exe 93 PID 1984 wrote to memory of 3308 1984 hbbbtt.exe 94 PID 1984 wrote to memory of 3308 1984 hbbbtt.exe 94 PID 1984 wrote to memory of 3308 1984 hbbbtt.exe 94 PID 3308 wrote to memory of 4572 3308 ffxrffr.exe 95 PID 3308 wrote to memory of 4572 3308 ffxrffr.exe 95 PID 3308 wrote to memory of 4572 3308 ffxrffr.exe 95 PID 4572 wrote to memory of 2820 4572 ttnhbb.exe 96 PID 4572 wrote to memory of 2820 4572 ttnhbb.exe 96 PID 4572 wrote to memory of 2820 4572 ttnhbb.exe 96 PID 2820 wrote to memory of 1748 2820 fllflll.exe 97 PID 2820 wrote to memory of 1748 2820 fllflll.exe 97 PID 2820 wrote to memory of 1748 2820 fllflll.exe 97 PID 1748 wrote to memory of 764 1748 thbbtn.exe 98 PID 1748 wrote to memory of 764 1748 thbbtn.exe 98 PID 1748 wrote to memory of 764 1748 thbbtn.exe 98 PID 764 wrote to memory of 2808 764 jjjdd.exe 99 PID 764 wrote to memory of 2808 764 jjjdd.exe 99 PID 764 wrote to memory of 2808 764 jjjdd.exe 99 PID 2808 wrote to memory of 3088 2808 jppvp.exe 100 PID 2808 wrote to memory of 3088 2808 jppvp.exe 100 PID 2808 wrote to memory of 3088 2808 jppvp.exe 100 PID 3088 wrote to memory of 1736 3088 bbhbnh.exe 101 PID 3088 wrote to memory of 1736 3088 bbhbnh.exe 101 PID 3088 wrote to memory of 1736 3088 bbhbnh.exe 101 PID 1736 wrote to memory of 4124 1736 fxxrrll.exe 102 PID 1736 wrote to memory of 4124 1736 fxxrrll.exe 102 PID 1736 wrote to memory of 4124 1736 fxxrrll.exe 102 PID 4124 wrote to memory of 3200 4124 5dddv.exe 103 PID 4124 wrote to memory of 3200 4124 5dddv.exe 103 PID 4124 wrote to memory of 3200 4124 5dddv.exe 103 PID 3200 wrote to memory of 872 3200 thnnnt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe"C:\Users\Admin\AppData\Local\Temp\adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\vpppp.exec:\vpppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\btbttt.exec:\btbttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\dddvv.exec:\dddvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\3xrlflr.exec:\3xrlflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\bnbbtt.exec:\bnbbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\ppppj.exec:\ppppj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\7xxfxrl.exec:\7xxfxrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\nhnhbb.exec:\nhnhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\7jppj.exec:\7jppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\rxrrllf.exec:\rxrrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\hbbbtt.exec:\hbbbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\ffxrffr.exec:\ffxrffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\ttnhbb.exec:\ttnhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\fllflll.exec:\fllflll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\thbbtn.exec:\thbbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\jjjdd.exec:\jjjdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\jppvp.exec:\jppvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\bbhbnh.exec:\bbhbnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\fxxrrll.exec:\fxxrrll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\5dddv.exec:\5dddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\thnnnt.exec:\thnnnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\5fxrlfx.exec:\5fxrlfx.exe23⤵
- Executes dropped EXE
PID:872 -
\??\c:\ffxlfxl.exec:\ffxlfxl.exe24⤵
- Executes dropped EXE
PID:3768 -
\??\c:\7thbtn.exec:\7thbtn.exe25⤵
- Executes dropped EXE
PID:1752 -
\??\c:\nthhbb.exec:\nthhbb.exe26⤵
- Executes dropped EXE
PID:1408 -
\??\c:\flfrlfx.exec:\flfrlfx.exe27⤵
- Executes dropped EXE
PID:3572 -
\??\c:\jpjdp.exec:\jpjdp.exe28⤵
- Executes dropped EXE
PID:1900 -
\??\c:\rflxrxr.exec:\rflxrxr.exe29⤵
- Executes dropped EXE
PID:4404 -
\??\c:\rrflflf.exec:\rrflflf.exe30⤵
- Executes dropped EXE
PID:4612 -
\??\c:\hnthbn.exec:\hnthbn.exe31⤵
- Executes dropped EXE
PID:3940 -
\??\c:\bbnhtt.exec:\bbnhtt.exe32⤵
- Executes dropped EXE
PID:1912 -
\??\c:\hhbtnh.exec:\hhbtnh.exe33⤵
- Executes dropped EXE
PID:1440 -
\??\c:\bhttbb.exec:\bhttbb.exe34⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rxlxllx.exec:\rxlxllx.exe35⤵
- Executes dropped EXE
PID:4556 -
\??\c:\xrllrxl.exec:\xrllrxl.exe36⤵
- Executes dropped EXE
PID:3108 -
\??\c:\tnnnhb.exec:\tnnnhb.exe37⤵
- Executes dropped EXE
PID:3900 -
\??\c:\3dvpj.exec:\3dvpj.exe38⤵
- Executes dropped EXE
PID:3464 -
\??\c:\llrlrrl.exec:\llrlrrl.exe39⤵
- Executes dropped EXE
PID:1392 -
\??\c:\7hhbtt.exec:\7hhbtt.exe40⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pjdpd.exec:\pjdpd.exe41⤵
- Executes dropped EXE
PID:4964 -
\??\c:\vvdvj.exec:\vvdvj.exe42⤵
- Executes dropped EXE
PID:4272 -
\??\c:\frrlffx.exec:\frrlffx.exe43⤵
- Executes dropped EXE
PID:672 -
\??\c:\hnhhhh.exec:\hnhhhh.exe44⤵
- Executes dropped EXE
PID:4100 -
\??\c:\dppjd.exec:\dppjd.exe45⤵
- Executes dropped EXE
PID:2344 -
\??\c:\htbtnt.exec:\htbtnt.exe46⤵
- Executes dropped EXE
PID:2544 -
\??\c:\vjpdj.exec:\vjpdj.exe47⤵
- Executes dropped EXE
PID:3256 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe48⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rxrllff.exec:\rxrllff.exe49⤵
- Executes dropped EXE
PID:3148 -
\??\c:\1bbbtb.exec:\1bbbtb.exe50⤵
- Executes dropped EXE
PID:896 -
\??\c:\3djjj.exec:\3djjj.exe51⤵
- Executes dropped EXE
PID:4500 -
\??\c:\flffxxx.exec:\flffxxx.exe52⤵
- Executes dropped EXE
PID:376 -
\??\c:\rlfxxxr.exec:\rlfxxxr.exe53⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hhntnn.exec:\hhntnn.exe54⤵
- Executes dropped EXE
PID:1860 -
\??\c:\3jjdd.exec:\3jjdd.exe55⤵
- Executes dropped EXE
PID:3104 -
\??\c:\rlxxfrr.exec:\rlxxfrr.exe56⤵
- Executes dropped EXE
PID:2248 -
\??\c:\rrxxxxr.exec:\rrxxxxr.exe57⤵
- Executes dropped EXE
PID:3340 -
\??\c:\bbbttt.exec:\bbbttt.exe58⤵
- Executes dropped EXE
PID:4520 -
\??\c:\pdpvv.exec:\pdpvv.exe59⤵
- Executes dropped EXE
PID:2368 -
\??\c:\1ddpj.exec:\1ddpj.exe60⤵
- Executes dropped EXE
PID:2440 -
\??\c:\rrlxxxx.exec:\rrlxxxx.exe61⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hhnhtt.exec:\hhnhtt.exe62⤵
- Executes dropped EXE
PID:756 -
\??\c:\9dpjj.exec:\9dpjj.exe63⤵
- Executes dropped EXE
PID:4936 -
\??\c:\3dvvv.exec:\3dvvv.exe64⤵
- Executes dropped EXE
PID:4924 -
\??\c:\fxxrllf.exec:\fxxrllf.exe65⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bnbbtt.exec:\bnbbtt.exe66⤵PID:4696
-
\??\c:\ppvjd.exec:\ppvjd.exe67⤵PID:3576
-
\??\c:\7pvvd.exec:\7pvvd.exe68⤵PID:3360
-
\??\c:\frxfffx.exec:\frxfffx.exe69⤵PID:3456
-
\??\c:\7hhhhh.exec:\7hhhhh.exe70⤵PID:3924
-
\??\c:\vppvp.exec:\vppvp.exe71⤵PID:388
-
\??\c:\xflfrrf.exec:\xflfrrf.exe72⤵PID:3064
-
\??\c:\9btttt.exec:\9btttt.exe73⤵PID:5084
-
\??\c:\1dddd.exec:\1dddd.exe74⤵PID:964
-
\??\c:\rrffxfx.exec:\rrffxfx.exe75⤵PID:2956
-
\??\c:\tnhbtn.exec:\tnhbtn.exe76⤵PID:4360
-
\??\c:\tntnnn.exec:\tntnnn.exe77⤵PID:4064
-
\??\c:\5pjdv.exec:\5pjdv.exe78⤵PID:3856
-
\??\c:\frlfxrr.exec:\frlfxrr.exe79⤵PID:4952
-
\??\c:\9thtnt.exec:\9thtnt.exe80⤵PID:4984
-
\??\c:\dvpjd.exec:\dvpjd.exe81⤵PID:4004
-
\??\c:\pjjjd.exec:\pjjjd.exe82⤵PID:1708
-
\??\c:\fffxlfx.exec:\fffxlfx.exe83⤵PID:4000
-
\??\c:\tbhttn.exec:\tbhttn.exe84⤵PID:4068
-
\??\c:\pvdvv.exec:\pvdvv.exe85⤵PID:2208
-
\??\c:\9rrlllx.exec:\9rrlllx.exe86⤵PID:3800
-
\??\c:\btnbtt.exec:\btnbtt.exe87⤵PID:4812
-
\??\c:\hnbttt.exec:\hnbttt.exe88⤵PID:948
-
\??\c:\pdvpj.exec:\pdvpj.exe89⤵PID:2772
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe90⤵PID:1720
-
\??\c:\1nbtnn.exec:\1nbtnn.exe91⤵PID:3316
-
\??\c:\ppvvv.exec:\ppvvv.exe92⤵PID:4996
-
\??\c:\vddjj.exec:\vddjj.exe93⤵PID:3580
-
\??\c:\fxlfxrl.exec:\fxlfxrl.exe94⤵PID:4668
-
\??\c:\tnbthb.exec:\tnbthb.exe95⤵PID:1120
-
\??\c:\vjppp.exec:\vjppp.exe96⤵PID:2452
-
\??\c:\9vdvv.exec:\9vdvv.exe97⤵PID:4824
-
\??\c:\xxrlxxl.exec:\xxrlxxl.exe98⤵PID:1212
-
\??\c:\9thbtt.exec:\9thbtt.exe99⤵PID:3916
-
\??\c:\vjdvj.exec:\vjdvj.exe100⤵PID:2824
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe101⤵PID:3164
-
\??\c:\hhhhhh.exec:\hhhhhh.exe102⤵PID:656
-
\??\c:\pvppj.exec:\pvppj.exe103⤵PID:2308
-
\??\c:\lrrfxrf.exec:\lrrfxrf.exe104⤵PID:3004
-
\??\c:\9xxrlfx.exec:\9xxrlfx.exe105⤵PID:2052
-
\??\c:\1nbbbh.exec:\1nbbbh.exe106⤵PID:4184
-
\??\c:\ddjjd.exec:\ddjjd.exe107⤵PID:720
-
\??\c:\5xfrlfr.exec:\5xfrlfr.exe108⤵PID:2468
-
\??\c:\nbtnnt.exec:\nbtnnt.exe109⤵PID:1060
-
\??\c:\bhhhhh.exec:\bhhhhh.exe110⤵PID:3660
-
\??\c:\dvpdp.exec:\dvpdp.exe111⤵PID:1404
-
\??\c:\7lffxrf.exec:\7lffxrf.exe112⤵PID:3056
-
\??\c:\bbntbb.exec:\bbntbb.exe113⤵PID:2944
-
\??\c:\pjpjd.exec:\pjpjd.exe114⤵PID:380
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe115⤵PID:552
-
\??\c:\nhtnbb.exec:\nhtnbb.exe116⤵PID:4500
-
\??\c:\dvvvp.exec:\dvvvp.exe117⤵PID:4672
-
\??\c:\7rlfxxr.exec:\7rlfxxr.exe118⤵PID:2492
-
\??\c:\3nnhbh.exec:\3nnhbh.exe119⤵PID:5092
-
\??\c:\vdjdj.exec:\vdjdj.exe120⤵PID:4052
-
\??\c:\3vpjd.exec:\3vpjd.exe121⤵PID:2904
-
\??\c:\rrrrlll.exec:\rrrrlll.exe122⤵PID:3340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-