Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 22:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a8658eba4a56c98472abd220c893a5d29728ee345c6e7cd9fa7cebd97a7deeceN.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
a8658eba4a56c98472abd220c893a5d29728ee345c6e7cd9fa7cebd97a7deeceN.exe
-
Size
453KB
-
MD5
03bfa4aeaa04d4af5a232ae8ad3a2e10
-
SHA1
c8d8c14f3ff3f974e4009fa097bd9f49ba9cba3a
-
SHA256
a8658eba4a56c98472abd220c893a5d29728ee345c6e7cd9fa7cebd97a7deece
-
SHA512
c8e38654edc59673ff3839c7e8f166fb976f12cad72e1818e007357fcb69281cee7b958b9b720bb80f8924511007206a55dc8daa77718644f2788787f1668799
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2312-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1784-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2804-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1408-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2072-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4140-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2812-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1140-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4248-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/664-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-943-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-1176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2932 frllxff.exe 2300 hbttnt.exe 3936 jdjpv.exe 664 vdvdv.exe 1528 xxllrxf.exe 3592 hhnnnt.exe 4248 nnhnth.exe 4876 djpvd.exe 4536 lflfllf.exe 2952 nbhtbh.exe 1924 bhtbhn.exe 1140 ppvvd.exe 1200 rxfflrx.exe 1900 xrrlxxx.exe 960 ntnthn.exe 3904 ppddd.exe 4316 vddjj.exe 3236 rlfxfrf.exe 2812 hhtbbh.exe 1592 vdddd.exe 4484 7lrrlrx.exe 1220 nbhhhb.exe 4764 hnhnnt.exe 1720 vjjvp.exe 4636 rrrllxr.exe 4140 tnhbtn.exe 2272 pjdjv.exe 1492 ddpjp.exe 4460 3ffxxrx.exe 4448 tbttth.exe 456 9vppv.exe 2072 9lffllx.exe 4712 bttttb.exe 2232 7nbhhh.exe 3308 pjpvv.exe 3572 frxfflr.exe 1784 llxxflr.exe 2372 tbnnhn.exe 808 pjvvv.exe 3684 rlfllxx.exe 3500 rxfxxfl.exe 4984 tbhbtb.exe 4548 jvddv.exe 1572 lxrllfl.exe 2668 1nbhht.exe 3832 jjpjp.exe 2992 xfxrfll.exe 3736 5rxxfrx.exe 232 btttbh.exe 2844 vjvvp.exe 5016 ffrlrrf.exe 4772 xrxxrrf.exe 1340 nhnnhh.exe 1480 vjppj.exe 1836 lxllrxf.exe 3636 llflxfr.exe 3576 3bhhnt.exe 4172 pvpvj.exe 2192 ffxxfrx.exe 3148 bbtbbn.exe 5108 hhnntt.exe 4972 jdpvv.exe 4488 lxlxrff.exe 2740 lxlrflx.exe -
resource yara_rule behavioral2/memory/2312-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2804-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1408-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2072-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4140-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1140-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/664-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1140-761-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrrxf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2932 2312 a8658eba4a56c98472abd220c893a5d29728ee345c6e7cd9fa7cebd97a7deeceN.exe 81 PID 2312 wrote to memory of 2932 2312 a8658eba4a56c98472abd220c893a5d29728ee345c6e7cd9fa7cebd97a7deeceN.exe 81 PID 2312 wrote to memory of 2932 2312 a8658eba4a56c98472abd220c893a5d29728ee345c6e7cd9fa7cebd97a7deeceN.exe 81 PID 2932 wrote to memory of 2300 2932 frllxff.exe 82 PID 2932 wrote to memory of 2300 2932 frllxff.exe 82 PID 2932 wrote to memory of 2300 2932 frllxff.exe 82 PID 2300 wrote to memory of 3936 2300 hbttnt.exe 83 PID 2300 wrote to memory of 3936 2300 hbttnt.exe 83 PID 2300 wrote to memory of 3936 2300 hbttnt.exe 83 PID 3936 wrote to memory of 664 3936 jdjpv.exe 84 PID 3936 wrote to memory of 664 3936 jdjpv.exe 84 PID 3936 wrote to memory of 664 3936 jdjpv.exe 84 PID 664 wrote to memory of 1528 664 vdvdv.exe 85 PID 664 wrote to memory of 1528 664 vdvdv.exe 85 PID 664 wrote to memory of 1528 664 vdvdv.exe 85 PID 1528 wrote to memory of 3592 1528 xxllrxf.exe 86 PID 1528 wrote to memory of 3592 1528 xxllrxf.exe 86 PID 1528 wrote to memory of 3592 1528 xxllrxf.exe 86 PID 3592 wrote to memory of 4248 3592 hhnnnt.exe 87 PID 3592 wrote to memory of 4248 3592 hhnnnt.exe 87 PID 3592 wrote to memory of 4248 3592 hhnnnt.exe 87 PID 4248 wrote to memory of 4876 4248 nnhnth.exe 88 PID 4248 wrote to memory of 4876 4248 nnhnth.exe 88 PID 4248 wrote to memory of 4876 4248 nnhnth.exe 88 PID 4876 wrote to memory of 4536 4876 djpvd.exe 89 PID 4876 wrote to memory of 4536 4876 djpvd.exe 89 PID 4876 wrote to memory of 4536 4876 djpvd.exe 89 PID 4536 wrote to memory of 2952 4536 lflfllf.exe 90 PID 4536 wrote to memory of 2952 4536 lflfllf.exe 90 PID 4536 wrote to memory of 2952 4536 lflfllf.exe 90 PID 2952 wrote to memory of 1924 2952 nbhtbh.exe 91 PID 2952 wrote to memory of 1924 2952 nbhtbh.exe 91 PID 2952 wrote to memory of 1924 2952 nbhtbh.exe 91 PID 1924 wrote to memory of 1140 1924 bhtbhn.exe 92 PID 1924 wrote to memory of 1140 1924 bhtbhn.exe 92 PID 1924 wrote to memory of 1140 1924 bhtbhn.exe 92 PID 1140 wrote to memory of 1200 1140 ppvvd.exe 93 PID 1140 wrote to memory of 1200 1140 ppvvd.exe 93 PID 1140 wrote to memory of 1200 1140 ppvvd.exe 93 PID 1200 wrote to memory of 1900 1200 rxfflrx.exe 158 PID 1200 wrote to memory of 1900 1200 rxfflrx.exe 158 PID 1200 wrote to memory of 1900 1200 rxfflrx.exe 158 PID 1900 wrote to memory of 960 1900 xrrlxxx.exe 95 PID 1900 wrote to memory of 960 1900 xrrlxxx.exe 95 PID 1900 wrote to memory of 960 1900 xrrlxxx.exe 95 PID 960 wrote to memory of 3904 960 ntnthn.exe 96 PID 960 wrote to memory of 3904 960 ntnthn.exe 96 PID 960 wrote to memory of 3904 960 ntnthn.exe 96 PID 3904 wrote to memory of 4316 3904 ppddd.exe 97 PID 3904 wrote to memory of 4316 3904 ppddd.exe 97 PID 3904 wrote to memory of 4316 3904 ppddd.exe 97 PID 4316 wrote to memory of 3236 4316 vddjj.exe 98 PID 4316 wrote to memory of 3236 4316 vddjj.exe 98 PID 4316 wrote to memory of 3236 4316 vddjj.exe 98 PID 3236 wrote to memory of 2812 3236 rlfxfrf.exe 162 PID 3236 wrote to memory of 2812 3236 rlfxfrf.exe 162 PID 3236 wrote to memory of 2812 3236 rlfxfrf.exe 162 PID 2812 wrote to memory of 1592 2812 hhtbbh.exe 100 PID 2812 wrote to memory of 1592 2812 hhtbbh.exe 100 PID 2812 wrote to memory of 1592 2812 hhtbbh.exe 100 PID 1592 wrote to memory of 4484 1592 vdddd.exe 101 PID 1592 wrote to memory of 4484 1592 vdddd.exe 101 PID 1592 wrote to memory of 4484 1592 vdddd.exe 101 PID 4484 wrote to memory of 1220 4484 7lrrlrx.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8658eba4a56c98472abd220c893a5d29728ee345c6e7cd9fa7cebd97a7deeceN.exe"C:\Users\Admin\AppData\Local\Temp\a8658eba4a56c98472abd220c893a5d29728ee345c6e7cd9fa7cebd97a7deeceN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\frllxff.exec:\frllxff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\hbttnt.exec:\hbttnt.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\jdjpv.exec:\jdjpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\vdvdv.exec:\vdvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\xxllrxf.exec:\xxllrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\hhnnnt.exec:\hhnnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\nnhnth.exec:\nnhnth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\djpvd.exec:\djpvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\lflfllf.exec:\lflfllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\nbhtbh.exec:\nbhtbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\bhtbhn.exec:\bhtbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\ppvvd.exec:\ppvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\rxfflrx.exec:\rxfflrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\xrrlxxx.exec:\xrrlxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\ntnthn.exec:\ntnthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\ppddd.exec:\ppddd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\vddjj.exec:\vddjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\rlfxfrf.exec:\rlfxfrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\hhtbbh.exec:\hhtbbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\vdddd.exec:\vdddd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\7lrrlrx.exec:\7lrrlrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\nbhhhb.exec:\nbhhhb.exe23⤵
- Executes dropped EXE
PID:1220 -
\??\c:\hnhnnt.exec:\hnhnnt.exe24⤵
- Executes dropped EXE
PID:4764 -
\??\c:\vjjvp.exec:\vjjvp.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1720 -
\??\c:\rrrllxr.exec:\rrrllxr.exe26⤵
- Executes dropped EXE
PID:4636 -
\??\c:\tnhbtn.exec:\tnhbtn.exe27⤵
- Executes dropped EXE
PID:4140 -
\??\c:\pjdjv.exec:\pjdjv.exe28⤵
- Executes dropped EXE
PID:2272 -
\??\c:\ddpjp.exec:\ddpjp.exe29⤵
- Executes dropped EXE
PID:1492 -
\??\c:\3ffxxrx.exec:\3ffxxrx.exe30⤵
- Executes dropped EXE
PID:4460 -
\??\c:\tbttth.exec:\tbttth.exe31⤵
- Executes dropped EXE
PID:4448 -
\??\c:\9vppv.exec:\9vppv.exe32⤵
- Executes dropped EXE
PID:456 -
\??\c:\9lffllx.exec:\9lffllx.exe33⤵
- Executes dropped EXE
PID:2072 -
\??\c:\bttttb.exec:\bttttb.exe34⤵
- Executes dropped EXE
PID:4712 -
\??\c:\7nbhhh.exec:\7nbhhh.exe35⤵
- Executes dropped EXE
PID:2232 -
\??\c:\pjpvv.exec:\pjpvv.exe36⤵
- Executes dropped EXE
PID:3308 -
\??\c:\frxfflr.exec:\frxfflr.exe37⤵
- Executes dropped EXE
PID:3572 -
\??\c:\llxxflr.exec:\llxxflr.exe38⤵
- Executes dropped EXE
PID:1784 -
\??\c:\tbnnhn.exec:\tbnnhn.exe39⤵
- Executes dropped EXE
PID:2372 -
\??\c:\pjvvv.exec:\pjvvv.exe40⤵
- Executes dropped EXE
PID:808 -
\??\c:\rlfllxx.exec:\rlfllxx.exe41⤵
- Executes dropped EXE
PID:3684 -
\??\c:\rxfxxfl.exec:\rxfxxfl.exe42⤵
- Executes dropped EXE
PID:3500 -
\??\c:\tbhbtb.exec:\tbhbtb.exe43⤵
- Executes dropped EXE
PID:4984 -
\??\c:\jvddv.exec:\jvddv.exe44⤵
- Executes dropped EXE
PID:4548 -
\??\c:\lxrllfl.exec:\lxrllfl.exe45⤵
- Executes dropped EXE
PID:1572 -
\??\c:\1nbhht.exec:\1nbhht.exe46⤵
- Executes dropped EXE
PID:2668 -
\??\c:\jjpjp.exec:\jjpjp.exe47⤵
- Executes dropped EXE
PID:3832 -
\??\c:\xfxrfll.exec:\xfxrfll.exe48⤵
- Executes dropped EXE
PID:2992 -
\??\c:\5rxxfrx.exec:\5rxxfrx.exe49⤵
- Executes dropped EXE
PID:3736 -
\??\c:\btttbh.exec:\btttbh.exe50⤵
- Executes dropped EXE
PID:232 -
\??\c:\vjvvp.exec:\vjvvp.exe51⤵
- Executes dropped EXE
PID:2844 -
\??\c:\ffrlrrf.exec:\ffrlrrf.exe52⤵
- Executes dropped EXE
PID:5016 -
\??\c:\xrxxrrf.exec:\xrxxrrf.exe53⤵
- Executes dropped EXE
PID:4772 -
\??\c:\nhnnhh.exec:\nhnnhh.exe54⤵
- Executes dropped EXE
PID:1340 -
\??\c:\vjppj.exec:\vjppj.exe55⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lxllrxf.exec:\lxllrxf.exe56⤵
- Executes dropped EXE
PID:1836 -
\??\c:\llflxfr.exec:\llflxfr.exe57⤵
- Executes dropped EXE
PID:3636 -
\??\c:\3bhhnt.exec:\3bhhnt.exe58⤵
- Executes dropped EXE
PID:3576 -
\??\c:\pvpvj.exec:\pvpvj.exe59⤵
- Executes dropped EXE
PID:4172 -
\??\c:\ffxxfrx.exec:\ffxxfrx.exe60⤵
- Executes dropped EXE
PID:2192 -
\??\c:\bbtbbn.exec:\bbtbbn.exe61⤵
- Executes dropped EXE
PID:3148 -
\??\c:\hhnntt.exec:\hhnntt.exe62⤵
- Executes dropped EXE
PID:5108 -
\??\c:\jdpvv.exec:\jdpvv.exe63⤵
- Executes dropped EXE
PID:4972 -
\??\c:\lxlxrff.exec:\lxlxrff.exe64⤵
- Executes dropped EXE
PID:4488 -
\??\c:\lxlrflx.exec:\lxlrflx.exe65⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nbnhnt.exec:\nbnhnt.exe66⤵PID:1408
-
\??\c:\dvjdj.exec:\dvjdj.exe67⤵PID:2440
-
\??\c:\9xlxrff.exec:\9xlxrff.exe68⤵PID:2872
-
\??\c:\5nbbnt.exec:\5nbbnt.exe69⤵PID:2132
-
\??\c:\5djpp.exec:\5djpp.exe70⤵PID:4676
-
\??\c:\djppp.exec:\djppp.exe71⤵PID:4744
-
\??\c:\3lrrxfl.exec:\3lrrxfl.exe72⤵PID:1528
-
\??\c:\bntnnt.exec:\bntnnt.exe73⤵PID:3380
-
\??\c:\5ddjj.exec:\5ddjj.exe74⤵PID:5056
-
\??\c:\3vjpv.exec:\3vjpv.exe75⤵PID:4132
-
\??\c:\rrxxxfr.exec:\rrxxxfr.exe76⤵PID:2804
-
\??\c:\bhbhtb.exec:\bhbhtb.exe77⤵PID:1072
-
\??\c:\djvdj.exec:\djvdj.exe78⤵PID:428
-
\??\c:\bhhhhn.exec:\bhhhhn.exe79⤵PID:1900
-
\??\c:\7pjjd.exec:\7pjjd.exe80⤵PID:1284
-
\??\c:\flfllrr.exec:\flfllrr.exe81⤵
- System Location Discovery: System Language Discovery
PID:2448 -
\??\c:\nbbhhn.exec:\nbbhhn.exe82⤵PID:4960
-
\??\c:\ppddd.exec:\ppddd.exe83⤵PID:2812
-
\??\c:\flxlrfl.exec:\flxlrfl.exe84⤵PID:8
-
\??\c:\bbhntb.exec:\bbhntb.exe85⤵PID:1540
-
\??\c:\ddpdj.exec:\ddpdj.exe86⤵PID:3096
-
\??\c:\lxxrfxx.exec:\lxxrfxx.exe87⤵PID:1740
-
\??\c:\nttnht.exec:\nttnht.exe88⤵PID:4044
-
\??\c:\9vjpp.exec:\9vjpp.exe89⤵PID:4968
-
\??\c:\3jpjd.exec:\3jpjd.exe90⤵PID:3136
-
\??\c:\rrflflr.exec:\rrflflr.exe91⤵PID:3896
-
\??\c:\tthhnn.exec:\tthhnn.exe92⤵PID:2816
-
\??\c:\vjppp.exec:\vjppp.exe93⤵PID:4424
-
\??\c:\jjppd.exec:\jjppd.exe94⤵PID:1548
-
\??\c:\lrfxxxx.exec:\lrfxxxx.exe95⤵PID:4100
-
\??\c:\nnhntn.exec:\nnhntn.exe96⤵PID:452
-
\??\c:\ppppp.exec:\ppppp.exe97⤵PID:2500
-
\??\c:\fxlllrr.exec:\fxlllrr.exe98⤵PID:2632
-
\??\c:\nhhntb.exec:\nhhntb.exe99⤵PID:3360
-
\??\c:\1vjjj.exec:\1vjjj.exe100⤵PID:1416
-
\??\c:\xxrxlxr.exec:\xxrxlxr.exe101⤵PID:3500
-
\??\c:\7hbbbh.exec:\7hbbbh.exe102⤵PID:5036
-
\??\c:\jjjvp.exec:\jjjvp.exe103⤵PID:2344
-
\??\c:\thbhbh.exec:\thbhbh.exe104⤵PID:2668
-
\??\c:\ppvvv.exec:\ppvvv.exe105⤵PID:224
-
\??\c:\5lrrlrx.exec:\5lrrlrx.exe106⤵PID:4036
-
\??\c:\tnbnhb.exec:\tnbnhb.exe107⤵PID:1808
-
\??\c:\rrrrxlr.exec:\rrrrxlr.exe108⤵PID:2040
-
\??\c:\bbnnth.exec:\bbnnth.exe109⤵PID:4328
-
\??\c:\xfxxrxl.exec:\xfxxrxl.exe110⤵PID:1392
-
\??\c:\jdddv.exec:\jdddv.exe111⤵PID:4772
-
\??\c:\ffrrxfl.exec:\ffrrxfl.exe112⤵PID:1084
-
\??\c:\nnbbhn.exec:\nnbbhn.exe113⤵PID:1340
-
\??\c:\1xfflrx.exec:\1xfflrx.exe114⤵PID:1836
-
\??\c:\jpppp.exec:\jpppp.exe115⤵PID:1860
-
\??\c:\llfffff.exec:\llfffff.exe116⤵PID:4084
-
\??\c:\rfxffrx.exec:\rfxffrx.exe117⤵PID:3576
-
\??\c:\5htbhh.exec:\5htbhh.exe118⤵PID:4320
-
\??\c:\dpjjj.exec:\dpjjj.exe119⤵PID:4060
-
\??\c:\rxflrxf.exec:\rxflrxf.exe120⤵PID:3148
-
\??\c:\thnttb.exec:\thnttb.exe121⤵PID:4816
-
\??\c:\rfrlllf.exec:\rfrlllf.exe122⤵PID:4564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-