Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 22:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe
-
Size
453KB
-
MD5
82ef3b69ce334a2addbbb2c2f1513f94
-
SHA1
7894dde28b156bd8b6a7c094eae645e7c72c413f
-
SHA256
31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638
-
SHA512
581a8e35c1dbab70d1c9b53b02dbaefb9c9abb039b5b4675a97911ef417159d891e6540abd6768993934bdeafc86385a6d70dc127869cb0b727b1cb8cae0c344
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeY:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4864-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1508-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1744-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/528-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1744-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3272-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1104-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/648-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-705-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-724-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-1103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-1311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-1423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-1803-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3260 hhtnnn.exe 4736 vjppp.exe 4396 ffxxrxx.exe 632 rlrllff.exe 1432 ddddd.exe 2960 nbhhhn.exe 1180 fxfxrrl.exe 5056 ttbbbn.exe 1508 pdjjj.exe 5024 xrffxff.exe 1064 bbhhhh.exe 2140 pjvvp.exe 2468 ffxxlrf.exe 4992 htbbtt.exe 1200 htbtnn.exe 1704 hhthhb.exe 4168 9djjj.exe 3664 rrxxxxx.exe 2908 5tbbbh.exe 448 xxrrlrl.exe 2756 tbnnnn.exe 1800 ttbhhn.exe 2340 jdjjj.exe 4460 vvvvv.exe 5008 1pvpj.exe 2976 fxrrrxr.exe 2800 vpddd.exe 2380 5lrllrx.exe 4048 thnnnb.exe 3652 pjjjj.exe 4268 7xxxrxr.exe 4372 djppd.exe 1084 bnnbnt.exe 4880 dvjjj.exe 2824 xxlflll.exe 1360 jppjj.exe 1828 5rrrrxx.exe 264 bthtnn.exe 4760 ddjdd.exe 4516 lrffxff.exe 4312 5thhtt.exe 2728 xrxrrrr.exe 4304 frffxff.exe 5016 pdppp.exe 1744 5bbhbb.exe 5032 pvppj.exe 924 5frlxlf.exe 2072 1nbttt.exe 5104 pppdj.exe 4432 xlxrxxx.exe 1432 btbttt.exe 4868 dvvpj.exe 2636 9lxfrfl.exe 3836 5btnnn.exe 744 1bhbbt.exe 1108 pjvpp.exe 4320 3xxxrrr.exe 2312 lxxrrxr.exe 1584 tbtbhn.exe 660 ddjjv.exe 3360 tttttb.exe 2396 dvjdd.exe 3060 vdjjj.exe 4352 llfxrff.exe -
resource yara_rule behavioral2/memory/4864-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1432-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1508-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1508-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/528-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3272-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1104-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/648-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-724-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-1103-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4864 wrote to memory of 3260 4864 31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe 83 PID 4864 wrote to memory of 3260 4864 31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe 83 PID 4864 wrote to memory of 3260 4864 31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe 83 PID 3260 wrote to memory of 4736 3260 hhtnnn.exe 84 PID 3260 wrote to memory of 4736 3260 hhtnnn.exe 84 PID 3260 wrote to memory of 4736 3260 hhtnnn.exe 84 PID 4736 wrote to memory of 4396 4736 vjppp.exe 85 PID 4736 wrote to memory of 4396 4736 vjppp.exe 85 PID 4736 wrote to memory of 4396 4736 vjppp.exe 85 PID 4396 wrote to memory of 632 4396 ffxxrxx.exe 86 PID 4396 wrote to memory of 632 4396 ffxxrxx.exe 86 PID 4396 wrote to memory of 632 4396 ffxxrxx.exe 86 PID 632 wrote to memory of 1432 632 rlrllff.exe 87 PID 632 wrote to memory of 1432 632 rlrllff.exe 87 PID 632 wrote to memory of 1432 632 rlrllff.exe 87 PID 1432 wrote to memory of 2960 1432 ddddd.exe 88 PID 1432 wrote to memory of 2960 1432 ddddd.exe 88 PID 1432 wrote to memory of 2960 1432 ddddd.exe 88 PID 2960 wrote to memory of 1180 2960 nbhhhn.exe 89 PID 2960 wrote to memory of 1180 2960 nbhhhn.exe 89 PID 2960 wrote to memory of 1180 2960 nbhhhn.exe 89 PID 1180 wrote to memory of 5056 1180 fxfxrrl.exe 90 PID 1180 wrote to memory of 5056 1180 fxfxrrl.exe 90 PID 1180 wrote to memory of 5056 1180 fxfxrrl.exe 90 PID 5056 wrote to memory of 1508 5056 ttbbbn.exe 91 PID 5056 wrote to memory of 1508 5056 ttbbbn.exe 91 PID 5056 wrote to memory of 1508 5056 ttbbbn.exe 91 PID 1508 wrote to memory of 5024 1508 pdjjj.exe 92 PID 1508 wrote to memory of 5024 1508 pdjjj.exe 92 PID 1508 wrote to memory of 5024 1508 pdjjj.exe 92 PID 5024 wrote to memory of 1064 5024 xrffxff.exe 93 PID 5024 wrote to memory of 1064 5024 xrffxff.exe 93 PID 5024 wrote to memory of 1064 5024 xrffxff.exe 93 PID 1064 wrote to memory of 2140 1064 bbhhhh.exe 94 PID 1064 wrote to memory of 2140 1064 bbhhhh.exe 94 PID 1064 wrote to memory of 2140 1064 bbhhhh.exe 94 PID 2140 wrote to memory of 2468 2140 pjvvp.exe 95 PID 2140 wrote to memory of 2468 2140 pjvvp.exe 95 PID 2140 wrote to memory of 2468 2140 pjvvp.exe 95 PID 2468 wrote to memory of 4992 2468 ffxxlrf.exe 96 PID 2468 wrote to memory of 4992 2468 ffxxlrf.exe 96 PID 2468 wrote to memory of 4992 2468 ffxxlrf.exe 96 PID 4992 wrote to memory of 1200 4992 htbbtt.exe 97 PID 4992 wrote to memory of 1200 4992 htbbtt.exe 97 PID 4992 wrote to memory of 1200 4992 htbbtt.exe 97 PID 1200 wrote to memory of 1704 1200 htbtnn.exe 98 PID 1200 wrote to memory of 1704 1200 htbtnn.exe 98 PID 1200 wrote to memory of 1704 1200 htbtnn.exe 98 PID 1704 wrote to memory of 4168 1704 hhthhb.exe 99 PID 1704 wrote to memory of 4168 1704 hhthhb.exe 99 PID 1704 wrote to memory of 4168 1704 hhthhb.exe 99 PID 4168 wrote to memory of 3664 4168 9djjj.exe 100 PID 4168 wrote to memory of 3664 4168 9djjj.exe 100 PID 4168 wrote to memory of 3664 4168 9djjj.exe 100 PID 3664 wrote to memory of 2908 3664 rrxxxxx.exe 101 PID 3664 wrote to memory of 2908 3664 rrxxxxx.exe 101 PID 3664 wrote to memory of 2908 3664 rrxxxxx.exe 101 PID 2908 wrote to memory of 448 2908 5tbbbh.exe 102 PID 2908 wrote to memory of 448 2908 5tbbbh.exe 102 PID 2908 wrote to memory of 448 2908 5tbbbh.exe 102 PID 448 wrote to memory of 2756 448 xxrrlrl.exe 103 PID 448 wrote to memory of 2756 448 xxrrlrl.exe 103 PID 448 wrote to memory of 2756 448 xxrrlrl.exe 103 PID 2756 wrote to memory of 1800 2756 tbnnnn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe"C:\Users\Admin\AppData\Local\Temp\31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\hhtnnn.exec:\hhtnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\vjppp.exec:\vjppp.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\ffxxrxx.exec:\ffxxrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\rlrllff.exec:\rlrllff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\ddddd.exec:\ddddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\nbhhhn.exec:\nbhhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\ttbbbn.exec:\ttbbbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\pdjjj.exec:\pdjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\xrffxff.exec:\xrffxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\bbhhhh.exec:\bbhhhh.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\pjvvp.exec:\pjvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\ffxxlrf.exec:\ffxxlrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\htbbtt.exec:\htbbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\htbtnn.exec:\htbtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\hhthhb.exec:\hhthhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\9djjj.exec:\9djjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\5tbbbh.exec:\5tbbbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\xxrrlrl.exec:\xxrrlrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\tbnnnn.exec:\tbnnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\ttbhhn.exec:\ttbhhn.exe23⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jdjjj.exec:\jdjjj.exe24⤵
- Executes dropped EXE
PID:2340 -
\??\c:\vvvvv.exec:\vvvvv.exe25⤵
- Executes dropped EXE
PID:4460 -
\??\c:\1pvpj.exec:\1pvpj.exe26⤵
- Executes dropped EXE
PID:5008 -
\??\c:\fxrrrxr.exec:\fxrrrxr.exe27⤵
- Executes dropped EXE
PID:2976 -
\??\c:\vpddd.exec:\vpddd.exe28⤵
- Executes dropped EXE
PID:2800 -
\??\c:\5lrllrx.exec:\5lrllrx.exe29⤵
- Executes dropped EXE
PID:2380 -
\??\c:\thnnnb.exec:\thnnnb.exe30⤵
- Executes dropped EXE
PID:4048 -
\??\c:\pjjjj.exec:\pjjjj.exe31⤵
- Executes dropped EXE
PID:3652 -
\??\c:\7xxxrxr.exec:\7xxxrxr.exe32⤵
- Executes dropped EXE
PID:4268 -
\??\c:\djppd.exec:\djppd.exe33⤵
- Executes dropped EXE
PID:4372 -
\??\c:\bnnbnt.exec:\bnnbnt.exe34⤵
- Executes dropped EXE
PID:1084 -
\??\c:\dvjjj.exec:\dvjjj.exe35⤵
- Executes dropped EXE
PID:4880 -
\??\c:\xxlflll.exec:\xxlflll.exe36⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jppjj.exec:\jppjj.exe37⤵
- Executes dropped EXE
PID:1360 -
\??\c:\5rrrrxx.exec:\5rrrrxx.exe38⤵
- Executes dropped EXE
PID:1828 -
\??\c:\bthtnn.exec:\bthtnn.exe39⤵
- Executes dropped EXE
PID:264 -
\??\c:\ddjdd.exec:\ddjdd.exe40⤵
- Executes dropped EXE
PID:4760 -
\??\c:\lrffxff.exec:\lrffxff.exe41⤵
- Executes dropped EXE
PID:4516 -
\??\c:\5thhtt.exec:\5thhtt.exe42⤵
- Executes dropped EXE
PID:4312 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe43⤵
- Executes dropped EXE
PID:2728 -
\??\c:\frffxff.exec:\frffxff.exe44⤵
- Executes dropped EXE
PID:4304 -
\??\c:\pdppp.exec:\pdppp.exe45⤵
- Executes dropped EXE
PID:5016 -
\??\c:\5bbhbb.exec:\5bbhbb.exe46⤵
- Executes dropped EXE
PID:1744 -
\??\c:\pvppj.exec:\pvppj.exe47⤵
- Executes dropped EXE
PID:5032 -
\??\c:\5frlxlf.exec:\5frlxlf.exe48⤵
- Executes dropped EXE
PID:924 -
\??\c:\1nbttt.exec:\1nbttt.exe49⤵
- Executes dropped EXE
PID:2072 -
\??\c:\pppdj.exec:\pppdj.exe50⤵
- Executes dropped EXE
PID:5104 -
\??\c:\xlxrxxx.exec:\xlxrxxx.exe51⤵
- Executes dropped EXE
PID:4432 -
\??\c:\btbttt.exec:\btbttt.exe52⤵
- Executes dropped EXE
PID:1432 -
\??\c:\dvvpj.exec:\dvvpj.exe53⤵
- Executes dropped EXE
PID:4868 -
\??\c:\9lxfrfl.exec:\9lxfrfl.exe54⤵
- Executes dropped EXE
PID:2636 -
\??\c:\5btnnn.exec:\5btnnn.exe55⤵
- Executes dropped EXE
PID:3836 -
\??\c:\1bhbbt.exec:\1bhbbt.exe56⤵
- Executes dropped EXE
PID:744 -
\??\c:\pjvpp.exec:\pjvpp.exe57⤵
- Executes dropped EXE
PID:1108 -
\??\c:\3xxxrrr.exec:\3xxxrrr.exe58⤵
- Executes dropped EXE
PID:4320 -
\??\c:\lxxrrxr.exec:\lxxrrxr.exe59⤵
- Executes dropped EXE
PID:2312 -
\??\c:\tbtbhn.exec:\tbtbhn.exe60⤵
- Executes dropped EXE
PID:1584 -
\??\c:\ddjjv.exec:\ddjjv.exe61⤵
- Executes dropped EXE
PID:660 -
\??\c:\tttttb.exec:\tttttb.exe62⤵
- Executes dropped EXE
PID:3360 -
\??\c:\dvjdd.exec:\dvjdd.exe63⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vdjjj.exec:\vdjjj.exe64⤵
- Executes dropped EXE
PID:3060 -
\??\c:\llfxrff.exec:\llfxrff.exe65⤵
- Executes dropped EXE
PID:4352 -
\??\c:\nnttnn.exec:\nnttnn.exe66⤵PID:2940
-
\??\c:\dppvp.exec:\dppvp.exe67⤵PID:2480
-
\??\c:\lxffxxf.exec:\lxffxxf.exe68⤵PID:4276
-
\??\c:\7rrrlxr.exec:\7rrrlxr.exe69⤵PID:528
-
\??\c:\tnhbtb.exec:\tnhbtb.exe70⤵PID:3204
-
\??\c:\pdjdd.exec:\pdjdd.exe71⤵PID:4956
-
\??\c:\rrrlffx.exec:\rrrlffx.exe72⤵PID:448
-
\??\c:\hhnhhh.exec:\hhnhhh.exe73⤵PID:1996
-
\??\c:\dpddd.exec:\dpddd.exe74⤵PID:372
-
\??\c:\lllxrlx.exec:\lllxrlx.exe75⤵PID:2936
-
\??\c:\1tbnnt.exec:\1tbnnt.exe76⤵PID:4068
-
\??\c:\pvvpp.exec:\pvvpp.exe77⤵PID:1708
-
\??\c:\lfxlfxr.exec:\lfxlfxr.exe78⤵PID:3128
-
\??\c:\thhbtn.exec:\thhbtn.exe79⤵PID:1576
-
\??\c:\ppdvd.exec:\ppdvd.exe80⤵PID:3004
-
\??\c:\rlrlfff.exec:\rlrlfff.exe81⤵PID:540
-
\??\c:\3ntttb.exec:\3ntttb.exe82⤵PID:3432
-
\??\c:\5ppjj.exec:\5ppjj.exe83⤵PID:3636
-
\??\c:\vpdvv.exec:\vpdvv.exe84⤵PID:2972
-
\??\c:\llxrlxr.exec:\llxrlxr.exe85⤵PID:3752
-
\??\c:\bhthbt.exec:\bhthbt.exe86⤵PID:2364
-
\??\c:\pdjdv.exec:\pdjdv.exe87⤵PID:2820
-
\??\c:\xfffxfx.exec:\xfffxfx.exe88⤵PID:4448
-
\??\c:\hhhbtt.exec:\hhhbtt.exe89⤵PID:2120
-
\??\c:\thbtnb.exec:\thbtnb.exe90⤵PID:3468
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe91⤵PID:3232
-
\??\c:\xrffrxr.exec:\xrffrxr.exe92⤵PID:1628
-
\??\c:\bhnnnn.exec:\bhnnnn.exe93⤵PID:4608
-
\??\c:\vpjjd.exec:\vpjjd.exe94⤵PID:3364
-
\??\c:\lfxlfrl.exec:\lfxlfrl.exe95⤵PID:2360
-
\??\c:\5bhhbh.exec:\5bhhbh.exe96⤵PID:4368
-
\??\c:\jdpvv.exec:\jdpvv.exe97⤵PID:4516
-
\??\c:\xrlllrf.exec:\xrlllrf.exe98⤵PID:3424
-
\??\c:\3bhbtt.exec:\3bhbtt.exe99⤵PID:1772
-
\??\c:\tnhbtt.exec:\tnhbtt.exe100⤵PID:5020
-
\??\c:\pvddd.exec:\pvddd.exe101⤵PID:3124
-
\??\c:\frxxrrf.exec:\frxxrrf.exe102⤵PID:5060
-
\??\c:\bthbhh.exec:\bthbhh.exe103⤵PID:4976
-
\??\c:\vdvvj.exec:\vdvvj.exe104⤵PID:1744
-
\??\c:\rllxrrl.exec:\rllxrrl.exe105⤵PID:3988
-
\??\c:\tbnhtt.exec:\tbnhtt.exe106⤵PID:1240
-
\??\c:\dvvvp.exec:\dvvvp.exe107⤵PID:1204
-
\??\c:\ffllrrr.exec:\ffllrrr.exe108⤵PID:2900
-
\??\c:\thhhbb.exec:\thhhbb.exe109⤵PID:4544
-
\??\c:\pdjvp.exec:\pdjvp.exe110⤵PID:3336
-
\??\c:\rlrrllf.exec:\rlrrllf.exe111⤵PID:1180
-
\??\c:\nhtttb.exec:\nhtttb.exe112⤵PID:3940
-
\??\c:\vvjjj.exec:\vvjjj.exe113⤵PID:1508
-
\??\c:\frfxffl.exec:\frfxffl.exe114⤵PID:1644
-
\??\c:\thntnn.exec:\thntnn.exe115⤵PID:3052
-
\??\c:\1jdvp.exec:\1jdvp.exe116⤵PID:2668
-
\??\c:\lxflrrr.exec:\lxflrrr.exe117⤵PID:2240
-
\??\c:\tnnntb.exec:\tnnntb.exe118⤵PID:2652
-
\??\c:\jdvvp.exec:\jdvvp.exe119⤵PID:2520
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe120⤵PID:1064
-
\??\c:\3tbtbb.exec:\3tbtbb.exe121⤵PID:3272
-
\??\c:\vvjjd.exec:\vvjjd.exe122⤵PID:720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-