Analysis
-
max time kernel
120s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 10:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f6dfbd075628b876b76f46a122f83d98c10e323b6a079d798d7f2ad500d205bfN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
f6dfbd075628b876b76f46a122f83d98c10e323b6a079d798d7f2ad500d205bfN.exe
-
Size
454KB
-
MD5
299e44dbd8aa0f5d1f42f92c88fc4bc0
-
SHA1
ab20061d5af428a278dac9be3c0de406dfad713c
-
SHA256
f6dfbd075628b876b76f46a122f83d98c10e323b6a079d798d7f2ad500d205bf
-
SHA512
2d79c55e6dd37d6ba493539b15f8c6e781260c6cca90bb142abf1c074635e9b172ee1048b047014b90e5f831c40b9c9b8fa26df69ebcb5d8d9915f8289fe80e2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeL:q7Tc2NYHUrAwfMp3CDL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4676-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/736-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4208-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1080-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3908-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-655-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-734-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-780-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-941-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-1062-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-1253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-1497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-1594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-1694-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3468 btbtnh.exe 2800 vpjpp.exe 4820 rrrlllx.exe 4908 xrflffr.exe 452 3tthnh.exe 1776 dvvpp.exe 736 nhbbtn.exe 3476 xfxxrxl.exe 2288 5ntttb.exe 3436 djvpv.exe 4360 rflfrrl.exe 4036 hbnhbb.exe 372 vvddd.exe 2208 vjdjd.exe 1596 rxxlfxr.exe 632 fxxrrlr.exe 2320 vpdvv.exe 3292 xfrlxrf.exe 3036 xxfxfff.exe 3620 dppjj.exe 696 xxfrfxr.exe 3536 rfxlflx.exe 628 nhhbnh.exe 4856 lrrlfxr.exe 1492 pjdjv.exe 5032 xffxrlf.exe 4068 thnnhh.exe 3300 xrxrlff.exe 2676 bhbtnh.exe 3696 lllxrrf.exe 3420 7vvpv.exe 4420 3ffrllf.exe 1752 vpvpj.exe 2196 xrlxrrl.exe 4524 bthbtn.exe 1824 1nhbbb.exe 4468 ffrlrxl.exe 4180 thnhtt.exe 3920 pvvpj.exe 4728 lxrrrll.exe 4216 tnnthb.exe 4708 djdjv.exe 4292 9xlfxxf.exe 388 fxlrlfx.exe 1756 1bntbt.exe 724 dddvp.exe 3680 xrlfxff.exe 4776 tnhtht.exe 4536 dpdpp.exe 4908 3fxlfxr.exe 1424 1bnhhn.exe 1288 dvdvv.exe 4236 lrrlllr.exe 4012 5htntt.exe 4344 bbnnnn.exe 4328 dppjv.exe 4240 lfflllr.exe 1964 tntnnn.exe 4688 1pvdd.exe 4152 pjjdv.exe 4944 lxflxxf.exe 4448 tnnhbb.exe 2208 thtnnt.exe 5084 pjdvj.exe -
resource yara_rule behavioral2/memory/4676-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/736-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4208-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1292-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3908-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-780-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1292-941-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-1062-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-1147-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ffflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4676 wrote to memory of 3468 4676 f6dfbd075628b876b76f46a122f83d98c10e323b6a079d798d7f2ad500d205bfN.exe 83 PID 4676 wrote to memory of 3468 4676 f6dfbd075628b876b76f46a122f83d98c10e323b6a079d798d7f2ad500d205bfN.exe 83 PID 4676 wrote to memory of 3468 4676 f6dfbd075628b876b76f46a122f83d98c10e323b6a079d798d7f2ad500d205bfN.exe 83 PID 3468 wrote to memory of 2800 3468 btbtnh.exe 84 PID 3468 wrote to memory of 2800 3468 btbtnh.exe 84 PID 3468 wrote to memory of 2800 3468 btbtnh.exe 84 PID 2800 wrote to memory of 4820 2800 vpjpp.exe 85 PID 2800 wrote to memory of 4820 2800 vpjpp.exe 85 PID 2800 wrote to memory of 4820 2800 vpjpp.exe 85 PID 4820 wrote to memory of 4908 4820 rrrlllx.exe 86 PID 4820 wrote to memory of 4908 4820 rrrlllx.exe 86 PID 4820 wrote to memory of 4908 4820 rrrlllx.exe 86 PID 4908 wrote to memory of 452 4908 xrflffr.exe 87 PID 4908 wrote to memory of 452 4908 xrflffr.exe 87 PID 4908 wrote to memory of 452 4908 xrflffr.exe 87 PID 452 wrote to memory of 1776 452 3tthnh.exe 88 PID 452 wrote to memory of 1776 452 3tthnh.exe 88 PID 452 wrote to memory of 1776 452 3tthnh.exe 88 PID 1776 wrote to memory of 736 1776 dvvpp.exe 89 PID 1776 wrote to memory of 736 1776 dvvpp.exe 89 PID 1776 wrote to memory of 736 1776 dvvpp.exe 89 PID 736 wrote to memory of 3476 736 nhbbtn.exe 90 PID 736 wrote to memory of 3476 736 nhbbtn.exe 90 PID 736 wrote to memory of 3476 736 nhbbtn.exe 90 PID 3476 wrote to memory of 2288 3476 xfxxrxl.exe 91 PID 3476 wrote to memory of 2288 3476 xfxxrxl.exe 91 PID 3476 wrote to memory of 2288 3476 xfxxrxl.exe 91 PID 2288 wrote to memory of 3436 2288 5ntttb.exe 92 PID 2288 wrote to memory of 3436 2288 5ntttb.exe 92 PID 2288 wrote to memory of 3436 2288 5ntttb.exe 92 PID 3436 wrote to memory of 4360 3436 djvpv.exe 93 PID 3436 wrote to memory of 4360 3436 djvpv.exe 93 PID 3436 wrote to memory of 4360 3436 djvpv.exe 93 PID 4360 wrote to memory of 4036 4360 rflfrrl.exe 94 PID 4360 wrote to memory of 4036 4360 rflfrrl.exe 94 PID 4360 wrote to memory of 4036 4360 rflfrrl.exe 94 PID 4036 wrote to memory of 372 4036 hbnhbb.exe 95 PID 4036 wrote to memory of 372 4036 hbnhbb.exe 95 PID 4036 wrote to memory of 372 4036 hbnhbb.exe 95 PID 372 wrote to memory of 2208 372 vvddd.exe 96 PID 372 wrote to memory of 2208 372 vvddd.exe 96 PID 372 wrote to memory of 2208 372 vvddd.exe 96 PID 2208 wrote to memory of 1596 2208 vjdjd.exe 97 PID 2208 wrote to memory of 1596 2208 vjdjd.exe 97 PID 2208 wrote to memory of 1596 2208 vjdjd.exe 97 PID 1596 wrote to memory of 632 1596 rxxlfxr.exe 98 PID 1596 wrote to memory of 632 1596 rxxlfxr.exe 98 PID 1596 wrote to memory of 632 1596 rxxlfxr.exe 98 PID 632 wrote to memory of 2320 632 fxxrrlr.exe 99 PID 632 wrote to memory of 2320 632 fxxrrlr.exe 99 PID 632 wrote to memory of 2320 632 fxxrrlr.exe 99 PID 2320 wrote to memory of 3292 2320 vpdvv.exe 100 PID 2320 wrote to memory of 3292 2320 vpdvv.exe 100 PID 2320 wrote to memory of 3292 2320 vpdvv.exe 100 PID 3292 wrote to memory of 3036 3292 xfrlxrf.exe 101 PID 3292 wrote to memory of 3036 3292 xfrlxrf.exe 101 PID 3292 wrote to memory of 3036 3292 xfrlxrf.exe 101 PID 3036 wrote to memory of 3620 3036 xxfxfff.exe 102 PID 3036 wrote to memory of 3620 3036 xxfxfff.exe 102 PID 3036 wrote to memory of 3620 3036 xxfxfff.exe 102 PID 3620 wrote to memory of 696 3620 dppjj.exe 103 PID 3620 wrote to memory of 696 3620 dppjj.exe 103 PID 3620 wrote to memory of 696 3620 dppjj.exe 103 PID 696 wrote to memory of 3536 696 xxfrfxr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6dfbd075628b876b76f46a122f83d98c10e323b6a079d798d7f2ad500d205bfN.exe"C:\Users\Admin\AppData\Local\Temp\f6dfbd075628b876b76f46a122f83d98c10e323b6a079d798d7f2ad500d205bfN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\btbtnh.exec:\btbtnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\vpjpp.exec:\vpjpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\rrrlllx.exec:\rrrlllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\xrflffr.exec:\xrflffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\3tthnh.exec:\3tthnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\dvvpp.exec:\dvvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\nhbbtn.exec:\nhbbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\xfxxrxl.exec:\xfxxrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\5ntttb.exec:\5ntttb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\djvpv.exec:\djvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\rflfrrl.exec:\rflfrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\hbnhbb.exec:\hbnhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\vvddd.exec:\vvddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\vjdjd.exec:\vjdjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\rxxlfxr.exec:\rxxlfxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\fxxrrlr.exec:\fxxrrlr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\vpdvv.exec:\vpdvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\xfrlxrf.exec:\xfrlxrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\xxfxfff.exec:\xxfxfff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\dppjj.exec:\dppjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\xxfrfxr.exec:\xxfrfxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\rfxlflx.exec:\rfxlflx.exe23⤵
- Executes dropped EXE
PID:3536 -
\??\c:\nhhbnh.exec:\nhhbnh.exe24⤵
- Executes dropped EXE
PID:628 -
\??\c:\lrrlfxr.exec:\lrrlfxr.exe25⤵
- Executes dropped EXE
PID:4856 -
\??\c:\pjdjv.exec:\pjdjv.exe26⤵
- Executes dropped EXE
PID:1492 -
\??\c:\xffxrlf.exec:\xffxrlf.exe27⤵
- Executes dropped EXE
PID:5032 -
\??\c:\thnnhh.exec:\thnnhh.exe28⤵
- Executes dropped EXE
PID:4068 -
\??\c:\xrxrlff.exec:\xrxrlff.exe29⤵
- Executes dropped EXE
PID:3300 -
\??\c:\bhbtnh.exec:\bhbtnh.exe30⤵
- Executes dropped EXE
PID:2676 -
\??\c:\lllxrrf.exec:\lllxrrf.exe31⤵
- Executes dropped EXE
PID:3696 -
\??\c:\7vvpv.exec:\7vvpv.exe32⤵
- Executes dropped EXE
PID:3420 -
\??\c:\3ffrllf.exec:\3ffrllf.exe33⤵
- Executes dropped EXE
PID:4420 -
\??\c:\vpvpj.exec:\vpvpj.exe34⤵
- Executes dropped EXE
PID:1752 -
\??\c:\xrlxrrl.exec:\xrlxrrl.exe35⤵
- Executes dropped EXE
PID:2196 -
\??\c:\bthbtn.exec:\bthbtn.exe36⤵
- Executes dropped EXE
PID:4524 -
\??\c:\1nhbbb.exec:\1nhbbb.exe37⤵
- Executes dropped EXE
PID:1824 -
\??\c:\ffrlrxl.exec:\ffrlrxl.exe38⤵
- Executes dropped EXE
PID:4468 -
\??\c:\thnhtt.exec:\thnhtt.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4180 -
\??\c:\pvvpj.exec:\pvvpj.exe40⤵
- Executes dropped EXE
PID:3920 -
\??\c:\lxrrrll.exec:\lxrrrll.exe41⤵
- Executes dropped EXE
PID:4728 -
\??\c:\tnnthb.exec:\tnnthb.exe42⤵
- Executes dropped EXE
PID:4216 -
\??\c:\djdjv.exec:\djdjv.exe43⤵
- Executes dropped EXE
PID:4708 -
\??\c:\9xlfxxf.exec:\9xlfxxf.exe44⤵
- Executes dropped EXE
PID:4292 -
\??\c:\fxlrlfx.exec:\fxlrlfx.exe45⤵
- Executes dropped EXE
PID:388 -
\??\c:\1bntbt.exec:\1bntbt.exe46⤵
- Executes dropped EXE
PID:1756 -
\??\c:\dddvp.exec:\dddvp.exe47⤵
- Executes dropped EXE
PID:724 -
\??\c:\xrlfxff.exec:\xrlfxff.exe48⤵
- Executes dropped EXE
PID:3680 -
\??\c:\tnhtht.exec:\tnhtht.exe49⤵
- Executes dropped EXE
PID:4776 -
\??\c:\dpdpp.exec:\dpdpp.exe50⤵
- Executes dropped EXE
PID:4536 -
\??\c:\3fxlfxr.exec:\3fxlfxr.exe51⤵
- Executes dropped EXE
PID:4908 -
\??\c:\1bnhhn.exec:\1bnhhn.exe52⤵
- Executes dropped EXE
PID:1424 -
\??\c:\dvdvv.exec:\dvdvv.exe53⤵
- Executes dropped EXE
PID:1288 -
\??\c:\lrrlllr.exec:\lrrlllr.exe54⤵
- Executes dropped EXE
PID:4236 -
\??\c:\5htntt.exec:\5htntt.exe55⤵
- Executes dropped EXE
PID:4012 -
\??\c:\bbnnnn.exec:\bbnnnn.exe56⤵
- Executes dropped EXE
PID:4344 -
\??\c:\dppjv.exec:\dppjv.exe57⤵
- Executes dropped EXE
PID:4328 -
\??\c:\lfflllr.exec:\lfflllr.exe58⤵
- Executes dropped EXE
PID:4240 -
\??\c:\tntnnn.exec:\tntnnn.exe59⤵
- Executes dropped EXE
PID:1964 -
\??\c:\1pvdd.exec:\1pvdd.exe60⤵
- Executes dropped EXE
PID:4688 -
\??\c:\pjjdv.exec:\pjjdv.exe61⤵
- Executes dropped EXE
PID:4152 -
\??\c:\lxflxxf.exec:\lxflxxf.exe62⤵
- Executes dropped EXE
PID:4944 -
\??\c:\tnnhbb.exec:\tnnhbb.exe63⤵
- Executes dropped EXE
PID:4448 -
\??\c:\thtnnt.exec:\thtnnt.exe64⤵
- Executes dropped EXE
PID:2208 -
\??\c:\pjdvj.exec:\pjdvj.exe65⤵
- Executes dropped EXE
PID:5084 -
\??\c:\rllffxf.exec:\rllffxf.exe66⤵PID:4396
-
\??\c:\5ttthh.exec:\5ttthh.exe67⤵PID:1116
-
\??\c:\jjjdd.exec:\jjjdd.exe68⤵PID:2636
-
\??\c:\vvjdp.exec:\vvjdp.exe69⤵PID:1936
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe70⤵PID:4132
-
\??\c:\1nnhbt.exec:\1nnhbt.exe71⤵PID:3668
-
\??\c:\9vvpd.exec:\9vvpd.exe72⤵PID:4208
-
\??\c:\llrlxxr.exec:\llrlxxr.exe73⤵PID:1540
-
\??\c:\xfrlflf.exec:\xfrlflf.exe74⤵PID:2388
-
\??\c:\btttbb.exec:\btttbb.exe75⤵PID:2500
-
\??\c:\ppddj.exec:\ppddj.exe76⤵PID:1080
-
\??\c:\9djdp.exec:\9djdp.exe77⤵PID:628
-
\??\c:\frrrrlf.exec:\frrrrlf.exe78⤵PID:2652
-
\??\c:\bbtnhh.exec:\bbtnhh.exe79⤵PID:4040
-
\??\c:\jdjvv.exec:\jdjvv.exe80⤵PID:2668
-
\??\c:\flxlrfr.exec:\flxlrfr.exe81⤵PID:5032
-
\??\c:\3bhbtn.exec:\3bhbtn.exe82⤵PID:4068
-
\??\c:\dddvp.exec:\dddvp.exe83⤵PID:2588
-
\??\c:\pjddd.exec:\pjddd.exe84⤵PID:3848
-
\??\c:\5lrxrrl.exec:\5lrxrrl.exe85⤵PID:3832
-
\??\c:\1btnhh.exec:\1btnhh.exe86⤵PID:5104
-
\??\c:\hnhbnn.exec:\hnhbnn.exe87⤵PID:2824
-
\??\c:\vvpjv.exec:\vvpjv.exe88⤵PID:3908
-
\??\c:\9lrlllr.exec:\9lrlllr.exe89⤵PID:3584
-
\??\c:\tttbbn.exec:\tttbbn.exe90⤵PID:1588
-
\??\c:\dpjjp.exec:\dpjjp.exe91⤵PID:2196
-
\??\c:\lfflxlf.exec:\lfflxlf.exe92⤵PID:4524
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe93⤵PID:4932
-
\??\c:\hnthbt.exec:\hnthbt.exe94⤵PID:4468
-
\??\c:\vppvj.exec:\vppvj.exe95⤵PID:2092
-
\??\c:\rfffxrl.exec:\rfffxrl.exe96⤵PID:2632
-
\??\c:\xlrrllf.exec:\xlrrllf.exe97⤵PID:2728
-
\??\c:\bhbtnh.exec:\bhbtnh.exe98⤵PID:4296
-
\??\c:\ppvjd.exec:\ppvjd.exe99⤵PID:400
-
\??\c:\rlrlrlr.exec:\rlrlrlr.exe100⤵PID:4292
-
\??\c:\thnhnn.exec:\thnhnn.exe101⤵PID:3196
-
\??\c:\pjjdv.exec:\pjjdv.exe102⤵PID:1756
-
\??\c:\vpdvj.exec:\vpdvj.exe103⤵PID:724
-
\??\c:\1rxrfll.exec:\1rxrfll.exe104⤵PID:4484
-
\??\c:\tnhhbb.exec:\tnhhbb.exe105⤵PID:4776
-
\??\c:\pvvpj.exec:\pvvpj.exe106⤵PID:4536
-
\??\c:\5xlfffx.exec:\5xlfffx.exe107⤵PID:1660
-
\??\c:\xxxfxxr.exec:\xxxfxxr.exe108⤵PID:3604
-
\??\c:\btnhbt.exec:\btnhbt.exe109⤵PID:3340
-
\??\c:\jjvpp.exec:\jjvpp.exe110⤵PID:4872
-
\??\c:\lxrrffx.exec:\lxrrffx.exe111⤵PID:4012
-
\??\c:\lxlxxfx.exec:\lxlxxfx.exe112⤵PID:4344
-
\??\c:\tbnhbb.exec:\tbnhbb.exe113⤵PID:4328
-
\??\c:\7jvpp.exec:\7jvpp.exe114⤵PID:3944
-
\??\c:\5rllffl.exec:\5rllffl.exe115⤵PID:2952
-
\??\c:\rlllfff.exec:\rlllfff.exe116⤵PID:4696
-
\??\c:\bbttbb.exec:\bbttbb.exe117⤵PID:2268
-
\??\c:\djjjd.exec:\djjjd.exe118⤵PID:684
-
\??\c:\5fllllf.exec:\5fllllf.exe119⤵PID:2828
-
\??\c:\nhtntt.exec:\nhtntt.exe120⤵PID:4920
-
\??\c:\tnntth.exec:\tnntth.exe121⤵PID:1396
-
\??\c:\dvjdd.exec:\dvjdd.exe122⤵PID:4248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-