Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 22:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe
-
Size
453KB
-
MD5
4ec3247ccb526f9aecdc2d4a627a3ddf
-
SHA1
a4137a09d5e726f68a82d4a0bda6fc26824af3cd
-
SHA256
4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c
-
SHA512
bd98e819d0142c9a7087ff29f1e85045c59ef132bfaefb55c161e914447a824cb3a5464ccaad02832077d844bbe4fc99c1a166db9df628ab59e17bee48424f16
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1384-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/588-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2680-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2492-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1080-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1280-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/656-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-649-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-769-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-1078-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-1491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-1927-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 588 9hbttt.exe 2376 lxxrllf.exe 4272 jdvvp.exe 3992 bttnht.exe 3676 llxrlfx.exe 4504 tnnnbb.exe 2940 xrrllff.exe 1476 nhtnhb.exe 3028 jdpjp.exe 2680 nnhnth.exe 1464 rxxrrll.exe 3920 jjppp.exe 1268 rxllfxr.exe 3224 pvpvv.exe 2364 pdjdp.exe 2188 thnhtt.exe 852 htthnh.exe 2472 lfxlffx.exe 4156 vvdpd.exe 2248 bthbbb.exe 3308 fllxlfr.exe 4656 bbbbtt.exe 3836 djvpj.exe 1540 tnhbhh.exe 2492 pjjdp.exe 4804 1lfxflr.exe 4144 ddjdj.exe 1080 ffrfrrl.exe 2388 tthbbb.exe 2540 xxxrrrl.exe 1332 bbhbbb.exe 4344 jdddp.exe 3432 rxlfxxx.exe 3472 fffxrfx.exe 1696 jdpjp.exe 872 3lrrrxr.exe 4600 7ttnhn.exe 1512 jvpdp.exe 316 lxfrrlf.exe 3328 hbtbtn.exe 4824 7vjdp.exe 1820 pjvpd.exe 1940 lrxlxlx.exe 4632 bttnnn.exe 3080 jjppv.exe 1356 1lrlffx.exe 2320 thhbtn.exe 1460 dppjd.exe 4488 vjjdd.exe 3200 llxrrrr.exe 1384 tnnhhh.exe 860 dddvv.exe 4460 xxlflfr.exe 4008 7bhbhh.exe 1040 vpjjd.exe 2924 7ppdv.exe 3644 rllfxxr.exe 4232 hbbbtt.exe 4624 ppppd.exe 1280 fxlfllr.exe 728 btttnn.exe 2584 jppdp.exe 1476 flrflff.exe 4016 xrffrrr.exe -
resource yara_rule behavioral2/memory/1384-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/588-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2492-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1280-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/656-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-668-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1384 wrote to memory of 588 1384 4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe 83 PID 1384 wrote to memory of 588 1384 4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe 83 PID 1384 wrote to memory of 588 1384 4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe 83 PID 588 wrote to memory of 2376 588 9hbttt.exe 84 PID 588 wrote to memory of 2376 588 9hbttt.exe 84 PID 588 wrote to memory of 2376 588 9hbttt.exe 84 PID 2376 wrote to memory of 4272 2376 lxxrllf.exe 85 PID 2376 wrote to memory of 4272 2376 lxxrllf.exe 85 PID 2376 wrote to memory of 4272 2376 lxxrllf.exe 85 PID 4272 wrote to memory of 3992 4272 jdvvp.exe 86 PID 4272 wrote to memory of 3992 4272 jdvvp.exe 86 PID 4272 wrote to memory of 3992 4272 jdvvp.exe 86 PID 3992 wrote to memory of 3676 3992 bttnht.exe 87 PID 3992 wrote to memory of 3676 3992 bttnht.exe 87 PID 3992 wrote to memory of 3676 3992 bttnht.exe 87 PID 3676 wrote to memory of 4504 3676 llxrlfx.exe 88 PID 3676 wrote to memory of 4504 3676 llxrlfx.exe 88 PID 3676 wrote to memory of 4504 3676 llxrlfx.exe 88 PID 4504 wrote to memory of 2940 4504 tnnnbb.exe 89 PID 4504 wrote to memory of 2940 4504 tnnnbb.exe 89 PID 4504 wrote to memory of 2940 4504 tnnnbb.exe 89 PID 2940 wrote to memory of 1476 2940 xrrllff.exe 90 PID 2940 wrote to memory of 1476 2940 xrrllff.exe 90 PID 2940 wrote to memory of 1476 2940 xrrllff.exe 90 PID 1476 wrote to memory of 3028 1476 nhtnhb.exe 91 PID 1476 wrote to memory of 3028 1476 nhtnhb.exe 91 PID 1476 wrote to memory of 3028 1476 nhtnhb.exe 91 PID 3028 wrote to memory of 2680 3028 jdpjp.exe 92 PID 3028 wrote to memory of 2680 3028 jdpjp.exe 92 PID 3028 wrote to memory of 2680 3028 jdpjp.exe 92 PID 2680 wrote to memory of 1464 2680 nnhnth.exe 93 PID 2680 wrote to memory of 1464 2680 nnhnth.exe 93 PID 2680 wrote to memory of 1464 2680 nnhnth.exe 93 PID 1464 wrote to memory of 3920 1464 rxxrrll.exe 94 PID 1464 wrote to memory of 3920 1464 rxxrrll.exe 94 PID 1464 wrote to memory of 3920 1464 rxxrrll.exe 94 PID 3920 wrote to memory of 1268 3920 jjppp.exe 95 PID 3920 wrote to memory of 1268 3920 jjppp.exe 95 PID 3920 wrote to memory of 1268 3920 jjppp.exe 95 PID 1268 wrote to memory of 3224 1268 rxllfxr.exe 96 PID 1268 wrote to memory of 3224 1268 rxllfxr.exe 96 PID 1268 wrote to memory of 3224 1268 rxllfxr.exe 96 PID 3224 wrote to memory of 2364 3224 pvpvv.exe 97 PID 3224 wrote to memory of 2364 3224 pvpvv.exe 97 PID 3224 wrote to memory of 2364 3224 pvpvv.exe 97 PID 2364 wrote to memory of 2188 2364 pdjdp.exe 98 PID 2364 wrote to memory of 2188 2364 pdjdp.exe 98 PID 2364 wrote to memory of 2188 2364 pdjdp.exe 98 PID 2188 wrote to memory of 852 2188 thnhtt.exe 99 PID 2188 wrote to memory of 852 2188 thnhtt.exe 99 PID 2188 wrote to memory of 852 2188 thnhtt.exe 99 PID 852 wrote to memory of 2472 852 htthnh.exe 100 PID 852 wrote to memory of 2472 852 htthnh.exe 100 PID 852 wrote to memory of 2472 852 htthnh.exe 100 PID 2472 wrote to memory of 4156 2472 lfxlffx.exe 101 PID 2472 wrote to memory of 4156 2472 lfxlffx.exe 101 PID 2472 wrote to memory of 4156 2472 lfxlffx.exe 101 PID 4156 wrote to memory of 2248 4156 vvdpd.exe 102 PID 4156 wrote to memory of 2248 4156 vvdpd.exe 102 PID 4156 wrote to memory of 2248 4156 vvdpd.exe 102 PID 2248 wrote to memory of 3308 2248 bthbbb.exe 103 PID 2248 wrote to memory of 3308 2248 bthbbb.exe 103 PID 2248 wrote to memory of 3308 2248 bthbbb.exe 103 PID 3308 wrote to memory of 4656 3308 fllxlfr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe"C:\Users\Admin\AppData\Local\Temp\4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\9hbttt.exec:\9hbttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\lxxrllf.exec:\lxxrllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\jdvvp.exec:\jdvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\bttnht.exec:\bttnht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\llxrlfx.exec:\llxrlfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\tnnnbb.exec:\tnnnbb.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\xrrllff.exec:\xrrllff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\nhtnhb.exec:\nhtnhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\jdpjp.exec:\jdpjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\nnhnth.exec:\nnhnth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\rxxrrll.exec:\rxxrrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\jjppp.exec:\jjppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\rxllfxr.exec:\rxllfxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\pvpvv.exec:\pvpvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\pdjdp.exec:\pdjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\thnhtt.exec:\thnhtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\htthnh.exec:\htthnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\lfxlffx.exec:\lfxlffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\vvdpd.exec:\vvdpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\bthbbb.exec:\bthbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\fllxlfr.exec:\fllxlfr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\bbbbtt.exec:\bbbbtt.exe23⤵
- Executes dropped EXE
PID:4656 -
\??\c:\djvpj.exec:\djvpj.exe24⤵
- Executes dropped EXE
PID:3836 -
\??\c:\tnhbhh.exec:\tnhbhh.exe25⤵
- Executes dropped EXE
PID:1540 -
\??\c:\pjjdp.exec:\pjjdp.exe26⤵
- Executes dropped EXE
PID:2492 -
\??\c:\1lfxflr.exec:\1lfxflr.exe27⤵
- Executes dropped EXE
PID:4804 -
\??\c:\ddjdj.exec:\ddjdj.exe28⤵
- Executes dropped EXE
PID:4144 -
\??\c:\ffrfrrl.exec:\ffrfrrl.exe29⤵
- Executes dropped EXE
PID:1080 -
\??\c:\tthbbb.exec:\tthbbb.exe30⤵
- Executes dropped EXE
PID:2388 -
\??\c:\xxxrrrl.exec:\xxxrrrl.exe31⤵
- Executes dropped EXE
PID:2540 -
\??\c:\bbhbbb.exec:\bbhbbb.exe32⤵
- Executes dropped EXE
PID:1332 -
\??\c:\jdddp.exec:\jdddp.exe33⤵
- Executes dropped EXE
PID:4344 -
\??\c:\rxlfxxx.exec:\rxlfxxx.exe34⤵
- Executes dropped EXE
PID:3432 -
\??\c:\fffxrfx.exec:\fffxrfx.exe35⤵
- Executes dropped EXE
PID:3472 -
\??\c:\jdpjp.exec:\jdpjp.exe36⤵
- Executes dropped EXE
PID:1696 -
\??\c:\3lrrrxr.exec:\3lrrrxr.exe37⤵
- Executes dropped EXE
PID:872 -
\??\c:\7ttnhn.exec:\7ttnhn.exe38⤵
- Executes dropped EXE
PID:4600 -
\??\c:\jvpdp.exec:\jvpdp.exe39⤵
- Executes dropped EXE
PID:1512 -
\??\c:\lxfrrlf.exec:\lxfrrlf.exe40⤵
- Executes dropped EXE
PID:316 -
\??\c:\hbtbtn.exec:\hbtbtn.exe41⤵
- Executes dropped EXE
PID:3328 -
\??\c:\7vjdp.exec:\7vjdp.exe42⤵
- Executes dropped EXE
PID:4824 -
\??\c:\pjvpd.exec:\pjvpd.exe43⤵
- Executes dropped EXE
PID:1820 -
\??\c:\lrxlxlx.exec:\lrxlxlx.exe44⤵
- Executes dropped EXE
PID:1940 -
\??\c:\bttnnn.exec:\bttnnn.exe45⤵
- Executes dropped EXE
PID:4632 -
\??\c:\jjppv.exec:\jjppv.exe46⤵
- Executes dropped EXE
PID:3080 -
\??\c:\1lrlffx.exec:\1lrlffx.exe47⤵
- Executes dropped EXE
PID:1356 -
\??\c:\thhbtn.exec:\thhbtn.exe48⤵
- Executes dropped EXE
PID:2320 -
\??\c:\dppjd.exec:\dppjd.exe49⤵
- Executes dropped EXE
PID:1460 -
\??\c:\vjjdd.exec:\vjjdd.exe50⤵
- Executes dropped EXE
PID:4488 -
\??\c:\llxrrrr.exec:\llxrrrr.exe51⤵
- Executes dropped EXE
PID:3200 -
\??\c:\tnnhhh.exec:\tnnhhh.exe52⤵
- Executes dropped EXE
PID:1384 -
\??\c:\dddvv.exec:\dddvv.exe53⤵
- Executes dropped EXE
PID:860 -
\??\c:\xxlflfr.exec:\xxlflfr.exe54⤵
- Executes dropped EXE
PID:4460 -
\??\c:\7bhbhh.exec:\7bhbhh.exe55⤵
- Executes dropped EXE
PID:4008 -
\??\c:\vpjjd.exec:\vpjjd.exe56⤵
- Executes dropped EXE
PID:1040 -
\??\c:\7ppdv.exec:\7ppdv.exe57⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rllfxxr.exec:\rllfxxr.exe58⤵
- Executes dropped EXE
PID:3644 -
\??\c:\hbbbtt.exec:\hbbbtt.exe59⤵
- Executes dropped EXE
PID:4232 -
\??\c:\ppppd.exec:\ppppd.exe60⤵
- Executes dropped EXE
PID:4624 -
\??\c:\fxlfllr.exec:\fxlfllr.exe61⤵
- Executes dropped EXE
PID:1280 -
\??\c:\btttnn.exec:\btttnn.exe62⤵
- Executes dropped EXE
PID:728 -
\??\c:\jppdp.exec:\jppdp.exe63⤵
- Executes dropped EXE
PID:2584 -
\??\c:\flrflff.exec:\flrflff.exe64⤵
- Executes dropped EXE
PID:1476 -
\??\c:\xrffrrr.exec:\xrffrrr.exe65⤵
- Executes dropped EXE
PID:4016 -
\??\c:\bbbthb.exec:\bbbthb.exe66⤵PID:4740
-
\??\c:\jjvpj.exec:\jjvpj.exe67⤵PID:4580
-
\??\c:\pdpdd.exec:\pdpdd.exe68⤵PID:1660
-
\??\c:\3frlllr.exec:\3frlllr.exe69⤵PID:1908
-
\??\c:\bhnbnh.exec:\bhnbnh.exe70⤵PID:3184
-
\??\c:\pjppp.exec:\pjppp.exe71⤵PID:1380
-
\??\c:\xlxlffr.exec:\xlxlffr.exe72⤵PID:1268
-
\??\c:\hhbbtt.exec:\hhbbtt.exe73⤵PID:3460
-
\??\c:\jppjp.exec:\jppjp.exe74⤵PID:1044
-
\??\c:\rfrllll.exec:\rfrllll.exe75⤵PID:2572
-
\??\c:\tnhbtn.exec:\tnhbtn.exe76⤵PID:808
-
\??\c:\jjdvd.exec:\jjdvd.exe77⤵PID:4828
-
\??\c:\rlxrrrl.exec:\rlxrrrl.exe78⤵PID:4644
-
\??\c:\nntttb.exec:\nntttb.exe79⤵PID:4516
-
\??\c:\jdddd.exec:\jdddd.exe80⤵PID:4156
-
\??\c:\rxrlffx.exec:\rxrlffx.exe81⤵PID:116
-
\??\c:\fflfxxr.exec:\fflfxxr.exe82⤵PID:1368
-
\??\c:\bbbbtt.exec:\bbbbtt.exe83⤵PID:2384
-
\??\c:\jvpdd.exec:\jvpdd.exe84⤵PID:3012
-
\??\c:\rxxrffx.exec:\rxxrffx.exe85⤵PID:3500
-
\??\c:\nthnbb.exec:\nthnbb.exe86⤵PID:3604
-
\??\c:\7vjdv.exec:\7vjdv.exe87⤵PID:1540
-
\??\c:\lflfxll.exec:\lflfxll.exe88⤵PID:464
-
\??\c:\tnthth.exec:\tnthth.exe89⤵PID:1620
-
\??\c:\5bbthh.exec:\5bbthh.exe90⤵PID:2104
-
\??\c:\jjvpj.exec:\jjvpj.exe91⤵PID:1076
-
\??\c:\rlffxff.exec:\rlffxff.exe92⤵PID:3540
-
\??\c:\9fffffr.exec:\9fffffr.exe93⤵PID:2264
-
\??\c:\btbtnh.exec:\btbtnh.exe94⤵PID:536
-
\??\c:\pvvpp.exec:\pvvpp.exe95⤵PID:5012
-
\??\c:\rrrfxxr.exec:\rrrfxxr.exe96⤵PID:1956
-
\??\c:\nbtbhh.exec:\nbtbhh.exe97⤵PID:2328
-
\??\c:\hnnnbb.exec:\hnnnbb.exe98⤵PID:4520
-
\??\c:\dvvpj.exec:\dvvpj.exe99⤵PID:656
-
\??\c:\rrrlxxr.exec:\rrrlxxr.exe100⤵PID:4944
-
\??\c:\xlrlffl.exec:\xlrlffl.exe101⤵PID:2360
-
\??\c:\thtbtt.exec:\thtbtt.exe102⤵PID:3252
-
\??\c:\jdvjj.exec:\jdvjj.exe103⤵PID:2180
-
\??\c:\rxflxrr.exec:\rxflxrr.exe104⤵PID:2372
-
\??\c:\rllrllx.exec:\rllrllx.exe105⤵PID:4952
-
\??\c:\htbtnn.exec:\htbtnn.exe106⤵PID:3516
-
\??\c:\9ppjv.exec:\9ppjv.exe107⤵PID:3988
-
\??\c:\pvvpd.exec:\pvvpd.exe108⤵PID:5116
-
\??\c:\rxfxlll.exec:\rxfxlll.exe109⤵PID:1536
-
\??\c:\dvppp.exec:\dvppp.exe110⤵PID:1940
-
\??\c:\jjvpd.exec:\jjvpd.exe111⤵PID:4632
-
\??\c:\xlxrxxf.exec:\xlxrxxf.exe112⤵PID:3324
-
\??\c:\bbhntb.exec:\bbhntb.exe113⤵PID:4148
-
\??\c:\vpjdv.exec:\vpjdv.exe114⤵PID:4832
-
\??\c:\ppvpj.exec:\ppvpj.exe115⤵PID:4376
-
\??\c:\lxxrffx.exec:\lxxrffx.exe116⤵PID:2500
-
\??\c:\1lfxxrr.exec:\1lfxxrr.exe117⤵PID:3144
-
\??\c:\hbtnnn.exec:\hbtnnn.exe118⤵PID:600
-
\??\c:\5vppj.exec:\5vppj.exe119⤵PID:3316
-
\??\c:\5djdj.exec:\5djdj.exe120⤵PID:3024
-
\??\c:\9lrxfxx.exec:\9lrxfxx.exe121⤵PID:1788
-
\??\c:\hhhnnt.exec:\hhhnnt.exe122⤵PID:4956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-