Analysis
-
max time kernel
150s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 01:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a6fe6c5900e969f0ef5df3fd62e3708675abef8d6496900943bbf3bb8b0b6e2c.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
a6fe6c5900e969f0ef5df3fd62e3708675abef8d6496900943bbf3bb8b0b6e2c.exe
-
Size
453KB
-
MD5
82b621c3b330f9263a847ed8bcf6e2ef
-
SHA1
e406e62e1e15012c52d2dfc6027e9e0498adeaa2
-
SHA256
a6fe6c5900e969f0ef5df3fd62e3708675abef8d6496900943bbf3bb8b0b6e2c
-
SHA512
a25c39abec151e031fce45c4d10724da9adfd48a3c8bd04b0644886ee8ef62106a290657c4a0683225c3a1606461552d2e728308bcd50f41bdb256dd56368adc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeh:q7Tc2NYHUrAwfMp3CDh
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1296-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1256-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2836-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1148-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1272-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/840-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1296-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/844-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1272-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-730-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-785-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-835-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-974-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-1029-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-1234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-1735-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 224 tntttb.exe 3632 frrrllr.exe 864 nhnnnn.exe 4776 rrrrxff.exe 8 jvddd.exe 4484 nhbbbh.exe 3084 ttttbb.exe 1256 dddpp.exe 4176 xxflfxx.exe 1644 1vvvd.exe 2836 flrlfxf.exe 1148 rffrrrr.exe 1476 ppppd.exe 2716 3bhhht.exe 2124 ntnbhn.exe 4628 3xfxffr.exe 4144 jjjjd.exe 4880 xrrfxxr.exe 3592 bbhbbb.exe 4800 3jvpd.exe 2600 fxlrxxx.exe 2064 hbhbtn.exe 2692 djddd.exe 536 hntnhh.exe 4736 nbnnhn.exe 2180 rrflrrx.exe 4732 djjdv.exe 1052 9tnntn.exe 4504 lrxrlll.exe 3332 xxxrlfx.exe 4720 ppjjd.exe 1272 frlfxrx.exe 1912 1ddvj.exe 2972 9xffxlf.exe 748 5htthh.exe 2368 jpvpd.exe 3356 3rfxffl.exe 1800 thbhhb.exe 1520 dpdvv.exe 840 1lfrrff.exe 2508 ttnnhb.exe 3440 pdvpj.exe 3344 fxfxrlf.exe 2996 nthbtb.exe 2736 3pjdd.exe 1896 rflfxxr.exe 4848 nhhhtn.exe 2752 jddpj.exe 2476 lrxfllx.exe 2232 btnnnb.exe 2592 9dddv.exe 4448 llfxrll.exe 5060 thhbbt.exe 1296 jpvvp.exe 1772 fxfffff.exe 1600 bnbbbb.exe 1892 9vddp.exe 4280 pvjdv.exe 4948 nttttb.exe 844 ddjdj.exe 2188 djvpp.exe 3476 7nhtht.exe 4484 1pppj.exe 3704 ppdvv.exe -
resource yara_rule behavioral2/memory/1296-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1256-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1272-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/840-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1296-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/844-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1272-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-785-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-810-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lllflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1296 wrote to memory of 224 1296 a6fe6c5900e969f0ef5df3fd62e3708675abef8d6496900943bbf3bb8b0b6e2c.exe 82 PID 1296 wrote to memory of 224 1296 a6fe6c5900e969f0ef5df3fd62e3708675abef8d6496900943bbf3bb8b0b6e2c.exe 82 PID 1296 wrote to memory of 224 1296 a6fe6c5900e969f0ef5df3fd62e3708675abef8d6496900943bbf3bb8b0b6e2c.exe 82 PID 224 wrote to memory of 3632 224 tntttb.exe 83 PID 224 wrote to memory of 3632 224 tntttb.exe 83 PID 224 wrote to memory of 3632 224 tntttb.exe 83 PID 3632 wrote to memory of 864 3632 frrrllr.exe 84 PID 3632 wrote to memory of 864 3632 frrrllr.exe 84 PID 3632 wrote to memory of 864 3632 frrrllr.exe 84 PID 864 wrote to memory of 4776 864 nhnnnn.exe 85 PID 864 wrote to memory of 4776 864 nhnnnn.exe 85 PID 864 wrote to memory of 4776 864 nhnnnn.exe 85 PID 4776 wrote to memory of 8 4776 rrrrxff.exe 86 PID 4776 wrote to memory of 8 4776 rrrrxff.exe 86 PID 4776 wrote to memory of 8 4776 rrrrxff.exe 86 PID 8 wrote to memory of 4484 8 jvddd.exe 87 PID 8 wrote to memory of 4484 8 jvddd.exe 87 PID 8 wrote to memory of 4484 8 jvddd.exe 87 PID 4484 wrote to memory of 3084 4484 nhbbbh.exe 88 PID 4484 wrote to memory of 3084 4484 nhbbbh.exe 88 PID 4484 wrote to memory of 3084 4484 nhbbbh.exe 88 PID 3084 wrote to memory of 1256 3084 ttttbb.exe 89 PID 3084 wrote to memory of 1256 3084 ttttbb.exe 89 PID 3084 wrote to memory of 1256 3084 ttttbb.exe 89 PID 1256 wrote to memory of 4176 1256 dddpp.exe 90 PID 1256 wrote to memory of 4176 1256 dddpp.exe 90 PID 1256 wrote to memory of 4176 1256 dddpp.exe 90 PID 4176 wrote to memory of 1644 4176 xxflfxx.exe 91 PID 4176 wrote to memory of 1644 4176 xxflfxx.exe 91 PID 4176 wrote to memory of 1644 4176 xxflfxx.exe 91 PID 1644 wrote to memory of 2836 1644 1vvvd.exe 92 PID 1644 wrote to memory of 2836 1644 1vvvd.exe 92 PID 1644 wrote to memory of 2836 1644 1vvvd.exe 92 PID 2836 wrote to memory of 1148 2836 flrlfxf.exe 93 PID 2836 wrote to memory of 1148 2836 flrlfxf.exe 93 PID 2836 wrote to memory of 1148 2836 flrlfxf.exe 93 PID 1148 wrote to memory of 1476 1148 rffrrrr.exe 94 PID 1148 wrote to memory of 1476 1148 rffrrrr.exe 94 PID 1148 wrote to memory of 1476 1148 rffrrrr.exe 94 PID 1476 wrote to memory of 2716 1476 ppppd.exe 95 PID 1476 wrote to memory of 2716 1476 ppppd.exe 95 PID 1476 wrote to memory of 2716 1476 ppppd.exe 95 PID 2716 wrote to memory of 2124 2716 3bhhht.exe 96 PID 2716 wrote to memory of 2124 2716 3bhhht.exe 96 PID 2716 wrote to memory of 2124 2716 3bhhht.exe 96 PID 2124 wrote to memory of 4628 2124 ntnbhn.exe 97 PID 2124 wrote to memory of 4628 2124 ntnbhn.exe 97 PID 2124 wrote to memory of 4628 2124 ntnbhn.exe 97 PID 4628 wrote to memory of 4144 4628 3xfxffr.exe 98 PID 4628 wrote to memory of 4144 4628 3xfxffr.exe 98 PID 4628 wrote to memory of 4144 4628 3xfxffr.exe 98 PID 4144 wrote to memory of 4880 4144 jjjjd.exe 99 PID 4144 wrote to memory of 4880 4144 jjjjd.exe 99 PID 4144 wrote to memory of 4880 4144 jjjjd.exe 99 PID 4880 wrote to memory of 3592 4880 xrrfxxr.exe 100 PID 4880 wrote to memory of 3592 4880 xrrfxxr.exe 100 PID 4880 wrote to memory of 3592 4880 xrrfxxr.exe 100 PID 3592 wrote to memory of 4800 3592 bbhbbb.exe 101 PID 3592 wrote to memory of 4800 3592 bbhbbb.exe 101 PID 3592 wrote to memory of 4800 3592 bbhbbb.exe 101 PID 4800 wrote to memory of 2600 4800 3jvpd.exe 102 PID 4800 wrote to memory of 2600 4800 3jvpd.exe 102 PID 4800 wrote to memory of 2600 4800 3jvpd.exe 102 PID 2600 wrote to memory of 2064 2600 fxlrxxx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6fe6c5900e969f0ef5df3fd62e3708675abef8d6496900943bbf3bb8b0b6e2c.exe"C:\Users\Admin\AppData\Local\Temp\a6fe6c5900e969f0ef5df3fd62e3708675abef8d6496900943bbf3bb8b0b6e2c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\tntttb.exec:\tntttb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\frrrllr.exec:\frrrllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\nhnnnn.exec:\nhnnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\rrrrxff.exec:\rrrrxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\jvddd.exec:\jvddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\nhbbbh.exec:\nhbbbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\ttttbb.exec:\ttttbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\dddpp.exec:\dddpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\xxflfxx.exec:\xxflfxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\1vvvd.exec:\1vvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\flrlfxf.exec:\flrlfxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\rffrrrr.exec:\rffrrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\ppppd.exec:\ppppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\3bhhht.exec:\3bhhht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\ntnbhn.exec:\ntnbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\3xfxffr.exec:\3xfxffr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\jjjjd.exec:\jjjjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\xrrfxxr.exec:\xrrfxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\bbhbbb.exec:\bbhbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\3jvpd.exec:\3jvpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\fxlrxxx.exec:\fxlrxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\hbhbtn.exec:\hbhbtn.exe23⤵
- Executes dropped EXE
PID:2064 -
\??\c:\djddd.exec:\djddd.exe24⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hntnhh.exec:\hntnhh.exe25⤵
- Executes dropped EXE
PID:536 -
\??\c:\nbnnhn.exec:\nbnnhn.exe26⤵
- Executes dropped EXE
PID:4736 -
\??\c:\rrflrrx.exec:\rrflrrx.exe27⤵
- Executes dropped EXE
PID:2180 -
\??\c:\djjdv.exec:\djjdv.exe28⤵
- Executes dropped EXE
PID:4732 -
\??\c:\9tnntn.exec:\9tnntn.exe29⤵
- Executes dropped EXE
PID:1052 -
\??\c:\lrxrlll.exec:\lrxrlll.exe30⤵
- Executes dropped EXE
PID:4504 -
\??\c:\xxxrlfx.exec:\xxxrlfx.exe31⤵
- Executes dropped EXE
PID:3332 -
\??\c:\ppjjd.exec:\ppjjd.exe32⤵
- Executes dropped EXE
PID:4720 -
\??\c:\frlfxrx.exec:\frlfxrx.exe33⤵
- Executes dropped EXE
PID:1272 -
\??\c:\1ddvj.exec:\1ddvj.exe34⤵
- Executes dropped EXE
PID:1912 -
\??\c:\9xffxlf.exec:\9xffxlf.exe35⤵
- Executes dropped EXE
PID:2972 -
\??\c:\5htthh.exec:\5htthh.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:748 -
\??\c:\jpvpd.exec:\jpvpd.exe37⤵
- Executes dropped EXE
PID:2368 -
\??\c:\3rfxffl.exec:\3rfxffl.exe38⤵
- Executes dropped EXE
PID:3356 -
\??\c:\thbhhb.exec:\thbhhb.exe39⤵
- Executes dropped EXE
PID:1800 -
\??\c:\dpdvv.exec:\dpdvv.exe40⤵
- Executes dropped EXE
PID:1520 -
\??\c:\1lfrrff.exec:\1lfrrff.exe41⤵
- Executes dropped EXE
PID:840 -
\??\c:\ttnnhb.exec:\ttnnhb.exe42⤵
- Executes dropped EXE
PID:2508 -
\??\c:\pdvpj.exec:\pdvpj.exe43⤵
- Executes dropped EXE
PID:3440 -
\??\c:\fxfxrlf.exec:\fxfxrlf.exe44⤵
- Executes dropped EXE
PID:3344 -
\??\c:\nthbtb.exec:\nthbtb.exe45⤵
- Executes dropped EXE
PID:2996 -
\??\c:\3pjdd.exec:\3pjdd.exe46⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rflfxxr.exec:\rflfxxr.exe47⤵
- Executes dropped EXE
PID:1896 -
\??\c:\nhhhtn.exec:\nhhhtn.exe48⤵
- Executes dropped EXE
PID:4848 -
\??\c:\jddpj.exec:\jddpj.exe49⤵
- Executes dropped EXE
PID:2752 -
\??\c:\lrxfllx.exec:\lrxfllx.exe50⤵
- Executes dropped EXE
PID:2476 -
\??\c:\btnnnb.exec:\btnnnb.exe51⤵
- Executes dropped EXE
PID:2232 -
\??\c:\9dddv.exec:\9dddv.exe52⤵
- Executes dropped EXE
PID:2592 -
\??\c:\llfxrll.exec:\llfxrll.exe53⤵
- Executes dropped EXE
PID:4448 -
\??\c:\thhbbt.exec:\thhbbt.exe54⤵
- Executes dropped EXE
PID:5060 -
\??\c:\jpvvp.exec:\jpvvp.exe55⤵
- Executes dropped EXE
PID:1296 -
\??\c:\fxfffff.exec:\fxfffff.exe56⤵
- Executes dropped EXE
PID:1772 -
\??\c:\bnbbbb.exec:\bnbbbb.exe57⤵
- Executes dropped EXE
PID:1600 -
\??\c:\9vddp.exec:\9vddp.exe58⤵
- Executes dropped EXE
PID:1892 -
\??\c:\pvjdv.exec:\pvjdv.exe59⤵
- Executes dropped EXE
PID:4280 -
\??\c:\nttttb.exec:\nttttb.exe60⤵
- Executes dropped EXE
PID:4948 -
\??\c:\ddjdj.exec:\ddjdj.exe61⤵
- Executes dropped EXE
PID:844 -
\??\c:\djvpp.exec:\djvpp.exe62⤵
- Executes dropped EXE
PID:2188 -
\??\c:\7nhtht.exec:\7nhtht.exe63⤵
- Executes dropped EXE
PID:3476 -
\??\c:\1pppj.exec:\1pppj.exe64⤵
- Executes dropped EXE
PID:4484 -
\??\c:\ppdvv.exec:\ppdvv.exe65⤵
- Executes dropped EXE
PID:3704 -
\??\c:\tttnnh.exec:\tttnnh.exe66⤵PID:1060
-
\??\c:\vjdpp.exec:\vjdpp.exe67⤵PID:396
-
\??\c:\llffllr.exec:\llffllr.exe68⤵PID:1684
-
\??\c:\hbnhbb.exec:\hbnhbb.exe69⤵PID:2364
-
\??\c:\jpddd.exec:\jpddd.exe70⤵PID:632
-
\??\c:\pppjd.exec:\pppjd.exe71⤵PID:2768
-
\??\c:\rxfrrlf.exec:\rxfrrlf.exe72⤵PID:3172
-
\??\c:\nbhbbb.exec:\nbhbbb.exe73⤵PID:1000
-
\??\c:\frxxrxx.exec:\frxxrxx.exe74⤵PID:4060
-
\??\c:\xlrlxfr.exec:\xlrlxfr.exe75⤵PID:5044
-
\??\c:\hbnhhh.exec:\hbnhhh.exe76⤵PID:2588
-
\??\c:\ppvpj.exec:\ppvpj.exe77⤵PID:4548
-
\??\c:\1lrrlfx.exec:\1lrrlfx.exe78⤵PID:2124
-
\??\c:\nhttnb.exec:\nhttnb.exe79⤵PID:4628
-
\??\c:\jdppp.exec:\jdppp.exe80⤵PID:2388
-
\??\c:\rllfffl.exec:\rllfffl.exe81⤵PID:4120
-
\??\c:\1hhbhn.exec:\1hhbhn.exe82⤵PID:2924
-
\??\c:\djvvj.exec:\djvvj.exe83⤵PID:3324
-
\??\c:\7pvvd.exec:\7pvvd.exe84⤵PID:2760
-
\??\c:\fxxrllr.exec:\fxxrllr.exe85⤵PID:1344
-
\??\c:\hhhhbb.exec:\hhhhbb.exe86⤵PID:2112
-
\??\c:\dpdvd.exec:\dpdvd.exe87⤵PID:4288
-
\??\c:\1jddv.exec:\1jddv.exe88⤵
- System Location Discovery: System Language Discovery
PID:2044 -
\??\c:\rfllfll.exec:\rfllfll.exe89⤵PID:1368
-
\??\c:\5bnhtt.exec:\5bnhtt.exe90⤵PID:3404
-
\??\c:\jvddv.exec:\jvddv.exe91⤵PID:3640
-
\??\c:\xrrllff.exec:\xrrllff.exe92⤵PID:3832
-
\??\c:\rxrrrrr.exec:\rxrrrrr.exe93⤵PID:2180
-
\??\c:\hhtntn.exec:\hhtntn.exe94⤵PID:4680
-
\??\c:\vppvp.exec:\vppvp.exe95⤵PID:4784
-
\??\c:\lrxrllr.exec:\lrxrllr.exe96⤵PID:3116
-
\??\c:\nbnnnn.exec:\nbnnnn.exe97⤵PID:1756
-
\??\c:\tbnnhb.exec:\tbnnhb.exe98⤵PID:2316
-
\??\c:\7pvvv.exec:\7pvvv.exe99⤵PID:2176
-
\??\c:\fflffff.exec:\fflffff.exe100⤵PID:2964
-
\??\c:\bhhntt.exec:\bhhntt.exe101⤵PID:1272
-
\??\c:\1djdd.exec:\1djdd.exe102⤵PID:3776
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe103⤵PID:644
-
\??\c:\nnhbbb.exec:\nnhbbb.exe104⤵PID:1624
-
\??\c:\7ppjj.exec:\7ppjj.exe105⤵PID:116
-
\??\c:\7xxfxxx.exec:\7xxfxxx.exe106⤵PID:1532
-
\??\c:\tttnnn.exec:\tttnnn.exe107⤵PID:3748
-
\??\c:\vddjp.exec:\vddjp.exe108⤵PID:2900
-
\??\c:\xrxxffx.exec:\xrxxffx.exe109⤵PID:1020
-
\??\c:\xlfxlfx.exec:\xlfxlfx.exe110⤵PID:1864
-
\??\c:\9ttnnn.exec:\9ttnnn.exe111⤵PID:3440
-
\??\c:\ppjpp.exec:\ppjpp.exe112⤵PID:3048
-
\??\c:\fxfffff.exec:\fxfffff.exe113⤵PID:3996
-
\??\c:\5bhhnt.exec:\5bhhnt.exe114⤵PID:4024
-
\??\c:\9vppj.exec:\9vppj.exe115⤵PID:532
-
\??\c:\ppjdp.exec:\ppjdp.exe116⤵PID:3100
-
\??\c:\bntttt.exec:\bntttt.exe117⤵PID:968
-
\??\c:\dvvvv.exec:\dvvvv.exe118⤵PID:1976
-
\??\c:\vdjdd.exec:\vdjdd.exe119⤵PID:1244
-
\??\c:\1rrrlxr.exec:\1rrrlxr.exe120⤵PID:5056
-
\??\c:\bnhtbn.exec:\bnhtbn.exe121⤵PID:4436
-
\??\c:\pdjjd.exec:\pdjjd.exe122⤵PID:3820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-