Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 06:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
470a97b9acf7bac66f1a66858dd89ee348c637b6e02ce7b3aa0c519ff146cfc9N.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
470a97b9acf7bac66f1a66858dd89ee348c637b6e02ce7b3aa0c519ff146cfc9N.exe
-
Size
454KB
-
MD5
17962242910e85ff3b8ed6723e72cb30
-
SHA1
276766fb1af728e03e0672b868bae7024c3d21b1
-
SHA256
470a97b9acf7bac66f1a66858dd89ee348c637b6e02ce7b3aa0c519ff146cfc9
-
SHA512
4f3aeed5f9ff18e8367cf96fd8aa685036c434f4418b81c03d21636a5cdbb2d1a70a8f91a68d3cae71c37eb1641275bbdea4778e0b46a5e01449f026b2c77f3f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR:q7Tc2NYHUrAwfMp3CDR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4780-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/416-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2748-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1088-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/680-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1784-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1104-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/888-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/244-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/848-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/528-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4244-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-723-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-905-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-933-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-937-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-1203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3164 pvjdv.exe 1504 hbnhtn.exe 3148 llffxff.exe 1052 ntbbbb.exe 4080 btttnn.exe 3044 vdjjv.exe 4268 hnbhhb.exe 3912 lxxrllf.exe 1684 thhbnh.exe 4788 rfrlfxx.exe 2648 vjdvp.exe 2020 7lrlffx.exe 4912 bntntn.exe 4812 jjjjj.exe 416 vjvpj.exe 4352 flfxrrl.exe 2300 nhtnth.exe 4492 djpjd.exe 2748 hbbbth.exe 3664 fllrxrf.exe 4992 rffxffx.exe 3316 pdvpd.exe 2068 btnthh.exe 4296 9ddjd.exe 2036 lxxfxxr.exe 1088 ffxrllf.exe 1784 xrrlxrl.exe 680 ntthth.exe 2620 pjdvd.exe 4232 nnnnnn.exe 3572 jdppp.exe 4656 frfxrrl.exe 2492 rrllfxr.exe 392 hbbbhh.exe 1104 vpdvj.exe 4020 lrxrrrl.exe 4576 hbnnnt.exe 2412 llxxxff.exe 888 xrfxfll.exe 3964 nbbtnn.exe 3476 vdppj.exe 2924 lflfxrl.exe 2664 nbtnbb.exe 4340 pvppj.exe 2556 5xffxff.exe 3932 xxffxrr.exe 4380 9btnhn.exe 4548 jdjdv.exe 1872 rxllrxx.exe 3760 bthhhn.exe 1792 pvdvv.exe 1176 ddjjj.exe 1036 9xrfrrl.exe 4336 hhnnnt.exe 3236 jjvvv.exe 4916 xrxxlll.exe 4936 nhtttb.exe 3252 9djdj.exe 3148 rrfxllf.exe 3520 5bhbth.exe 4180 nnhbtb.exe 4128 pppdv.exe 3268 xxxxffl.exe 2060 tnbhbh.exe -
resource yara_rule behavioral2/memory/4780-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/416-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2748-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1088-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/680-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1104-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/888-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/244-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/848-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/528-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1568-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-905-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-933-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-937-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4780 wrote to memory of 3164 4780 470a97b9acf7bac66f1a66858dd89ee348c637b6e02ce7b3aa0c519ff146cfc9N.exe 82 PID 4780 wrote to memory of 3164 4780 470a97b9acf7bac66f1a66858dd89ee348c637b6e02ce7b3aa0c519ff146cfc9N.exe 82 PID 4780 wrote to memory of 3164 4780 470a97b9acf7bac66f1a66858dd89ee348c637b6e02ce7b3aa0c519ff146cfc9N.exe 82 PID 3164 wrote to memory of 1504 3164 pvjdv.exe 83 PID 3164 wrote to memory of 1504 3164 pvjdv.exe 83 PID 3164 wrote to memory of 1504 3164 pvjdv.exe 83 PID 1504 wrote to memory of 3148 1504 hbnhtn.exe 84 PID 1504 wrote to memory of 3148 1504 hbnhtn.exe 84 PID 1504 wrote to memory of 3148 1504 hbnhtn.exe 84 PID 3148 wrote to memory of 1052 3148 llffxff.exe 85 PID 3148 wrote to memory of 1052 3148 llffxff.exe 85 PID 3148 wrote to memory of 1052 3148 llffxff.exe 85 PID 1052 wrote to memory of 4080 1052 ntbbbb.exe 86 PID 1052 wrote to memory of 4080 1052 ntbbbb.exe 86 PID 1052 wrote to memory of 4080 1052 ntbbbb.exe 86 PID 4080 wrote to memory of 3044 4080 btttnn.exe 87 PID 4080 wrote to memory of 3044 4080 btttnn.exe 87 PID 4080 wrote to memory of 3044 4080 btttnn.exe 87 PID 3044 wrote to memory of 4268 3044 vdjjv.exe 88 PID 3044 wrote to memory of 4268 3044 vdjjv.exe 88 PID 3044 wrote to memory of 4268 3044 vdjjv.exe 88 PID 4268 wrote to memory of 3912 4268 hnbhhb.exe 89 PID 4268 wrote to memory of 3912 4268 hnbhhb.exe 89 PID 4268 wrote to memory of 3912 4268 hnbhhb.exe 89 PID 3912 wrote to memory of 1684 3912 lxxrllf.exe 90 PID 3912 wrote to memory of 1684 3912 lxxrllf.exe 90 PID 3912 wrote to memory of 1684 3912 lxxrllf.exe 90 PID 1684 wrote to memory of 4788 1684 thhbnh.exe 91 PID 1684 wrote to memory of 4788 1684 thhbnh.exe 91 PID 1684 wrote to memory of 4788 1684 thhbnh.exe 91 PID 4788 wrote to memory of 2648 4788 rfrlfxx.exe 92 PID 4788 wrote to memory of 2648 4788 rfrlfxx.exe 92 PID 4788 wrote to memory of 2648 4788 rfrlfxx.exe 92 PID 2648 wrote to memory of 2020 2648 vjdvp.exe 93 PID 2648 wrote to memory of 2020 2648 vjdvp.exe 93 PID 2648 wrote to memory of 2020 2648 vjdvp.exe 93 PID 2020 wrote to memory of 4912 2020 7lrlffx.exe 94 PID 2020 wrote to memory of 4912 2020 7lrlffx.exe 94 PID 2020 wrote to memory of 4912 2020 7lrlffx.exe 94 PID 4912 wrote to memory of 4812 4912 bntntn.exe 95 PID 4912 wrote to memory of 4812 4912 bntntn.exe 95 PID 4912 wrote to memory of 4812 4912 bntntn.exe 95 PID 4812 wrote to memory of 416 4812 jjjjj.exe 96 PID 4812 wrote to memory of 416 4812 jjjjj.exe 96 PID 4812 wrote to memory of 416 4812 jjjjj.exe 96 PID 416 wrote to memory of 4352 416 vjvpj.exe 97 PID 416 wrote to memory of 4352 416 vjvpj.exe 97 PID 416 wrote to memory of 4352 416 vjvpj.exe 97 PID 4352 wrote to memory of 2300 4352 flfxrrl.exe 98 PID 4352 wrote to memory of 2300 4352 flfxrrl.exe 98 PID 4352 wrote to memory of 2300 4352 flfxrrl.exe 98 PID 2300 wrote to memory of 4492 2300 nhtnth.exe 99 PID 2300 wrote to memory of 4492 2300 nhtnth.exe 99 PID 2300 wrote to memory of 4492 2300 nhtnth.exe 99 PID 4492 wrote to memory of 2748 4492 djpjd.exe 100 PID 4492 wrote to memory of 2748 4492 djpjd.exe 100 PID 4492 wrote to memory of 2748 4492 djpjd.exe 100 PID 2748 wrote to memory of 3664 2748 hbbbth.exe 101 PID 2748 wrote to memory of 3664 2748 hbbbth.exe 101 PID 2748 wrote to memory of 3664 2748 hbbbth.exe 101 PID 3664 wrote to memory of 4992 3664 fllrxrf.exe 102 PID 3664 wrote to memory of 4992 3664 fllrxrf.exe 102 PID 3664 wrote to memory of 4992 3664 fllrxrf.exe 102 PID 4992 wrote to memory of 3316 4992 rffxffx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\470a97b9acf7bac66f1a66858dd89ee348c637b6e02ce7b3aa0c519ff146cfc9N.exe"C:\Users\Admin\AppData\Local\Temp\470a97b9acf7bac66f1a66858dd89ee348c637b6e02ce7b3aa0c519ff146cfc9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\pvjdv.exec:\pvjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\hbnhtn.exec:\hbnhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\llffxff.exec:\llffxff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\ntbbbb.exec:\ntbbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\btttnn.exec:\btttnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\vdjjv.exec:\vdjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\hnbhhb.exec:\hnbhhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\lxxrllf.exec:\lxxrllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\thhbnh.exec:\thhbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\rfrlfxx.exec:\rfrlfxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\vjdvp.exec:\vjdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\7lrlffx.exec:\7lrlffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\bntntn.exec:\bntntn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\jjjjj.exec:\jjjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\vjvpj.exec:\vjvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
\??\c:\flfxrrl.exec:\flfxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\nhtnth.exec:\nhtnth.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\djpjd.exec:\djpjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\hbbbth.exec:\hbbbth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\fllrxrf.exec:\fllrxrf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\rffxffx.exec:\rffxffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\pdvpd.exec:\pdvpd.exe23⤵
- Executes dropped EXE
PID:3316 -
\??\c:\btnthh.exec:\btnthh.exe24⤵
- Executes dropped EXE
PID:2068 -
\??\c:\9ddjd.exec:\9ddjd.exe25⤵
- Executes dropped EXE
PID:4296 -
\??\c:\lxxfxxr.exec:\lxxfxxr.exe26⤵
- Executes dropped EXE
PID:2036 -
\??\c:\ffxrllf.exec:\ffxrllf.exe27⤵
- Executes dropped EXE
PID:1088 -
\??\c:\xrrlxrl.exec:\xrrlxrl.exe28⤵
- Executes dropped EXE
PID:1784 -
\??\c:\ntthth.exec:\ntthth.exe29⤵
- Executes dropped EXE
PID:680 -
\??\c:\pjdvd.exec:\pjdvd.exe30⤵
- Executes dropped EXE
PID:2620 -
\??\c:\nnnnnn.exec:\nnnnnn.exe31⤵
- Executes dropped EXE
PID:4232 -
\??\c:\jdppp.exec:\jdppp.exe32⤵
- Executes dropped EXE
PID:3572 -
\??\c:\frfxrrl.exec:\frfxrrl.exe33⤵
- Executes dropped EXE
PID:4656 -
\??\c:\rrllfxr.exec:\rrllfxr.exe34⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hbbbhh.exec:\hbbbhh.exe35⤵
- Executes dropped EXE
PID:392 -
\??\c:\vpdvj.exec:\vpdvj.exe36⤵
- Executes dropped EXE
PID:1104 -
\??\c:\lrxrrrl.exec:\lrxrrrl.exe37⤵
- Executes dropped EXE
PID:4020 -
\??\c:\hbnnnt.exec:\hbnnnt.exe38⤵
- Executes dropped EXE
PID:4576 -
\??\c:\llxxxff.exec:\llxxxff.exe39⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xrfxfll.exec:\xrfxfll.exe40⤵
- Executes dropped EXE
PID:888 -
\??\c:\nbbtnn.exec:\nbbtnn.exe41⤵
- Executes dropped EXE
PID:3964 -
\??\c:\vdppj.exec:\vdppj.exe42⤵
- Executes dropped EXE
PID:3476 -
\??\c:\lflfxrl.exec:\lflfxrl.exe43⤵
- Executes dropped EXE
PID:2924 -
\??\c:\nbtnbb.exec:\nbtnbb.exe44⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pvppj.exec:\pvppj.exe45⤵
- Executes dropped EXE
PID:4340 -
\??\c:\5xffxff.exec:\5xffxff.exe46⤵
- Executes dropped EXE
PID:2556 -
\??\c:\xxffxrr.exec:\xxffxrr.exe47⤵
- Executes dropped EXE
PID:3932 -
\??\c:\9btnhn.exec:\9btnhn.exe48⤵
- Executes dropped EXE
PID:4380 -
\??\c:\jdjdv.exec:\jdjdv.exe49⤵
- Executes dropped EXE
PID:4548 -
\??\c:\rxllrxx.exec:\rxllrxx.exe50⤵
- Executes dropped EXE
PID:1872 -
\??\c:\bthhhn.exec:\bthhhn.exe51⤵
- Executes dropped EXE
PID:3760 -
\??\c:\pvdvv.exec:\pvdvv.exe52⤵
- Executes dropped EXE
PID:1792 -
\??\c:\ddjjj.exec:\ddjjj.exe53⤵
- Executes dropped EXE
PID:1176 -
\??\c:\9xrfrrl.exec:\9xrfrrl.exe54⤵
- Executes dropped EXE
PID:1036 -
\??\c:\hhnnnt.exec:\hhnnnt.exe55⤵
- Executes dropped EXE
PID:4336 -
\??\c:\jjvvv.exec:\jjvvv.exe56⤵
- Executes dropped EXE
PID:3236 -
\??\c:\xrxxlll.exec:\xrxxlll.exe57⤵
- Executes dropped EXE
PID:4916 -
\??\c:\nhtttb.exec:\nhtttb.exe58⤵
- Executes dropped EXE
PID:4936 -
\??\c:\9djdj.exec:\9djdj.exe59⤵
- Executes dropped EXE
PID:3252 -
\??\c:\rrfxllf.exec:\rrfxllf.exe60⤵
- Executes dropped EXE
PID:3148 -
\??\c:\5bhbth.exec:\5bhbth.exe61⤵
- Executes dropped EXE
PID:3520 -
\??\c:\nnhbtb.exec:\nnhbtb.exe62⤵
- Executes dropped EXE
PID:4180 -
\??\c:\pppdv.exec:\pppdv.exe63⤵
- Executes dropped EXE
PID:4128 -
\??\c:\xxxxffl.exec:\xxxxffl.exe64⤵
- Executes dropped EXE
PID:3268 -
\??\c:\tnbhbh.exec:\tnbhbh.exe65⤵
- Executes dropped EXE
PID:2060 -
\??\c:\jpdvp.exec:\jpdvp.exe66⤵PID:2056
-
\??\c:\rlfxffl.exec:\rlfxffl.exe67⤵PID:3176
-
\??\c:\nntnnt.exec:\nntnnt.exe68⤵PID:4816
-
\??\c:\dvjdj.exec:\dvjdj.exe69⤵PID:4740
-
\??\c:\jvjjj.exec:\jvjjj.exe70⤵PID:2132
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe71⤵PID:3648
-
\??\c:\hthhbn.exec:\hthhbn.exe72⤵PID:1468
-
\??\c:\thnbbb.exec:\thnbbb.exe73⤵PID:244
-
\??\c:\pdpjd.exec:\pdpjd.exe74⤵
- System Location Discovery: System Language Discovery
PID:4348 -
\??\c:\lfflflf.exec:\lfflflf.exe75⤵PID:4496
-
\??\c:\bbnnnn.exec:\bbnnnn.exe76⤵PID:3928
-
\??\c:\nbnhtb.exec:\nbnhtb.exe77⤵PID:4840
-
\??\c:\xxrrrff.exec:\xxrrrff.exe78⤵PID:1736
-
\??\c:\9flrllf.exec:\9flrllf.exe79⤵PID:2300
-
\??\c:\btttnn.exec:\btttnn.exe80⤵PID:3884
-
\??\c:\jjjvj.exec:\jjjvj.exe81⤵PID:1260
-
\??\c:\flrlffr.exec:\flrlffr.exe82⤵PID:1192
-
\??\c:\hnbhht.exec:\hnbhht.exe83⤵PID:2164
-
\??\c:\ddjjd.exec:\ddjjd.exe84⤵PID:5052
-
\??\c:\ffrlfxf.exec:\ffrlfxf.exe85⤵PID:4832
-
\??\c:\fxfrlxx.exec:\fxfrlxx.exe86⤵PID:848
-
\??\c:\ntbbtt.exec:\ntbbtt.exe87⤵PID:4712
-
\??\c:\vvddd.exec:\vvddd.exe88⤵PID:1248
-
\??\c:\lllrlrl.exec:\lllrlrl.exe89⤵PID:2528
-
\??\c:\bhtbth.exec:\bhtbth.exe90⤵PID:1008
-
\??\c:\vjvvv.exec:\vjvvv.exe91⤵PID:1380
-
\??\c:\ppvvv.exec:\ppvvv.exe92⤵PID:2036
-
\??\c:\fxrllll.exec:\fxrllll.exe93⤵PID:1088
-
\??\c:\hhhnhh.exec:\hhhnhh.exe94⤵PID:396
-
\??\c:\5jjdp.exec:\5jjdp.exe95⤵PID:760
-
\??\c:\pppjd.exec:\pppjd.exe96⤵PID:216
-
\??\c:\3lrlffl.exec:\3lrlffl.exe97⤵PID:232
-
\??\c:\7jjvp.exec:\7jjvp.exe98⤵PID:3592
-
\??\c:\xflfxxr.exec:\xflfxxr.exe99⤵PID:3572
-
\??\c:\hthhtt.exec:\hthhtt.exe100⤵PID:3528
-
\??\c:\tttttt.exec:\tttttt.exe101⤵PID:2356
-
\??\c:\vpjjj.exec:\vpjjj.exe102⤵PID:2492
-
\??\c:\rffxxrr.exec:\rffxxrr.exe103⤵PID:392
-
\??\c:\1nbhhn.exec:\1nbhhn.exe104⤵PID:1104
-
\??\c:\vpvpj.exec:\vpvpj.exe105⤵PID:2468
-
\??\c:\lfllrlf.exec:\lfllrlf.exe106⤵PID:4184
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe107⤵PID:2064
-
\??\c:\thnhtn.exec:\thnhtn.exe108⤵PID:4536
-
\??\c:\9djvv.exec:\9djvv.exe109⤵PID:4784
-
\??\c:\ffxxflr.exec:\ffxxflr.exe110⤵PID:1336
-
\??\c:\btbbbb.exec:\btbbbb.exe111⤵PID:4796
-
\??\c:\bbhhbh.exec:\bbhhbh.exe112⤵PID:1828
-
\??\c:\pjpjp.exec:\pjpjp.exe113⤵PID:4928
-
\??\c:\flxxfll.exec:\flxxfll.exe114⤵PID:2112
-
\??\c:\nbhbnn.exec:\nbhbnn.exe115⤵PID:528
-
\??\c:\pppvp.exec:\pppvp.exe116⤵PID:3632
-
\??\c:\rlrrlll.exec:\rlrrlll.exe117⤵PID:1568
-
\??\c:\ffxxxrr.exec:\ffxxxrr.exe118⤵PID:3004
-
\??\c:\hbhnbh.exec:\hbhnbh.exe119⤵PID:1224
-
\??\c:\3vpjv.exec:\3vpjv.exe120⤵PID:3672
-
\??\c:\fxffflf.exec:\fxffflf.exe121⤵PID:1620
-
\??\c:\nntbhb.exec:\nntbhb.exe122⤵PID:4328
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-