Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 23:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b010cf987b58c4443e3016bc8fb17f4bfdca8822d4e89b2fbab7a782bd82e5deN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b010cf987b58c4443e3016bc8fb17f4bfdca8822d4e89b2fbab7a782bd82e5deN.exe
-
Size
453KB
-
MD5
5ca8ae7dc84e9b099872a3a294845a00
-
SHA1
7fa0d97fe84b66897f0ebe34d0a13d704818f8c8
-
SHA256
b010cf987b58c4443e3016bc8fb17f4bfdca8822d4e89b2fbab7a782bd82e5de
-
SHA512
03e5d828918b458528b08a8c04130a3eb303d142389ba3c570f942c8b6f9962fd89b07bbf41d4abd4cfa3b522c7c1c2fada092604af4abebefd770b3bd60750c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbef:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4456-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/848-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1756-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/908-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-768-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-817-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-1025-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-1083-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2892 028820.exe 848 btbtnb.exe 4112 660426.exe 3920 3lfrlrl.exe 3360 06682.exe 4016 lxxxxff.exe 2860 240600.exe 2316 rllffff.exe 872 22608.exe 2876 thnbhh.exe 4696 00224.exe 4572 hbttbb.exe 3036 rlxrrrr.exe 3624 28666.exe 4932 60088.exe 4168 rrrlrrx.exe 3648 dddpp.exe 1060 668804.exe 4876 8620042.exe 1612 vpddv.exe 1352 4866684.exe 3760 0664864.exe 1068 xfllrxx.exe 1860 480440.exe 1788 2280022.exe 4316 vdjjj.exe 3012 hhnttb.exe 1892 xfllxxx.exe 620 886684.exe 4000 dppvj.exe 1532 44066.exe 5092 8088840.exe 4844 086600.exe 3688 rrffrfx.exe 3444 jdjdd.exe 2336 xrxrrrx.exe 5080 6048086.exe 4532 fflxfxf.exe 4236 rlfxrxr.exe 3492 480464.exe 3744 862426.exe 2760 c444488.exe 3152 xrrrrrr.exe 536 6444426.exe 4384 rlllxrf.exe 3932 pdjjp.exe 2168 bhttbb.exe 2892 tbhnnt.exe 4900 w04884.exe 2404 62666.exe 2200 xxfrxrx.exe 4264 pjpvv.exe 3300 dpppd.exe 3000 vpddd.exe 2176 28062.exe 2860 dvjdd.exe 4812 nhtthh.exe 1196 606882.exe 4924 bthttn.exe 3884 240660.exe 2468 022082.exe 2876 nbnnnh.exe 3712 9jppv.exe 4816 02884.exe -
resource yara_rule behavioral2/memory/4456-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/848-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3300-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/908-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-768-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-817-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-878-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 266482.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0820482.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4644406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 006640.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46888.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02264.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6244066.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42204.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u064844.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8288264.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 888648.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02644.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6444426.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g4228.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0880204.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4064826.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24420.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrlrxf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4456 wrote to memory of 2892 4456 b010cf987b58c4443e3016bc8fb17f4bfdca8822d4e89b2fbab7a782bd82e5deN.exe 83 PID 4456 wrote to memory of 2892 4456 b010cf987b58c4443e3016bc8fb17f4bfdca8822d4e89b2fbab7a782bd82e5deN.exe 83 PID 4456 wrote to memory of 2892 4456 b010cf987b58c4443e3016bc8fb17f4bfdca8822d4e89b2fbab7a782bd82e5deN.exe 83 PID 2892 wrote to memory of 848 2892 028820.exe 84 PID 2892 wrote to memory of 848 2892 028820.exe 84 PID 2892 wrote to memory of 848 2892 028820.exe 84 PID 848 wrote to memory of 4112 848 btbtnb.exe 85 PID 848 wrote to memory of 4112 848 btbtnb.exe 85 PID 848 wrote to memory of 4112 848 btbtnb.exe 85 PID 4112 wrote to memory of 3920 4112 660426.exe 86 PID 4112 wrote to memory of 3920 4112 660426.exe 86 PID 4112 wrote to memory of 3920 4112 660426.exe 86 PID 3920 wrote to memory of 3360 3920 3lfrlrl.exe 87 PID 3920 wrote to memory of 3360 3920 3lfrlrl.exe 87 PID 3920 wrote to memory of 3360 3920 3lfrlrl.exe 87 PID 3360 wrote to memory of 4016 3360 06682.exe 88 PID 3360 wrote to memory of 4016 3360 06682.exe 88 PID 3360 wrote to memory of 4016 3360 06682.exe 88 PID 4016 wrote to memory of 2860 4016 lxxxxff.exe 89 PID 4016 wrote to memory of 2860 4016 lxxxxff.exe 89 PID 4016 wrote to memory of 2860 4016 lxxxxff.exe 89 PID 2860 wrote to memory of 2316 2860 240600.exe 90 PID 2860 wrote to memory of 2316 2860 240600.exe 90 PID 2860 wrote to memory of 2316 2860 240600.exe 90 PID 2316 wrote to memory of 872 2316 rllffff.exe 91 PID 2316 wrote to memory of 872 2316 rllffff.exe 91 PID 2316 wrote to memory of 872 2316 rllffff.exe 91 PID 872 wrote to memory of 2876 872 22608.exe 92 PID 872 wrote to memory of 2876 872 22608.exe 92 PID 872 wrote to memory of 2876 872 22608.exe 92 PID 2876 wrote to memory of 4696 2876 thnbhh.exe 93 PID 2876 wrote to memory of 4696 2876 thnbhh.exe 93 PID 2876 wrote to memory of 4696 2876 thnbhh.exe 93 PID 4696 wrote to memory of 4572 4696 00224.exe 94 PID 4696 wrote to memory of 4572 4696 00224.exe 94 PID 4696 wrote to memory of 4572 4696 00224.exe 94 PID 4572 wrote to memory of 3036 4572 hbttbb.exe 95 PID 4572 wrote to memory of 3036 4572 hbttbb.exe 95 PID 4572 wrote to memory of 3036 4572 hbttbb.exe 95 PID 3036 wrote to memory of 3624 3036 rlxrrrr.exe 96 PID 3036 wrote to memory of 3624 3036 rlxrrrr.exe 96 PID 3036 wrote to memory of 3624 3036 rlxrrrr.exe 96 PID 3624 wrote to memory of 4932 3624 28666.exe 97 PID 3624 wrote to memory of 4932 3624 28666.exe 97 PID 3624 wrote to memory of 4932 3624 28666.exe 97 PID 4932 wrote to memory of 4168 4932 60088.exe 98 PID 4932 wrote to memory of 4168 4932 60088.exe 98 PID 4932 wrote to memory of 4168 4932 60088.exe 98 PID 4168 wrote to memory of 3648 4168 rrrlrrx.exe 99 PID 4168 wrote to memory of 3648 4168 rrrlrrx.exe 99 PID 4168 wrote to memory of 3648 4168 rrrlrrx.exe 99 PID 3648 wrote to memory of 1060 3648 dddpp.exe 100 PID 3648 wrote to memory of 1060 3648 dddpp.exe 100 PID 3648 wrote to memory of 1060 3648 dddpp.exe 100 PID 1060 wrote to memory of 4876 1060 668804.exe 101 PID 1060 wrote to memory of 4876 1060 668804.exe 101 PID 1060 wrote to memory of 4876 1060 668804.exe 101 PID 4876 wrote to memory of 1612 4876 8620042.exe 102 PID 4876 wrote to memory of 1612 4876 8620042.exe 102 PID 4876 wrote to memory of 1612 4876 8620042.exe 102 PID 1612 wrote to memory of 1352 1612 vpddv.exe 103 PID 1612 wrote to memory of 1352 1612 vpddv.exe 103 PID 1612 wrote to memory of 1352 1612 vpddv.exe 103 PID 1352 wrote to memory of 3760 1352 4866684.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b010cf987b58c4443e3016bc8fb17f4bfdca8822d4e89b2fbab7a782bd82e5deN.exe"C:\Users\Admin\AppData\Local\Temp\b010cf987b58c4443e3016bc8fb17f4bfdca8822d4e89b2fbab7a782bd82e5deN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\028820.exec:\028820.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\btbtnb.exec:\btbtnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\660426.exec:\660426.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\3lfrlrl.exec:\3lfrlrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\06682.exec:\06682.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\lxxxxff.exec:\lxxxxff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\240600.exec:\240600.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\rllffff.exec:\rllffff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\22608.exec:\22608.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\thnbhh.exec:\thnbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\00224.exec:\00224.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\hbttbb.exec:\hbttbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\rlxrrrr.exec:\rlxrrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\28666.exec:\28666.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\60088.exec:\60088.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\rrrlrrx.exec:\rrrlrrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\dddpp.exec:\dddpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\668804.exec:\668804.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\8620042.exec:\8620042.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\vpddv.exec:\vpddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\4866684.exec:\4866684.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\0664864.exec:\0664864.exe23⤵
- Executes dropped EXE
PID:3760 -
\??\c:\xfllrxx.exec:\xfllrxx.exe24⤵
- Executes dropped EXE
PID:1068 -
\??\c:\480440.exec:\480440.exe25⤵
- Executes dropped EXE
PID:1860 -
\??\c:\2280022.exec:\2280022.exe26⤵
- Executes dropped EXE
PID:1788 -
\??\c:\vdjjj.exec:\vdjjj.exe27⤵
- Executes dropped EXE
PID:4316 -
\??\c:\hhnttb.exec:\hhnttb.exe28⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xfllxxx.exec:\xfllxxx.exe29⤵
- Executes dropped EXE
PID:1892 -
\??\c:\886684.exec:\886684.exe30⤵
- Executes dropped EXE
PID:620 -
\??\c:\dppvj.exec:\dppvj.exe31⤵
- Executes dropped EXE
PID:4000 -
\??\c:\44066.exec:\44066.exe32⤵
- Executes dropped EXE
PID:1532 -
\??\c:\8088840.exec:\8088840.exe33⤵
- Executes dropped EXE
PID:5092 -
\??\c:\086600.exec:\086600.exe34⤵
- Executes dropped EXE
PID:4844 -
\??\c:\rrffrfx.exec:\rrffrfx.exe35⤵
- Executes dropped EXE
PID:3688 -
\??\c:\jdjdd.exec:\jdjdd.exe36⤵
- Executes dropped EXE
PID:3444 -
\??\c:\xrxrrrx.exec:\xrxrrrx.exe37⤵
- Executes dropped EXE
PID:2336 -
\??\c:\6048086.exec:\6048086.exe38⤵
- Executes dropped EXE
PID:5080 -
\??\c:\fflxfxf.exec:\fflxfxf.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4532 -
\??\c:\rlfxrxr.exec:\rlfxrxr.exe40⤵
- Executes dropped EXE
PID:4236 -
\??\c:\480464.exec:\480464.exe41⤵
- Executes dropped EXE
PID:3492 -
\??\c:\862426.exec:\862426.exe42⤵
- Executes dropped EXE
PID:3744 -
\??\c:\c444488.exec:\c444488.exe43⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe44⤵
- Executes dropped EXE
PID:3152 -
\??\c:\6444426.exec:\6444426.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:536 -
\??\c:\rlllxrf.exec:\rlllxrf.exe46⤵
- Executes dropped EXE
PID:4384 -
\??\c:\pdjjp.exec:\pdjjp.exe47⤵
- Executes dropped EXE
PID:3932 -
\??\c:\bhttbb.exec:\bhttbb.exe48⤵
- Executes dropped EXE
PID:2168 -
\??\c:\tbhnnt.exec:\tbhnnt.exe49⤵
- Executes dropped EXE
PID:2892 -
\??\c:\w04884.exec:\w04884.exe50⤵
- Executes dropped EXE
PID:4900 -
\??\c:\62666.exec:\62666.exe51⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xxfrxrx.exec:\xxfrxrx.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2200 -
\??\c:\pjpvv.exec:\pjpvv.exe53⤵
- Executes dropped EXE
PID:4264 -
\??\c:\dpppd.exec:\dpppd.exe54⤵
- Executes dropped EXE
PID:3300 -
\??\c:\vpddd.exec:\vpddd.exe55⤵
- Executes dropped EXE
PID:3000 -
\??\c:\28062.exec:\28062.exe56⤵
- Executes dropped EXE
PID:2176 -
\??\c:\dvjdd.exec:\dvjdd.exe57⤵
- Executes dropped EXE
PID:2860 -
\??\c:\nhtthh.exec:\nhtthh.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4812 -
\??\c:\606882.exec:\606882.exe59⤵
- Executes dropped EXE
PID:1196 -
\??\c:\bthttn.exec:\bthttn.exe60⤵
- Executes dropped EXE
PID:4924 -
\??\c:\240660.exec:\240660.exe61⤵
- Executes dropped EXE
PID:3884 -
\??\c:\022082.exec:\022082.exe62⤵
- Executes dropped EXE
PID:2468 -
\??\c:\nbnnnh.exec:\nbnnnh.exe63⤵
- Executes dropped EXE
PID:2876 -
\??\c:\9jppv.exec:\9jppv.exe64⤵
- Executes dropped EXE
PID:3712 -
\??\c:\02884.exec:\02884.exe65⤵
- Executes dropped EXE
PID:4816 -
\??\c:\pvvm2.exec:\pvvm2.exe66⤵PID:1420
-
\??\c:\02644.exec:\02644.exe67⤵
- System Location Discovery: System Language Discovery
PID:60 -
\??\c:\44688.exec:\44688.exe68⤵PID:2224
-
\??\c:\tnhhhn.exec:\tnhhhn.exe69⤵PID:1576
-
\??\c:\0204444.exec:\0204444.exe70⤵PID:5040
-
\??\c:\80622.exec:\80622.exe71⤵PID:4544
-
\??\c:\662288.exec:\662288.exe72⤵PID:3648
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe73⤵PID:4260
-
\??\c:\4406268.exec:\4406268.exe74⤵PID:4304
-
\??\c:\00800.exec:\00800.exe75⤵PID:2648
-
\??\c:\486648.exec:\486648.exe76⤵PID:4348
-
\??\c:\pjvvd.exec:\pjvvd.exe77⤵PID:2368
-
\??\c:\xfllrrx.exec:\xfllrrx.exe78⤵PID:3760
-
\??\c:\08000.exec:\08000.exe79⤵PID:224
-
\??\c:\frrfxxl.exec:\frrfxxl.exe80⤵PID:3552
-
\??\c:\206684.exec:\206684.exe81⤵PID:3412
-
\??\c:\24642.exec:\24642.exe82⤵PID:456
-
\??\c:\0220264.exec:\0220264.exe83⤵PID:1756
-
\??\c:\260864.exec:\260864.exe84⤵PID:2552
-
\??\c:\802884.exec:\802884.exe85⤵PID:1580
-
\??\c:\6066666.exec:\6066666.exe86⤵PID:1916
-
\??\c:\pjjdd.exec:\pjjdd.exe87⤵PID:3596
-
\??\c:\02608.exec:\02608.exe88⤵PID:2052
-
\??\c:\826082.exec:\826082.exe89⤵PID:4292
-
\??\c:\tbthnb.exec:\tbthnb.exe90⤵PID:2232
-
\??\c:\80222.exec:\80222.exe91⤵PID:3976
-
\??\c:\ffllfff.exec:\ffllfff.exe92⤵PID:1880
-
\??\c:\djppd.exec:\djppd.exe93⤵PID:908
-
\??\c:\bnnhbb.exec:\bnnhbb.exe94⤵PID:4704
-
\??\c:\66202.exec:\66202.exe95⤵PID:1772
-
\??\c:\pdvvp.exec:\pdvvp.exe96⤵PID:5064
-
\??\c:\nthbnn.exec:\nthbnn.exe97⤵PID:2464
-
\??\c:\llxrllx.exec:\llxrllx.exe98⤵PID:4356
-
\??\c:\jjjjj.exec:\jjjjj.exe99⤵PID:4832
-
\??\c:\thhbhh.exec:\thhbhh.exe100⤵PID:632
-
\??\c:\thbbnt.exec:\thbbnt.exe101⤵PID:4504
-
\??\c:\0880204.exec:\0880204.exe102⤵
- System Location Discovery: System Language Discovery
PID:1160 -
\??\c:\604446.exec:\604446.exe103⤵PID:2252
-
\??\c:\pdpjp.exec:\pdpjp.exe104⤵PID:4368
-
\??\c:\q86464.exec:\q86464.exe105⤵PID:2444
-
\??\c:\lxfrffl.exec:\lxfrffl.exe106⤵PID:1204
-
\??\c:\600422.exec:\600422.exe107⤵PID:2820
-
\??\c:\3nnthn.exec:\3nnthn.exe108⤵PID:4872
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe109⤵PID:4180
-
\??\c:\1bnnhh.exec:\1bnnhh.exe110⤵PID:2376
-
\??\c:\5bbnbn.exec:\5bbnbn.exe111⤵PID:4112
-
\??\c:\xrrllll.exec:\xrrllll.exe112⤵PID:2716
-
\??\c:\ppppd.exec:\ppppd.exe113⤵PID:2572
-
\??\c:\jpvvp.exec:\jpvvp.exe114⤵
- System Location Discovery: System Language Discovery
PID:2520 -
\??\c:\46822.exec:\46822.exe115⤵PID:2176
-
\??\c:\hntttb.exec:\hntttb.exe116⤵PID:3940
-
\??\c:\244820.exec:\244820.exe117⤵PID:112
-
\??\c:\xfffrxl.exec:\xfffrxl.exe118⤵PID:2932
-
\??\c:\vdddd.exec:\vdddd.exe119⤵PID:852
-
\??\c:\vpddj.exec:\vpddj.exe120⤵PID:464
-
\??\c:\3bnhhn.exec:\3bnhhn.exe121⤵PID:2456
-
\??\c:\0204066.exec:\0204066.exe122⤵PID:1868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-