Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 21:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
25f8b6a718607062deb028978519b11d4c8cda8df6a355092e136065dcb84dbc.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
25f8b6a718607062deb028978519b11d4c8cda8df6a355092e136065dcb84dbc.exe
-
Size
454KB
-
MD5
2295ecead46ec7a7b200ceeffec735c3
-
SHA1
e384200d341d3c9b866d4f75a5fa78903082159e
-
SHA256
25f8b6a718607062deb028978519b11d4c8cda8df6a355092e136065dcb84dbc
-
SHA512
d8adb81235cd66f6d18077b7b5548eecdfc4dc81368f4197d1af714cce3a20c873cf0e03c1701a18cc73cdeb9072f0e89c14df2348d02696a38a744a99e92f54
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe+:q7Tc2NYHUrAwfMp3CD+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/5004-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/772-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4208-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1760-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1412-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2836-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2504-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-755-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-795-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-892-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2300 vjpdv.exe 372 btthbt.exe 4568 jvjdp.exe 3320 nnbttt.exe 5064 dvjdj.exe 3840 ppvpj.exe 2160 1ttnhh.exe 624 ffrxlfl.exe 2284 tnnnhh.exe 4616 pvdvv.exe 1920 hhbnnb.exe 1292 vjdpj.exe 4936 nhnhbb.exe 3136 xlxfrfx.exe 3944 hnttnt.exe 3308 pjjdv.exe 4328 rflflll.exe 772 hhbbtt.exe 4384 7vddj.exe 3256 pdddv.exe 404 3hhhbh.exe 1248 vpjjv.exe 680 9vdvp.exe 3112 jjjdv.exe 3828 dddvd.exe 2808 hthbbb.exe 1480 lxlxxxx.exe 3148 rlxxxxx.exe 4344 xrrllrl.exe 4744 dpjdd.exe 3468 rllrlrl.exe 1436 ppppp.exe 3988 lxlllll.exe 3472 nthbtt.exe 2084 fffffff.exe 4544 xxfxxrr.exe 396 bnnhhb.exe 2256 9ppjd.exe 2764 9lrlffx.exe 808 tnbhhh.exe 4988 jdddv.exe 4316 xlrxrxr.exe 4208 1nnhbh.exe 2584 lrrfxrr.exe 2152 9nbtbb.exe 2596 vpjjv.exe 2192 xflllll.exe 4704 7thbtt.exe 1760 7jjjd.exe 432 1rxxflr.exe 4872 thnhhh.exe 636 9dddv.exe 232 jdvjd.exe 2160 rflffxx.exe 1004 tthhtt.exe 5112 dvvvp.exe 2284 llfxxrr.exe 4364 thtbtt.exe 4508 xxrllll.exe 1564 nhthnn.exe 4724 nnthbb.exe 4732 rlxxxxx.exe 3652 5xfxrrl.exe 968 nhhhbh.exe -
resource yara_rule behavioral2/memory/5004-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1292-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/772-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4208-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1412-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2504-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-694-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlxrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5004 wrote to memory of 2300 5004 25f8b6a718607062deb028978519b11d4c8cda8df6a355092e136065dcb84dbc.exe 83 PID 5004 wrote to memory of 2300 5004 25f8b6a718607062deb028978519b11d4c8cda8df6a355092e136065dcb84dbc.exe 83 PID 5004 wrote to memory of 2300 5004 25f8b6a718607062deb028978519b11d4c8cda8df6a355092e136065dcb84dbc.exe 83 PID 2300 wrote to memory of 372 2300 vjpdv.exe 84 PID 2300 wrote to memory of 372 2300 vjpdv.exe 84 PID 2300 wrote to memory of 372 2300 vjpdv.exe 84 PID 372 wrote to memory of 4568 372 btthbt.exe 85 PID 372 wrote to memory of 4568 372 btthbt.exe 85 PID 372 wrote to memory of 4568 372 btthbt.exe 85 PID 4568 wrote to memory of 3320 4568 jvjdp.exe 86 PID 4568 wrote to memory of 3320 4568 jvjdp.exe 86 PID 4568 wrote to memory of 3320 4568 jvjdp.exe 86 PID 3320 wrote to memory of 5064 3320 nnbttt.exe 87 PID 3320 wrote to memory of 5064 3320 nnbttt.exe 87 PID 3320 wrote to memory of 5064 3320 nnbttt.exe 87 PID 5064 wrote to memory of 3840 5064 dvjdj.exe 88 PID 5064 wrote to memory of 3840 5064 dvjdj.exe 88 PID 5064 wrote to memory of 3840 5064 dvjdj.exe 88 PID 3840 wrote to memory of 2160 3840 ppvpj.exe 89 PID 3840 wrote to memory of 2160 3840 ppvpj.exe 89 PID 3840 wrote to memory of 2160 3840 ppvpj.exe 89 PID 2160 wrote to memory of 624 2160 1ttnhh.exe 90 PID 2160 wrote to memory of 624 2160 1ttnhh.exe 90 PID 2160 wrote to memory of 624 2160 1ttnhh.exe 90 PID 624 wrote to memory of 2284 624 ffrxlfl.exe 91 PID 624 wrote to memory of 2284 624 ffrxlfl.exe 91 PID 624 wrote to memory of 2284 624 ffrxlfl.exe 91 PID 2284 wrote to memory of 4616 2284 tnnnhh.exe 92 PID 2284 wrote to memory of 4616 2284 tnnnhh.exe 92 PID 2284 wrote to memory of 4616 2284 tnnnhh.exe 92 PID 4616 wrote to memory of 1920 4616 pvdvv.exe 93 PID 4616 wrote to memory of 1920 4616 pvdvv.exe 93 PID 4616 wrote to memory of 1920 4616 pvdvv.exe 93 PID 1920 wrote to memory of 1292 1920 hhbnnb.exe 94 PID 1920 wrote to memory of 1292 1920 hhbnnb.exe 94 PID 1920 wrote to memory of 1292 1920 hhbnnb.exe 94 PID 1292 wrote to memory of 4936 1292 vjdpj.exe 95 PID 1292 wrote to memory of 4936 1292 vjdpj.exe 95 PID 1292 wrote to memory of 4936 1292 vjdpj.exe 95 PID 4936 wrote to memory of 3136 4936 nhnhbb.exe 96 PID 4936 wrote to memory of 3136 4936 nhnhbb.exe 96 PID 4936 wrote to memory of 3136 4936 nhnhbb.exe 96 PID 3136 wrote to memory of 3944 3136 xlxfrfx.exe 97 PID 3136 wrote to memory of 3944 3136 xlxfrfx.exe 97 PID 3136 wrote to memory of 3944 3136 xlxfrfx.exe 97 PID 3944 wrote to memory of 3308 3944 hnttnt.exe 98 PID 3944 wrote to memory of 3308 3944 hnttnt.exe 98 PID 3944 wrote to memory of 3308 3944 hnttnt.exe 98 PID 3308 wrote to memory of 4328 3308 pjjdv.exe 99 PID 3308 wrote to memory of 4328 3308 pjjdv.exe 99 PID 3308 wrote to memory of 4328 3308 pjjdv.exe 99 PID 4328 wrote to memory of 772 4328 rflflll.exe 100 PID 4328 wrote to memory of 772 4328 rflflll.exe 100 PID 4328 wrote to memory of 772 4328 rflflll.exe 100 PID 772 wrote to memory of 4384 772 hhbbtt.exe 101 PID 772 wrote to memory of 4384 772 hhbbtt.exe 101 PID 772 wrote to memory of 4384 772 hhbbtt.exe 101 PID 4384 wrote to memory of 3256 4384 7vddj.exe 102 PID 4384 wrote to memory of 3256 4384 7vddj.exe 102 PID 4384 wrote to memory of 3256 4384 7vddj.exe 102 PID 3256 wrote to memory of 404 3256 pdddv.exe 103 PID 3256 wrote to memory of 404 3256 pdddv.exe 103 PID 3256 wrote to memory of 404 3256 pdddv.exe 103 PID 404 wrote to memory of 1248 404 3hhhbh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\25f8b6a718607062deb028978519b11d4c8cda8df6a355092e136065dcb84dbc.exe"C:\Users\Admin\AppData\Local\Temp\25f8b6a718607062deb028978519b11d4c8cda8df6a355092e136065dcb84dbc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\vjpdv.exec:\vjpdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\btthbt.exec:\btthbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\jvjdp.exec:\jvjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\nnbttt.exec:\nnbttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\dvjdj.exec:\dvjdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\ppvpj.exec:\ppvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\1ttnhh.exec:\1ttnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\ffrxlfl.exec:\ffrxlfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\tnnnhh.exec:\tnnnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\pvdvv.exec:\pvdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\hhbnnb.exec:\hhbnnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\vjdpj.exec:\vjdpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\nhnhbb.exec:\nhnhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\xlxfrfx.exec:\xlxfrfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\hnttnt.exec:\hnttnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\pjjdv.exec:\pjjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\rflflll.exec:\rflflll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\hhbbtt.exec:\hhbbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\7vddj.exec:\7vddj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\pdddv.exec:\pdddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\3hhhbh.exec:\3hhhbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\vpjjv.exec:\vpjjv.exe23⤵
- Executes dropped EXE
PID:1248 -
\??\c:\9vdvp.exec:\9vdvp.exe24⤵
- Executes dropped EXE
PID:680 -
\??\c:\jjjdv.exec:\jjjdv.exe25⤵
- Executes dropped EXE
PID:3112 -
\??\c:\dddvd.exec:\dddvd.exe26⤵
- Executes dropped EXE
PID:3828 -
\??\c:\hthbbb.exec:\hthbbb.exe27⤵
- Executes dropped EXE
PID:2808 -
\??\c:\lxlxxxx.exec:\lxlxxxx.exe28⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe29⤵
- Executes dropped EXE
PID:3148 -
\??\c:\xrrllrl.exec:\xrrllrl.exe30⤵
- Executes dropped EXE
PID:4344 -
\??\c:\dpjdd.exec:\dpjdd.exe31⤵
- Executes dropped EXE
PID:4744 -
\??\c:\rllrlrl.exec:\rllrlrl.exe32⤵
- Executes dropped EXE
PID:3468 -
\??\c:\ppppp.exec:\ppppp.exe33⤵
- Executes dropped EXE
PID:1436 -
\??\c:\lxlllll.exec:\lxlllll.exe34⤵
- Executes dropped EXE
PID:3988 -
\??\c:\nthbtt.exec:\nthbtt.exe35⤵
- Executes dropped EXE
PID:3472 -
\??\c:\fffffff.exec:\fffffff.exe36⤵
- Executes dropped EXE
PID:2084 -
\??\c:\xxfxxrr.exec:\xxfxxrr.exe37⤵
- Executes dropped EXE
PID:4544 -
\??\c:\bnnhhb.exec:\bnnhhb.exe38⤵
- Executes dropped EXE
PID:396 -
\??\c:\9ppjd.exec:\9ppjd.exe39⤵
- Executes dropped EXE
PID:2256 -
\??\c:\9lrlffx.exec:\9lrlffx.exe40⤵
- Executes dropped EXE
PID:2764 -
\??\c:\tnbhhh.exec:\tnbhhh.exe41⤵
- Executes dropped EXE
PID:808 -
\??\c:\jdddv.exec:\jdddv.exe42⤵
- Executes dropped EXE
PID:4988 -
\??\c:\xlrxrxr.exec:\xlrxrxr.exe43⤵
- Executes dropped EXE
PID:4316 -
\??\c:\1nnhbh.exec:\1nnhbh.exe44⤵
- Executes dropped EXE
PID:4208 -
\??\c:\lrrfxrr.exec:\lrrfxrr.exe45⤵
- Executes dropped EXE
PID:2584 -
\??\c:\9nbtbb.exec:\9nbtbb.exe46⤵
- Executes dropped EXE
PID:2152 -
\??\c:\vpjjv.exec:\vpjjv.exe47⤵
- Executes dropped EXE
PID:2596 -
\??\c:\xflllll.exec:\xflllll.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2192 -
\??\c:\7thbtt.exec:\7thbtt.exe49⤵
- Executes dropped EXE
PID:4704 -
\??\c:\7jjjd.exec:\7jjjd.exe50⤵
- Executes dropped EXE
PID:1760 -
\??\c:\1rxxflr.exec:\1rxxflr.exe51⤵
- Executes dropped EXE
PID:432 -
\??\c:\thnhhh.exec:\thnhhh.exe52⤵
- Executes dropped EXE
PID:4872 -
\??\c:\9dddv.exec:\9dddv.exe53⤵
- Executes dropped EXE
PID:636 -
\??\c:\jdvjd.exec:\jdvjd.exe54⤵
- Executes dropped EXE
PID:232 -
\??\c:\rflffxx.exec:\rflffxx.exe55⤵
- Executes dropped EXE
PID:2160 -
\??\c:\tthhtt.exec:\tthhtt.exe56⤵
- Executes dropped EXE
PID:1004 -
\??\c:\dvvvp.exec:\dvvvp.exe57⤵
- Executes dropped EXE
PID:5112 -
\??\c:\llfxxrr.exec:\llfxxrr.exe58⤵
- Executes dropped EXE
PID:2284 -
\??\c:\thtbtt.exec:\thtbtt.exe59⤵
- Executes dropped EXE
PID:4364 -
\??\c:\xxrllll.exec:\xxrllll.exe60⤵
- Executes dropped EXE
PID:4508 -
\??\c:\nhthnn.exec:\nhthnn.exe61⤵
- Executes dropped EXE
PID:1564 -
\??\c:\nnthbb.exec:\nnthbb.exe62⤵
- Executes dropped EXE
PID:4724 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe63⤵
- Executes dropped EXE
PID:4732 -
\??\c:\5xfxrrl.exec:\5xfxrrl.exe64⤵
- Executes dropped EXE
PID:3652 -
\??\c:\nhhhbh.exec:\nhhhbh.exe65⤵
- Executes dropped EXE
PID:968 -
\??\c:\pjvpv.exec:\pjvpv.exe66⤵PID:3688
-
\??\c:\xxlfrrf.exec:\xxlfrrf.exe67⤵PID:4408
-
\??\c:\hbhhtt.exec:\hbhhtt.exe68⤵PID:1960
-
\??\c:\jjjdd.exec:\jjjdd.exe69⤵PID:1476
-
\??\c:\lllrxff.exec:\lllrxff.exe70⤵PID:2408
-
\??\c:\pvjpv.exec:\pvjpv.exe71⤵PID:4492
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe72⤵PID:3876
-
\??\c:\lxfffff.exec:\lxfffff.exe73⤵PID:4740
-
\??\c:\bnhhhh.exec:\bnhhhh.exe74⤵PID:4224
-
\??\c:\dvppj.exec:\dvppj.exe75⤵PID:1912
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe76⤵PID:1568
-
\??\c:\1ntttt.exec:\1ntttt.exe77⤵PID:2872
-
\??\c:\jjvvd.exec:\jjvvd.exe78⤵PID:4832
-
\??\c:\xrfxfxf.exec:\xrfxfxf.exe79⤵PID:1484
-
\??\c:\rllrrrr.exec:\rllrrrr.exe80⤵PID:2056
-
\??\c:\3hbnnn.exec:\3hbnnn.exe81⤵PID:1016
-
\??\c:\5jjjd.exec:\5jjjd.exe82⤵PID:1544
-
\??\c:\rxlffff.exec:\rxlffff.exe83⤵PID:4468
-
\??\c:\ttntth.exec:\ttntth.exe84⤵PID:2608
-
\??\c:\jdjjd.exec:\jdjjd.exe85⤵PID:3584
-
\??\c:\1lrllff.exec:\1lrllff.exe86⤵PID:556
-
\??\c:\ffxxrrl.exec:\ffxxrrl.exe87⤵PID:2200
-
\??\c:\jjvdp.exec:\jjvdp.exe88⤵PID:3964
-
\??\c:\xrxxxll.exec:\xrxxxll.exe89⤵PID:4496
-
\??\c:\lxlffff.exec:\lxlffff.exe90⤵PID:2280
-
\??\c:\5tbttt.exec:\5tbttt.exe91⤵PID:1104
-
\??\c:\ddjjp.exec:\ddjjp.exe92⤵PID:1412
-
\??\c:\lllrllf.exec:\lllrllf.exe93⤵PID:3632
-
\??\c:\thnnth.exec:\thnnth.exe94⤵PID:4620
-
\??\c:\dvvjv.exec:\dvvjv.exe95⤵PID:2836
-
\??\c:\pjpdv.exec:\pjpdv.exe96⤵PID:1316
-
\??\c:\llrlfxx.exec:\llrlfxx.exe97⤵PID:1472
-
\??\c:\bttttt.exec:\bttttt.exe98⤵PID:4160
-
\??\c:\nttnbb.exec:\nttnbb.exe99⤵PID:3720
-
\??\c:\pdvvv.exec:\pdvvv.exe100⤵PID:1164
-
\??\c:\fxffrrr.exec:\fxffrrr.exe101⤵PID:2392
-
\??\c:\bbnntn.exec:\bbnntn.exe102⤵PID:1864
-
\??\c:\7djjd.exec:\7djjd.exe103⤵PID:1180
-
\??\c:\flffrrf.exec:\flffrrf.exe104⤵PID:4204
-
\??\c:\7hhhbh.exec:\7hhhbh.exe105⤵PID:3696
-
\??\c:\pppvd.exec:\pppvd.exe106⤵PID:4588
-
\??\c:\rlllfff.exec:\rlllfff.exe107⤵PID:4136
-
\??\c:\jdppp.exec:\jdppp.exe108⤵PID:2960
-
\??\c:\ffllffx.exec:\ffllffx.exe109⤵PID:4448
-
\??\c:\bbttbb.exec:\bbttbb.exe110⤵PID:5068
-
\??\c:\ntnnnh.exec:\ntnnnh.exe111⤵PID:1020
-
\??\c:\lffffff.exec:\lffffff.exe112⤵PID:4356
-
\??\c:\lllllrr.exec:\lllllrr.exe113⤵PID:1204
-
\??\c:\nhnhnn.exec:\nhnhnn.exe114⤵PID:924
-
\??\c:\vvvjj.exec:\vvvjj.exe115⤵PID:2212
-
\??\c:\rrxrxxf.exec:\rrxrxxf.exe116⤵PID:2108
-
\??\c:\rllfxxx.exec:\rllfxxx.exe117⤵PID:4788
-
\??\c:\thbttt.exec:\thbttt.exe118⤵PID:4480
-
\??\c:\pvdvv.exec:\pvdvv.exe119⤵
- System Location Discovery: System Language Discovery
PID:2504 -
\??\c:\lfflflx.exec:\lfflflx.exe120⤵PID:4900
-
\??\c:\tnbbtt.exec:\tnbbtt.exe121⤵PID:3412
-
\??\c:\jddvv.exec:\jddvv.exe122⤵PID:4276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-