Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 04:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe
-
Size
454KB
-
MD5
00ebe5aa3e0cfa89b5d66da611833774
-
SHA1
03c2951df57b5427f310d4c230d0b969ed66ef1d
-
SHA256
d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819
-
SHA512
534c7935ec0847bad84d9dcbd5b8a19322ae0cd4a850cda4a7b9b07d3a5e45c5a83812b38f9a4afba2c840dca5281fd506db737ec7748587dfdbc0e55caa0ac9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAben:q7Tc2NYHUrAwfMp3CDn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4384-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2012-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/716-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/732-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/716-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2772-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1856-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-713-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-732-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-784-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-877-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-944-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-1405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-1595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3500 bbbnbt.exe 2924 hhbbbb.exe 4792 vvpjd.exe 3308 pvddv.exe 4860 btnbtt.exe 4804 fxxlfxr.exe 2612 5jpjp.exe 4296 tnnnbt.exe 408 llxlfxl.exe 4308 9pppj.exe 3656 jpjdv.exe 716 ppvvv.exe 2012 fxffxxr.exe 2596 nnhnhn.exe 4092 hbtnhb.exe 4168 vjjjj.exe 3880 7frlrrf.exe 4952 hbbntb.exe 112 jvpjj.exe 4900 flxfxxf.exe 3364 nnhbnh.exe 1980 pddvp.exe 2028 rllffff.exe 2456 1nnhtt.exe 2964 pdjjd.exe 2664 xxlfxrl.exe 3788 ttnbtn.exe 732 rxrfxrl.exe 1604 dvpjd.exe 3976 ffxlfxl.exe 3492 jjdvp.exe 5112 xlffxxr.exe 4440 bhthbb.exe 4944 ddpjv.exe 2384 tnnbnh.exe 2228 djdpj.exe 2508 rlfxfxx.exe 3552 nhnhhb.exe 3768 xrrlfxl.exe 3392 htnhbt.exe 4348 tbbnht.exe 3244 dvvpj.exe 1676 ntnnhh.exe 4452 vpjdv.exe 4248 3xffxxl.exe 4936 ttnbtb.exe 4256 jpddv.exe 3412 lrrfxrf.exe 116 rllxrrl.exe 3840 btnbbh.exe 4804 dvpjv.exe 3864 9jdpj.exe 1500 fxxfxxf.exe 4244 btnnhh.exe 1424 dvpvj.exe 1900 ffxxxxx.exe 2796 9ttbnt.exe 3196 htnnbb.exe 716 9jpjd.exe 3792 rxrlxxr.exe 2288 xfflfxr.exe 1544 tnnnhh.exe 4060 pjdvj.exe 3040 xxxxlxf.exe -
resource yara_rule behavioral2/memory/4384-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2012-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/716-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2664-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/732-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/716-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2772-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1856-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3312-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-836-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-944-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4384 wrote to memory of 3500 4384 d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe 83 PID 4384 wrote to memory of 3500 4384 d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe 83 PID 4384 wrote to memory of 3500 4384 d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe 83 PID 3500 wrote to memory of 2924 3500 bbbnbt.exe 84 PID 3500 wrote to memory of 2924 3500 bbbnbt.exe 84 PID 3500 wrote to memory of 2924 3500 bbbnbt.exe 84 PID 2924 wrote to memory of 4792 2924 hhbbbb.exe 85 PID 2924 wrote to memory of 4792 2924 hhbbbb.exe 85 PID 2924 wrote to memory of 4792 2924 hhbbbb.exe 85 PID 4792 wrote to memory of 3308 4792 vvpjd.exe 86 PID 4792 wrote to memory of 3308 4792 vvpjd.exe 86 PID 4792 wrote to memory of 3308 4792 vvpjd.exe 86 PID 3308 wrote to memory of 4860 3308 pvddv.exe 87 PID 3308 wrote to memory of 4860 3308 pvddv.exe 87 PID 3308 wrote to memory of 4860 3308 pvddv.exe 87 PID 4860 wrote to memory of 4804 4860 btnbtt.exe 88 PID 4860 wrote to memory of 4804 4860 btnbtt.exe 88 PID 4860 wrote to memory of 4804 4860 btnbtt.exe 88 PID 4804 wrote to memory of 2612 4804 fxxlfxr.exe 89 PID 4804 wrote to memory of 2612 4804 fxxlfxr.exe 89 PID 4804 wrote to memory of 2612 4804 fxxlfxr.exe 89 PID 2612 wrote to memory of 4296 2612 5jpjp.exe 90 PID 2612 wrote to memory of 4296 2612 5jpjp.exe 90 PID 2612 wrote to memory of 4296 2612 5jpjp.exe 90 PID 4296 wrote to memory of 408 4296 tnnnbt.exe 91 PID 4296 wrote to memory of 408 4296 tnnnbt.exe 91 PID 4296 wrote to memory of 408 4296 tnnnbt.exe 91 PID 408 wrote to memory of 4308 408 llxlfxl.exe 92 PID 408 wrote to memory of 4308 408 llxlfxl.exe 92 PID 408 wrote to memory of 4308 408 llxlfxl.exe 92 PID 4308 wrote to memory of 3656 4308 9pppj.exe 93 PID 4308 wrote to memory of 3656 4308 9pppj.exe 93 PID 4308 wrote to memory of 3656 4308 9pppj.exe 93 PID 3656 wrote to memory of 716 3656 jpjdv.exe 94 PID 3656 wrote to memory of 716 3656 jpjdv.exe 94 PID 3656 wrote to memory of 716 3656 jpjdv.exe 94 PID 716 wrote to memory of 2012 716 ppvvv.exe 95 PID 716 wrote to memory of 2012 716 ppvvv.exe 95 PID 716 wrote to memory of 2012 716 ppvvv.exe 95 PID 2012 wrote to memory of 2596 2012 fxffxxr.exe 96 PID 2012 wrote to memory of 2596 2012 fxffxxr.exe 96 PID 2012 wrote to memory of 2596 2012 fxffxxr.exe 96 PID 2596 wrote to memory of 4092 2596 nnhnhn.exe 97 PID 2596 wrote to memory of 4092 2596 nnhnhn.exe 97 PID 2596 wrote to memory of 4092 2596 nnhnhn.exe 97 PID 4092 wrote to memory of 4168 4092 hbtnhb.exe 98 PID 4092 wrote to memory of 4168 4092 hbtnhb.exe 98 PID 4092 wrote to memory of 4168 4092 hbtnhb.exe 98 PID 4168 wrote to memory of 3880 4168 vjjjj.exe 99 PID 4168 wrote to memory of 3880 4168 vjjjj.exe 99 PID 4168 wrote to memory of 3880 4168 vjjjj.exe 99 PID 3880 wrote to memory of 4952 3880 7frlrrf.exe 100 PID 3880 wrote to memory of 4952 3880 7frlrrf.exe 100 PID 3880 wrote to memory of 4952 3880 7frlrrf.exe 100 PID 4952 wrote to memory of 112 4952 hbbntb.exe 101 PID 4952 wrote to memory of 112 4952 hbbntb.exe 101 PID 4952 wrote to memory of 112 4952 hbbntb.exe 101 PID 112 wrote to memory of 4900 112 jvpjj.exe 102 PID 112 wrote to memory of 4900 112 jvpjj.exe 102 PID 112 wrote to memory of 4900 112 jvpjj.exe 102 PID 4900 wrote to memory of 3364 4900 flxfxxf.exe 103 PID 4900 wrote to memory of 3364 4900 flxfxxf.exe 103 PID 4900 wrote to memory of 3364 4900 flxfxxf.exe 103 PID 3364 wrote to memory of 1980 3364 nnhbnh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe"C:\Users\Admin\AppData\Local\Temp\d6c182e7bb0c8e193a6df458cb7e8ac8d0629f61f05dd4d878fe124f043d9819.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\bbbnbt.exec:\bbbnbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\hhbbbb.exec:\hhbbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\vvpjd.exec:\vvpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\pvddv.exec:\pvddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\btnbtt.exec:\btnbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\fxxlfxr.exec:\fxxlfxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\5jpjp.exec:\5jpjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\tnnnbt.exec:\tnnnbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\llxlfxl.exec:\llxlfxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\9pppj.exec:\9pppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\jpjdv.exec:\jpjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\ppvvv.exec:\ppvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\fxffxxr.exec:\fxffxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\nnhnhn.exec:\nnhnhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\hbtnhb.exec:\hbtnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\vjjjj.exec:\vjjjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\7frlrrf.exec:\7frlrrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\hbbntb.exec:\hbbntb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\jvpjj.exec:\jvpjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\flxfxxf.exec:\flxfxxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\nnhbnh.exec:\nnhbnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\pddvp.exec:\pddvp.exe23⤵
- Executes dropped EXE
PID:1980 -
\??\c:\rllffff.exec:\rllffff.exe24⤵
- Executes dropped EXE
PID:2028 -
\??\c:\1nnhtt.exec:\1nnhtt.exe25⤵
- Executes dropped EXE
PID:2456 -
\??\c:\pdjjd.exec:\pdjjd.exe26⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xxlfxrl.exec:\xxlfxrl.exe27⤵
- Executes dropped EXE
PID:2664 -
\??\c:\ttnbtn.exec:\ttnbtn.exe28⤵
- Executes dropped EXE
PID:3788 -
\??\c:\rxrfxrl.exec:\rxrfxrl.exe29⤵
- Executes dropped EXE
PID:732 -
\??\c:\dvpjd.exec:\dvpjd.exe30⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ffxlfxl.exec:\ffxlfxl.exe31⤵
- Executes dropped EXE
PID:3976 -
\??\c:\jjdvp.exec:\jjdvp.exe32⤵
- Executes dropped EXE
PID:3492 -
\??\c:\xlffxxr.exec:\xlffxxr.exe33⤵
- Executes dropped EXE
PID:5112 -
\??\c:\bhthbb.exec:\bhthbb.exe34⤵
- Executes dropped EXE
PID:4440 -
\??\c:\ddpjv.exec:\ddpjv.exe35⤵
- Executes dropped EXE
PID:4944 -
\??\c:\tnnbnh.exec:\tnnbnh.exe36⤵
- Executes dropped EXE
PID:2384 -
\??\c:\djdpj.exec:\djdpj.exe37⤵
- Executes dropped EXE
PID:2228 -
\??\c:\rlfxfxx.exec:\rlfxfxx.exe38⤵
- Executes dropped EXE
PID:2508 -
\??\c:\nhnhhb.exec:\nhnhhb.exe39⤵
- Executes dropped EXE
PID:3552 -
\??\c:\xrrlfxl.exec:\xrrlfxl.exe40⤵
- Executes dropped EXE
PID:3768 -
\??\c:\htnhbt.exec:\htnhbt.exe41⤵
- Executes dropped EXE
PID:3392 -
\??\c:\tbbnht.exec:\tbbnht.exe42⤵
- Executes dropped EXE
PID:4348 -
\??\c:\dvvpj.exec:\dvvpj.exe43⤵
- Executes dropped EXE
PID:3244 -
\??\c:\ntnnhh.exec:\ntnnhh.exe44⤵
- Executes dropped EXE
PID:1676 -
\??\c:\vpjdv.exec:\vpjdv.exe45⤵
- Executes dropped EXE
PID:4452 -
\??\c:\3xffxxl.exec:\3xffxxl.exe46⤵
- Executes dropped EXE
PID:4248 -
\??\c:\ttnbtb.exec:\ttnbtb.exe47⤵
- Executes dropped EXE
PID:4936 -
\??\c:\jpddv.exec:\jpddv.exe48⤵
- Executes dropped EXE
PID:4256 -
\??\c:\lrrfxrf.exec:\lrrfxrf.exe49⤵
- Executes dropped EXE
PID:3412 -
\??\c:\rllxrrl.exec:\rllxrrl.exe50⤵
- Executes dropped EXE
PID:116 -
\??\c:\btnbbh.exec:\btnbbh.exe51⤵
- Executes dropped EXE
PID:3840 -
\??\c:\dvpjv.exec:\dvpjv.exe52⤵
- Executes dropped EXE
PID:4804 -
\??\c:\9jdpj.exec:\9jdpj.exe53⤵
- Executes dropped EXE
PID:3864 -
\??\c:\fxxfxxf.exec:\fxxfxxf.exe54⤵
- Executes dropped EXE
PID:1500 -
\??\c:\btnnhh.exec:\btnnhh.exe55⤵
- Executes dropped EXE
PID:4244 -
\??\c:\dvpvj.exec:\dvpvj.exe56⤵
- Executes dropped EXE
PID:1424 -
\??\c:\ffxxxxx.exec:\ffxxxxx.exe57⤵
- Executes dropped EXE
PID:1900 -
\??\c:\9ttbnt.exec:\9ttbnt.exe58⤵
- Executes dropped EXE
PID:2796 -
\??\c:\htnnbb.exec:\htnnbb.exe59⤵
- Executes dropped EXE
PID:3196 -
\??\c:\9jpjd.exec:\9jpjd.exe60⤵
- Executes dropped EXE
PID:716 -
\??\c:\rxrlxxr.exec:\rxrlxxr.exe61⤵
- Executes dropped EXE
PID:3792 -
\??\c:\xfflfxr.exec:\xfflfxr.exe62⤵
- Executes dropped EXE
PID:2288 -
\??\c:\tnnnhh.exec:\tnnnhh.exe63⤵
- Executes dropped EXE
PID:1544 -
\??\c:\pjdvj.exec:\pjdvj.exe64⤵
- Executes dropped EXE
PID:4060 -
\??\c:\xxxxlxf.exec:\xxxxlxf.exe65⤵
- Executes dropped EXE
PID:3040 -
\??\c:\nnhnnb.exec:\nnhnnb.exe66⤵PID:624
-
\??\c:\tbbbbb.exec:\tbbbbb.exe67⤵PID:3680
-
\??\c:\dpvvp.exec:\dpvvp.exe68⤵PID:5072
-
\??\c:\bbnbtn.exec:\bbnbtn.exe69⤵PID:4820
-
\??\c:\ppvpp.exec:\ppvpp.exe70⤵PID:548
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe71⤵PID:4900
-
\??\c:\bttntn.exec:\bttntn.exe72⤵PID:3364
-
\??\c:\tthbhh.exec:\tthbhh.exe73⤵PID:4644
-
\??\c:\pjdvp.exec:\pjdvp.exe74⤵PID:4156
-
\??\c:\xfrrlff.exec:\xfrrlff.exe75⤵PID:2584
-
\??\c:\hnbbtt.exec:\hnbbtt.exe76⤵PID:3844
-
\??\c:\djvdd.exec:\djvdd.exe77⤵PID:1792
-
\??\c:\9frlxxf.exec:\9frlxxf.exe78⤵PID:2772
-
\??\c:\3frlfxr.exec:\3frlfxr.exe79⤵PID:1856
-
\??\c:\ntnttb.exec:\ntnttb.exe80⤵PID:3952
-
\??\c:\pdjvp.exec:\pdjvp.exe81⤵PID:1660
-
\??\c:\1rrfrxr.exec:\1rrfrxr.exe82⤵PID:4624
-
\??\c:\hhtbnn.exec:\hhtbnn.exe83⤵PID:3204
-
\??\c:\5jjjd.exec:\5jjjd.exe84⤵PID:3856
-
\??\c:\jdjvd.exec:\jdjvd.exe85⤵PID:5116
-
\??\c:\fxrlffr.exec:\fxrlffr.exe86⤵PID:4472
-
\??\c:\5tnbtt.exec:\5tnbtt.exe87⤵PID:2624
-
\??\c:\nbbnhh.exec:\nbbnhh.exe88⤵PID:220
-
\??\c:\vjjjd.exec:\vjjjd.exe89⤵PID:3060
-
\??\c:\rfxrflx.exec:\rfxrflx.exe90⤵PID:464
-
\??\c:\ttbnnn.exec:\ttbnnn.exe91⤵PID:4468
-
\??\c:\vpdvp.exec:\vpdvp.exe92⤵PID:928
-
\??\c:\pvvpd.exec:\pvvpd.exe93⤵PID:1696
-
\??\c:\llfrlfr.exec:\llfrlfr.exe94⤵PID:4396
-
\??\c:\nttnnn.exec:\nttnnn.exe95⤵PID:4480
-
\??\c:\3nhbtn.exec:\3nhbtn.exe96⤵PID:4964
-
\??\c:\jddpp.exec:\jddpp.exe97⤵PID:8
-
\??\c:\lrrlxlx.exec:\lrrlxlx.exe98⤵PID:2924
-
\??\c:\rxrlxrl.exec:\rxrlxrl.exe99⤵PID:3512
-
\??\c:\hhnbbb.exec:\hhnbbb.exe100⤵PID:4908
-
\??\c:\vppjd.exec:\vppjd.exe101⤵PID:3620
-
\??\c:\dppjd.exec:\dppjd.exe102⤵PID:3904
-
\??\c:\llxxxff.exec:\llxxxff.exe103⤵PID:864
-
\??\c:\thhhbb.exec:\thhhbb.exe104⤵PID:2932
-
\??\c:\vjjjd.exec:\vjjjd.exe105⤵PID:1624
-
\??\c:\dvjjj.exec:\dvjjj.exe106⤵PID:4880
-
\??\c:\7xxrfxr.exec:\7xxrfxr.exe107⤵PID:2612
-
\??\c:\nnthnn.exec:\nnthnn.exe108⤵PID:2128
-
\??\c:\3hhbtn.exec:\3hhbtn.exe109⤵PID:1180
-
\??\c:\ddpvd.exec:\ddpvd.exe110⤵PID:2284
-
\??\c:\3rffllx.exec:\3rffllx.exe111⤵PID:4244
-
\??\c:\hbbnhb.exec:\hbbnhb.exe112⤵PID:1424
-
\??\c:\hhbtnh.exec:\hhbtnh.exe113⤵PID:1852
-
\??\c:\dddvj.exec:\dddvj.exe114⤵PID:2872
-
\??\c:\xxrlxxl.exec:\xxrlxxl.exe115⤵PID:4784
-
\??\c:\tbhtnh.exec:\tbhtnh.exe116⤵PID:3196
-
\??\c:\htbbtb.exec:\htbbtb.exe117⤵PID:5100
-
\??\c:\pdvdv.exec:\pdvdv.exe118⤵PID:2536
-
\??\c:\xxlfrlx.exec:\xxlfrlx.exe119⤵PID:392
-
\??\c:\hnthbt.exec:\hnthbt.exe120⤵PID:2012
-
\??\c:\pjjdd.exec:\pjjdd.exe121⤵PID:2596
-
\??\c:\xxflllx.exec:\xxflllx.exe122⤵PID:1884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-