Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 03:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe
-
Size
453KB
-
MD5
7c4ee55372a70b6196c4e9f4e630c8f3
-
SHA1
0f74b176d10d0bf4b37aca649c3d30e4843f4324
-
SHA256
4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0
-
SHA512
f69a48e34352aac3fe35d29e3c41045eddf667833d11e33803e064da38271070e5566c8edd2984c65509ff70c09175a1647b412274da7782922fe9b57622e984
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeY:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1420-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2784-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/508-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2568-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3804-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/844-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2472-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-607-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-657-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-716-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-1009-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-1055-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-1104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-1147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1412-1486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-1778-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2008 bthnnn.exe 3736 ttbbbh.exe 4988 7pvdd.exe 2784 bbttbn.exe 1064 frxfxrl.exe 2308 ppjdd.exe 1484 pvpjj.exe 4432 vvvdv.exe 508 llrrlrl.exe 5048 3nbtbn.exe 2324 hbbthn.exe 4128 vppjv.exe 2444 5djjj.exe 4092 3frrrxx.exe 2568 hthhtt.exe 4488 jvpjv.exe 3156 flxrrxx.exe 4684 pdjdd.exe 3412 9rrlfff.exe 4920 tntttt.exe 3324 ddjjj.exe 3524 ffxxxfx.exe 4144 1hnttb.exe 116 ddjdd.exe 2492 fxfflxx.exe 1168 ttbhnt.exe 4528 9pppp.exe 1564 jddjd.exe 4000 lrxrflr.exe 2472 pdjdp.exe 1328 hnbbnt.exe 4956 9pvpp.exe 1904 rlllllr.exe 1132 9dppv.exe 1004 llllfxf.exe 3136 xllffxr.exe 1988 hhnnnn.exe 3260 djddv.exe 4184 nbntnn.exe 1428 vvjpd.exe 2504 fxfffll.exe 2184 tntnnb.exe 4456 jjvvv.exe 3332 nbhbbb.exe 1492 pppvv.exe 644 nhttth.exe 4060 3dppv.exe 544 xlrllll.exe 3168 nbbtnn.exe 2908 jjvdv.exe 4916 xfrlfxr.exe 5012 hbbbbh.exe 2264 hnbbbh.exe 1884 jvjjj.exe 4420 lffrxfl.exe 4016 tnbbbh.exe 3764 jdjjd.exe 3988 7rxxxxx.exe 1464 hnnntt.exe 4572 1thhbh.exe 4432 lffxrff.exe 4056 rlrrrxr.exe 1532 nnhhbb.exe 4180 3dddd.exe -
resource yara_rule behavioral2/memory/1420-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2784-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/508-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2568-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3804-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/844-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2072-921-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-1009-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfffxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1420 wrote to memory of 2008 1420 4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe 83 PID 1420 wrote to memory of 2008 1420 4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe 83 PID 1420 wrote to memory of 2008 1420 4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe 83 PID 2008 wrote to memory of 3736 2008 bthnnn.exe 84 PID 2008 wrote to memory of 3736 2008 bthnnn.exe 84 PID 2008 wrote to memory of 3736 2008 bthnnn.exe 84 PID 3736 wrote to memory of 4988 3736 ttbbbh.exe 85 PID 3736 wrote to memory of 4988 3736 ttbbbh.exe 85 PID 3736 wrote to memory of 4988 3736 ttbbbh.exe 85 PID 4988 wrote to memory of 2784 4988 7pvdd.exe 86 PID 4988 wrote to memory of 2784 4988 7pvdd.exe 86 PID 4988 wrote to memory of 2784 4988 7pvdd.exe 86 PID 2784 wrote to memory of 1064 2784 bbttbn.exe 87 PID 2784 wrote to memory of 1064 2784 bbttbn.exe 87 PID 2784 wrote to memory of 1064 2784 bbttbn.exe 87 PID 1064 wrote to memory of 2308 1064 frxfxrl.exe 88 PID 1064 wrote to memory of 2308 1064 frxfxrl.exe 88 PID 1064 wrote to memory of 2308 1064 frxfxrl.exe 88 PID 2308 wrote to memory of 1484 2308 ppjdd.exe 89 PID 2308 wrote to memory of 1484 2308 ppjdd.exe 89 PID 2308 wrote to memory of 1484 2308 ppjdd.exe 89 PID 1484 wrote to memory of 4432 1484 pvpjj.exe 90 PID 1484 wrote to memory of 4432 1484 pvpjj.exe 90 PID 1484 wrote to memory of 4432 1484 pvpjj.exe 90 PID 4432 wrote to memory of 508 4432 vvvdv.exe 91 PID 4432 wrote to memory of 508 4432 vvvdv.exe 91 PID 4432 wrote to memory of 508 4432 vvvdv.exe 91 PID 508 wrote to memory of 5048 508 llrrlrl.exe 92 PID 508 wrote to memory of 5048 508 llrrlrl.exe 92 PID 508 wrote to memory of 5048 508 llrrlrl.exe 92 PID 5048 wrote to memory of 2324 5048 3nbtbn.exe 93 PID 5048 wrote to memory of 2324 5048 3nbtbn.exe 93 PID 5048 wrote to memory of 2324 5048 3nbtbn.exe 93 PID 2324 wrote to memory of 4128 2324 hbbthn.exe 94 PID 2324 wrote to memory of 4128 2324 hbbthn.exe 94 PID 2324 wrote to memory of 4128 2324 hbbthn.exe 94 PID 4128 wrote to memory of 2444 4128 vppjv.exe 95 PID 4128 wrote to memory of 2444 4128 vppjv.exe 95 PID 4128 wrote to memory of 2444 4128 vppjv.exe 95 PID 2444 wrote to memory of 4092 2444 5djjj.exe 96 PID 2444 wrote to memory of 4092 2444 5djjj.exe 96 PID 2444 wrote to memory of 4092 2444 5djjj.exe 96 PID 4092 wrote to memory of 2568 4092 3frrrxx.exe 97 PID 4092 wrote to memory of 2568 4092 3frrrxx.exe 97 PID 4092 wrote to memory of 2568 4092 3frrrxx.exe 97 PID 2568 wrote to memory of 4488 2568 hthhtt.exe 98 PID 2568 wrote to memory of 4488 2568 hthhtt.exe 98 PID 2568 wrote to memory of 4488 2568 hthhtt.exe 98 PID 4488 wrote to memory of 3156 4488 jvpjv.exe 99 PID 4488 wrote to memory of 3156 4488 jvpjv.exe 99 PID 4488 wrote to memory of 3156 4488 jvpjv.exe 99 PID 3156 wrote to memory of 4684 3156 flxrrxx.exe 100 PID 3156 wrote to memory of 4684 3156 flxrrxx.exe 100 PID 3156 wrote to memory of 4684 3156 flxrrxx.exe 100 PID 4684 wrote to memory of 3412 4684 pdjdd.exe 101 PID 4684 wrote to memory of 3412 4684 pdjdd.exe 101 PID 4684 wrote to memory of 3412 4684 pdjdd.exe 101 PID 3412 wrote to memory of 4920 3412 9rrlfff.exe 102 PID 3412 wrote to memory of 4920 3412 9rrlfff.exe 102 PID 3412 wrote to memory of 4920 3412 9rrlfff.exe 102 PID 4920 wrote to memory of 3324 4920 tntttt.exe 103 PID 4920 wrote to memory of 3324 4920 tntttt.exe 103 PID 4920 wrote to memory of 3324 4920 tntttt.exe 103 PID 3324 wrote to memory of 3524 3324 ddjjj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe"C:\Users\Admin\AppData\Local\Temp\4ee035a1c99acbc08f978adbcf231c9a3ec699fabaf4fe7967987c152b3a22c0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\bthnnn.exec:\bthnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\ttbbbh.exec:\ttbbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\7pvdd.exec:\7pvdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\bbttbn.exec:\bbttbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\frxfxrl.exec:\frxfxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\ppjdd.exec:\ppjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\pvpjj.exec:\pvpjj.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\vvvdv.exec:\vvvdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\llrrlrl.exec:\llrrlrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
\??\c:\3nbtbn.exec:\3nbtbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\hbbthn.exec:\hbbthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\vppjv.exec:\vppjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\5djjj.exec:\5djjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\3frrrxx.exec:\3frrrxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\hthhtt.exec:\hthhtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\jvpjv.exec:\jvpjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\flxrrxx.exec:\flxrrxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\pdjdd.exec:\pdjdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\9rrlfff.exec:\9rrlfff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\tntttt.exec:\tntttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\ddjjj.exec:\ddjjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\ffxxxfx.exec:\ffxxxfx.exe23⤵
- Executes dropped EXE
PID:3524 -
\??\c:\1hnttb.exec:\1hnttb.exe24⤵
- Executes dropped EXE
PID:4144 -
\??\c:\ddjdd.exec:\ddjdd.exe25⤵
- Executes dropped EXE
PID:116 -
\??\c:\fxfflxx.exec:\fxfflxx.exe26⤵
- Executes dropped EXE
PID:2492 -
\??\c:\ttbhnt.exec:\ttbhnt.exe27⤵
- Executes dropped EXE
PID:1168 -
\??\c:\9pppp.exec:\9pppp.exe28⤵
- Executes dropped EXE
PID:4528 -
\??\c:\jddjd.exec:\jddjd.exe29⤵
- Executes dropped EXE
PID:1564 -
\??\c:\lrxrflr.exec:\lrxrflr.exe30⤵
- Executes dropped EXE
PID:4000 -
\??\c:\pdjdp.exec:\pdjdp.exe31⤵
- Executes dropped EXE
PID:2472 -
\??\c:\hnbbnt.exec:\hnbbnt.exe32⤵
- Executes dropped EXE
PID:1328 -
\??\c:\9pvpp.exec:\9pvpp.exe33⤵
- Executes dropped EXE
PID:4956 -
\??\c:\rlllllr.exec:\rlllllr.exe34⤵
- Executes dropped EXE
PID:1904 -
\??\c:\9dppv.exec:\9dppv.exe35⤵
- Executes dropped EXE
PID:1132 -
\??\c:\llllfxf.exec:\llllfxf.exe36⤵
- Executes dropped EXE
PID:1004 -
\??\c:\xllffxr.exec:\xllffxr.exe37⤵
- Executes dropped EXE
PID:3136 -
\??\c:\hhnnnn.exec:\hhnnnn.exe38⤵
- Executes dropped EXE
PID:1988 -
\??\c:\djddv.exec:\djddv.exe39⤵
- Executes dropped EXE
PID:3260 -
\??\c:\nbntnn.exec:\nbntnn.exe40⤵
- Executes dropped EXE
PID:4184 -
\??\c:\vvjpd.exec:\vvjpd.exe41⤵
- Executes dropped EXE
PID:1428 -
\??\c:\fxfffll.exec:\fxfffll.exe42⤵
- Executes dropped EXE
PID:2504 -
\??\c:\tntnnb.exec:\tntnnb.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2184 -
\??\c:\jjvvv.exec:\jjvvv.exe44⤵
- Executes dropped EXE
PID:4456 -
\??\c:\nbhbbb.exec:\nbhbbb.exe45⤵
- Executes dropped EXE
PID:3332 -
\??\c:\pppvv.exec:\pppvv.exe46⤵
- Executes dropped EXE
PID:1492 -
\??\c:\nhttth.exec:\nhttth.exe47⤵
- Executes dropped EXE
PID:644 -
\??\c:\3dppv.exec:\3dppv.exe48⤵
- Executes dropped EXE
PID:4060 -
\??\c:\xlrllll.exec:\xlrllll.exe49⤵
- Executes dropped EXE
PID:544 -
\??\c:\nbbtnn.exec:\nbbtnn.exe50⤵
- Executes dropped EXE
PID:3168 -
\??\c:\jjvdv.exec:\jjvdv.exe51⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xfrlfxr.exec:\xfrlfxr.exe52⤵
- Executes dropped EXE
PID:4916 -
\??\c:\hbbbbh.exec:\hbbbbh.exe53⤵
- Executes dropped EXE
PID:5012 -
\??\c:\hnbbbh.exec:\hnbbbh.exe54⤵
- Executes dropped EXE
PID:2264 -
\??\c:\jvjjj.exec:\jvjjj.exe55⤵
- Executes dropped EXE
PID:1884 -
\??\c:\lffrxfl.exec:\lffrxfl.exe56⤵
- Executes dropped EXE
PID:4420 -
\??\c:\tnbbbh.exec:\tnbbbh.exe57⤵
- Executes dropped EXE
PID:4016 -
\??\c:\jdjjd.exec:\jdjjd.exe58⤵
- Executes dropped EXE
PID:3764 -
\??\c:\7rxxxxx.exec:\7rxxxxx.exe59⤵
- Executes dropped EXE
PID:3988 -
\??\c:\hnnntt.exec:\hnnntt.exe60⤵
- Executes dropped EXE
PID:1464 -
\??\c:\1thhbh.exec:\1thhbh.exe61⤵
- Executes dropped EXE
PID:4572 -
\??\c:\lffxrff.exec:\lffxrff.exe62⤵
- Executes dropped EXE
PID:4432 -
\??\c:\rlrrrxr.exec:\rlrrrxr.exe63⤵
- Executes dropped EXE
PID:4056 -
\??\c:\nnhhbb.exec:\nnhhbb.exe64⤵
- Executes dropped EXE
PID:1532 -
\??\c:\3dddd.exec:\3dddd.exe65⤵
- Executes dropped EXE
PID:4180 -
\??\c:\flffffl.exec:\flffffl.exe66⤵PID:4316
-
\??\c:\thbbtt.exec:\thbbtt.exe67⤵PID:3536
-
\??\c:\vjjjj.exec:\vjjjj.exe68⤵PID:2728
-
\??\c:\ffxrlrl.exec:\ffxrlrl.exe69⤵PID:3804
-
\??\c:\5tttnt.exec:\5tttnt.exe70⤵PID:2376
-
\??\c:\dpvvj.exec:\dpvvj.exe71⤵PID:3204
-
\??\c:\llffrrl.exec:\llffrrl.exe72⤵PID:1816
-
\??\c:\1bhhhn.exec:\1bhhhn.exe73⤵PID:2988
-
\??\c:\tnhbhb.exec:\tnhbhb.exe74⤵PID:4992
-
\??\c:\vvpvd.exec:\vvpvd.exe75⤵PID:3304
-
\??\c:\lflfxrl.exec:\lflfxrl.exe76⤵PID:4668
-
\??\c:\bbbtnn.exec:\bbbtnn.exe77⤵PID:4564
-
\??\c:\pdppv.exec:\pdppv.exe78⤵PID:700
-
\??\c:\rlxrffx.exec:\rlxrffx.exe79⤵PID:3652
-
\??\c:\nnnnhh.exec:\nnnnhh.exe80⤵PID:4244
-
\??\c:\hbhhhn.exec:\hbhhhn.exe81⤵PID:4924
-
\??\c:\ddvjj.exec:\ddvjj.exe82⤵PID:1792
-
\??\c:\9xxxxff.exec:\9xxxxff.exe83⤵PID:588
-
\??\c:\ntbthh.exec:\ntbthh.exe84⤵PID:2328
-
\??\c:\djjdv.exec:\djjdv.exe85⤵PID:4084
-
\??\c:\frffffl.exec:\frffffl.exe86⤵PID:2492
-
\??\c:\3hhhbh.exec:\3hhhbh.exe87⤵PID:4100
-
\??\c:\pjddj.exec:\pjddj.exe88⤵PID:2212
-
\??\c:\5vddj.exec:\5vddj.exe89⤵PID:2476
-
\??\c:\xfxflrx.exec:\xfxflrx.exe90⤵PID:4616
-
\??\c:\tttnnh.exec:\tttnnh.exe91⤵PID:4824
-
\??\c:\dvjdd.exec:\dvjdd.exe92⤵PID:432
-
\??\c:\fxxlxxr.exec:\fxxlxxr.exe93⤵PID:2472
-
\??\c:\nnnbtt.exec:\nnnbtt.exe94⤵PID:4348
-
\??\c:\vjppj.exec:\vjppj.exe95⤵PID:3816
-
\??\c:\pvdvv.exec:\pvdvv.exe96⤵PID:4956
-
\??\c:\lfxrrlf.exec:\lfxrrlf.exe97⤵PID:3216
-
\??\c:\5btttt.exec:\5btttt.exe98⤵PID:1284
-
\??\c:\rxxxxfr.exec:\rxxxxfr.exe99⤵PID:4648
-
\??\c:\ttttnn.exec:\ttttnn.exe100⤵PID:5040
-
\??\c:\vdjjv.exec:\vdjjv.exe101⤵PID:1692
-
\??\c:\rfrrrxr.exec:\rfrrrxr.exe102⤵PID:1668
-
\??\c:\ntnhhn.exec:\ntnhhn.exe103⤵PID:3260
-
\??\c:\bbnhbb.exec:\bbnhbb.exe104⤵PID:3288
-
\??\c:\jpvjd.exec:\jpvjd.exe105⤵PID:3208
-
\??\c:\xlxfrxr.exec:\xlxfrxr.exe106⤵PID:2844
-
\??\c:\hnbbtn.exec:\hnbbtn.exe107⤵PID:4424
-
\??\c:\jppjp.exec:\jppjp.exe108⤵PID:1036
-
\??\c:\3lrfxff.exec:\3lrfxff.exe109⤵PID:1300
-
\??\c:\hnnbbb.exec:\hnnbbb.exe110⤵PID:3408
-
\??\c:\vpjjd.exec:\vpjjd.exe111⤵PID:540
-
\??\c:\vdvvd.exec:\vdvvd.exe112⤵PID:1608
-
\??\c:\hbbhnh.exec:\hbbhnh.exe113⤵PID:2228
-
\??\c:\tttnbb.exec:\tttnbb.exe114⤵PID:3212
-
\??\c:\pvddv.exec:\pvddv.exe115⤵PID:2704
-
\??\c:\flfxxxr.exec:\flfxxxr.exe116⤵PID:1292
-
\??\c:\thtbnb.exec:\thtbnb.exe117⤵PID:1620
-
\??\c:\jddvp.exec:\jddvp.exe118⤵PID:4988
-
\??\c:\7vjjd.exec:\7vjjd.exe119⤵PID:5044
-
\??\c:\flxlrrl.exec:\flxlrrl.exe120⤵PID:760
-
\??\c:\nhhbbb.exec:\nhhbbb.exe121⤵PID:1924
-
\??\c:\9djpp.exec:\9djpp.exe122⤵PID:4936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-