Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 01:22
Behavioral task
behavioral1
Sample
2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe
-
Size
334KB
-
MD5
110175f070cd0ff0983d94b3aaa4f9f7
-
SHA1
bdea063c8efdcc25587746af3d1545634bdba50b
-
SHA256
2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda
-
SHA512
6692e9a86dcdde691e4d1a38e9878009649980cfc8db74c7ed50b178d976b06375f861229fcf8aa5bc0ccff7aedaf676a99ed03d725e7b625d182e7bfa516a08
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeR4:R4wFHoSHYHUrAwfMp3CDR4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2632-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2476-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2388-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3828-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1572-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3608-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3668-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4800-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/984-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4772-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3936-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2888-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/408-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2988-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3484-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4740-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3964-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4328-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1228-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2968-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1008-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4160-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1012-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3692-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/844-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2224-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3940-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2636-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2412-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1616-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4472-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2672-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-480-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3844-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2108-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1736-614-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-896-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-938-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2476 5hbbhh.exe 2388 rrrlllf.exe 4720 pjppd.exe 1356 fffxlll.exe 2604 9bhhnh.exe 3828 htbbhh.exe 1572 jddpd.exe 3608 tbnhhb.exe 3668 7dddj.exe 2312 nttnbb.exe 4800 dvppp.exe 984 lxfffxr.exe 4944 hhttbn.exe 4772 ddddv.exe 2664 nntttb.exe 3936 jvppp.exe 4424 tthbnn.exe 2988 tbhbtt.exe 3484 jddpj.exe 8 fxllrrx.exe 3524 nthbnt.exe 2888 ddjdd.exe 408 flrlfxr.exe 3628 tbnnhn.exe 1072 vvddv.exe 1896 pdppv.exe 3380 5lrffff.exe 3000 hbbnnn.exe 4740 hbttnn.exe 2232 jdpjj.exe 3964 ppvjv.exe 4020 tbbbbh.exe 2616 bnhtnh.exe 3804 pdjdv.exe 2652 1fxflfr.exe 2036 7bhbbt.exe 4804 lxlfxxx.exe 4764 9ntnhh.exe 4360 xrxrllf.exe 4328 hbnhnh.exe 208 9djdd.exe 1228 vjpvp.exe 2968 xrrrlll.exe 1556 xxrllff.exe 1216 thtbbt.exe 404 vjjjd.exe 3404 tntnnt.exe 4956 9nbbhh.exe 2116 nhhhbb.exe 5068 vvdjp.exe 4040 lrxrlll.exe 3468 jvvvv.exe 3448 fffrrrx.exe 1444 btbbhb.exe 2332 tbhhnn.exe 4444 ppdjj.exe 2380 frrfxxr.exe 4728 fxfrrfr.exe 856 nhhbtb.exe 1008 7dpjp.exe 4824 xrxrrrx.exe 4392 fxrrllf.exe 2892 jddvj.exe 4160 jdjdj.exe -
resource yara_rule behavioral2/memory/2632-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023c87-3.dat upx behavioral2/memory/2632-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c8e-10.dat upx behavioral2/memory/2476-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c8f-11.dat upx behavioral2/memory/2388-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c90-18.dat upx behavioral2/memory/1356-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c91-25.dat upx behavioral2/memory/1356-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2604-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4720-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c92-30.dat upx behavioral2/memory/2604-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c93-35.dat upx behavioral2/memory/3828-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1572-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c94-40.dat upx behavioral2/files/0x0007000000023c95-45.dat upx behavioral2/memory/3608-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c96-50.dat upx behavioral2/memory/3668-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c97-55.dat upx behavioral2/memory/4800-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c98-61.dat upx behavioral2/files/0x0007000000023c99-65.dat upx behavioral2/memory/984-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9a-69.dat upx behavioral2/memory/4944-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c8b-74.dat upx behavioral2/memory/4772-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9c-79.dat upx behavioral2/memory/3936-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4424-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9e-89.dat upx behavioral2/files/0x0007000000023c9d-85.dat upx behavioral2/files/0x0007000000023ca0-100.dat upx behavioral2/files/0x0007000000023ca1-104.dat upx behavioral2/memory/2888-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca2-109.dat upx behavioral2/files/0x0007000000023ca4-117.dat upx behavioral2/memory/3628-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca5-124.dat upx behavioral2/files/0x0007000000023ca7-132.dat upx behavioral2/files/0x0007000000023ca6-128.dat upx behavioral2/memory/408-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca3-114.dat upx behavioral2/memory/8-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c9f-94.dat upx behavioral2/memory/2988-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3484-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca8-135.dat upx behavioral2/files/0x0007000000023ca9-140.dat upx behavioral2/files/0x0007000000023caa-145.dat upx behavioral2/memory/4740-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cab-148.dat upx behavioral2/memory/4020-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3964-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cac-153.dat upx behavioral2/memory/2036-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4804-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4360-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4328-177-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lflllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlflfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2632 wrote to memory of 2476 2632 2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe 82 PID 2632 wrote to memory of 2476 2632 2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe 82 PID 2632 wrote to memory of 2476 2632 2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe 82 PID 2476 wrote to memory of 2388 2476 5hbbhh.exe 83 PID 2476 wrote to memory of 2388 2476 5hbbhh.exe 83 PID 2476 wrote to memory of 2388 2476 5hbbhh.exe 83 PID 2388 wrote to memory of 4720 2388 rrrlllf.exe 84 PID 2388 wrote to memory of 4720 2388 rrrlllf.exe 84 PID 2388 wrote to memory of 4720 2388 rrrlllf.exe 84 PID 4720 wrote to memory of 1356 4720 pjppd.exe 85 PID 4720 wrote to memory of 1356 4720 pjppd.exe 85 PID 4720 wrote to memory of 1356 4720 pjppd.exe 85 PID 1356 wrote to memory of 2604 1356 fffxlll.exe 86 PID 1356 wrote to memory of 2604 1356 fffxlll.exe 86 PID 1356 wrote to memory of 2604 1356 fffxlll.exe 86 PID 2604 wrote to memory of 3828 2604 9bhhnh.exe 87 PID 2604 wrote to memory of 3828 2604 9bhhnh.exe 87 PID 2604 wrote to memory of 3828 2604 9bhhnh.exe 87 PID 3828 wrote to memory of 1572 3828 htbbhh.exe 88 PID 3828 wrote to memory of 1572 3828 htbbhh.exe 88 PID 3828 wrote to memory of 1572 3828 htbbhh.exe 88 PID 1572 wrote to memory of 3608 1572 jddpd.exe 89 PID 1572 wrote to memory of 3608 1572 jddpd.exe 89 PID 1572 wrote to memory of 3608 1572 jddpd.exe 89 PID 3608 wrote to memory of 3668 3608 tbnhhb.exe 90 PID 3608 wrote to memory of 3668 3608 tbnhhb.exe 90 PID 3608 wrote to memory of 3668 3608 tbnhhb.exe 90 PID 3668 wrote to memory of 2312 3668 7dddj.exe 91 PID 3668 wrote to memory of 2312 3668 7dddj.exe 91 PID 3668 wrote to memory of 2312 3668 7dddj.exe 91 PID 2312 wrote to memory of 4800 2312 nttnbb.exe 92 PID 2312 wrote to memory of 4800 2312 nttnbb.exe 92 PID 2312 wrote to memory of 4800 2312 nttnbb.exe 92 PID 4800 wrote to memory of 984 4800 dvppp.exe 93 PID 4800 wrote to memory of 984 4800 dvppp.exe 93 PID 4800 wrote to memory of 984 4800 dvppp.exe 93 PID 984 wrote to memory of 4944 984 lxfffxr.exe 94 PID 984 wrote to memory of 4944 984 lxfffxr.exe 94 PID 984 wrote to memory of 4944 984 lxfffxr.exe 94 PID 4944 wrote to memory of 4772 4944 hhttbn.exe 95 PID 4944 wrote to memory of 4772 4944 hhttbn.exe 95 PID 4944 wrote to memory of 4772 4944 hhttbn.exe 95 PID 4772 wrote to memory of 2664 4772 ddddv.exe 96 PID 4772 wrote to memory of 2664 4772 ddddv.exe 96 PID 4772 wrote to memory of 2664 4772 ddddv.exe 96 PID 2664 wrote to memory of 3936 2664 nntttb.exe 97 PID 2664 wrote to memory of 3936 2664 nntttb.exe 97 PID 2664 wrote to memory of 3936 2664 nntttb.exe 97 PID 3936 wrote to memory of 4424 3936 jvppp.exe 98 PID 3936 wrote to memory of 4424 3936 jvppp.exe 98 PID 3936 wrote to memory of 4424 3936 jvppp.exe 98 PID 4424 wrote to memory of 2988 4424 tthbnn.exe 99 PID 4424 wrote to memory of 2988 4424 tthbnn.exe 99 PID 4424 wrote to memory of 2988 4424 tthbnn.exe 99 PID 2988 wrote to memory of 3484 2988 tbhbtt.exe 100 PID 2988 wrote to memory of 3484 2988 tbhbtt.exe 100 PID 2988 wrote to memory of 3484 2988 tbhbtt.exe 100 PID 3484 wrote to memory of 8 3484 jddpj.exe 101 PID 3484 wrote to memory of 8 3484 jddpj.exe 101 PID 3484 wrote to memory of 8 3484 jddpj.exe 101 PID 8 wrote to memory of 3524 8 fxllrrx.exe 102 PID 8 wrote to memory of 3524 8 fxllrrx.exe 102 PID 8 wrote to memory of 3524 8 fxllrrx.exe 102 PID 3524 wrote to memory of 2888 3524 nthbnt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe"C:\Users\Admin\AppData\Local\Temp\2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\5hbbhh.exec:\5hbbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\rrrlllf.exec:\rrrlllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\pjppd.exec:\pjppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\fffxlll.exec:\fffxlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\9bhhnh.exec:\9bhhnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\htbbhh.exec:\htbbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\jddpd.exec:\jddpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\tbnhhb.exec:\tbnhhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\7dddj.exec:\7dddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\nttnbb.exec:\nttnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\dvppp.exec:\dvppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\lxfffxr.exec:\lxfffxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\hhttbn.exec:\hhttbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\ddddv.exec:\ddddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\nntttb.exec:\nntttb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\jvppp.exec:\jvppp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\tthbnn.exec:\tthbnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\tbhbtt.exec:\tbhbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\jddpj.exec:\jddpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\fxllrrx.exec:\fxllrrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\nthbnt.exec:\nthbnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\ddjdd.exec:\ddjdd.exe23⤵
- Executes dropped EXE
PID:2888 -
\??\c:\flrlfxr.exec:\flrlfxr.exe24⤵
- Executes dropped EXE
PID:408 -
\??\c:\tbnnhn.exec:\tbnnhn.exe25⤵
- Executes dropped EXE
PID:3628 -
\??\c:\vvddv.exec:\vvddv.exe26⤵
- Executes dropped EXE
PID:1072 -
\??\c:\pdppv.exec:\pdppv.exe27⤵
- Executes dropped EXE
PID:1896 -
\??\c:\5lrffff.exec:\5lrffff.exe28⤵
- Executes dropped EXE
PID:3380 -
\??\c:\hbbnnn.exec:\hbbnnn.exe29⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hbttnn.exec:\hbttnn.exe30⤵
- Executes dropped EXE
PID:4740 -
\??\c:\jdpjj.exec:\jdpjj.exe31⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ppvjv.exec:\ppvjv.exe32⤵
- Executes dropped EXE
PID:3964 -
\??\c:\tbbbbh.exec:\tbbbbh.exe33⤵
- Executes dropped EXE
PID:4020 -
\??\c:\bnhtnh.exec:\bnhtnh.exe34⤵
- Executes dropped EXE
PID:2616 -
\??\c:\pdjdv.exec:\pdjdv.exe35⤵
- Executes dropped EXE
PID:3804 -
\??\c:\1fxflfr.exec:\1fxflfr.exe36⤵
- Executes dropped EXE
PID:2652 -
\??\c:\7bhbbt.exec:\7bhbbt.exe37⤵
- Executes dropped EXE
PID:2036 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe38⤵
- Executes dropped EXE
PID:4804 -
\??\c:\9ntnhh.exec:\9ntnhh.exe39⤵
- Executes dropped EXE
PID:4764 -
\??\c:\xrxrllf.exec:\xrxrllf.exe40⤵
- Executes dropped EXE
PID:4360 -
\??\c:\hbnhnh.exec:\hbnhnh.exe41⤵
- Executes dropped EXE
PID:4328 -
\??\c:\9djdd.exec:\9djdd.exe42⤵
- Executes dropped EXE
PID:208 -
\??\c:\vjpvp.exec:\vjpvp.exe43⤵
- Executes dropped EXE
PID:1228 -
\??\c:\xrrrlll.exec:\xrrrlll.exe44⤵
- Executes dropped EXE
PID:2968 -
\??\c:\xxrllff.exec:\xxrllff.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1556 -
\??\c:\thtbbt.exec:\thtbbt.exe46⤵
- Executes dropped EXE
PID:1216 -
\??\c:\vjjjd.exec:\vjjjd.exe47⤵
- Executes dropped EXE
PID:404 -
\??\c:\tntnnt.exec:\tntnnt.exe48⤵
- Executes dropped EXE
PID:3404 -
\??\c:\9nbbhh.exec:\9nbbhh.exe49⤵
- Executes dropped EXE
PID:4956 -
\??\c:\nhhhbb.exec:\nhhhbb.exe50⤵
- Executes dropped EXE
PID:2116 -
\??\c:\vvdjp.exec:\vvdjp.exe51⤵
- Executes dropped EXE
PID:5068 -
\??\c:\lrxrlll.exec:\lrxrlll.exe52⤵
- Executes dropped EXE
PID:4040 -
\??\c:\jvvvv.exec:\jvvvv.exe53⤵
- Executes dropped EXE
PID:3468 -
\??\c:\fffrrrx.exec:\fffrrrx.exe54⤵
- Executes dropped EXE
PID:3448 -
\??\c:\btbbhb.exec:\btbbhb.exe55⤵
- Executes dropped EXE
PID:1444 -
\??\c:\tbhhnn.exec:\tbhhnn.exe56⤵
- Executes dropped EXE
PID:2332 -
\??\c:\ppdjj.exec:\ppdjj.exe57⤵
- Executes dropped EXE
PID:4444 -
\??\c:\frrfxxr.exec:\frrfxxr.exe58⤵
- Executes dropped EXE
PID:2380 -
\??\c:\fxfrrfr.exec:\fxfrrfr.exe59⤵
- Executes dropped EXE
PID:4728 -
\??\c:\nhhbtb.exec:\nhhbtb.exe60⤵
- Executes dropped EXE
PID:856 -
\??\c:\7dpjp.exec:\7dpjp.exe61⤵
- Executes dropped EXE
PID:1008 -
\??\c:\xrxrrrx.exec:\xrxrrrx.exe62⤵
- Executes dropped EXE
PID:4824 -
\??\c:\fxrrllf.exec:\fxrrllf.exe63⤵
- Executes dropped EXE
PID:4392 -
\??\c:\jddvj.exec:\jddvj.exe64⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jdjdj.exec:\jdjdj.exe65⤵
- Executes dropped EXE
PID:4160 -
\??\c:\xrfxxxx.exec:\xrfxxxx.exe66⤵PID:1032
-
\??\c:\bnnnhh.exec:\bnnnhh.exe67⤵PID:3060
-
\??\c:\jdjjd.exec:\jdjjd.exe68⤵PID:1516
-
\??\c:\1ppjj.exec:\1ppjj.exe69⤵PID:4716
-
\??\c:\rlrrlrl.exec:\rlrrlrl.exe70⤵PID:4484
-
\??\c:\7tbtbb.exec:\7tbtbb.exe71⤵PID:4400
-
\??\c:\jvddv.exec:\jvddv.exe72⤵PID:4180
-
\??\c:\5dddp.exec:\5dddp.exe73⤵PID:3748
-
\??\c:\rlrlrxx.exec:\rlrlrxx.exe74⤵PID:4856
-
\??\c:\nbhbtt.exec:\nbhbtt.exe75⤵PID:3192
-
\??\c:\dvpjd.exec:\dvpjd.exe76⤵PID:4552
-
\??\c:\rrfxffx.exec:\rrfxffx.exe77⤵PID:2932
-
\??\c:\rlrlxrx.exec:\rlrlxrx.exe78⤵PID:2844
-
\??\c:\3hhhnt.exec:\3hhhnt.exe79⤵PID:2684
-
\??\c:\vvddd.exec:\vvddd.exe80⤵PID:1012
-
\??\c:\llrllfl.exec:\llrllfl.exe81⤵PID:1020
-
\??\c:\xfxrllf.exec:\xfxrllf.exe82⤵PID:4884
-
\??\c:\nnbtnn.exec:\nnbtnn.exe83⤵PID:2696
-
\??\c:\dpdvv.exec:\dpdvv.exe84⤵PID:2408
-
\??\c:\ddjdv.exec:\ddjdv.exe85⤵PID:2796
-
\??\c:\lrrlfff.exec:\lrrlfff.exe86⤵PID:3692
-
\??\c:\btnbnh.exec:\btnbnh.exe87⤵
- System Location Discovery: System Language Discovery
PID:2736 -
\??\c:\nnnnhh.exec:\nnnnhh.exe88⤵PID:4760
-
\??\c:\jjjdd.exec:\jjjdd.exe89⤵PID:4796
-
\??\c:\fflfffx.exec:\fflfffx.exe90⤵PID:1136
-
\??\c:\9btthn.exec:\9btthn.exe91⤵PID:5008
-
\??\c:\nhtnnn.exec:\nhtnnn.exe92⤵PID:2384
-
\??\c:\1vpjd.exec:\1vpjd.exe93⤵PID:844
-
\??\c:\7rxrrrl.exec:\7rxrrrl.exe94⤵PID:4988
-
\??\c:\tbnntb.exec:\tbnntb.exe95⤵PID:2224
-
\??\c:\htnhbb.exec:\htnhbb.exe96⤵PID:1344
-
\??\c:\ddddd.exec:\ddddd.exe97⤵PID:1564
-
\??\c:\1xfxrrl.exec:\1xfxrrl.exe98⤵PID:952
-
\??\c:\rfffffx.exec:\rfffffx.exe99⤵PID:2076
-
\??\c:\nthbbb.exec:\nthbbb.exe100⤵PID:1428
-
\??\c:\dvdvv.exec:\dvdvv.exe101⤵PID:4124
-
\??\c:\vjvdv.exec:\vjvdv.exe102⤵PID:4244
-
\??\c:\rlfffff.exec:\rlfffff.exe103⤵PID:4904
-
\??\c:\nntnnt.exec:\nntnnt.exe104⤵PID:3380
-
\??\c:\hbnnht.exec:\hbnnht.exe105⤵PID:5012
-
\??\c:\jjjpj.exec:\jjjpj.exe106⤵PID:4892
-
\??\c:\flrlfrr.exec:\flrlfrr.exe107⤵PID:1336
-
\??\c:\rflfxxx.exec:\rflfxxx.exe108⤵PID:2748
-
\??\c:\bnhhbt.exec:\bnhhbt.exe109⤵PID:4600
-
\??\c:\ddvvv.exec:\ddvvv.exe110⤵PID:4420
-
\??\c:\flflxfx.exec:\flflxfx.exe111⤵PID:4696
-
\??\c:\7xlffff.exec:\7xlffff.exe112⤵PID:3940
-
\??\c:\ntnnnh.exec:\ntnnnh.exe113⤵PID:2636
-
\??\c:\tntnbb.exec:\tntnbb.exe114⤵PID:5024
-
\??\c:\pjpvp.exec:\pjpvp.exe115⤵PID:2108
-
\??\c:\fxlflfl.exec:\fxlflfl.exe116⤵PID:2272
-
\??\c:\nbnbhb.exec:\nbnbhb.exe117⤵PID:4812
-
\??\c:\hhbbtn.exec:\hhbbtn.exe118⤵PID:2412
-
\??\c:\jjjvj.exec:\jjjvj.exe119⤵PID:4912
-
\??\c:\5lrrrrr.exec:\5lrrrrr.exe120⤵PID:1616
-
\??\c:\fflfffx.exec:\fflfffx.exe121⤵PID:2184
-
\??\c:\hntbhn.exec:\hntbhn.exe122⤵PID:3052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-