Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 01:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe
-
Size
455KB
-
MD5
cea7f83c18ba553af131d7f9b25942b7
-
SHA1
8941504acd8cdc4f72a0cec54dc80cfdc160a1af
-
SHA256
a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822
-
SHA512
6a51961d20dba6eaabd9b43ea6b0592bb225b22d4a5d4df8b200ac09aafa0d4a59f2c363450e3cd361ceb4bc3ad67a2b45a52356c1f11f74dbbf49d7843feb89
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2260-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/612-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/884-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1236-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4116-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-656-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-720-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/708-1133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-1158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-1228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2340 nnhbtt.exe 628 rlrrlll.exe 964 jdvvp.exe 2336 nbttnh.exe 612 bthntn.exe 3964 rrxfllf.exe 1692 1jdvp.exe 1992 lxlxllr.exe 4192 rflfllr.exe 4100 xlfflfr.exe 2384 dvdvj.exe 2192 fflfrff.exe 2676 jvdvj.exe 3896 9lllxff.exe 976 rlxxflr.exe 1288 vvppj.exe 4688 1rllffx.exe 4732 bnnnnb.exe 1380 pjpvp.exe 4448 nnhhhh.exe 2000 lffxxrr.exe 948 7vpjd.exe 2104 ppjdj.exe 4644 ttttnn.exe 3920 9vdvv.exe 4912 lxffxfx.exe 1564 vjjdv.exe 1568 1thhbb.exe 4892 djddv.exe 2876 llllfff.exe 4440 hbbtnh.exe 3164 vvpdj.exe 1928 xllfffx.exe 3500 bnbttn.exe 1832 pjjdv.exe 884 ddjdp.exe 2516 1rlllll.exe 432 pjpvv.exe 1768 5vppj.exe 3140 xrfxxxf.exe 4268 hbnhnn.exe 2632 vdjdv.exe 1236 1lfxxxr.exe 1124 1frlxxr.exe 1800 btttbt.exe 452 llxrffl.exe 4840 tnbthh.exe 4948 bthhtb.exe 3336 jjdvp.exe 1240 fxfxfxf.exe 3952 9bhbbb.exe 2248 7nnhbb.exe 4608 7dpjd.exe 2328 rflxxxf.exe 708 5bttnn.exe 3392 3bhbhh.exe 3324 1pvpp.exe 3172 7fxrffx.exe 2952 3xrlfxx.exe 3440 thnnhh.exe 2596 dvpjd.exe 2336 lxfxrrr.exe 4212 3bttnh.exe 2292 dvppj.exe -
resource yara_rule behavioral2/memory/2260-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/612-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1568-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/884-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1236-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4116-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/708-1133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-1158-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxlfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3httnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2340 2260 a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe 82 PID 2260 wrote to memory of 2340 2260 a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe 82 PID 2260 wrote to memory of 2340 2260 a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe 82 PID 2340 wrote to memory of 628 2340 nnhbtt.exe 83 PID 2340 wrote to memory of 628 2340 nnhbtt.exe 83 PID 2340 wrote to memory of 628 2340 nnhbtt.exe 83 PID 628 wrote to memory of 964 628 rlrrlll.exe 84 PID 628 wrote to memory of 964 628 rlrrlll.exe 84 PID 628 wrote to memory of 964 628 rlrrlll.exe 84 PID 964 wrote to memory of 2336 964 jdvvp.exe 85 PID 964 wrote to memory of 2336 964 jdvvp.exe 85 PID 964 wrote to memory of 2336 964 jdvvp.exe 85 PID 2336 wrote to memory of 612 2336 nbttnh.exe 86 PID 2336 wrote to memory of 612 2336 nbttnh.exe 86 PID 2336 wrote to memory of 612 2336 nbttnh.exe 86 PID 612 wrote to memory of 3964 612 bthntn.exe 87 PID 612 wrote to memory of 3964 612 bthntn.exe 87 PID 612 wrote to memory of 3964 612 bthntn.exe 87 PID 3964 wrote to memory of 1692 3964 rrxfllf.exe 88 PID 3964 wrote to memory of 1692 3964 rrxfllf.exe 88 PID 3964 wrote to memory of 1692 3964 rrxfllf.exe 88 PID 1692 wrote to memory of 1992 1692 1jdvp.exe 89 PID 1692 wrote to memory of 1992 1692 1jdvp.exe 89 PID 1692 wrote to memory of 1992 1692 1jdvp.exe 89 PID 1992 wrote to memory of 4192 1992 lxlxllr.exe 90 PID 1992 wrote to memory of 4192 1992 lxlxllr.exe 90 PID 1992 wrote to memory of 4192 1992 lxlxllr.exe 90 PID 4192 wrote to memory of 4100 4192 rflfllr.exe 91 PID 4192 wrote to memory of 4100 4192 rflfllr.exe 91 PID 4192 wrote to memory of 4100 4192 rflfllr.exe 91 PID 4100 wrote to memory of 2384 4100 xlfflfr.exe 92 PID 4100 wrote to memory of 2384 4100 xlfflfr.exe 92 PID 4100 wrote to memory of 2384 4100 xlfflfr.exe 92 PID 2384 wrote to memory of 2192 2384 dvdvj.exe 93 PID 2384 wrote to memory of 2192 2384 dvdvj.exe 93 PID 2384 wrote to memory of 2192 2384 dvdvj.exe 93 PID 2192 wrote to memory of 2676 2192 fflfrff.exe 94 PID 2192 wrote to memory of 2676 2192 fflfrff.exe 94 PID 2192 wrote to memory of 2676 2192 fflfrff.exe 94 PID 2676 wrote to memory of 3896 2676 jvdvj.exe 95 PID 2676 wrote to memory of 3896 2676 jvdvj.exe 95 PID 2676 wrote to memory of 3896 2676 jvdvj.exe 95 PID 3896 wrote to memory of 976 3896 9lllxff.exe 96 PID 3896 wrote to memory of 976 3896 9lllxff.exe 96 PID 3896 wrote to memory of 976 3896 9lllxff.exe 96 PID 976 wrote to memory of 1288 976 rlxxflr.exe 97 PID 976 wrote to memory of 1288 976 rlxxflr.exe 97 PID 976 wrote to memory of 1288 976 rlxxflr.exe 97 PID 1288 wrote to memory of 4688 1288 vvppj.exe 98 PID 1288 wrote to memory of 4688 1288 vvppj.exe 98 PID 1288 wrote to memory of 4688 1288 vvppj.exe 98 PID 4688 wrote to memory of 4732 4688 1rllffx.exe 99 PID 4688 wrote to memory of 4732 4688 1rllffx.exe 99 PID 4688 wrote to memory of 4732 4688 1rllffx.exe 99 PID 4732 wrote to memory of 1380 4732 bnnnnb.exe 100 PID 4732 wrote to memory of 1380 4732 bnnnnb.exe 100 PID 4732 wrote to memory of 1380 4732 bnnnnb.exe 100 PID 1380 wrote to memory of 4448 1380 pjpvp.exe 101 PID 1380 wrote to memory of 4448 1380 pjpvp.exe 101 PID 1380 wrote to memory of 4448 1380 pjpvp.exe 101 PID 4448 wrote to memory of 2000 4448 nnhhhh.exe 102 PID 4448 wrote to memory of 2000 4448 nnhhhh.exe 102 PID 4448 wrote to memory of 2000 4448 nnhhhh.exe 102 PID 2000 wrote to memory of 948 2000 lffxxrr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe"C:\Users\Admin\AppData\Local\Temp\a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\nnhbtt.exec:\nnhbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\rlrrlll.exec:\rlrrlll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\jdvvp.exec:\jdvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\nbttnh.exec:\nbttnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\bthntn.exec:\bthntn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\rrxfllf.exec:\rrxfllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\1jdvp.exec:\1jdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\lxlxllr.exec:\lxlxllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\rflfllr.exec:\rflfllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\xlfflfr.exec:\xlfflfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\dvdvj.exec:\dvdvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\fflfrff.exec:\fflfrff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\jvdvj.exec:\jvdvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\9lllxff.exec:\9lllxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\rlxxflr.exec:\rlxxflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\vvppj.exec:\vvppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\1rllffx.exec:\1rllffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\bnnnnb.exec:\bnnnnb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\pjpvp.exec:\pjpvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\nnhhhh.exec:\nnhhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\lffxxrr.exec:\lffxxrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\7vpjd.exec:\7vpjd.exe23⤵
- Executes dropped EXE
PID:948 -
\??\c:\ppjdj.exec:\ppjdj.exe24⤵
- Executes dropped EXE
PID:2104 -
\??\c:\ttttnn.exec:\ttttnn.exe25⤵
- Executes dropped EXE
PID:4644 -
\??\c:\9vdvv.exec:\9vdvv.exe26⤵
- Executes dropped EXE
PID:3920 -
\??\c:\lxffxfx.exec:\lxffxfx.exe27⤵
- Executes dropped EXE
PID:4912 -
\??\c:\vjjdv.exec:\vjjdv.exe28⤵
- Executes dropped EXE
PID:1564 -
\??\c:\1thhbb.exec:\1thhbb.exe29⤵
- Executes dropped EXE
PID:1568 -
\??\c:\djddv.exec:\djddv.exe30⤵
- Executes dropped EXE
PID:4892 -
\??\c:\llllfff.exec:\llllfff.exe31⤵
- Executes dropped EXE
PID:2876 -
\??\c:\hbbtnh.exec:\hbbtnh.exe32⤵
- Executes dropped EXE
PID:4440 -
\??\c:\vvpdj.exec:\vvpdj.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3164 -
\??\c:\xllfffx.exec:\xllfffx.exe34⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bnbttn.exec:\bnbttn.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3500 -
\??\c:\pjjdv.exec:\pjjdv.exe36⤵
- Executes dropped EXE
PID:1832 -
\??\c:\ddjdp.exec:\ddjdp.exe37⤵
- Executes dropped EXE
PID:884 -
\??\c:\1rlllll.exec:\1rlllll.exe38⤵
- Executes dropped EXE
PID:2516 -
\??\c:\pjpvv.exec:\pjpvv.exe39⤵
- Executes dropped EXE
PID:432 -
\??\c:\5vppj.exec:\5vppj.exe40⤵
- Executes dropped EXE
PID:1768 -
\??\c:\xrfxxxf.exec:\xrfxxxf.exe41⤵
- Executes dropped EXE
PID:3140 -
\??\c:\hbnhnn.exec:\hbnhnn.exe42⤵
- Executes dropped EXE
PID:4268 -
\??\c:\vdjdv.exec:\vdjdv.exe43⤵
- Executes dropped EXE
PID:2632 -
\??\c:\1lfxxxr.exec:\1lfxxxr.exe44⤵
- Executes dropped EXE
PID:1236 -
\??\c:\1frlxxr.exec:\1frlxxr.exe45⤵
- Executes dropped EXE
PID:1124 -
\??\c:\btttbt.exec:\btttbt.exe46⤵
- Executes dropped EXE
PID:1800 -
\??\c:\llxrffl.exec:\llxrffl.exe47⤵
- Executes dropped EXE
PID:452 -
\??\c:\tnbthh.exec:\tnbthh.exe48⤵
- Executes dropped EXE
PID:4840 -
\??\c:\bthhtb.exec:\bthhtb.exe49⤵
- Executes dropped EXE
PID:4948 -
\??\c:\jjdvp.exec:\jjdvp.exe50⤵
- Executes dropped EXE
PID:3336 -
\??\c:\fxfxfxf.exec:\fxfxfxf.exe51⤵
- Executes dropped EXE
PID:1240 -
\??\c:\9bhbbb.exec:\9bhbbb.exe52⤵
- Executes dropped EXE
PID:3952 -
\??\c:\7nnhbb.exec:\7nnhbb.exe53⤵
- Executes dropped EXE
PID:2248 -
\??\c:\7dpjd.exec:\7dpjd.exe54⤵
- Executes dropped EXE
PID:4608 -
\??\c:\rflxxxf.exec:\rflxxxf.exe55⤵
- Executes dropped EXE
PID:2328 -
\??\c:\5bttnn.exec:\5bttnn.exe56⤵
- Executes dropped EXE
PID:708 -
\??\c:\3bhbhh.exec:\3bhbhh.exe57⤵
- Executes dropped EXE
PID:3392 -
\??\c:\1pvpp.exec:\1pvpp.exe58⤵
- Executes dropped EXE
PID:3324 -
\??\c:\7fxrffx.exec:\7fxrffx.exe59⤵
- Executes dropped EXE
PID:3172 -
\??\c:\3xrlfxx.exec:\3xrlfxx.exe60⤵
- Executes dropped EXE
PID:2952 -
\??\c:\thnnhh.exec:\thnnhh.exe61⤵
- Executes dropped EXE
PID:3440 -
\??\c:\dvpjd.exec:\dvpjd.exe62⤵
- Executes dropped EXE
PID:2596 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe63⤵
- Executes dropped EXE
PID:2336 -
\??\c:\3bttnh.exec:\3bttnh.exe64⤵
- Executes dropped EXE
PID:4212 -
\??\c:\dvppj.exec:\dvppj.exe65⤵
- Executes dropped EXE
PID:2292 -
\??\c:\vdvpj.exec:\vdvpj.exe66⤵PID:4068
-
\??\c:\9xfxrlr.exec:\9xfxrlr.exe67⤵PID:2972
-
\??\c:\hbhhbb.exec:\hbhhbb.exe68⤵PID:1112
-
\??\c:\ttbbhh.exec:\ttbbhh.exe69⤵PID:1224
-
\??\c:\pjppj.exec:\pjppj.exe70⤵PID:1772
-
\??\c:\xfxxrxr.exec:\xfxxrxr.exe71⤵PID:3520
-
\??\c:\nnnhhb.exec:\nnnhhb.exe72⤵PID:2640
-
\??\c:\1hbbbh.exec:\1hbbbh.exe73⤵PID:4308
-
\??\c:\dpjjp.exec:\dpjjp.exe74⤵PID:3124
-
\??\c:\rfrlflf.exec:\rfrlflf.exe75⤵PID:2132
-
\??\c:\hthhhn.exec:\hthhhn.exe76⤵PID:320
-
\??\c:\hhbbtb.exec:\hhbbtb.exe77⤵PID:3736
-
\??\c:\jjvvv.exec:\jjvvv.exe78⤵PID:2408
-
\??\c:\fxrlffx.exec:\fxrlffx.exe79⤵PID:3840
-
\??\c:\hbthbh.exec:\hbthbh.exe80⤵PID:976
-
\??\c:\pjpjj.exec:\pjpjj.exe81⤵PID:4596
-
\??\c:\9llrllf.exec:\9llrllf.exe82⤵PID:4688
-
\??\c:\hhnnnt.exec:\hhnnnt.exe83⤵PID:1316
-
\??\c:\dpjdv.exec:\dpjdv.exe84⤵PID:3396
-
\??\c:\1lxxrlf.exec:\1lxxrlf.exe85⤵PID:1380
-
\??\c:\rrfllll.exec:\rrfllll.exe86⤵PID:2960
-
\??\c:\tntnnn.exec:\tntnnn.exe87⤵PID:3608
-
\??\c:\pjjjd.exec:\pjjjd.exe88⤵PID:396
-
\??\c:\1vjdd.exec:\1vjdd.exe89⤵PID:948
-
\??\c:\fffffff.exec:\fffffff.exe90⤵PID:1916
-
\??\c:\thtnhh.exec:\thtnhh.exe91⤵PID:2392
-
\??\c:\dvjjj.exec:\dvjjj.exe92⤵PID:3220
-
\??\c:\xfllfll.exec:\xfllfll.exe93⤵PID:3920
-
\??\c:\7bbtnn.exec:\7bbtnn.exe94⤵PID:2116
-
\??\c:\btthbb.exec:\btthbb.exe95⤵PID:3728
-
\??\c:\vjpjd.exec:\vjpjd.exe96⤵PID:1564
-
\??\c:\rxxlxfx.exec:\rxxlxfx.exe97⤵PID:3772
-
\??\c:\btttnh.exec:\btttnh.exe98⤵PID:2656
-
\??\c:\nnnnhh.exec:\nnnnhh.exe99⤵PID:3276
-
\??\c:\jjpjv.exec:\jjpjv.exe100⤵PID:3384
-
\??\c:\llfxrrr.exec:\llfxrrr.exe101⤵PID:1964
-
\??\c:\3tnbbn.exec:\3tnbbn.exe102⤵PID:2728
-
\??\c:\bhnhbn.exec:\bhnhbn.exe103⤵PID:2312
-
\??\c:\ppdvd.exec:\ppdvd.exe104⤵PID:2440
-
\??\c:\lfrfxrx.exec:\lfrfxrx.exe105⤵PID:1432
-
\??\c:\lflfxrl.exec:\lflfxrl.exe106⤵PID:1128
-
\??\c:\tnntbt.exec:\tnntbt.exe107⤵PID:4272
-
\??\c:\pjpjp.exec:\pjpjp.exe108⤵PID:2584
-
\??\c:\7djdd.exec:\7djdd.exe109⤵PID:4180
-
\??\c:\3xxrffx.exec:\3xxrffx.exe110⤵PID:1648
-
\??\c:\nntttn.exec:\nntttn.exe111⤵PID:1980
-
\??\c:\pdjdd.exec:\pdjdd.exe112⤵PID:2632
-
\??\c:\frrlrrl.exec:\frrlrrl.exe113⤵PID:1352
-
\??\c:\1xrrffx.exec:\1xrrffx.exe114⤵
- System Location Discovery: System Language Discovery
PID:4196 -
\??\c:\bhhbhh.exec:\bhhbhh.exe115⤵PID:920
-
\??\c:\3vppj.exec:\3vppj.exe116⤵PID:2748
-
\??\c:\9nnnbh.exec:\9nnnbh.exe117⤵PID:4036
-
\??\c:\jvdpj.exec:\jvdpj.exe118⤵PID:400
-
\??\c:\ffrrrrr.exec:\ffrrrrr.exe119⤵PID:2884
-
\??\c:\lxlfxff.exec:\lxlfxff.exe120⤵PID:5028
-
\??\c:\htnnhn.exec:\htnnhn.exe121⤵PID:2772
-
\??\c:\vjpjj.exec:\vjpjj.exe122⤵PID:3948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-