Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 04:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d555f3a07f4b639effe3ae2a8ee2d1a893e8f63a387b5f77eb352b021c699b23.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d555f3a07f4b639effe3ae2a8ee2d1a893e8f63a387b5f77eb352b021c699b23.exe
-
Size
455KB
-
MD5
af40a74c0f70c93a16970ec5c319283b
-
SHA1
45ec2d42093ee15866f9a81eacbc25c9b7ebd0e0
-
SHA256
d555f3a07f4b639effe3ae2a8ee2d1a893e8f63a387b5f77eb352b021c699b23
-
SHA512
59155c497e068cf08dcc463e95a5a5433167d617f82505ac213c5dff62f5cb3e653a59b4281c0d3497d54a9ef5e9c0548fb5a0ebbb98971c20012c5665d23939
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbee:q7Tc2NYHUrAwfMp3CDe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2644-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/712-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2492-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1384-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1300-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2112-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/184-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3900-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-627-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2988-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2712-1021-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-1556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-1763-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4676 btnnbt.exe 4496 bthhnn.exe 4436 jdvvd.exe 2632 rllrrlx.exe 4904 ttnnbh.exe 3608 xxfxrfl.exe 1924 bnhhbn.exe 3016 ppdvv.exe 1672 xrfxrrl.exe 2792 nnnhhb.exe 1488 jjvpp.exe 1132 llfxxfx.exe 1936 bntnhb.exe 1204 dpdvp.exe 3520 lfrrlxr.exe 4860 3flrlrl.exe 4984 rxlxrrl.exe 4324 fxfffll.exe 3164 fffxlrl.exe 4852 vdjjd.exe 3976 3jpdj.exe 3080 djdpv.exe 4152 xrrlffx.exe 4956 vdppd.exe 1604 flxrrrl.exe 4520 ppvvv.exe 4832 7lxflrr.exe 548 nnnhhb.exe 2928 9lrlfxr.exe 3104 tbtnnn.exe 916 pjvvd.exe 3372 btnnnn.exe 2372 dvdpv.exe 1504 3rlfxxr.exe 1304 htnnht.exe 668 jpvpp.exe 3992 xxllrxx.exe 628 hbhhbh.exe 712 httnht.exe 116 xfrlfxr.exe 4408 rllxrrf.exe 4640 nhhbtn.exe 1500 jdjjd.exe 3248 5xfxlrf.exe 2788 fxfxrlx.exe 1376 btbtnn.exe 4712 jddvp.exe 2504 3xrfxxl.exe 4508 tttnhh.exe 4056 pvvvj.exe 3428 rlxxxxx.exe 2492 nhbtnh.exe 3932 jjpjd.exe 1380 pvdpv.exe 4756 7rrxrll.exe 4212 bnnhbb.exe 1496 1djdv.exe 1384 xfrrfff.exe 4948 bbhtnh.exe 1940 1pvvp.exe 5076 ffrllrl.exe 3020 nhtntt.exe 1300 nbbtbb.exe 2292 rfffflr.exe -
resource yara_rule behavioral2/memory/4676-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/712-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2492-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1384-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1300-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2112-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/184-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3900-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2988-695-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxxxr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 4676 2644 d555f3a07f4b639effe3ae2a8ee2d1a893e8f63a387b5f77eb352b021c699b23.exe 82 PID 2644 wrote to memory of 4676 2644 d555f3a07f4b639effe3ae2a8ee2d1a893e8f63a387b5f77eb352b021c699b23.exe 82 PID 2644 wrote to memory of 4676 2644 d555f3a07f4b639effe3ae2a8ee2d1a893e8f63a387b5f77eb352b021c699b23.exe 82 PID 4676 wrote to memory of 4496 4676 btnnbt.exe 83 PID 4676 wrote to memory of 4496 4676 btnnbt.exe 83 PID 4676 wrote to memory of 4496 4676 btnnbt.exe 83 PID 4496 wrote to memory of 4436 4496 bthhnn.exe 84 PID 4496 wrote to memory of 4436 4496 bthhnn.exe 84 PID 4496 wrote to memory of 4436 4496 bthhnn.exe 84 PID 4436 wrote to memory of 2632 4436 jdvvd.exe 85 PID 4436 wrote to memory of 2632 4436 jdvvd.exe 85 PID 4436 wrote to memory of 2632 4436 jdvvd.exe 85 PID 2632 wrote to memory of 4904 2632 rllrrlx.exe 86 PID 2632 wrote to memory of 4904 2632 rllrrlx.exe 86 PID 2632 wrote to memory of 4904 2632 rllrrlx.exe 86 PID 4904 wrote to memory of 3608 4904 ttnnbh.exe 87 PID 4904 wrote to memory of 3608 4904 ttnnbh.exe 87 PID 4904 wrote to memory of 3608 4904 ttnnbh.exe 87 PID 3608 wrote to memory of 1924 3608 xxfxrfl.exe 88 PID 3608 wrote to memory of 1924 3608 xxfxrfl.exe 88 PID 3608 wrote to memory of 1924 3608 xxfxrfl.exe 88 PID 1924 wrote to memory of 3016 1924 bnhhbn.exe 89 PID 1924 wrote to memory of 3016 1924 bnhhbn.exe 89 PID 1924 wrote to memory of 3016 1924 bnhhbn.exe 89 PID 3016 wrote to memory of 1672 3016 ppdvv.exe 90 PID 3016 wrote to memory of 1672 3016 ppdvv.exe 90 PID 3016 wrote to memory of 1672 3016 ppdvv.exe 90 PID 1672 wrote to memory of 2792 1672 xrfxrrl.exe 91 PID 1672 wrote to memory of 2792 1672 xrfxrrl.exe 91 PID 1672 wrote to memory of 2792 1672 xrfxrrl.exe 91 PID 2792 wrote to memory of 1488 2792 nnnhhb.exe 92 PID 2792 wrote to memory of 1488 2792 nnnhhb.exe 92 PID 2792 wrote to memory of 1488 2792 nnnhhb.exe 92 PID 1488 wrote to memory of 1132 1488 jjvpp.exe 93 PID 1488 wrote to memory of 1132 1488 jjvpp.exe 93 PID 1488 wrote to memory of 1132 1488 jjvpp.exe 93 PID 1132 wrote to memory of 1936 1132 llfxxfx.exe 94 PID 1132 wrote to memory of 1936 1132 llfxxfx.exe 94 PID 1132 wrote to memory of 1936 1132 llfxxfx.exe 94 PID 1936 wrote to memory of 1204 1936 bntnhb.exe 95 PID 1936 wrote to memory of 1204 1936 bntnhb.exe 95 PID 1936 wrote to memory of 1204 1936 bntnhb.exe 95 PID 1204 wrote to memory of 3520 1204 dpdvp.exe 96 PID 1204 wrote to memory of 3520 1204 dpdvp.exe 96 PID 1204 wrote to memory of 3520 1204 dpdvp.exe 96 PID 3520 wrote to memory of 4860 3520 lfrrlxr.exe 97 PID 3520 wrote to memory of 4860 3520 lfrrlxr.exe 97 PID 3520 wrote to memory of 4860 3520 lfrrlxr.exe 97 PID 4860 wrote to memory of 4984 4860 3flrlrl.exe 98 PID 4860 wrote to memory of 4984 4860 3flrlrl.exe 98 PID 4860 wrote to memory of 4984 4860 3flrlrl.exe 98 PID 4984 wrote to memory of 4324 4984 rxlxrrl.exe 99 PID 4984 wrote to memory of 4324 4984 rxlxrrl.exe 99 PID 4984 wrote to memory of 4324 4984 rxlxrrl.exe 99 PID 4324 wrote to memory of 3164 4324 fxfffll.exe 100 PID 4324 wrote to memory of 3164 4324 fxfffll.exe 100 PID 4324 wrote to memory of 3164 4324 fxfffll.exe 100 PID 3164 wrote to memory of 4852 3164 fffxlrl.exe 101 PID 3164 wrote to memory of 4852 3164 fffxlrl.exe 101 PID 3164 wrote to memory of 4852 3164 fffxlrl.exe 101 PID 4852 wrote to memory of 3976 4852 vdjjd.exe 102 PID 4852 wrote to memory of 3976 4852 vdjjd.exe 102 PID 4852 wrote to memory of 3976 4852 vdjjd.exe 102 PID 3976 wrote to memory of 3080 3976 3jpdj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\d555f3a07f4b639effe3ae2a8ee2d1a893e8f63a387b5f77eb352b021c699b23.exe"C:\Users\Admin\AppData\Local\Temp\d555f3a07f4b639effe3ae2a8ee2d1a893e8f63a387b5f77eb352b021c699b23.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\btnnbt.exec:\btnnbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\bthhnn.exec:\bthhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\jdvvd.exec:\jdvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\rllrrlx.exec:\rllrrlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\ttnnbh.exec:\ttnnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\xxfxrfl.exec:\xxfxrfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\bnhhbn.exec:\bnhhbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\ppdvv.exec:\ppdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\nnnhhb.exec:\nnnhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\jjvpp.exec:\jjvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\llfxxfx.exec:\llfxxfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\bntnhb.exec:\bntnhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\dpdvp.exec:\dpdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\lfrrlxr.exec:\lfrrlxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\3flrlrl.exec:\3flrlrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\rxlxrrl.exec:\rxlxrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\fxfffll.exec:\fxfffll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\fffxlrl.exec:\fffxlrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\vdjjd.exec:\vdjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\3jpdj.exec:\3jpdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\djdpv.exec:\djdpv.exe23⤵
- Executes dropped EXE
PID:3080 -
\??\c:\xrrlffx.exec:\xrrlffx.exe24⤵
- Executes dropped EXE
PID:4152 -
\??\c:\vdppd.exec:\vdppd.exe25⤵
- Executes dropped EXE
PID:4956 -
\??\c:\flxrrrl.exec:\flxrrrl.exe26⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ppvvv.exec:\ppvvv.exe27⤵
- Executes dropped EXE
PID:4520 -
\??\c:\7lxflrr.exec:\7lxflrr.exe28⤵
- Executes dropped EXE
PID:4832 -
\??\c:\nnnhhb.exec:\nnnhhb.exe29⤵
- Executes dropped EXE
PID:548 -
\??\c:\9lrlfxr.exec:\9lrlfxr.exe30⤵
- Executes dropped EXE
PID:2928 -
\??\c:\tbtnnn.exec:\tbtnnn.exe31⤵
- Executes dropped EXE
PID:3104 -
\??\c:\pjvvd.exec:\pjvvd.exe32⤵
- Executes dropped EXE
PID:916 -
\??\c:\btnnnn.exec:\btnnnn.exe33⤵
- Executes dropped EXE
PID:3372 -
\??\c:\dvdpv.exec:\dvdpv.exe34⤵
- Executes dropped EXE
PID:2372 -
\??\c:\3rlfxxr.exec:\3rlfxxr.exe35⤵
- Executes dropped EXE
PID:1504 -
\??\c:\htnnht.exec:\htnnht.exe36⤵
- Executes dropped EXE
PID:1304 -
\??\c:\jpvpp.exec:\jpvpp.exe37⤵
- Executes dropped EXE
PID:668 -
\??\c:\xxllrxx.exec:\xxllrxx.exe38⤵
- Executes dropped EXE
PID:3992 -
\??\c:\hbhhbh.exec:\hbhhbh.exe39⤵
- Executes dropped EXE
PID:628 -
\??\c:\httnht.exec:\httnht.exe40⤵
- Executes dropped EXE
PID:712 -
\??\c:\xfrlfxr.exec:\xfrlfxr.exe41⤵
- Executes dropped EXE
PID:116 -
\??\c:\rllxrrf.exec:\rllxrrf.exe42⤵
- Executes dropped EXE
PID:4408 -
\??\c:\nhhbtn.exec:\nhhbtn.exe43⤵
- Executes dropped EXE
PID:4640 -
\??\c:\jdjjd.exec:\jdjjd.exe44⤵
- Executes dropped EXE
PID:1500 -
\??\c:\5xfxlrf.exec:\5xfxlrf.exe45⤵
- Executes dropped EXE
PID:3248 -
\??\c:\fxfxrlx.exec:\fxfxrlx.exe46⤵
- Executes dropped EXE
PID:2788 -
\??\c:\btbtnn.exec:\btbtnn.exe47⤵
- Executes dropped EXE
PID:1376 -
\??\c:\jddvp.exec:\jddvp.exe48⤵
- Executes dropped EXE
PID:4712 -
\??\c:\3xrfxxl.exec:\3xrfxxl.exe49⤵
- Executes dropped EXE
PID:2504 -
\??\c:\tttnhh.exec:\tttnhh.exe50⤵
- Executes dropped EXE
PID:4508 -
\??\c:\pvvvj.exec:\pvvvj.exe51⤵
- Executes dropped EXE
PID:4056 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe52⤵
- Executes dropped EXE
PID:3428 -
\??\c:\nhbtnh.exec:\nhbtnh.exe53⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jjpjd.exec:\jjpjd.exe54⤵
- Executes dropped EXE
PID:3932 -
\??\c:\pvdpv.exec:\pvdpv.exe55⤵
- Executes dropped EXE
PID:1380 -
\??\c:\7rrxrll.exec:\7rrxrll.exe56⤵
- Executes dropped EXE
PID:4756 -
\??\c:\bnnhbb.exec:\bnnhbb.exe57⤵
- Executes dropped EXE
PID:4212 -
\??\c:\1djdv.exec:\1djdv.exe58⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xfrrfff.exec:\xfrrfff.exe59⤵
- Executes dropped EXE
PID:1384 -
\??\c:\bbhtnh.exec:\bbhtnh.exe60⤵
- Executes dropped EXE
PID:4948 -
\??\c:\1pvvp.exec:\1pvvp.exe61⤵
- Executes dropped EXE
PID:1940 -
\??\c:\ffrllrl.exec:\ffrllrl.exe62⤵
- Executes dropped EXE
PID:5076 -
\??\c:\nhtntt.exec:\nhtntt.exe63⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nbbtbb.exec:\nbbtbb.exe64⤵
- Executes dropped EXE
PID:1300 -
\??\c:\rfffflr.exec:\rfffflr.exe65⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nbhhhn.exec:\nbhhhn.exe66⤵PID:3592
-
\??\c:\nbhtnn.exec:\nbhtnn.exe67⤵PID:592
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe68⤵PID:1144
-
\??\c:\9tnbnn.exec:\9tnbnn.exe69⤵PID:4860
-
\??\c:\3tbthb.exec:\3tbthb.exe70⤵PID:208
-
\??\c:\vvdvv.exec:\vvdvv.exe71⤵PID:1176
-
\??\c:\xllxxrx.exec:\xllxxrx.exe72⤵PID:4324
-
\??\c:\tnbtnh.exec:\tnbtnh.exe73⤵PID:1456
-
\??\c:\ddjpp.exec:\ddjpp.exe74⤵
- System Location Discovery: System Language Discovery
PID:2524 -
\??\c:\lfxxffl.exec:\lfxxffl.exe75⤵PID:3584
-
\??\c:\hhhbnn.exec:\hhhbnn.exe76⤵PID:2704
-
\??\c:\ddjpv.exec:\ddjpv.exe77⤵PID:3080
-
\??\c:\rlfrlfx.exec:\rlfrlfx.exe78⤵PID:4424
-
\??\c:\tbhbtt.exec:\tbhbtt.exe79⤵PID:1080
-
\??\c:\pjvpj.exec:\pjvpj.exe80⤵PID:2112
-
\??\c:\ppvvd.exec:\ppvvd.exe81⤵PID:4760
-
\??\c:\xxrxflr.exec:\xxrxflr.exe82⤵PID:212
-
\??\c:\1thhth.exec:\1thhth.exe83⤵PID:2388
-
\??\c:\5vddv.exec:\5vddv.exe84⤵PID:4832
-
\??\c:\1jddv.exec:\1jddv.exe85⤵PID:548
-
\??\c:\3rfxrxx.exec:\3rfxrxx.exe86⤵PID:1908
-
\??\c:\frxxxff.exec:\frxxxff.exe87⤵PID:3200
-
\??\c:\thtnnt.exec:\thtnnt.exe88⤵PID:784
-
\??\c:\7djjd.exec:\7djjd.exe89⤵PID:4740
-
\??\c:\rlxxrrr.exec:\rlxxrrr.exe90⤵PID:1408
-
\??\c:\1bhtbh.exec:\1bhtbh.exe91⤵PID:4620
-
\??\c:\jpppj.exec:\jpppj.exe92⤵PID:5012
-
\??\c:\frrlxfx.exec:\frrlxfx.exe93⤵PID:968
-
\??\c:\bnbbtb.exec:\bnbbtb.exe94⤵PID:3808
-
\??\c:\vpdvv.exec:\vpdvv.exe95⤵PID:184
-
\??\c:\ddjjj.exec:\ddjjj.exe96⤵PID:3900
-
\??\c:\7rxxrff.exec:\7rxxrff.exe97⤵PID:4624
-
\??\c:\9thhhn.exec:\9thhhn.exe98⤵PID:4692
-
\??\c:\pjppj.exec:\pjppj.exe99⤵PID:1040
-
\??\c:\fxrrlll.exec:\fxrrlll.exe100⤵PID:3348
-
\??\c:\lrxxrll.exec:\lrxxrll.exe101⤵PID:4408
-
\??\c:\thttnn.exec:\thttnn.exe102⤵PID:4640
-
\??\c:\7pdjd.exec:\7pdjd.exe103⤵PID:1500
-
\??\c:\llxxrxx.exec:\llxxrxx.exe104⤵PID:1092
-
\??\c:\bhtttt.exec:\bhtttt.exe105⤵PID:4328
-
\??\c:\ttnhbh.exec:\ttnhbh.exe106⤵PID:404
-
\??\c:\7vddv.exec:\7vddv.exe107⤵PID:1032
-
\??\c:\xrxlxfr.exec:\xrxlxfr.exe108⤵PID:4712
-
\??\c:\nhhhtb.exec:\nhhhtb.exe109⤵PID:2504
-
\??\c:\bbntbb.exec:\bbntbb.exe110⤵PID:4436
-
\??\c:\jpddd.exec:\jpddd.exe111⤵PID:2632
-
\??\c:\7rrrrrx.exec:\7rrrrrx.exe112⤵PID:3496
-
\??\c:\xxfffff.exec:\xxfffff.exe113⤵PID:2428
-
\??\c:\tnbttt.exec:\tnbttt.exe114⤵PID:3504
-
\??\c:\jjppd.exec:\jjppd.exe115⤵PID:3932
-
\??\c:\xrfffll.exec:\xrfffll.exe116⤵PID:2892
-
\??\c:\rxffxxx.exec:\rxffxxx.exe117⤵PID:3536
-
\??\c:\tbnhhn.exec:\tbnhhn.exe118⤵PID:932
-
\??\c:\pdpdv.exec:\pdpdv.exe119⤵PID:4836
-
\??\c:\lflffff.exec:\lflffff.exe120⤵PID:4388
-
\??\c:\lxxxffl.exec:\lxxxffl.exe121⤵PID:4920
-
\??\c:\bthnht.exec:\bthnht.exe122⤵PID:2988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-