Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 06:30
Behavioral task
behavioral1
Sample
97a5bb57af93d94e307d79a1e65a575094797b884844bb5c18baad8d549a7109.exe
Resource
win7-20240729-en
7 signatures
120 seconds
General
-
Target
97a5bb57af93d94e307d79a1e65a575094797b884844bb5c18baad8d549a7109.exe
-
Size
142KB
-
MD5
d85e723e5943ab83a3945187ce79fa5c
-
SHA1
0f1691f8b0df2a9750270d3be24a88473283848f
-
SHA256
97a5bb57af93d94e307d79a1e65a575094797b884844bb5c18baad8d549a7109
-
SHA512
f7a71c29d383b260bdb3238bd32ccbe80f1acd95cc592a1a7db1ee7973cb41f2ceeb37f7990cf23cb1471a1dfd4cf8e666e3f90652d99191ade5e3a9299979f4
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BfDKPeGrR+i:kcm4FmowdHoSphraHcpOaKHci
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4756-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3972-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2260-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2720-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2516-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2708-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1452-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/560-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3336-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1224-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2948-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2500-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2820-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1552-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1764-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1820-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/648-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1792-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3056-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1912-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3972-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1056-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2988-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4472-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2656-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3000-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3336-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2500-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1664-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4684-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1556-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2708-533-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4696-540-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4796-577-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2476-593-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4188-609-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-671-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2532-744-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2732-790-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-818-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-987-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2672-994-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-1067-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2000-1092-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1152 9bhhbh.exe 2260 xflfxxl.exe 3972 nbttnn.exe 3516 dpvvp.exe 5064 fxxxxfx.exe 2392 7vdpv.exe 2720 tbttnb.exe 3948 jvdvp.exe 4084 nbbnnt.exe 3828 vjjpd.exe 2516 fxfxxrr.exe 1532 bhhhbh.exe 4700 jvdvv.exe 2996 rrrxlxr.exe 1804 tthhhb.exe 1464 vpjvv.exe 2708 frxxfll.exe 216 httbbn.exe 4064 ddjjp.exe 5092 rllrfxx.exe 1452 nttbnn.exe 560 pjppp.exe 368 rlxrrll.exe 1328 3rrxxxx.exe 3336 dpjdj.exe 1224 vjpvv.exe 4612 5bnntb.exe 2948 djdjv.exe 2212 nbbbtb.exe 2500 dvpvp.exe 2820 fxfrxll.exe 3892 vjpdp.exe 4052 pdvdv.exe 4088 xxfxxrl.exe 3288 tntbnn.exe 1552 vddpv.exe 1764 tbbhhh.exe 2956 1vjpd.exe 4188 xlrxfrx.exe 1820 1dpjj.exe 3556 nbtbhb.exe 648 hthhbn.exe 1676 llxxrrx.exe 3572 hnbttb.exe 1792 dvdjj.exe 796 llllrrl.exe 3056 rfxrxxr.exe 3684 1tnttb.exe 4148 llfllll.exe 4448 thbnbt.exe 1912 7nnnhh.exe 4756 jjvvp.exe 4784 xffflrl.exe 1020 fffxxxx.exe 3984 hbnnnn.exe 3972 3dvvv.exe 5096 rlxxxff.exe 1056 rflfffx.exe 3980 thntnt.exe 4592 ddddp.exe 3588 xxrfxlr.exe 3144 ttbhtt.exe 3948 ppdjj.exe 5048 xxxxrxx.exe -
resource yara_rule behavioral2/memory/4756-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023c1e-3.dat upx behavioral2/memory/4756-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023c98-8.dat upx behavioral2/memory/1152-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cab-12.dat upx behavioral2/memory/3972-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cac-22.dat upx behavioral2/memory/3516-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2260-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cad-28.dat upx behavioral2/memory/3516-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5064-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5064-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023caf-35.dat upx behavioral2/files/0x0007000000023cb0-40.dat upx behavioral2/memory/2392-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb1-49.dat upx behavioral2/memory/2720-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb2-52.dat upx behavioral2/memory/3948-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb3-59.dat upx behavioral2/memory/4084-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb4-65.dat upx behavioral2/memory/2516-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb5-68.dat upx behavioral2/files/0x0007000000023cb6-74.dat upx behavioral2/files/0x0007000000023cb7-79.dat upx behavioral2/files/0x0007000000023cb8-85.dat upx behavioral2/memory/1804-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb9-89.dat upx behavioral2/files/0x0007000000023cba-95.dat upx behavioral2/files/0x000a000000023c9f-100.dat upx behavioral2/memory/2708-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbc-106.dat upx behavioral2/memory/216-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbe-118.dat upx behavioral2/memory/5092-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbd-113.dat upx behavioral2/files/0x0007000000023cbf-126.dat upx behavioral2/memory/1452-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc0-131.dat upx behavioral2/files/0x0007000000023cc1-135.dat upx behavioral2/memory/560-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc2-141.dat upx behavioral2/files/0x0007000000023cc3-148.dat upx behavioral2/memory/3336-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc4-152.dat upx behavioral2/memory/1224-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4612-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc5-159.dat upx behavioral2/memory/2948-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc6-164.dat upx behavioral2/files/0x0007000000023cc7-170.dat upx behavioral2/files/0x0007000000023cc8-176.dat upx behavioral2/memory/2500-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc9-183.dat upx behavioral2/memory/2820-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3892-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1552-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1764-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1820-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3556-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/648-222-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lllxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4756 wrote to memory of 1152 4756 97a5bb57af93d94e307d79a1e65a575094797b884844bb5c18baad8d549a7109.exe 82 PID 4756 wrote to memory of 1152 4756 97a5bb57af93d94e307d79a1e65a575094797b884844bb5c18baad8d549a7109.exe 82 PID 4756 wrote to memory of 1152 4756 97a5bb57af93d94e307d79a1e65a575094797b884844bb5c18baad8d549a7109.exe 82 PID 1152 wrote to memory of 2260 1152 9bhhbh.exe 83 PID 1152 wrote to memory of 2260 1152 9bhhbh.exe 83 PID 1152 wrote to memory of 2260 1152 9bhhbh.exe 83 PID 2260 wrote to memory of 3972 2260 xflfxxl.exe 84 PID 2260 wrote to memory of 3972 2260 xflfxxl.exe 84 PID 2260 wrote to memory of 3972 2260 xflfxxl.exe 84 PID 3972 wrote to memory of 3516 3972 nbttnn.exe 85 PID 3972 wrote to memory of 3516 3972 nbttnn.exe 85 PID 3972 wrote to memory of 3516 3972 nbttnn.exe 85 PID 3516 wrote to memory of 5064 3516 dpvvp.exe 86 PID 3516 wrote to memory of 5064 3516 dpvvp.exe 86 PID 3516 wrote to memory of 5064 3516 dpvvp.exe 86 PID 5064 wrote to memory of 2392 5064 fxxxxfx.exe 87 PID 5064 wrote to memory of 2392 5064 fxxxxfx.exe 87 PID 5064 wrote to memory of 2392 5064 fxxxxfx.exe 87 PID 2392 wrote to memory of 2720 2392 7vdpv.exe 88 PID 2392 wrote to memory of 2720 2392 7vdpv.exe 88 PID 2392 wrote to memory of 2720 2392 7vdpv.exe 88 PID 2720 wrote to memory of 3948 2720 tbttnb.exe 89 PID 2720 wrote to memory of 3948 2720 tbttnb.exe 89 PID 2720 wrote to memory of 3948 2720 tbttnb.exe 89 PID 3948 wrote to memory of 4084 3948 jvdvp.exe 90 PID 3948 wrote to memory of 4084 3948 jvdvp.exe 90 PID 3948 wrote to memory of 4084 3948 jvdvp.exe 90 PID 4084 wrote to memory of 3828 4084 nbbnnt.exe 91 PID 4084 wrote to memory of 3828 4084 nbbnnt.exe 91 PID 4084 wrote to memory of 3828 4084 nbbnnt.exe 91 PID 3828 wrote to memory of 2516 3828 vjjpd.exe 92 PID 3828 wrote to memory of 2516 3828 vjjpd.exe 92 PID 3828 wrote to memory of 2516 3828 vjjpd.exe 92 PID 2516 wrote to memory of 1532 2516 fxfxxrr.exe 93 PID 2516 wrote to memory of 1532 2516 fxfxxrr.exe 93 PID 2516 wrote to memory of 1532 2516 fxfxxrr.exe 93 PID 1532 wrote to memory of 4700 1532 bhhhbh.exe 94 PID 1532 wrote to memory of 4700 1532 bhhhbh.exe 94 PID 1532 wrote to memory of 4700 1532 bhhhbh.exe 94 PID 4700 wrote to memory of 2996 4700 jvdvv.exe 95 PID 4700 wrote to memory of 2996 4700 jvdvv.exe 95 PID 4700 wrote to memory of 2996 4700 jvdvv.exe 95 PID 2996 wrote to memory of 1804 2996 rrrxlxr.exe 96 PID 2996 wrote to memory of 1804 2996 rrrxlxr.exe 96 PID 2996 wrote to memory of 1804 2996 rrrxlxr.exe 96 PID 1804 wrote to memory of 1464 1804 tthhhb.exe 97 PID 1804 wrote to memory of 1464 1804 tthhhb.exe 97 PID 1804 wrote to memory of 1464 1804 tthhhb.exe 97 PID 1464 wrote to memory of 2708 1464 vpjvv.exe 98 PID 1464 wrote to memory of 2708 1464 vpjvv.exe 98 PID 1464 wrote to memory of 2708 1464 vpjvv.exe 98 PID 2708 wrote to memory of 216 2708 frxxfll.exe 99 PID 2708 wrote to memory of 216 2708 frxxfll.exe 99 PID 2708 wrote to memory of 216 2708 frxxfll.exe 99 PID 216 wrote to memory of 4064 216 httbbn.exe 100 PID 216 wrote to memory of 4064 216 httbbn.exe 100 PID 216 wrote to memory of 4064 216 httbbn.exe 100 PID 4064 wrote to memory of 5092 4064 ddjjp.exe 101 PID 4064 wrote to memory of 5092 4064 ddjjp.exe 101 PID 4064 wrote to memory of 5092 4064 ddjjp.exe 101 PID 5092 wrote to memory of 1452 5092 rllrfxx.exe 102 PID 5092 wrote to memory of 1452 5092 rllrfxx.exe 102 PID 5092 wrote to memory of 1452 5092 rllrfxx.exe 102 PID 1452 wrote to memory of 560 1452 nttbnn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\97a5bb57af93d94e307d79a1e65a575094797b884844bb5c18baad8d549a7109.exe"C:\Users\Admin\AppData\Local\Temp\97a5bb57af93d94e307d79a1e65a575094797b884844bb5c18baad8d549a7109.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\9bhhbh.exec:\9bhhbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\xflfxxl.exec:\xflfxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\nbttnn.exec:\nbttnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\dpvvp.exec:\dpvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\fxxxxfx.exec:\fxxxxfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\7vdpv.exec:\7vdpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\tbttnb.exec:\tbttnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jvdvp.exec:\jvdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\nbbnnt.exec:\nbbnnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\vjjpd.exec:\vjjpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\bhhhbh.exec:\bhhhbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\jvdvv.exec:\jvdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\rrrxlxr.exec:\rrrxlxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\tthhhb.exec:\tthhhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\vpjvv.exec:\vpjvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\frxxfll.exec:\frxxfll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\httbbn.exec:\httbbn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\ddjjp.exec:\ddjjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\rllrfxx.exec:\rllrfxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\nttbnn.exec:\nttbnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\pjppp.exec:\pjppp.exe23⤵
- Executes dropped EXE
PID:560 -
\??\c:\rlxrrll.exec:\rlxrrll.exe24⤵
- Executes dropped EXE
PID:368 -
\??\c:\3rrxxxx.exec:\3rrxxxx.exe25⤵
- Executes dropped EXE
PID:1328 -
\??\c:\dpjdj.exec:\dpjdj.exe26⤵
- Executes dropped EXE
PID:3336 -
\??\c:\vjpvv.exec:\vjpvv.exe27⤵
- Executes dropped EXE
PID:1224 -
\??\c:\5bnntb.exec:\5bnntb.exe28⤵
- Executes dropped EXE
PID:4612 -
\??\c:\djdjv.exec:\djdjv.exe29⤵
- Executes dropped EXE
PID:2948 -
\??\c:\nbbbtb.exec:\nbbbtb.exe30⤵
- Executes dropped EXE
PID:2212 -
\??\c:\dvpvp.exec:\dvpvp.exe31⤵
- Executes dropped EXE
PID:2500 -
\??\c:\fxfrxll.exec:\fxfrxll.exe32⤵
- Executes dropped EXE
PID:2820 -
\??\c:\vjpdp.exec:\vjpdp.exe33⤵
- Executes dropped EXE
PID:3892 -
\??\c:\pdvdv.exec:\pdvdv.exe34⤵
- Executes dropped EXE
PID:4052 -
\??\c:\xxfxxrl.exec:\xxfxxrl.exe35⤵
- Executes dropped EXE
PID:4088 -
\??\c:\tntbnn.exec:\tntbnn.exe36⤵
- Executes dropped EXE
PID:3288 -
\??\c:\vddpv.exec:\vddpv.exe37⤵
- Executes dropped EXE
PID:1552 -
\??\c:\tbbhhh.exec:\tbbhhh.exe38⤵
- Executes dropped EXE
PID:1764 -
\??\c:\1vjpd.exec:\1vjpd.exe39⤵
- Executes dropped EXE
PID:2956 -
\??\c:\xlrxfrx.exec:\xlrxfrx.exe40⤵
- Executes dropped EXE
PID:4188 -
\??\c:\1dpjj.exec:\1dpjj.exe41⤵
- Executes dropped EXE
PID:1820 -
\??\c:\nbtbhb.exec:\nbtbhb.exe42⤵
- Executes dropped EXE
PID:3556 -
\??\c:\hthhbn.exec:\hthhbn.exe43⤵
- Executes dropped EXE
PID:648 -
\??\c:\llxxrrx.exec:\llxxrrx.exe44⤵
- Executes dropped EXE
PID:1676 -
\??\c:\hnbttb.exec:\hnbttb.exe45⤵
- Executes dropped EXE
PID:3572 -
\??\c:\dvdjj.exec:\dvdjj.exe46⤵
- Executes dropped EXE
PID:1792 -
\??\c:\llllrrl.exec:\llllrrl.exe47⤵
- Executes dropped EXE
PID:796 -
\??\c:\rfxrxxr.exec:\rfxrxxr.exe48⤵
- Executes dropped EXE
PID:3056 -
\??\c:\1tnttb.exec:\1tnttb.exe49⤵
- Executes dropped EXE
PID:3684 -
\??\c:\llfllll.exec:\llfllll.exe50⤵
- Executes dropped EXE
PID:4148 -
\??\c:\thbnbt.exec:\thbnbt.exe51⤵
- Executes dropped EXE
PID:4448 -
\??\c:\7nnnhh.exec:\7nnnhh.exe52⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jjvvp.exec:\jjvvp.exe53⤵
- Executes dropped EXE
PID:4756 -
\??\c:\xffflrl.exec:\xffflrl.exe54⤵
- Executes dropped EXE
PID:4784 -
\??\c:\fffxxxx.exec:\fffxxxx.exe55⤵
- Executes dropped EXE
PID:1020 -
\??\c:\hbnnnn.exec:\hbnnnn.exe56⤵
- Executes dropped EXE
PID:3984 -
\??\c:\3dvvv.exec:\3dvvv.exe57⤵
- Executes dropped EXE
PID:3972 -
\??\c:\rlxxxff.exec:\rlxxxff.exe58⤵
- Executes dropped EXE
PID:5096 -
\??\c:\rflfffx.exec:\rflfffx.exe59⤵
- Executes dropped EXE
PID:1056 -
\??\c:\thntnt.exec:\thntnt.exe60⤵
- Executes dropped EXE
PID:3980 -
\??\c:\ddddp.exec:\ddddp.exe61⤵
- Executes dropped EXE
PID:4592 -
\??\c:\xxrfxlr.exec:\xxrfxlr.exe62⤵
- Executes dropped EXE
PID:3588 -
\??\c:\ttbhtt.exec:\ttbhtt.exe63⤵
- Executes dropped EXE
PID:3144 -
\??\c:\ppdjj.exec:\ppdjj.exe64⤵
- Executes dropped EXE
PID:3948 -
\??\c:\xxxxrxx.exec:\xxxxrxx.exe65⤵
- Executes dropped EXE
PID:5048 -
\??\c:\rfrlllr.exec:\rfrlllr.exe66⤵PID:2988
-
\??\c:\djdvj.exec:\djdvj.exe67⤵PID:4720
-
\??\c:\fllfrlf.exec:\fllfrlf.exe68⤵PID:664
-
\??\c:\rlxfflr.exec:\rlxfflr.exe69⤵PID:2440
-
\??\c:\tnttnb.exec:\tnttnb.exe70⤵PID:3384
-
\??\c:\vvdpp.exec:\vvdpp.exe71⤵PID:5008
-
\??\c:\9flllrr.exec:\9flllrr.exe72⤵PID:1996
-
\??\c:\5bbnth.exec:\5bbnth.exe73⤵PID:5032
-
\??\c:\vddvp.exec:\vddvp.exe74⤵PID:2312
-
\??\c:\flrlffx.exec:\flrlffx.exe75⤵PID:2416
-
\??\c:\fxxxrxf.exec:\fxxxrxf.exe76⤵PID:1464
-
\??\c:\nnbbnh.exec:\nnbbnh.exe77⤵PID:3108
-
\??\c:\dpvvp.exec:\dpvvp.exe78⤵PID:4472
-
\??\c:\fxlrxlr.exec:\fxlrxlr.exe79⤵PID:2656
-
\??\c:\hhbtnn.exec:\hhbtnn.exe80⤵PID:5084
-
\??\c:\nhnnhh.exec:\nhnnhh.exe81⤵PID:3000
-
\??\c:\jvdjj.exec:\jvdjj.exe82⤵PID:3104
-
\??\c:\5tbtth.exec:\5tbtth.exe83⤵PID:3996
-
\??\c:\jjjvj.exec:\jjjvj.exe84⤵PID:4480
-
\??\c:\rfflrrr.exec:\rfflrrr.exe85⤵PID:2532
-
\??\c:\lrlfllr.exec:\lrlfllr.exe86⤵PID:3872
-
\??\c:\vvpdd.exec:\vvpdd.exe87⤵PID:3580
-
\??\c:\5lllxfr.exec:\5lllxfr.exe88⤵
- System Location Discovery: System Language Discovery
PID:3336 -
\??\c:\5rrflrf.exec:\5rrflrf.exe89⤵PID:3640
-
\??\c:\3pddv.exec:\3pddv.exe90⤵PID:4612
-
\??\c:\pvvvv.exec:\pvvvv.exe91⤵PID:4964
-
\??\c:\llrxxrr.exec:\llrxxrr.exe92⤵PID:4900
-
\??\c:\3hbbnt.exec:\3hbbnt.exe93⤵PID:4912
-
\??\c:\dvvjd.exec:\dvvjd.exe94⤵PID:2500
-
\??\c:\jdjdp.exec:\jdjdp.exe95⤵PID:856
-
\??\c:\fffxxrr.exec:\fffxxrr.exe96⤵PID:3880
-
\??\c:\ntnbbh.exec:\ntnbbh.exe97⤵PID:1664
-
\??\c:\9jjjj.exec:\9jjjj.exe98⤵PID:4052
-
\??\c:\lfrrrfl.exec:\lfrrrfl.exe99⤵PID:4628
-
\??\c:\tnhbht.exec:\tnhbht.exe100⤵PID:3332
-
\??\c:\dpvpp.exec:\dpvpp.exe101⤵PID:1948
-
\??\c:\llrxxlr.exec:\llrxxlr.exe102⤵PID:1764
-
\??\c:\hnthth.exec:\hnthth.exe103⤵PID:1928
-
\??\c:\pjddp.exec:\pjddp.exe104⤵PID:212
-
\??\c:\bbbttb.exec:\bbbttb.exe105⤵PID:1632
-
\??\c:\vdpvp.exec:\vdpvp.exe106⤵PID:224
-
\??\c:\lflxrlx.exec:\lflxrlx.exe107⤵PID:4540
-
\??\c:\rrflxrf.exec:\rrflxrf.exe108⤵PID:3884
-
\??\c:\7hthtn.exec:\7hthtn.exe109⤵PID:3052
-
\??\c:\3pvjd.exec:\3pvjd.exe110⤵PID:3848
-
\??\c:\xflrlff.exec:\xflrlff.exe111⤵PID:4516
-
\??\c:\dpdpj.exec:\dpdpj.exe112⤵PID:2628
-
\??\c:\lfrllrr.exec:\lfrllrr.exe113⤵PID:1704
-
\??\c:\1httbn.exec:\1httbn.exe114⤵PID:2904
-
\??\c:\tnnnhb.exec:\tnnnhb.exe115⤵PID:4148
-
\??\c:\jdddd.exec:\jdddd.exe116⤵PID:4448
-
\??\c:\5ffrllx.exec:\5ffrllx.exe117⤵PID:1912
-
\??\c:\hnbbbt.exec:\hnbbbt.exe118⤵PID:3952
-
\??\c:\nbtnbt.exec:\nbtnbt.exe119⤵PID:4724
-
\??\c:\pvjjj.exec:\pvjjj.exe120⤵PID:552
-
\??\c:\frrxrxr.exec:\frrxrxr.exe121⤵PID:3664
-
\??\c:\jjppj.exec:\jjppj.exe122⤵PID:3516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-