Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 06:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f54581ee73ea741317790e096db955966367d01f5daebf2a7416e3c2e87ea16f.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
f54581ee73ea741317790e096db955966367d01f5daebf2a7416e3c2e87ea16f.exe
-
Size
454KB
-
MD5
8b02e803f02a33adf6c60c2f9a4fca1b
-
SHA1
e0cda18013e10cd76b171ee2f721cbe254531e63
-
SHA256
f54581ee73ea741317790e096db955966367d01f5daebf2a7416e3c2e87ea16f
-
SHA512
0f5245941cafd841e83bc2f2edb29f4e51c7ab214dc2c83108db46487ce8836c2121188ef06975d3ef036bb2969bfebc57362d00118f1d2ff97e447400da6009
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeg:q7Tc2NYHUrAwfMp3CDg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/3860-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1512-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2864-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2116-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/840-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2704-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/768-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2332-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/936-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-826-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-1177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-1286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-1308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-1318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3860 9btnnh.exe 4776 hbhbbb.exe 1844 vpppp.exe 4408 btnnnh.exe 2024 7frrxfr.exe 1592 jvvvd.exe 1368 lffrxfl.exe 2028 nbnntb.exe 3820 xrxrfll.exe 408 nhhttt.exe 1512 tbbhhh.exe 4544 ddvjd.exe 3668 pvvvd.exe 740 pjjjp.exe 3252 ntnhhh.exe 3076 vjdvj.exe 2924 frrxlrl.exe 2520 nhbttn.exe 1640 3hnnnn.exe 2116 vvjvd.exe 2864 lfffflf.exe 4416 nhhhnt.exe 3908 xflrxlr.exe 664 lflrlxr.exe 2668 7nhhhn.exe 1984 lrrxlfr.exe 4844 jjpdp.exe 4772 9jvvj.exe 2140 nnthnb.exe 5024 pdpdv.exe 4280 jpvvj.exe 1168 tbhtnn.exe 2328 ffllflf.exe 876 hbhbbb.exe 1736 jpvvd.exe 936 xrflrll.exe 2588 jjpvp.exe 2628 flfxffr.exe 1836 djppv.exe 1232 7lflfrl.exe 840 bnbhth.exe 4548 vdddj.exe 4788 9nnbhb.exe 2552 ppvpp.exe 5112 xlfrrxr.exe 4384 jjdjp.exe 3812 lfrxlfr.exe 2704 bbntth.exe 3180 vvjvj.exe 4328 tthtbn.exe 4404 jdvvv.exe 2376 xrxxlll.exe 3492 ttthnb.exe 4760 djvdd.exe 4388 xfrffxr.exe 232 tnhntb.exe 2380 fxxlxfx.exe 1020 ntbhnn.exe 3108 djvdd.exe 4808 vdjpd.exe 3568 frlflff.exe 448 tbhbhb.exe 3820 jddvj.exe 408 9xxffrr.exe -
resource yara_rule behavioral2/memory/3860-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1512-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2864-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2116-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/840-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2704-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/768-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2332-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1088-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/936-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-826-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-1069-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2376 wrote to memory of 3860 2376 f54581ee73ea741317790e096db955966367d01f5daebf2a7416e3c2e87ea16f.exe 82 PID 2376 wrote to memory of 3860 2376 f54581ee73ea741317790e096db955966367d01f5daebf2a7416e3c2e87ea16f.exe 82 PID 2376 wrote to memory of 3860 2376 f54581ee73ea741317790e096db955966367d01f5daebf2a7416e3c2e87ea16f.exe 82 PID 3860 wrote to memory of 4776 3860 9btnnh.exe 83 PID 3860 wrote to memory of 4776 3860 9btnnh.exe 83 PID 3860 wrote to memory of 4776 3860 9btnnh.exe 83 PID 4776 wrote to memory of 1844 4776 hbhbbb.exe 84 PID 4776 wrote to memory of 1844 4776 hbhbbb.exe 84 PID 4776 wrote to memory of 1844 4776 hbhbbb.exe 84 PID 1844 wrote to memory of 4408 1844 vpppp.exe 85 PID 1844 wrote to memory of 4408 1844 vpppp.exe 85 PID 1844 wrote to memory of 4408 1844 vpppp.exe 85 PID 4408 wrote to memory of 2024 4408 btnnnh.exe 86 PID 4408 wrote to memory of 2024 4408 btnnnh.exe 86 PID 4408 wrote to memory of 2024 4408 btnnnh.exe 86 PID 2024 wrote to memory of 1592 2024 7frrxfr.exe 87 PID 2024 wrote to memory of 1592 2024 7frrxfr.exe 87 PID 2024 wrote to memory of 1592 2024 7frrxfr.exe 87 PID 1592 wrote to memory of 1368 1592 jvvvd.exe 88 PID 1592 wrote to memory of 1368 1592 jvvvd.exe 88 PID 1592 wrote to memory of 1368 1592 jvvvd.exe 88 PID 1368 wrote to memory of 2028 1368 lffrxfl.exe 89 PID 1368 wrote to memory of 2028 1368 lffrxfl.exe 89 PID 1368 wrote to memory of 2028 1368 lffrxfl.exe 89 PID 2028 wrote to memory of 3820 2028 nbnntb.exe 90 PID 2028 wrote to memory of 3820 2028 nbnntb.exe 90 PID 2028 wrote to memory of 3820 2028 nbnntb.exe 90 PID 3820 wrote to memory of 408 3820 xrxrfll.exe 91 PID 3820 wrote to memory of 408 3820 xrxrfll.exe 91 PID 3820 wrote to memory of 408 3820 xrxrfll.exe 91 PID 408 wrote to memory of 1512 408 nhhttt.exe 92 PID 408 wrote to memory of 1512 408 nhhttt.exe 92 PID 408 wrote to memory of 1512 408 nhhttt.exe 92 PID 1512 wrote to memory of 4544 1512 tbbhhh.exe 93 PID 1512 wrote to memory of 4544 1512 tbbhhh.exe 93 PID 1512 wrote to memory of 4544 1512 tbbhhh.exe 93 PID 4544 wrote to memory of 3668 4544 ddvjd.exe 94 PID 4544 wrote to memory of 3668 4544 ddvjd.exe 94 PID 4544 wrote to memory of 3668 4544 ddvjd.exe 94 PID 3668 wrote to memory of 740 3668 pvvvd.exe 95 PID 3668 wrote to memory of 740 3668 pvvvd.exe 95 PID 3668 wrote to memory of 740 3668 pvvvd.exe 95 PID 740 wrote to memory of 3252 740 pjjjp.exe 96 PID 740 wrote to memory of 3252 740 pjjjp.exe 96 PID 740 wrote to memory of 3252 740 pjjjp.exe 96 PID 3252 wrote to memory of 3076 3252 ntnhhh.exe 97 PID 3252 wrote to memory of 3076 3252 ntnhhh.exe 97 PID 3252 wrote to memory of 3076 3252 ntnhhh.exe 97 PID 3076 wrote to memory of 2924 3076 vjdvj.exe 98 PID 3076 wrote to memory of 2924 3076 vjdvj.exe 98 PID 3076 wrote to memory of 2924 3076 vjdvj.exe 98 PID 2924 wrote to memory of 2520 2924 frrxlrl.exe 99 PID 2924 wrote to memory of 2520 2924 frrxlrl.exe 99 PID 2924 wrote to memory of 2520 2924 frrxlrl.exe 99 PID 2520 wrote to memory of 1640 2520 nhbttn.exe 100 PID 2520 wrote to memory of 1640 2520 nhbttn.exe 100 PID 2520 wrote to memory of 1640 2520 nhbttn.exe 100 PID 1640 wrote to memory of 2116 1640 3hnnnn.exe 101 PID 1640 wrote to memory of 2116 1640 3hnnnn.exe 101 PID 1640 wrote to memory of 2116 1640 3hnnnn.exe 101 PID 2116 wrote to memory of 2864 2116 vvjvd.exe 102 PID 2116 wrote to memory of 2864 2116 vvjvd.exe 102 PID 2116 wrote to memory of 2864 2116 vvjvd.exe 102 PID 2864 wrote to memory of 4416 2864 lfffflf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\f54581ee73ea741317790e096db955966367d01f5daebf2a7416e3c2e87ea16f.exe"C:\Users\Admin\AppData\Local\Temp\f54581ee73ea741317790e096db955966367d01f5daebf2a7416e3c2e87ea16f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\9btnnh.exec:\9btnnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\hbhbbb.exec:\hbhbbb.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\vpppp.exec:\vpppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\btnnnh.exec:\btnnnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\7frrxfr.exec:\7frrxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\jvvvd.exec:\jvvvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\lffrxfl.exec:\lffrxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\nbnntb.exec:\nbnntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\xrxrfll.exec:\xrxrfll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\nhhttt.exec:\nhhttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\tbbhhh.exec:\tbbhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\ddvjd.exec:\ddvjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\pvvvd.exec:\pvvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\pjjjp.exec:\pjjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\ntnhhh.exec:\ntnhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\vjdvj.exec:\vjdvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\frrxlrl.exec:\frrxlrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\nhbttn.exec:\nhbttn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\3hnnnn.exec:\3hnnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\vvjvd.exec:\vvjvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\lfffflf.exec:\lfffflf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\nhhhnt.exec:\nhhhnt.exe23⤵
- Executes dropped EXE
PID:4416 -
\??\c:\xflrxlr.exec:\xflrxlr.exe24⤵
- Executes dropped EXE
PID:3908 -
\??\c:\lflrlxr.exec:\lflrlxr.exe25⤵
- Executes dropped EXE
PID:664 -
\??\c:\7nhhhn.exec:\7nhhhn.exe26⤵
- Executes dropped EXE
PID:2668 -
\??\c:\lrrxlfr.exec:\lrrxlfr.exe27⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jjpdp.exec:\jjpdp.exe28⤵
- Executes dropped EXE
PID:4844 -
\??\c:\9jvvj.exec:\9jvvj.exe29⤵
- Executes dropped EXE
PID:4772 -
\??\c:\nnthnb.exec:\nnthnb.exe30⤵
- Executes dropped EXE
PID:2140 -
\??\c:\pdpdv.exec:\pdpdv.exe31⤵
- Executes dropped EXE
PID:5024 -
\??\c:\jpvvj.exec:\jpvvj.exe32⤵
- Executes dropped EXE
PID:4280 -
\??\c:\tbhtnn.exec:\tbhtnn.exe33⤵
- Executes dropped EXE
PID:1168 -
\??\c:\ffllflf.exec:\ffllflf.exe34⤵
- Executes dropped EXE
PID:2328 -
\??\c:\hbhbbb.exec:\hbhbbb.exe35⤵
- Executes dropped EXE
PID:876 -
\??\c:\jpvvd.exec:\jpvvd.exe36⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xrflrll.exec:\xrflrll.exe37⤵
- Executes dropped EXE
PID:936 -
\??\c:\jjpvp.exec:\jjpvp.exe38⤵
- Executes dropped EXE
PID:2588 -
\??\c:\flfxffr.exec:\flfxffr.exe39⤵
- Executes dropped EXE
PID:2628 -
\??\c:\djppv.exec:\djppv.exe40⤵
- Executes dropped EXE
PID:1836 -
\??\c:\7lflfrl.exec:\7lflfrl.exe41⤵
- Executes dropped EXE
PID:1232 -
\??\c:\bnbhth.exec:\bnbhth.exe42⤵
- Executes dropped EXE
PID:840 -
\??\c:\vdddj.exec:\vdddj.exe43⤵
- Executes dropped EXE
PID:4548 -
\??\c:\9nnbhb.exec:\9nnbhb.exe44⤵
- Executes dropped EXE
PID:4788 -
\??\c:\ppvpp.exec:\ppvpp.exe45⤵
- Executes dropped EXE
PID:2552 -
\??\c:\xlfrrxr.exec:\xlfrrxr.exe46⤵
- Executes dropped EXE
PID:5112 -
\??\c:\jjdjp.exec:\jjdjp.exe47⤵
- Executes dropped EXE
PID:4384 -
\??\c:\lfrxlfr.exec:\lfrxlfr.exe48⤵
- Executes dropped EXE
PID:3812 -
\??\c:\bbntth.exec:\bbntth.exe49⤵
- Executes dropped EXE
PID:2704 -
\??\c:\vvjvj.exec:\vvjvj.exe50⤵
- Executes dropped EXE
PID:3180 -
\??\c:\tthtbn.exec:\tthtbn.exe51⤵
- Executes dropped EXE
PID:4328 -
\??\c:\jdvvv.exec:\jdvvv.exe52⤵
- Executes dropped EXE
PID:4404 -
\??\c:\xrxxlll.exec:\xrxxlll.exe53⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ttthnb.exec:\ttthnb.exe54⤵
- Executes dropped EXE
PID:3492 -
\??\c:\djvdd.exec:\djvdd.exe55⤵
- Executes dropped EXE
PID:4760 -
\??\c:\xfrffxr.exec:\xfrffxr.exe56⤵
- Executes dropped EXE
PID:4388 -
\??\c:\tnhntb.exec:\tnhntb.exe57⤵
- Executes dropped EXE
PID:232 -
\??\c:\fxxlxfx.exec:\fxxlxfx.exe58⤵
- Executes dropped EXE
PID:2380 -
\??\c:\ntbhnn.exec:\ntbhnn.exe59⤵
- Executes dropped EXE
PID:1020 -
\??\c:\djvdd.exec:\djvdd.exe60⤵
- Executes dropped EXE
PID:3108 -
\??\c:\vdjpd.exec:\vdjpd.exe61⤵
- Executes dropped EXE
PID:4808 -
\??\c:\frlflff.exec:\frlflff.exe62⤵
- Executes dropped EXE
PID:3568 -
\??\c:\tbhbhb.exec:\tbhbhb.exe63⤵
- Executes dropped EXE
PID:448 -
\??\c:\jddvj.exec:\jddvj.exe64⤵
- Executes dropped EXE
PID:3820 -
\??\c:\9xxffrr.exec:\9xxffrr.exe65⤵
- Executes dropped EXE
PID:408 -
\??\c:\hnntbb.exec:\hnntbb.exe66⤵PID:768
-
\??\c:\djppd.exec:\djppd.exe67⤵PID:4984
-
\??\c:\rfxrfrl.exec:\rfxrfrl.exe68⤵PID:1636
-
\??\c:\tnbhht.exec:\tnbhht.exe69⤵PID:4244
-
\??\c:\pvdjj.exec:\pvdjj.exe70⤵PID:1992
-
\??\c:\djvpd.exec:\djvpd.exe71⤵PID:3916
-
\??\c:\fxfllrx.exec:\fxfllrx.exe72⤵PID:2056
-
\??\c:\htttht.exec:\htttht.exe73⤵PID:3252
-
\??\c:\ppvvp.exec:\ppvvp.exe74⤵PID:5088
-
\??\c:\rxrlfxr.exec:\rxrlfxr.exe75⤵PID:1628
-
\??\c:\bhbtnh.exec:\bhbtnh.exe76⤵PID:4216
-
\??\c:\3jvpp.exec:\3jvpp.exe77⤵PID:3656
-
\??\c:\rrrrlrr.exec:\rrrrlrr.exe78⤵PID:1944
-
\??\c:\bbnhhn.exec:\bbnhhn.exe79⤵PID:1740
-
\??\c:\pjjvv.exec:\pjjvv.exe80⤵PID:2208
-
\??\c:\rlxfflr.exec:\rlxfflr.exe81⤵PID:2240
-
\??\c:\tnnnbn.exec:\tnnnbn.exe82⤵PID:3736
-
\??\c:\7jvvp.exec:\7jvvp.exe83⤵PID:4656
-
\??\c:\frxxflr.exec:\frxxflr.exe84⤵PID:2052
-
\??\c:\nnnttb.exec:\nnnttb.exe85⤵PID:1076
-
\??\c:\vjpjd.exec:\vjpjd.exe86⤵PID:2880
-
\??\c:\xlfrlxf.exec:\xlfrlxf.exe87⤵PID:396
-
\??\c:\tthhnt.exec:\tthhnt.exe88⤵PID:2684
-
\??\c:\pjjdj.exec:\pjjdj.exe89⤵PID:908
-
\??\c:\fffxrrl.exec:\fffxrrl.exe90⤵PID:3580
-
\??\c:\nnnhhn.exec:\nnnhhn.exe91⤵PID:1840
-
\??\c:\fffrrrl.exec:\fffrrrl.exe92⤵PID:1108
-
\??\c:\flfffll.exec:\flfffll.exe93⤵PID:2172
-
\??\c:\7hnhhb.exec:\7hnhhb.exe94⤵PID:4636
-
\??\c:\djdjp.exec:\djdjp.exe95⤵PID:1568
-
\??\c:\btnntt.exec:\btnntt.exe96⤵PID:3596
-
\??\c:\nhbtnh.exec:\nhbtnh.exe97⤵PID:3856
-
\??\c:\djdjj.exec:\djdjj.exe98⤵PID:3200
-
\??\c:\5rxxfll.exec:\5rxxfll.exe99⤵PID:4524
-
\??\c:\hbnnth.exec:\hbnnth.exe100⤵PID:1508
-
\??\c:\pjjdv.exec:\pjjdv.exe101⤵PID:5044
-
\??\c:\tbnhtt.exec:\tbnhtt.exe102⤵PID:1836
-
\??\c:\pjjjd.exec:\pjjjd.exe103⤵PID:3012
-
\??\c:\lllrfrf.exec:\lllrfrf.exe104⤵PID:1016
-
\??\c:\nnbhnn.exec:\nnbhnn.exe105⤵PID:4500
-
\??\c:\djvdv.exec:\djvdv.exe106⤵PID:4696
-
\??\c:\3xxxxff.exec:\3xxxxff.exe107⤵PID:1480
-
\??\c:\thhtbh.exec:\thhtbh.exe108⤵PID:1796
-
\??\c:\nbbntt.exec:\nbbntt.exe109⤵PID:3504
-
\??\c:\7jppp.exec:\7jppp.exe110⤵PID:2332
-
\??\c:\lflllrr.exec:\lflllrr.exe111⤵PID:2652
-
\??\c:\vddjj.exec:\vddjj.exe112⤵PID:4312
-
\??\c:\xrlllfl.exec:\xrlllfl.exe113⤵PID:3592
-
\??\c:\tnnhbt.exec:\tnnhbt.exe114⤵PID:2156
-
\??\c:\pjpvp.exec:\pjpvp.exe115⤵PID:4740
-
\??\c:\lfxxxrl.exec:\lfxxxrl.exe116⤵PID:3468
-
\??\c:\tnbbbh.exec:\tnbbbh.exe117⤵PID:3920
-
\??\c:\pjddd.exec:\pjddd.exe118⤵PID:4392
-
\??\c:\frxllll.exec:\frxllll.exe119⤵PID:4388
-
\??\c:\9bnntb.exec:\9bnntb.exe120⤵PID:228
-
\??\c:\ntbhtn.exec:\ntbhtn.exe121⤵PID:4200
-
\??\c:\djppp.exec:\djppp.exe122⤵PID:3188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-