Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 19:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe
-
Size
455KB
-
MD5
c7f1f4b8ae83f4a1949435c9192845a0
-
SHA1
7fc551e6b21a57f222aa3f10d744ea20b0b9ebbf
-
SHA256
08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67
-
SHA512
0c22de0dac2048c13cd8f44f1c46f009a981b85c1ea34a55708be5e857a24679e8c1141c94c9cf5ae2d9142eea5e231d1c96dc83ddf5b5e2d164dd219799ca34
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR4:q7Tc2NYHUrAwfMp3CDR4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3532-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1740-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/756-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-683-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4208-997-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/944-1177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1028-1217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-1494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3424 bttnbb.exe 1740 xrrfxrl.exe 2556 nbhnbt.exe 3592 dvdpj.exe 4776 tnhbbt.exe 2652 nhnbtt.exe 2720 rfrrxxl.exe 4288 pvddv.exe 2020 1fxxrxl.exe 380 bbbttt.exe 548 jppdd.exe 4844 hnbhhb.exe 1460 tnhbnn.exe 1784 vjpdv.exe 2128 9rllrrr.exe 2748 7nnnhn.exe 4900 ddvdj.exe 3192 rlxfxxr.exe 4304 jjppv.exe 2776 1jjjd.exe 1724 9nnhbb.exe 2232 3tbttt.exe 2648 9xfxrrl.exe 1016 bttnhh.exe 4688 dvddv.exe 4524 5dpjj.exe 2820 rllfxrr.exe 3212 ntbtnn.exe 4988 jpdpd.exe 2840 flfrrll.exe 3720 7ffxxrr.exe 3608 5bbtnh.exe 4656 vdvpv.exe 3816 rlfxlll.exe 928 btnnnh.exe 4308 hbhhhh.exe 4568 pjjdd.exe 1348 ffxxrrl.exe 3976 nhnhbh.exe 3656 3nbttt.exe 4472 djjpd.exe 5112 xrlllrr.exe 5096 bhtnnn.exe 4544 jdvvp.exe 4284 lfllffr.exe 184 bntnhh.exe 3532 vjdvv.exe 4376 ddjdp.exe 4760 lllfxfx.exe 4060 lflllrl.exe 3472 vvvdv.exe 3932 dvjdd.exe 4740 rxxffll.exe 1044 7nhhbh.exe 1948 vdjvd.exe 2720 dvjdv.exe 2660 lrlfrxx.exe 2020 thtnnn.exe 1920 ddpjd.exe 1096 ffxxxfx.exe 4040 nnnhhb.exe 4844 5pjdd.exe 324 hthnnt.exe 2636 9pppp.exe -
resource yara_rule behavioral2/memory/3532-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1100-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-903-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4208-997-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-1157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/944-1177-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrflfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htttt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3532 wrote to memory of 3424 3532 08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe 83 PID 3532 wrote to memory of 3424 3532 08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe 83 PID 3532 wrote to memory of 3424 3532 08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe 83 PID 3424 wrote to memory of 1740 3424 bttnbb.exe 84 PID 3424 wrote to memory of 1740 3424 bttnbb.exe 84 PID 3424 wrote to memory of 1740 3424 bttnbb.exe 84 PID 1740 wrote to memory of 2556 1740 xrrfxrl.exe 85 PID 1740 wrote to memory of 2556 1740 xrrfxrl.exe 85 PID 1740 wrote to memory of 2556 1740 xrrfxrl.exe 85 PID 2556 wrote to memory of 3592 2556 nbhnbt.exe 86 PID 2556 wrote to memory of 3592 2556 nbhnbt.exe 86 PID 2556 wrote to memory of 3592 2556 nbhnbt.exe 86 PID 3592 wrote to memory of 4776 3592 dvdpj.exe 87 PID 3592 wrote to memory of 4776 3592 dvdpj.exe 87 PID 3592 wrote to memory of 4776 3592 dvdpj.exe 87 PID 4776 wrote to memory of 2652 4776 tnhbbt.exe 88 PID 4776 wrote to memory of 2652 4776 tnhbbt.exe 88 PID 4776 wrote to memory of 2652 4776 tnhbbt.exe 88 PID 2652 wrote to memory of 2720 2652 nhnbtt.exe 89 PID 2652 wrote to memory of 2720 2652 nhnbtt.exe 89 PID 2652 wrote to memory of 2720 2652 nhnbtt.exe 89 PID 2720 wrote to memory of 4288 2720 rfrrxxl.exe 90 PID 2720 wrote to memory of 4288 2720 rfrrxxl.exe 90 PID 2720 wrote to memory of 4288 2720 rfrrxxl.exe 90 PID 4288 wrote to memory of 2020 4288 pvddv.exe 91 PID 4288 wrote to memory of 2020 4288 pvddv.exe 91 PID 4288 wrote to memory of 2020 4288 pvddv.exe 91 PID 2020 wrote to memory of 380 2020 1fxxrxl.exe 92 PID 2020 wrote to memory of 380 2020 1fxxrxl.exe 92 PID 2020 wrote to memory of 380 2020 1fxxrxl.exe 92 PID 380 wrote to memory of 548 380 bbbttt.exe 93 PID 380 wrote to memory of 548 380 bbbttt.exe 93 PID 380 wrote to memory of 548 380 bbbttt.exe 93 PID 548 wrote to memory of 4844 548 jppdd.exe 94 PID 548 wrote to memory of 4844 548 jppdd.exe 94 PID 548 wrote to memory of 4844 548 jppdd.exe 94 PID 4844 wrote to memory of 1460 4844 hnbhhb.exe 95 PID 4844 wrote to memory of 1460 4844 hnbhhb.exe 95 PID 4844 wrote to memory of 1460 4844 hnbhhb.exe 95 PID 1460 wrote to memory of 1784 1460 tnhbnn.exe 96 PID 1460 wrote to memory of 1784 1460 tnhbnn.exe 96 PID 1460 wrote to memory of 1784 1460 tnhbnn.exe 96 PID 1784 wrote to memory of 2128 1784 vjpdv.exe 97 PID 1784 wrote to memory of 2128 1784 vjpdv.exe 97 PID 1784 wrote to memory of 2128 1784 vjpdv.exe 97 PID 2128 wrote to memory of 2748 2128 9rllrrr.exe 98 PID 2128 wrote to memory of 2748 2128 9rllrrr.exe 98 PID 2128 wrote to memory of 2748 2128 9rllrrr.exe 98 PID 2748 wrote to memory of 4900 2748 7nnnhn.exe 99 PID 2748 wrote to memory of 4900 2748 7nnnhn.exe 99 PID 2748 wrote to memory of 4900 2748 7nnnhn.exe 99 PID 4900 wrote to memory of 3192 4900 ddvdj.exe 100 PID 4900 wrote to memory of 3192 4900 ddvdj.exe 100 PID 4900 wrote to memory of 3192 4900 ddvdj.exe 100 PID 3192 wrote to memory of 4304 3192 rlxfxxr.exe 101 PID 3192 wrote to memory of 4304 3192 rlxfxxr.exe 101 PID 3192 wrote to memory of 4304 3192 rlxfxxr.exe 101 PID 4304 wrote to memory of 2776 4304 jjppv.exe 102 PID 4304 wrote to memory of 2776 4304 jjppv.exe 102 PID 4304 wrote to memory of 2776 4304 jjppv.exe 102 PID 2776 wrote to memory of 1724 2776 1jjjd.exe 103 PID 2776 wrote to memory of 1724 2776 1jjjd.exe 103 PID 2776 wrote to memory of 1724 2776 1jjjd.exe 103 PID 1724 wrote to memory of 2232 1724 9nnhbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe"C:\Users\Admin\AppData\Local\Temp\08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\bttnbb.exec:\bttnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\xrrfxrl.exec:\xrrfxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\nbhnbt.exec:\nbhnbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\dvdpj.exec:\dvdpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\tnhbbt.exec:\tnhbbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\nhnbtt.exec:\nhnbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\rfrrxxl.exec:\rfrrxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\pvddv.exec:\pvddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\1fxxrxl.exec:\1fxxrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\bbbttt.exec:\bbbttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\jppdd.exec:\jppdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\hnbhhb.exec:\hnbhhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\tnhbnn.exec:\tnhbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\vjpdv.exec:\vjpdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\9rllrrr.exec:\9rllrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\7nnnhn.exec:\7nnnhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\ddvdj.exec:\ddvdj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\rlxfxxr.exec:\rlxfxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\jjppv.exec:\jjppv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\1jjjd.exec:\1jjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\9nnhbb.exec:\9nnhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\3tbttt.exec:\3tbttt.exe23⤵
- Executes dropped EXE
PID:2232 -
\??\c:\9xfxrrl.exec:\9xfxrrl.exe24⤵
- Executes dropped EXE
PID:2648 -
\??\c:\bttnhh.exec:\bttnhh.exe25⤵
- Executes dropped EXE
PID:1016 -
\??\c:\dvddv.exec:\dvddv.exe26⤵
- Executes dropped EXE
PID:4688 -
\??\c:\5dpjj.exec:\5dpjj.exe27⤵
- Executes dropped EXE
PID:4524 -
\??\c:\rllfxrr.exec:\rllfxrr.exe28⤵
- Executes dropped EXE
PID:2820 -
\??\c:\ntbtnn.exec:\ntbtnn.exe29⤵
- Executes dropped EXE
PID:3212 -
\??\c:\jpdpd.exec:\jpdpd.exe30⤵
- Executes dropped EXE
PID:4988 -
\??\c:\flfrrll.exec:\flfrrll.exe31⤵
- Executes dropped EXE
PID:2840 -
\??\c:\7ffxxrr.exec:\7ffxxrr.exe32⤵
- Executes dropped EXE
PID:3720 -
\??\c:\5bbtnh.exec:\5bbtnh.exe33⤵
- Executes dropped EXE
PID:3608 -
\??\c:\vdvpv.exec:\vdvpv.exe34⤵
- Executes dropped EXE
PID:4656 -
\??\c:\rlfxlll.exec:\rlfxlll.exe35⤵
- Executes dropped EXE
PID:3816 -
\??\c:\btnnnh.exec:\btnnnh.exe36⤵
- Executes dropped EXE
PID:928 -
\??\c:\hbhhhh.exec:\hbhhhh.exe37⤵
- Executes dropped EXE
PID:4308 -
\??\c:\pjjdd.exec:\pjjdd.exe38⤵
- Executes dropped EXE
PID:4568 -
\??\c:\ffxxrrl.exec:\ffxxrrl.exe39⤵
- Executes dropped EXE
PID:1348 -
\??\c:\nhnhbh.exec:\nhnhbh.exe40⤵
- Executes dropped EXE
PID:3976 -
\??\c:\3nbttt.exec:\3nbttt.exe41⤵
- Executes dropped EXE
PID:3656 -
\??\c:\djjpd.exec:\djjpd.exe42⤵
- Executes dropped EXE
PID:4472 -
\??\c:\xrlllrr.exec:\xrlllrr.exe43⤵
- Executes dropped EXE
PID:5112 -
\??\c:\bhtnnn.exec:\bhtnnn.exe44⤵
- Executes dropped EXE
PID:5096 -
\??\c:\jdvvp.exec:\jdvvp.exe45⤵
- Executes dropped EXE
PID:4544 -
\??\c:\lfllffr.exec:\lfllffr.exe46⤵
- Executes dropped EXE
PID:4284 -
\??\c:\bntnhh.exec:\bntnhh.exe47⤵
- Executes dropped EXE
PID:184 -
\??\c:\vjdvv.exec:\vjdvv.exe48⤵
- Executes dropped EXE
PID:3532 -
\??\c:\ddjdp.exec:\ddjdp.exe49⤵
- Executes dropped EXE
PID:4376 -
\??\c:\lllfxfx.exec:\lllfxfx.exe50⤵
- Executes dropped EXE
PID:4760 -
\??\c:\lflllrl.exec:\lflllrl.exe51⤵
- Executes dropped EXE
PID:4060 -
\??\c:\vvvdv.exec:\vvvdv.exe52⤵
- Executes dropped EXE
PID:3472 -
\??\c:\dvjdd.exec:\dvjdd.exe53⤵
- Executes dropped EXE
PID:3932 -
\??\c:\rxxffll.exec:\rxxffll.exe54⤵
- Executes dropped EXE
PID:4740 -
\??\c:\7nhhbh.exec:\7nhhbh.exe55⤵
- Executes dropped EXE
PID:1044 -
\??\c:\vdjvd.exec:\vdjvd.exe56⤵
- Executes dropped EXE
PID:1948 -
\??\c:\dvjdv.exec:\dvjdv.exe57⤵
- Executes dropped EXE
PID:2720 -
\??\c:\lrlfrxx.exec:\lrlfrxx.exe58⤵
- Executes dropped EXE
PID:2660 -
\??\c:\thtnnn.exec:\thtnnn.exe59⤵
- Executes dropped EXE
PID:2020 -
\??\c:\ddpjd.exec:\ddpjd.exe60⤵
- Executes dropped EXE
PID:1920 -
\??\c:\ffxxxfx.exec:\ffxxxfx.exe61⤵
- Executes dropped EXE
PID:1096 -
\??\c:\nnnhhb.exec:\nnnhhb.exe62⤵
- Executes dropped EXE
PID:4040 -
\??\c:\5pjdd.exec:\5pjdd.exe63⤵
- Executes dropped EXE
PID:4844 -
\??\c:\hthnnt.exec:\hthnnt.exe64⤵
- Executes dropped EXE
PID:324 -
\??\c:\9pppp.exec:\9pppp.exe65⤵
- Executes dropped EXE
PID:2636 -
\??\c:\5ntttt.exec:\5ntttt.exe66⤵PID:2908
-
\??\c:\rxffxff.exec:\rxffxff.exe67⤵PID:4704
-
\??\c:\1bhhhn.exec:\1bhhhn.exe68⤵PID:3872
-
\??\c:\jddpj.exec:\jddpj.exe69⤵PID:5032
-
\??\c:\nnnnnn.exec:\nnnnnn.exe70⤵PID:4540
-
\??\c:\5ddvj.exec:\5ddvj.exe71⤵PID:4300
-
\??\c:\xlrlffx.exec:\xlrlffx.exe72⤵PID:4304
-
\??\c:\ttbtnb.exec:\ttbtnb.exe73⤵PID:4164
-
\??\c:\djddj.exec:\djddj.exe74⤵PID:2268
-
\??\c:\rllffxx.exec:\rllffxx.exe75⤵PID:1848
-
\??\c:\tbbntn.exec:\tbbntn.exe76⤵PID:4124
-
\??\c:\jvjvp.exec:\jvjvp.exe77⤵PID:756
-
\??\c:\rlxfxxr.exec:\rlxfxxr.exe78⤵PID:3700
-
\??\c:\5bbbtb.exec:\5bbbtb.exe79⤵PID:5080
-
\??\c:\jdddv.exec:\jdddv.exe80⤵PID:1100
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe81⤵PID:3212
-
\??\c:\nhhhhh.exec:\nhhhhh.exe82⤵PID:3632
-
\??\c:\pvvvv.exec:\pvvvv.exe83⤵PID:2172
-
\??\c:\9xffffl.exec:\9xffffl.exe84⤵PID:2436
-
\??\c:\ttttnn.exec:\ttttnn.exe85⤵PID:4148
-
\??\c:\pdpdd.exec:\pdpdd.exe86⤵PID:2344
-
\??\c:\xrlflfr.exec:\xrlflfr.exe87⤵
- System Location Discovery: System Language Discovery
PID:928 -
\??\c:\bhhhtb.exec:\bhhhtb.exe88⤵PID:1936
-
\??\c:\bnbbbn.exec:\bnbbbn.exe89⤵PID:2684
-
\??\c:\dpvvv.exec:\dpvvv.exe90⤵PID:5064
-
\??\c:\rrffxfx.exec:\rrffxfx.exe91⤵PID:4700
-
\??\c:\httnhh.exec:\httnhh.exe92⤵PID:4140
-
\??\c:\nbtbtt.exec:\nbtbtt.exe93⤵PID:616
-
\??\c:\vjvpj.exec:\vjvpj.exe94⤵
- System Location Discovery: System Language Discovery
PID:4548 -
\??\c:\llllxxf.exec:\llllxxf.exe95⤵PID:5096
-
\??\c:\hnbtth.exec:\hnbtth.exe96⤵PID:3760
-
\??\c:\jjppv.exec:\jjppv.exe97⤵PID:4856
-
\??\c:\ddddj.exec:\ddddj.exe98⤵PID:4640
-
\??\c:\rllrffr.exec:\rllrffr.exe99⤵PID:4544
-
\??\c:\7hhtth.exec:\7hhtth.exe100⤵PID:1288
-
\??\c:\vjddv.exec:\vjddv.exe101⤵PID:4908
-
\??\c:\lrrlffx.exec:\lrrlffx.exe102⤵PID:556
-
\??\c:\1nnhhn.exec:\1nnhhn.exe103⤵PID:1296
-
\??\c:\vvjpv.exec:\vvjpv.exe104⤵PID:3204
-
\??\c:\3djdv.exec:\3djdv.exe105⤵
- System Location Discovery: System Language Discovery
PID:2316 -
\??\c:\1xxllll.exec:\1xxllll.exe106⤵PID:3832
-
\??\c:\bnttbb.exec:\bnttbb.exe107⤵PID:3388
-
\??\c:\jvpjd.exec:\jvpjd.exe108⤵PID:3396
-
\??\c:\xrrrllf.exec:\xrrrllf.exe109⤵PID:3640
-
\??\c:\bbbhtt.exec:\bbbhtt.exe110⤵PID:4632
-
\??\c:\vvjjp.exec:\vvjjp.exe111⤵PID:1044
-
\??\c:\pppvp.exec:\pppvp.exe112⤵PID:376
-
\??\c:\xrllflf.exec:\xrllflf.exe113⤵PID:4288
-
\??\c:\nnnhbb.exec:\nnnhbb.exe114⤵PID:464
-
\??\c:\dvddd.exec:\dvddd.exe115⤵PID:4460
-
\??\c:\1lllfff.exec:\1lllfff.exe116⤵PID:1680
-
\??\c:\tnhnnb.exec:\tnhnnb.exe117⤵PID:3908
-
\??\c:\tbnttb.exec:\tbnttb.exe118⤵PID:4512
-
\??\c:\dpppp.exec:\dpppp.exe119⤵PID:2516
-
\??\c:\hthhbb.exec:\hthhbb.exe120⤵PID:2584
-
\??\c:\3vddv.exec:\3vddv.exe121⤵PID:2932
-
\??\c:\1xxxrfx.exec:\1xxxrfx.exe122⤵PID:1640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-