Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 09:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe
-
Size
453KB
-
MD5
754089979729cc9c5832818547315a06
-
SHA1
7e234f66e8c0ff49ea0ff5c2aad5ec2b963756b0
-
SHA256
f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4
-
SHA512
ef310ffeee73e80a1afee43bc121128cf43c2e0008e6d2b8a0b01451c3b1c8da53b11e4236e7029332e7fcca02aa8f4e61cf29eab62a1876f605abb51a9c8573
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeG:q7Tc2NYHUrAwfMp3CDG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1384-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1088-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/600-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2680-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/956-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-664-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-730-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-791-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-1026-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-1189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-1212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-1388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1876 jddpv.exe 4460 tbtnbb.exe 4316 5vpdv.exe 2924 rfxrfxl.exe 3668 xlxlrlf.exe 4232 tnnbbt.exe 1088 lxfrxlx.exe 4000 httnnb.exe 2584 3vdpp.exe 4268 ttthth.exe 1892 9xfxrlx.exe 4788 btbnbt.exe 3052 bnnbnh.exe 1268 7vpdp.exe 4028 nhbbnb.exe 3460 jppjd.exe 4828 dppdv.exe 1960 7lxlfxl.exe 2776 9rrrffr.exe 2380 nhthhh.exe 2616 3tnhtn.exe 1368 1btnbt.exe 3012 xlrfxrl.exe 1364 9jpjv.exe 544 nhhbnn.exe 464 rxrlrrx.exe 4840 httnbt.exe 5080 jvdvv.exe 2200 nhthhh.exe 3776 3llfxxr.exe 2292 pvjjd.exe 1956 9fllxff.exe 3700 vppjv.exe 3664 9lfxlrl.exe 2908 flrrlff.exe 2360 5hnhbb.exe 4884 dppvd.exe 1020 ttbtbb.exe 4752 pvdvp.exe 2212 frrlxxr.exe 612 bthhhh.exe 5116 bhnbtt.exe 1940 7pvpp.exe 4732 xflfffx.exe 3036 hhtnbb.exe 5060 vppjd.exe 4564 1jdvd.exe 4444 rllrfrl.exe 3020 fxffffl.exe 1532 5jdvd.exe 2376 lxxrffx.exe 600 ttnhhh.exe 4460 hththb.exe 4316 jpdjd.exe 1040 ffrlrxf.exe 2924 bnbttn.exe 3576 5ddvj.exe 4504 ffxlxlx.exe 4236 3hbttt.exe 2632 jdjvj.exe 4424 rllllrl.exe 4872 rlrrlll.exe 3976 bntnhb.exe 2584 jddvj.exe -
resource yara_rule behavioral2/memory/1384-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1088-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/600-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/956-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1100-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-709-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1384 wrote to memory of 1876 1384 f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe 83 PID 1384 wrote to memory of 1876 1384 f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe 83 PID 1384 wrote to memory of 1876 1384 f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe 83 PID 1876 wrote to memory of 4460 1876 jddpv.exe 84 PID 1876 wrote to memory of 4460 1876 jddpv.exe 84 PID 1876 wrote to memory of 4460 1876 jddpv.exe 84 PID 4460 wrote to memory of 4316 4460 tbtnbb.exe 85 PID 4460 wrote to memory of 4316 4460 tbtnbb.exe 85 PID 4460 wrote to memory of 4316 4460 tbtnbb.exe 85 PID 4316 wrote to memory of 2924 4316 5vpdv.exe 86 PID 4316 wrote to memory of 2924 4316 5vpdv.exe 86 PID 4316 wrote to memory of 2924 4316 5vpdv.exe 86 PID 2924 wrote to memory of 3668 2924 rfxrfxl.exe 87 PID 2924 wrote to memory of 3668 2924 rfxrfxl.exe 87 PID 2924 wrote to memory of 3668 2924 rfxrfxl.exe 87 PID 3668 wrote to memory of 4232 3668 xlxlrlf.exe 88 PID 3668 wrote to memory of 4232 3668 xlxlrlf.exe 88 PID 3668 wrote to memory of 4232 3668 xlxlrlf.exe 88 PID 4232 wrote to memory of 1088 4232 tnnbbt.exe 89 PID 4232 wrote to memory of 1088 4232 tnnbbt.exe 89 PID 4232 wrote to memory of 1088 4232 tnnbbt.exe 89 PID 1088 wrote to memory of 4000 1088 lxfrxlx.exe 90 PID 1088 wrote to memory of 4000 1088 lxfrxlx.exe 90 PID 1088 wrote to memory of 4000 1088 lxfrxlx.exe 90 PID 4000 wrote to memory of 2584 4000 httnnb.exe 91 PID 4000 wrote to memory of 2584 4000 httnnb.exe 91 PID 4000 wrote to memory of 2584 4000 httnnb.exe 91 PID 2584 wrote to memory of 4268 2584 3vdpp.exe 92 PID 2584 wrote to memory of 4268 2584 3vdpp.exe 92 PID 2584 wrote to memory of 4268 2584 3vdpp.exe 92 PID 4268 wrote to memory of 1892 4268 ttthth.exe 93 PID 4268 wrote to memory of 1892 4268 ttthth.exe 93 PID 4268 wrote to memory of 1892 4268 ttthth.exe 93 PID 1892 wrote to memory of 4788 1892 9xfxrlx.exe 94 PID 1892 wrote to memory of 4788 1892 9xfxrlx.exe 94 PID 1892 wrote to memory of 4788 1892 9xfxrlx.exe 94 PID 4788 wrote to memory of 3052 4788 btbnbt.exe 95 PID 4788 wrote to memory of 3052 4788 btbnbt.exe 95 PID 4788 wrote to memory of 3052 4788 btbnbt.exe 95 PID 3052 wrote to memory of 1268 3052 bnnbnh.exe 96 PID 3052 wrote to memory of 1268 3052 bnnbnh.exe 96 PID 3052 wrote to memory of 1268 3052 bnnbnh.exe 96 PID 1268 wrote to memory of 4028 1268 7vpdp.exe 97 PID 1268 wrote to memory of 4028 1268 7vpdp.exe 97 PID 1268 wrote to memory of 4028 1268 7vpdp.exe 97 PID 4028 wrote to memory of 3460 4028 nhbbnb.exe 98 PID 4028 wrote to memory of 3460 4028 nhbbnb.exe 98 PID 4028 wrote to memory of 3460 4028 nhbbnb.exe 98 PID 3460 wrote to memory of 4828 3460 jppjd.exe 99 PID 3460 wrote to memory of 4828 3460 jppjd.exe 99 PID 3460 wrote to memory of 4828 3460 jppjd.exe 99 PID 4828 wrote to memory of 1960 4828 dppdv.exe 100 PID 4828 wrote to memory of 1960 4828 dppdv.exe 100 PID 4828 wrote to memory of 1960 4828 dppdv.exe 100 PID 1960 wrote to memory of 2776 1960 7lxlfxl.exe 101 PID 1960 wrote to memory of 2776 1960 7lxlfxl.exe 101 PID 1960 wrote to memory of 2776 1960 7lxlfxl.exe 101 PID 2776 wrote to memory of 2380 2776 9rrrffr.exe 102 PID 2776 wrote to memory of 2380 2776 9rrrffr.exe 102 PID 2776 wrote to memory of 2380 2776 9rrrffr.exe 102 PID 2380 wrote to memory of 2616 2380 nhthhh.exe 103 PID 2380 wrote to memory of 2616 2380 nhthhh.exe 103 PID 2380 wrote to memory of 2616 2380 nhthhh.exe 103 PID 2616 wrote to memory of 1368 2616 3tnhtn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe"C:\Users\Admin\AppData\Local\Temp\f8b22c39030b32d8b1d1f9acebf40ea2a28de2b698d7a8a42a9f26253ce337e4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\jddpv.exec:\jddpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\tbtnbb.exec:\tbtnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\5vpdv.exec:\5vpdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\rfxrfxl.exec:\rfxrfxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\xlxlrlf.exec:\xlxlrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\tnnbbt.exec:\tnnbbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\lxfrxlx.exec:\lxfrxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\httnnb.exec:\httnnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\3vdpp.exec:\3vdpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\ttthth.exec:\ttthth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\9xfxrlx.exec:\9xfxrlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\btbnbt.exec:\btbnbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\bnnbnh.exec:\bnnbnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\7vpdp.exec:\7vpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\nhbbnb.exec:\nhbbnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\jppjd.exec:\jppjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\dppdv.exec:\dppdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\7lxlfxl.exec:\7lxlfxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\9rrrffr.exec:\9rrrffr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\nhthhh.exec:\nhthhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\3tnhtn.exec:\3tnhtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\1btnbt.exec:\1btnbt.exe23⤵
- Executes dropped EXE
PID:1368 -
\??\c:\xlrfxrl.exec:\xlrfxrl.exe24⤵
- Executes dropped EXE
PID:3012 -
\??\c:\9jpjv.exec:\9jpjv.exe25⤵
- Executes dropped EXE
PID:1364 -
\??\c:\nhhbnn.exec:\nhhbnn.exe26⤵
- Executes dropped EXE
PID:544 -
\??\c:\rxrlrrx.exec:\rxrlrrx.exe27⤵
- Executes dropped EXE
PID:464 -
\??\c:\httnbt.exec:\httnbt.exe28⤵
- Executes dropped EXE
PID:4840 -
\??\c:\jvdvv.exec:\jvdvv.exe29⤵
- Executes dropped EXE
PID:5080 -
\??\c:\nhthhh.exec:\nhthhh.exe30⤵
- Executes dropped EXE
PID:2200 -
\??\c:\3llfxxr.exec:\3llfxxr.exe31⤵
- Executes dropped EXE
PID:3776 -
\??\c:\pvjjd.exec:\pvjjd.exe32⤵
- Executes dropped EXE
PID:2292 -
\??\c:\9fllxff.exec:\9fllxff.exe33⤵
- Executes dropped EXE
PID:1956 -
\??\c:\vppjv.exec:\vppjv.exe34⤵
- Executes dropped EXE
PID:3700 -
\??\c:\9lfxlrl.exec:\9lfxlrl.exe35⤵
- Executes dropped EXE
PID:3664 -
\??\c:\flrrlff.exec:\flrrlff.exe36⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5hnhbb.exec:\5hnhbb.exe37⤵
- Executes dropped EXE
PID:2360 -
\??\c:\dppvd.exec:\dppvd.exe38⤵
- Executes dropped EXE
PID:4884 -
\??\c:\ttbtbb.exec:\ttbtbb.exe39⤵
- Executes dropped EXE
PID:1020 -
\??\c:\pvdvp.exec:\pvdvp.exe40⤵
- Executes dropped EXE
PID:4752 -
\??\c:\frrlxxr.exec:\frrlxxr.exe41⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bthhhh.exec:\bthhhh.exe42⤵
- Executes dropped EXE
PID:612 -
\??\c:\bhnbtt.exec:\bhnbtt.exe43⤵
- Executes dropped EXE
PID:5116 -
\??\c:\7pvpp.exec:\7pvpp.exe44⤵
- Executes dropped EXE
PID:1940 -
\??\c:\xflfffx.exec:\xflfffx.exe45⤵
- Executes dropped EXE
PID:4732 -
\??\c:\hhtnbb.exec:\hhtnbb.exe46⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vppjd.exec:\vppjd.exe47⤵
- Executes dropped EXE
PID:5060 -
\??\c:\1jdvd.exec:\1jdvd.exe48⤵
- Executes dropped EXE
PID:4564 -
\??\c:\rllrfrl.exec:\rllrfrl.exe49⤵
- Executes dropped EXE
PID:4444 -
\??\c:\fxffffl.exec:\fxffffl.exe50⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nbhbtn.exec:\nbhbtn.exe51⤵PID:4388
-
\??\c:\5jdvd.exec:\5jdvd.exe52⤵
- Executes dropped EXE
PID:1532 -
\??\c:\lxxrffx.exec:\lxxrffx.exe53⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ttnhhh.exec:\ttnhhh.exe54⤵
- Executes dropped EXE
PID:600 -
\??\c:\hththb.exec:\hththb.exe55⤵
- Executes dropped EXE
PID:4460 -
\??\c:\jpdjd.exec:\jpdjd.exe56⤵
- Executes dropped EXE
PID:4316 -
\??\c:\ffrlrxf.exec:\ffrlrxf.exe57⤵
- Executes dropped EXE
PID:1040 -
\??\c:\bnbttn.exec:\bnbttn.exe58⤵
- Executes dropped EXE
PID:2924 -
\??\c:\5ddvj.exec:\5ddvj.exe59⤵
- Executes dropped EXE
PID:3576 -
\??\c:\ffxlxlx.exec:\ffxlxlx.exe60⤵
- Executes dropped EXE
PID:4504 -
\??\c:\3hbttt.exec:\3hbttt.exe61⤵
- Executes dropped EXE
PID:4236 -
\??\c:\jdjvj.exec:\jdjvj.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2632 -
\??\c:\rllllrl.exec:\rllllrl.exe63⤵
- Executes dropped EXE
PID:4424 -
\??\c:\rlrrlll.exec:\rlrrlll.exe64⤵
- Executes dropped EXE
PID:4872 -
\??\c:\bntnhb.exec:\bntnhb.exe65⤵
- Executes dropped EXE
PID:3976 -
\??\c:\jddvj.exec:\jddvj.exe66⤵
- Executes dropped EXE
PID:2584 -
\??\c:\fffrlfx.exec:\fffrlfx.exe67⤵PID:2680
-
\??\c:\hnttnn.exec:\hnttnn.exe68⤵PID:1768
-
\??\c:\3jpjd.exec:\3jpjd.exe69⤵PID:1464
-
\??\c:\xfrxrfx.exec:\xfrxrfx.exe70⤵PID:3204
-
\??\c:\lxfxxxf.exec:\lxfxxxf.exe71⤵PID:2448
-
\??\c:\hbhhhh.exec:\hbhhhh.exe72⤵PID:1952
-
\??\c:\pjppp.exec:\pjppp.exe73⤵PID:2876
-
\??\c:\frxrffx.exec:\frxrffx.exe74⤵PID:376
-
\??\c:\tntnbb.exec:\tntnbb.exe75⤵PID:1480
-
\??\c:\pvvdp.exec:\pvvdp.exe76⤵PID:5004
-
\??\c:\pvjdp.exec:\pvjdp.exe77⤵PID:4644
-
\??\c:\lxfxllf.exec:\lxfxllf.exe78⤵PID:1624
-
\??\c:\bnhbtt.exec:\bnhbtt.exe79⤵PID:3260
-
\??\c:\jvvvp.exec:\jvvvp.exe80⤵PID:2776
-
\??\c:\1rxrlfx.exec:\1rxrlfx.exe81⤵PID:2380
-
\??\c:\rlrrrrl.exec:\rlrrrrl.exe82⤵PID:1628
-
\??\c:\thntnh.exec:\thntnh.exe83⤵PID:4152
-
\??\c:\pdjdd.exec:\pdjdd.exe84⤵PID:3580
-
\??\c:\1rlfxrr.exec:\1rlfxrr.exe85⤵PID:1616
-
\??\c:\xrffxlf.exec:\xrffxlf.exe86⤵PID:1540
-
\??\c:\tnnnnn.exec:\tnnnnn.exe87⤵PID:2492
-
\??\c:\jdpvj.exec:\jdpvj.exe88⤵PID:2752
-
\??\c:\fxffrrr.exec:\fxffrrr.exe89⤵PID:3016
-
\??\c:\tnnhhh.exec:\tnnhhh.exe90⤵PID:1588
-
\??\c:\ddjjd.exec:\ddjjd.exe91⤵PID:692
-
\??\c:\vvjjp.exec:\vvjjp.exe92⤵PID:2104
-
\??\c:\7xfxfll.exec:\7xfxfll.exe93⤵PID:1452
-
\??\c:\tttnnn.exec:\tttnnn.exe94⤵PID:3468
-
\??\c:\bbbbnn.exec:\bbbbnn.exe95⤵PID:3776
-
\??\c:\jjvvv.exec:\jjvvv.exe96⤵PID:3172
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe97⤵PID:684
-
\??\c:\bttnhh.exec:\bttnhh.exe98⤵PID:4116
-
\??\c:\9vdvp.exec:\9vdvp.exe99⤵PID:3700
-
\??\c:\xrrrrxx.exec:\xrrrrxx.exe100⤵PID:956
-
\??\c:\rrffrrx.exec:\rrffrrx.exe101⤵PID:2908
-
\??\c:\bnnhbb.exec:\bnnhbb.exe102⤵PID:1756
-
\??\c:\pvdvj.exec:\pvdvj.exe103⤵PID:4892
-
\??\c:\fxrrffx.exec:\fxrrffx.exe104⤵PID:4128
-
\??\c:\thtnhb.exec:\thtnhb.exe105⤵PID:4932
-
\??\c:\tbhhhh.exec:\tbhhhh.exe106⤵PID:432
-
\??\c:\7vdvp.exec:\7vdvp.exe107⤵PID:3428
-
\??\c:\rlffxxr.exec:\rlffxxr.exe108⤵PID:5116
-
\??\c:\thnntt.exec:\thnntt.exe109⤵PID:4612
-
\??\c:\jddvp.exec:\jddvp.exe110⤵PID:1240
-
\??\c:\5fxrrrr.exec:\5fxrrrr.exe111⤵PID:3932
-
\??\c:\tttnhh.exec:\tttnhh.exe112⤵PID:5060
-
\??\c:\9tbtnn.exec:\9tbtnn.exe113⤵PID:4936
-
\??\c:\pjjdv.exec:\pjjdv.exe114⤵PID:4392
-
\??\c:\5lxrrrx.exec:\5lxrrrx.exe115⤵PID:3644
-
\??\c:\bnnbth.exec:\bnnbth.exe116⤵PID:1280
-
\??\c:\hnbtnn.exec:\hnbtnn.exe117⤵PID:1876
-
\??\c:\jvddv.exec:\jvddv.exe118⤵PID:3752
-
\??\c:\xllfllf.exec:\xllfllf.exe119⤵PID:4360
-
\??\c:\3bbthn.exec:\3bbthn.exe120⤵PID:2064
-
\??\c:\1tbthh.exec:\1tbthh.exe121⤵PID:1516
-
\??\c:\1pjjd.exec:\1pjjd.exe122⤵PID:1636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-