Analysis
-
max time kernel
150s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 05:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe
-
Size
453KB
-
MD5
c8121d1beda68ab3b5178387102c7e14
-
SHA1
aacbe37f4debd150bd9a1090f5bfb26249b8cf8c
-
SHA256
e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec
-
SHA512
cf7a38fac52e840492e65b716d2bdc7066d050e9d03bcbad26fcfe63bd2bce8dd460ed2cac14bf905253245d014958fec989d427771e6dc8e50dc877509f960b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4088-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1280-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/944-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2712-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3544-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3288-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2012-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/896-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-737-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-771-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-821-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-1420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-1464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1280 ffxffxx.exe 3064 3dvpj.exe 448 tnbttb.exe 3608 pdjdd.exe 3288 xlxrllf.exe 1160 lxxfrrr.exe 4748 nbbhhn.exe 2208 dppjd.exe 2148 xrxrllf.exe 3544 nnbtnn.exe 3732 vvjjv.exe 3080 3lrlfrr.exe 2700 hnttnn.exe 2712 jppjd.exe 1368 jddvp.exe 2260 frxxrxx.exe 4576 3bbbbh.exe 1696 bhnhhh.exe 4964 pdjdv.exe 3264 rflrrrr.exe 4304 rlllfff.exe 220 bntnnn.exe 3424 jjjjj.exe 712 pjpjj.exe 2136 rlrlllf.exe 3952 nnnbtt.exe 3864 bhthhh.exe 944 vjvpp.exe 3116 rlrxrrr.exe 1620 xlrxrll.exe 3592 nhhbtt.exe 404 ntbbtb.exe 3956 vvdvp.exe 3360 xrrrlll.exe 1540 xrffxff.exe 3472 3hbbth.exe 2696 3ppjj.exe 2432 jpdvv.exe 1120 rlfffll.exe 420 llffxrx.exe 4912 7nnhbb.exe 5112 ddvpv.exe 3568 dvddd.exe 3748 fxrlxxr.exe 4756 htnnnn.exe 4784 bnnnhh.exe 2212 dvddv.exe 2908 rlrrrlr.exe 1812 rfrrrrr.exe 4072 thtnnn.exe 3636 bthhnh.exe 1196 dvjvv.exe 1040 rllxrxx.exe 4472 llrllrr.exe 4332 hbhnhn.exe 4456 vdpjj.exe 3536 vdpjv.exe 1380 fffflff.exe 3396 lfrrxxf.exe 3656 9nnhhn.exe 3608 dpvpj.exe 3532 dvvvp.exe 1036 xrrrrrr.exe 4100 nbhhnn.exe -
resource yara_rule behavioral2/memory/4088-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1280-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/944-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2712-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3544-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3288-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2012-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/896-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-737-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-771-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4116-912-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4088 wrote to memory of 1280 4088 e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe 81 PID 4088 wrote to memory of 1280 4088 e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe 81 PID 4088 wrote to memory of 1280 4088 e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe 81 PID 1280 wrote to memory of 3064 1280 ffxffxx.exe 82 PID 1280 wrote to memory of 3064 1280 ffxffxx.exe 82 PID 1280 wrote to memory of 3064 1280 ffxffxx.exe 82 PID 3064 wrote to memory of 448 3064 3dvpj.exe 83 PID 3064 wrote to memory of 448 3064 3dvpj.exe 83 PID 3064 wrote to memory of 448 3064 3dvpj.exe 83 PID 448 wrote to memory of 3608 448 tnbttb.exe 141 PID 448 wrote to memory of 3608 448 tnbttb.exe 141 PID 448 wrote to memory of 3608 448 tnbttb.exe 141 PID 3608 wrote to memory of 3288 3608 pdjdd.exe 85 PID 3608 wrote to memory of 3288 3608 pdjdd.exe 85 PID 3608 wrote to memory of 3288 3608 pdjdd.exe 85 PID 3288 wrote to memory of 1160 3288 xlxrllf.exe 86 PID 3288 wrote to memory of 1160 3288 xlxrllf.exe 86 PID 3288 wrote to memory of 1160 3288 xlxrllf.exe 86 PID 1160 wrote to memory of 4748 1160 lxxfrrr.exe 87 PID 1160 wrote to memory of 4748 1160 lxxfrrr.exe 87 PID 1160 wrote to memory of 4748 1160 lxxfrrr.exe 87 PID 4748 wrote to memory of 2208 4748 nbbhhn.exe 88 PID 4748 wrote to memory of 2208 4748 nbbhhn.exe 88 PID 4748 wrote to memory of 2208 4748 nbbhhn.exe 88 PID 2208 wrote to memory of 2148 2208 dppjd.exe 89 PID 2208 wrote to memory of 2148 2208 dppjd.exe 89 PID 2208 wrote to memory of 2148 2208 dppjd.exe 89 PID 2148 wrote to memory of 3544 2148 xrxrllf.exe 90 PID 2148 wrote to memory of 3544 2148 xrxrllf.exe 90 PID 2148 wrote to memory of 3544 2148 xrxrllf.exe 90 PID 3544 wrote to memory of 3732 3544 nnbtnn.exe 91 PID 3544 wrote to memory of 3732 3544 nnbtnn.exe 91 PID 3544 wrote to memory of 3732 3544 nnbtnn.exe 91 PID 3732 wrote to memory of 3080 3732 vvjjv.exe 92 PID 3732 wrote to memory of 3080 3732 vvjjv.exe 92 PID 3732 wrote to memory of 3080 3732 vvjjv.exe 92 PID 3080 wrote to memory of 2700 3080 3lrlfrr.exe 93 PID 3080 wrote to memory of 2700 3080 3lrlfrr.exe 93 PID 3080 wrote to memory of 2700 3080 3lrlfrr.exe 93 PID 2700 wrote to memory of 2712 2700 hnttnn.exe 94 PID 2700 wrote to memory of 2712 2700 hnttnn.exe 94 PID 2700 wrote to memory of 2712 2700 hnttnn.exe 94 PID 2712 wrote to memory of 1368 2712 jppjd.exe 95 PID 2712 wrote to memory of 1368 2712 jppjd.exe 95 PID 2712 wrote to memory of 1368 2712 jppjd.exe 95 PID 1368 wrote to memory of 2260 1368 jddvp.exe 96 PID 1368 wrote to memory of 2260 1368 jddvp.exe 96 PID 1368 wrote to memory of 2260 1368 jddvp.exe 96 PID 2260 wrote to memory of 4576 2260 frxxrxx.exe 97 PID 2260 wrote to memory of 4576 2260 frxxrxx.exe 97 PID 2260 wrote to memory of 4576 2260 frxxrxx.exe 97 PID 4576 wrote to memory of 1696 4576 3bbbbh.exe 98 PID 4576 wrote to memory of 1696 4576 3bbbbh.exe 98 PID 4576 wrote to memory of 1696 4576 3bbbbh.exe 98 PID 1696 wrote to memory of 4964 1696 bhnhhh.exe 99 PID 1696 wrote to memory of 4964 1696 bhnhhh.exe 99 PID 1696 wrote to memory of 4964 1696 bhnhhh.exe 99 PID 4964 wrote to memory of 3264 4964 pdjdv.exe 100 PID 4964 wrote to memory of 3264 4964 pdjdv.exe 100 PID 4964 wrote to memory of 3264 4964 pdjdv.exe 100 PID 3264 wrote to memory of 4304 3264 rflrrrr.exe 101 PID 3264 wrote to memory of 4304 3264 rflrrrr.exe 101 PID 3264 wrote to memory of 4304 3264 rflrrrr.exe 101 PID 4304 wrote to memory of 220 4304 rlllfff.exe 159
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe"C:\Users\Admin\AppData\Local\Temp\e6942677472ab45c309246300aab160729f8a767961c65553c9baedcafedccec.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\ffxffxx.exec:\ffxffxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\3dvpj.exec:\3dvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\tnbttb.exec:\tnbttb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\pdjdd.exec:\pdjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\xlxrllf.exec:\xlxrllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\lxxfrrr.exec:\lxxfrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\nbbhhn.exec:\nbbhhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\dppjd.exec:\dppjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\xrxrllf.exec:\xrxrllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\nnbtnn.exec:\nnbtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\vvjjv.exec:\vvjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\3lrlfrr.exec:\3lrlfrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\hnttnn.exec:\hnttnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\jppjd.exec:\jppjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\jddvp.exec:\jddvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\frxxrxx.exec:\frxxrxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\3bbbbh.exec:\3bbbbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\bhnhhh.exec:\bhnhhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\pdjdv.exec:\pdjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\rflrrrr.exec:\rflrrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\rlllfff.exec:\rlllfff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\bntnnn.exec:\bntnnn.exe23⤵
- Executes dropped EXE
PID:220 -
\??\c:\jjjjj.exec:\jjjjj.exe24⤵
- Executes dropped EXE
PID:3424 -
\??\c:\pjpjj.exec:\pjpjj.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:712 -
\??\c:\rlrlllf.exec:\rlrlllf.exe26⤵
- Executes dropped EXE
PID:2136 -
\??\c:\nnnbtt.exec:\nnnbtt.exe27⤵
- Executes dropped EXE
PID:3952 -
\??\c:\bhthhh.exec:\bhthhh.exe28⤵
- Executes dropped EXE
PID:3864 -
\??\c:\vjvpp.exec:\vjvpp.exe29⤵
- Executes dropped EXE
PID:944 -
\??\c:\rlrxrrr.exec:\rlrxrrr.exe30⤵
- Executes dropped EXE
PID:3116 -
\??\c:\xlrxrll.exec:\xlrxrll.exe31⤵
- Executes dropped EXE
PID:1620 -
\??\c:\nhhbtt.exec:\nhhbtt.exe32⤵
- Executes dropped EXE
PID:3592 -
\??\c:\ntbbtb.exec:\ntbbtb.exe33⤵
- Executes dropped EXE
PID:404 -
\??\c:\vvdvp.exec:\vvdvp.exe34⤵
- Executes dropped EXE
PID:3956 -
\??\c:\xrrrlll.exec:\xrrrlll.exe35⤵
- Executes dropped EXE
PID:3360 -
\??\c:\xrffxff.exec:\xrffxff.exe36⤵
- Executes dropped EXE
PID:1540 -
\??\c:\3hbbth.exec:\3hbbth.exe37⤵
- Executes dropped EXE
PID:3472 -
\??\c:\3ppjj.exec:\3ppjj.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2696 -
\??\c:\jpdvv.exec:\jpdvv.exe39⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rlfffll.exec:\rlfffll.exe40⤵
- Executes dropped EXE
PID:1120 -
\??\c:\llffxrx.exec:\llffxrx.exe41⤵
- Executes dropped EXE
PID:420 -
\??\c:\7nnhbb.exec:\7nnhbb.exe42⤵
- Executes dropped EXE
PID:4912 -
\??\c:\ddvpv.exec:\ddvpv.exe43⤵
- Executes dropped EXE
PID:5112 -
\??\c:\dvddd.exec:\dvddd.exe44⤵
- Executes dropped EXE
PID:3568 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe45⤵
- Executes dropped EXE
PID:3748 -
\??\c:\htnnnn.exec:\htnnnn.exe46⤵
- Executes dropped EXE
PID:4756 -
\??\c:\bnnnhh.exec:\bnnnhh.exe47⤵
- Executes dropped EXE
PID:4784 -
\??\c:\dvddv.exec:\dvddv.exe48⤵
- Executes dropped EXE
PID:2212 -
\??\c:\rlrrrlr.exec:\rlrrrlr.exe49⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rfrrrrr.exec:\rfrrrrr.exe50⤵
- Executes dropped EXE
PID:1812 -
\??\c:\thtnnn.exec:\thtnnn.exe51⤵
- Executes dropped EXE
PID:4072 -
\??\c:\bthhnh.exec:\bthhnh.exe52⤵
- Executes dropped EXE
PID:3636 -
\??\c:\dvjvv.exec:\dvjvv.exe53⤵
- Executes dropped EXE
PID:1196 -
\??\c:\rllxrxx.exec:\rllxrxx.exe54⤵
- Executes dropped EXE
PID:1040 -
\??\c:\llrllrr.exec:\llrllrr.exe55⤵
- Executes dropped EXE
PID:4472 -
\??\c:\hbhnhn.exec:\hbhnhn.exe56⤵
- Executes dropped EXE
PID:4332 -
\??\c:\vdpjj.exec:\vdpjj.exe57⤵
- Executes dropped EXE
PID:4456 -
\??\c:\vdpjv.exec:\vdpjv.exe58⤵
- Executes dropped EXE
PID:3536 -
\??\c:\fffflff.exec:\fffflff.exe59⤵
- Executes dropped EXE
PID:1380 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3396 -
\??\c:\9nnhhn.exec:\9nnhhn.exe61⤵
- Executes dropped EXE
PID:3656 -
\??\c:\dpvpj.exec:\dpvpj.exe62⤵
- Executes dropped EXE
PID:3608 -
\??\c:\dvvvp.exec:\dvvvp.exe63⤵
- Executes dropped EXE
PID:3532 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe64⤵
- Executes dropped EXE
PID:1036 -
\??\c:\nbhhnn.exec:\nbhhnn.exe65⤵
- Executes dropped EXE
PID:4100 -
\??\c:\hnbtnn.exec:\hnbtnn.exe66⤵PID:2544
-
\??\c:\pjpjv.exec:\pjpjv.exe67⤵PID:1976
-
\??\c:\flxrllf.exec:\flxrllf.exe68⤵PID:4352
-
\??\c:\bntnhh.exec:\bntnhh.exe69⤵PID:3096
-
\??\c:\vvppp.exec:\vvppp.exe70⤵PID:4152
-
\??\c:\rfxxxxr.exec:\rfxxxxr.exe71⤵PID:868
-
\??\c:\xxlfllr.exec:\xxlfllr.exe72⤵PID:640
-
\??\c:\9hbbtt.exec:\9hbbtt.exe73⤵PID:3020
-
\??\c:\dvdvp.exec:\dvdvp.exe74⤵PID:476
-
\??\c:\3jvvj.exec:\3jvvj.exe75⤵PID:4940
-
\??\c:\5xlfffl.exec:\5xlfffl.exe76⤵PID:2260
-
\??\c:\bthbhh.exec:\bthbhh.exe77⤵PID:4008
-
\??\c:\hthbtn.exec:\hthbtn.exe78⤵PID:3236
-
\??\c:\pjjjj.exec:\pjjjj.exe79⤵PID:1816
-
\??\c:\xrrrllf.exec:\xrrrllf.exe80⤵PID:220
-
\??\c:\tnhbth.exec:\tnhbth.exe81⤵PID:2012
-
\??\c:\dpjdp.exec:\dpjdp.exe82⤵PID:228
-
\??\c:\frlfllx.exec:\frlfllx.exe83⤵PID:1764
-
\??\c:\thnhbb.exec:\thnhbb.exe84⤵PID:3864
-
\??\c:\fflrrff.exec:\fflrrff.exe85⤵PID:3916
-
\??\c:\tbbbbb.exec:\tbbbbb.exe86⤵PID:3116
-
\??\c:\pvddd.exec:\pvddd.exe87⤵PID:1684
-
\??\c:\fxxrlrl.exec:\fxxrlrl.exe88⤵PID:3612
-
\??\c:\bnhhhn.exec:\bnhhhn.exe89⤵PID:1340
-
\??\c:\jpvpv.exec:\jpvpv.exe90⤵PID:3292
-
\??\c:\pvddp.exec:\pvddp.exe91⤵PID:2096
-
\??\c:\lflllff.exec:\lflllff.exe92⤵PID:2320
-
\??\c:\flrllrr.exec:\flrllrr.exe93⤵PID:4620
-
\??\c:\nthbth.exec:\nthbth.exe94⤵PID:4216
-
\??\c:\jvdvp.exec:\jvdvp.exe95⤵
- System Location Discovery: System Language Discovery
PID:4608 -
\??\c:\rllfxxr.exec:\rllfxxr.exe96⤵PID:3960
-
\??\c:\tbhbbt.exec:\tbhbbt.exe97⤵PID:2080
-
\??\c:\xlxfxlr.exec:\xlxfxlr.exe98⤵PID:1192
-
\??\c:\nhhbbn.exec:\nhhbbn.exe99⤵PID:3748
-
\??\c:\vvdvd.exec:\vvdvd.exe100⤵PID:5016
-
\??\c:\bbttnb.exec:\bbttnb.exe101⤵PID:1980
-
\??\c:\vpvpj.exec:\vpvpj.exe102⤵PID:4800
-
\??\c:\rrrlffx.exec:\rrrlffx.exe103⤵PID:3932
-
\??\c:\1pdvd.exec:\1pdvd.exe104⤵PID:2372
-
\??\c:\bnbtbt.exec:\bnbtbt.exe105⤵PID:3540
-
\??\c:\pjppp.exec:\pjppp.exe106⤵PID:1332
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe107⤵PID:3636
-
\??\c:\rlfxffl.exec:\rlfxffl.exe108⤵PID:5040
-
\??\c:\bntnnn.exec:\bntnnn.exe109⤵PID:4080
-
\??\c:\5ppjj.exec:\5ppjj.exe110⤵
- System Location Discovery: System Language Discovery
PID:4280 -
\??\c:\ffxxrrr.exec:\ffxxrrr.exe111⤵PID:4324
-
\??\c:\frffxxf.exec:\frffxxf.exe112⤵
- System Location Discovery: System Language Discovery
PID:3392 -
\??\c:\hbbbbb.exec:\hbbbbb.exe113⤵PID:4456
-
\??\c:\ddpvv.exec:\ddpvv.exe114⤵PID:1264
-
\??\c:\1jpjp.exec:\1jpjp.exe115⤵PID:1380
-
\??\c:\rlxrlll.exec:\rlxrlll.exe116⤵PID:896
-
\??\c:\nbbhbn.exec:\nbbhbn.exe117⤵PID:632
-
\??\c:\pjvpp.exec:\pjvpp.exe118⤵PID:1112
-
\??\c:\rflffff.exec:\rflffff.exe119⤵PID:2984
-
\??\c:\xrxllfx.exec:\xrxllfx.exe120⤵PID:2816
-
\??\c:\nhnnhn.exec:\nhnnhn.exe121⤵PID:1484
-
\??\c:\ddjjd.exec:\ddjjd.exe122⤵PID:2540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-