Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 01:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe
-
Size
454KB
-
MD5
8ce3a6cf2aa5afc0cd0997eab56af00e
-
SHA1
b10cb77e1f7a9dd80320d2a25e4222b39e01421d
-
SHA256
a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255
-
SHA512
f3890e805d647a3005ee27cbd67eb9e622d6dc85dd4ab183fa3ab3198a6503c1cdae8ee70239daf387a584af712aef582614601f42099f61fd33acda0caba982
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4320-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1784-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3544-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1324-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1280-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1104-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/112-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-649-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/384-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-779-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-984-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-1166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-1273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4224 ttbttt.exe 5072 lllfxff.exe 3476 ppdvj.exe 4580 vpvvv.exe 4484 hbnhbb.exe 4956 nbttnh.exe 3184 llflxxx.exe 3744 dpjvv.exe 2964 5htthn.exe 2944 rrfxflr.exe 100 jdppj.exe 3164 nnbtnt.exe 532 hhtnhh.exe 3936 5thnth.exe 3028 pddpd.exe 2720 pjppp.exe 3440 3thttt.exe 3984 lffrlrl.exe 32 bbbttt.exe 3432 xrllffx.exe 5068 hhbbtt.exe 4124 3vjpd.exe 4128 9xlfllr.exe 4812 bntbnh.exe 1784 hhbttt.exe 3516 jppjp.exe 1624 lxfxxll.exe 3280 jjpdv.exe 3544 lxxxxrr.exe 2416 1pvpp.exe 4824 jdjdv.exe 3324 pdjjv.exe 3472 llfxxxx.exe 1764 hbbbbt.exe 1004 7vpdp.exe 2652 rlflrlr.exe 1372 xrrllff.exe 1732 pppjv.exe 2692 lrrlfxr.exe 3076 ntbnnb.exe 1848 jddvp.exe 4768 9rfxffl.exe 4544 nbnhhb.exe 3228 bbhthb.exe 2760 5pvpv.exe 3108 xfrlrff.exe 4312 5nbbhn.exe 4376 dppjv.exe 1324 frfxlll.exe 4496 nbbtbn.exe 4224 dpvpj.exe 4664 5xrrlll.exe 928 jjjvj.exe 3776 rflfffl.exe 2468 7hhhhn.exe 1492 hbhhhn.exe 384 vvvpp.exe 3732 rlrllll.exe 3980 thnhbb.exe 4956 pdvpj.exe 1856 rrfxxxx.exe 64 xrxrllf.exe 2024 dddvv.exe 2940 1ffxxxr.exe -
resource yara_rule behavioral2/memory/4320-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/32-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3544-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1280-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1104-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/112-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/384-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-779-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxxxr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4320 wrote to memory of 4224 4320 a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe 82 PID 4320 wrote to memory of 4224 4320 a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe 82 PID 4320 wrote to memory of 4224 4320 a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe 82 PID 4224 wrote to memory of 5072 4224 ttbttt.exe 83 PID 4224 wrote to memory of 5072 4224 ttbttt.exe 83 PID 4224 wrote to memory of 5072 4224 ttbttt.exe 83 PID 5072 wrote to memory of 3476 5072 lllfxff.exe 84 PID 5072 wrote to memory of 3476 5072 lllfxff.exe 84 PID 5072 wrote to memory of 3476 5072 lllfxff.exe 84 PID 3476 wrote to memory of 4580 3476 ppdvj.exe 85 PID 3476 wrote to memory of 4580 3476 ppdvj.exe 85 PID 3476 wrote to memory of 4580 3476 ppdvj.exe 85 PID 4580 wrote to memory of 4484 4580 vpvvv.exe 86 PID 4580 wrote to memory of 4484 4580 vpvvv.exe 86 PID 4580 wrote to memory of 4484 4580 vpvvv.exe 86 PID 4484 wrote to memory of 4956 4484 hbnhbb.exe 87 PID 4484 wrote to memory of 4956 4484 hbnhbb.exe 87 PID 4484 wrote to memory of 4956 4484 hbnhbb.exe 87 PID 4956 wrote to memory of 3184 4956 nbttnh.exe 88 PID 4956 wrote to memory of 3184 4956 nbttnh.exe 88 PID 4956 wrote to memory of 3184 4956 nbttnh.exe 88 PID 3184 wrote to memory of 3744 3184 llflxxx.exe 89 PID 3184 wrote to memory of 3744 3184 llflxxx.exe 89 PID 3184 wrote to memory of 3744 3184 llflxxx.exe 89 PID 3744 wrote to memory of 2964 3744 dpjvv.exe 90 PID 3744 wrote to memory of 2964 3744 dpjvv.exe 90 PID 3744 wrote to memory of 2964 3744 dpjvv.exe 90 PID 2964 wrote to memory of 2944 2964 5htthn.exe 91 PID 2964 wrote to memory of 2944 2964 5htthn.exe 91 PID 2964 wrote to memory of 2944 2964 5htthn.exe 91 PID 2944 wrote to memory of 100 2944 rrfxflr.exe 92 PID 2944 wrote to memory of 100 2944 rrfxflr.exe 92 PID 2944 wrote to memory of 100 2944 rrfxflr.exe 92 PID 100 wrote to memory of 3164 100 jdppj.exe 93 PID 100 wrote to memory of 3164 100 jdppj.exe 93 PID 100 wrote to memory of 3164 100 jdppj.exe 93 PID 3164 wrote to memory of 532 3164 nnbtnt.exe 94 PID 3164 wrote to memory of 532 3164 nnbtnt.exe 94 PID 3164 wrote to memory of 532 3164 nnbtnt.exe 94 PID 532 wrote to memory of 3936 532 hhtnhh.exe 95 PID 532 wrote to memory of 3936 532 hhtnhh.exe 95 PID 532 wrote to memory of 3936 532 hhtnhh.exe 95 PID 3936 wrote to memory of 3028 3936 5thnth.exe 96 PID 3936 wrote to memory of 3028 3936 5thnth.exe 96 PID 3936 wrote to memory of 3028 3936 5thnth.exe 96 PID 3028 wrote to memory of 2720 3028 pddpd.exe 97 PID 3028 wrote to memory of 2720 3028 pddpd.exe 97 PID 3028 wrote to memory of 2720 3028 pddpd.exe 97 PID 2720 wrote to memory of 3440 2720 pjppp.exe 98 PID 2720 wrote to memory of 3440 2720 pjppp.exe 98 PID 2720 wrote to memory of 3440 2720 pjppp.exe 98 PID 3440 wrote to memory of 3984 3440 3thttt.exe 99 PID 3440 wrote to memory of 3984 3440 3thttt.exe 99 PID 3440 wrote to memory of 3984 3440 3thttt.exe 99 PID 3984 wrote to memory of 32 3984 lffrlrl.exe 100 PID 3984 wrote to memory of 32 3984 lffrlrl.exe 100 PID 3984 wrote to memory of 32 3984 lffrlrl.exe 100 PID 32 wrote to memory of 3432 32 bbbttt.exe 101 PID 32 wrote to memory of 3432 32 bbbttt.exe 101 PID 32 wrote to memory of 3432 32 bbbttt.exe 101 PID 3432 wrote to memory of 5068 3432 xrllffx.exe 102 PID 3432 wrote to memory of 5068 3432 xrllffx.exe 102 PID 3432 wrote to memory of 5068 3432 xrllffx.exe 102 PID 5068 wrote to memory of 4124 5068 hhbbtt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe"C:\Users\Admin\AppData\Local\Temp\a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\ttbttt.exec:\ttbttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\lllfxff.exec:\lllfxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\ppdvj.exec:\ppdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\vpvvv.exec:\vpvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\hbnhbb.exec:\hbnhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\nbttnh.exec:\nbttnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\llflxxx.exec:\llflxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\dpjvv.exec:\dpjvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\5htthn.exec:\5htthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\rrfxflr.exec:\rrfxflr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\jdppj.exec:\jdppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\nnbtnt.exec:\nnbtnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\hhtnhh.exec:\hhtnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\5thnth.exec:\5thnth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\pddpd.exec:\pddpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\pjppp.exec:\pjppp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\3thttt.exec:\3thttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\lffrlrl.exec:\lffrlrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\bbbttt.exec:\bbbttt.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\xrllffx.exec:\xrllffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\hhbbtt.exec:\hhbbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\3vjpd.exec:\3vjpd.exe23⤵
- Executes dropped EXE
PID:4124 -
\??\c:\9xlfllr.exec:\9xlfllr.exe24⤵
- Executes dropped EXE
PID:4128 -
\??\c:\bntbnh.exec:\bntbnh.exe25⤵
- Executes dropped EXE
PID:4812 -
\??\c:\hhbttt.exec:\hhbttt.exe26⤵
- Executes dropped EXE
PID:1784 -
\??\c:\jppjp.exec:\jppjp.exe27⤵
- Executes dropped EXE
PID:3516 -
\??\c:\lxfxxll.exec:\lxfxxll.exe28⤵
- Executes dropped EXE
PID:1624 -
\??\c:\jjpdv.exec:\jjpdv.exe29⤵
- Executes dropped EXE
PID:3280 -
\??\c:\lxxxxrr.exec:\lxxxxrr.exe30⤵
- Executes dropped EXE
PID:3544 -
\??\c:\1pvpp.exec:\1pvpp.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2416 -
\??\c:\jdjdv.exec:\jdjdv.exe32⤵
- Executes dropped EXE
PID:4824 -
\??\c:\pdjjv.exec:\pdjjv.exe33⤵
- Executes dropped EXE
PID:3324 -
\??\c:\llfxxxx.exec:\llfxxxx.exe34⤵
- Executes dropped EXE
PID:3472 -
\??\c:\hbbbbt.exec:\hbbbbt.exe35⤵
- Executes dropped EXE
PID:1764 -
\??\c:\7vpdp.exec:\7vpdp.exe36⤵
- Executes dropped EXE
PID:1004 -
\??\c:\rlflrlr.exec:\rlflrlr.exe37⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xrrllff.exec:\xrrllff.exe38⤵
- Executes dropped EXE
PID:1372 -
\??\c:\pppjv.exec:\pppjv.exe39⤵
- Executes dropped EXE
PID:1732 -
\??\c:\lrrlfxr.exec:\lrrlfxr.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\ntbnnb.exec:\ntbnnb.exe41⤵
- Executes dropped EXE
PID:3076 -
\??\c:\jddvp.exec:\jddvp.exe42⤵
- Executes dropped EXE
PID:1848 -
\??\c:\9rfxffl.exec:\9rfxffl.exe43⤵
- Executes dropped EXE
PID:4768 -
\??\c:\nbnhhb.exec:\nbnhhb.exe44⤵
- Executes dropped EXE
PID:4544 -
\??\c:\bbhthb.exec:\bbhthb.exe45⤵
- Executes dropped EXE
PID:3228 -
\??\c:\5pvpv.exec:\5pvpv.exe46⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xfrlrff.exec:\xfrlrff.exe47⤵
- Executes dropped EXE
PID:3108 -
\??\c:\5nbbhn.exec:\5nbbhn.exe48⤵
- Executes dropped EXE
PID:4312 -
\??\c:\dppjv.exec:\dppjv.exe49⤵
- Executes dropped EXE
PID:4376 -
\??\c:\frfxlll.exec:\frfxlll.exe50⤵
- Executes dropped EXE
PID:1324 -
\??\c:\nbbtbn.exec:\nbbtbn.exe51⤵
- Executes dropped EXE
PID:4496 -
\??\c:\dpvpj.exec:\dpvpj.exe52⤵
- Executes dropped EXE
PID:4224 -
\??\c:\5xrrlll.exec:\5xrrlll.exe53⤵
- Executes dropped EXE
PID:4664 -
\??\c:\jjjvj.exec:\jjjvj.exe54⤵
- Executes dropped EXE
PID:928 -
\??\c:\rflfffl.exec:\rflfffl.exe55⤵
- Executes dropped EXE
PID:3776 -
\??\c:\7hhhhn.exec:\7hhhhn.exe56⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hbhhhn.exec:\hbhhhn.exe57⤵
- Executes dropped EXE
PID:1492 -
\??\c:\vvvpp.exec:\vvvpp.exe58⤵
- Executes dropped EXE
PID:384 -
\??\c:\rlrllll.exec:\rlrllll.exe59⤵
- Executes dropped EXE
PID:3732 -
\??\c:\thnhbb.exec:\thnhbb.exe60⤵
- Executes dropped EXE
PID:3980 -
\??\c:\pdvpj.exec:\pdvpj.exe61⤵
- Executes dropped EXE
PID:4956 -
\??\c:\rrfxxxx.exec:\rrfxxxx.exe62⤵
- Executes dropped EXE
PID:1856 -
\??\c:\xrxrllf.exec:\xrxrllf.exe63⤵
- Executes dropped EXE
PID:64 -
\??\c:\dddvv.exec:\dddvv.exe64⤵
- Executes dropped EXE
PID:2024 -
\??\c:\1ffxxxr.exec:\1ffxxxr.exe65⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bhnnnn.exec:\bhnnnn.exe66⤵PID:2964
-
\??\c:\thnnnn.exec:\thnnnn.exe67⤵PID:1720
-
\??\c:\xxrrrrr.exec:\xxrrrrr.exe68⤵PID:216
-
\??\c:\rxffrxx.exec:\rxffrxx.exe69⤵PID:1092
-
\??\c:\3nthhn.exec:\3nthhn.exe70⤵PID:800
-
\??\c:\jpjvj.exec:\jpjvj.exe71⤵PID:3248
-
\??\c:\fxllllf.exec:\fxllllf.exe72⤵PID:4016
-
\??\c:\3frllll.exec:\3frllll.exe73⤵PID:3404
-
\??\c:\nhhhbt.exec:\nhhhbt.exe74⤵PID:2252
-
\??\c:\vvdpj.exec:\vvdpj.exe75⤵PID:4968
-
\??\c:\5llfffx.exec:\5llfffx.exe76⤵PID:1992
-
\??\c:\nhtnnh.exec:\nhtnnh.exe77⤵PID:1252
-
\??\c:\3vpjp.exec:\3vpjp.exe78⤵PID:3444
-
\??\c:\9fxxrrr.exec:\9fxxrrr.exe79⤵PID:3300
-
\??\c:\hthttn.exec:\hthttn.exe80⤵PID:4680
-
\??\c:\djdjj.exec:\djdjj.exe81⤵PID:4516
-
\??\c:\7pvjv.exec:\7pvjv.exe82⤵PID:4144
-
\??\c:\bnttbt.exec:\bnttbt.exe83⤵PID:1280
-
\??\c:\pjjvp.exec:\pjjvp.exe84⤵PID:5068
-
\??\c:\xrxrllf.exec:\xrxrllf.exe85⤵PID:3468
-
\??\c:\bntthb.exec:\bntthb.exe86⤵PID:5112
-
\??\c:\tbbttb.exec:\tbbttb.exe87⤵PID:4832
-
\??\c:\ddjdd.exec:\ddjdd.exe88⤵
- System Location Discovery: System Language Discovery
PID:5056 -
\??\c:\lfllrrl.exec:\lfllrrl.exe89⤵PID:1428
-
\??\c:\9rfxllx.exec:\9rfxllx.exe90⤵PID:5052
-
\??\c:\ththbh.exec:\ththbh.exe91⤵PID:4288
-
\??\c:\vjppp.exec:\vjppp.exe92⤵PID:1624
-
\??\c:\xrfxlfl.exec:\xrfxlfl.exe93⤵PID:1104
-
\??\c:\bthbtt.exec:\bthbtt.exe94⤵PID:3868
-
\??\c:\dvvdp.exec:\dvvdp.exe95⤵PID:3908
-
\??\c:\xflxllr.exec:\xflxllr.exe96⤵PID:1620
-
\??\c:\nhnhtt.exec:\nhnhtt.exe97⤵
- System Location Discovery: System Language Discovery
PID:3052 -
\??\c:\9ttnbb.exec:\9ttnbb.exe98⤵PID:4076
-
\??\c:\1dvvp.exec:\1dvvp.exe99⤵PID:4048
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe100⤵PID:2208
-
\??\c:\tttttt.exec:\tttttt.exe101⤵PID:2740
-
\??\c:\jdjdd.exec:\jdjdd.exe102⤵PID:2104
-
\??\c:\lflfxxr.exec:\lflfxxr.exe103⤵PID:3084
-
\??\c:\ffrrfff.exec:\ffrrfff.exe104⤵PID:1284
-
\??\c:\nntbbn.exec:\nntbbn.exe105⤵PID:2384
-
\??\c:\jpppp.exec:\jpppp.exe106⤵PID:4860
-
\??\c:\7rxxrrr.exec:\7rxxrrr.exe107⤵PID:1800
-
\??\c:\9tnhhh.exec:\9tnhhh.exe108⤵PID:3076
-
\??\c:\vvvpp.exec:\vvvpp.exe109⤵PID:4280
-
\??\c:\lfrlfff.exec:\lfrlfff.exe110⤵PID:2084
-
\??\c:\hhhbbb.exec:\hhhbbb.exe111⤵PID:3456
-
\??\c:\jvpjj.exec:\jvpjj.exe112⤵PID:4916
-
\??\c:\flrlxxf.exec:\flrlxxf.exe113⤵PID:3260
-
\??\c:\bnhhbn.exec:\bnhhbn.exe114⤵PID:3964
-
\??\c:\bntttt.exec:\bntttt.exe115⤵PID:4432
-
\??\c:\pddvv.exec:\pddvv.exe116⤵PID:3400
-
\??\c:\xrrlrrr.exec:\xrrlrrr.exe117⤵PID:4872
-
\??\c:\bbtttt.exec:\bbtttt.exe118⤵PID:624
-
\??\c:\9ddvp.exec:\9ddvp.exe119⤵PID:2300
-
\??\c:\fxfrflr.exec:\fxfrflr.exe120⤵PID:4056
-
\??\c:\btntth.exec:\btntth.exe121⤵PID:3208
-
\??\c:\5vddj.exec:\5vddj.exe122⤵PID:1272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-