Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 19:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0dab2635379eaa90b29c3858e5b9ff21f82518da51cf661245a63f62981527b5.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
General
-
Target
0dab2635379eaa90b29c3858e5b9ff21f82518da51cf661245a63f62981527b5.exe
-
Size
453KB
-
MD5
3c37577ab61b63bb95c81df12717f685
-
SHA1
7f1c2be1a76b6683d2801ed7cbffea93f0b743c5
-
SHA256
0dab2635379eaa90b29c3858e5b9ff21f82518da51cf661245a63f62981527b5
-
SHA512
622ee15fbd1906a5a0c9a7d1cc3c939f94d37fe0ba89bdb008c5ef76a467cd6c71553525a851d1fa5e18f9902e53af697eaa56876a71c4012758a2613571c849
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAber:q7Tc2NYHUrAwfMp3CDr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4232-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2116-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1516-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1104-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-807-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-1090-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-1172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-1512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4928 hbttnt.exe 2116 thnthh.exe 3660 httttt.exe 3504 5vjjp.exe 1064 htbthb.exe 2412 xrflxll.exe 2320 rxrrrrr.exe 1388 xfffxfx.exe 3500 hbbbbb.exe 5076 htbhbt.exe 3124 vpppp.exe 4476 jjjdv.exe 3732 lrxxrxf.exe 4084 vdppp.exe 3712 ffffflf.exe 1712 xrxxxff.exe 4896 xflrlrr.exe 1496 5ntttt.exe 2052 ppjdp.exe 1460 jjvpv.exe 2588 jjjjv.exe 1104 ttbbhb.exe 1516 rrlrxxl.exe 3016 tbhhhh.exe 1504 fllffxx.exe 4652 jdjjd.exe 4088 nhnhbb.exe 1188 dvvjd.exe 2308 rxrrxll.exe 4472 9hnhbb.exe 4664 dpvpp.exe 2448 xxlrxrr.exe 2656 tbbtnh.exe 4968 7jpjj.exe 2356 llrrlll.exe 3840 bhhhbh.exe 3624 ttttnt.exe 4296 1jdpp.exe 4644 1fllflf.exe 1416 hnnhbb.exe 4556 dpdvd.exe 2928 ffflflr.exe 4436 thhbbb.exe 3460 ddddv.exe 2872 xxxlflf.exe 3872 bbbbbb.exe 1400 xfflfff.exe 2860 fffffll.exe 4692 ntbbbb.exe 2644 vdjjd.exe 4500 rrrrrxr.exe 3736 5vvvp.exe 4832 ffllrxf.exe 3852 1hnhhn.exe 2312 3vjpp.exe 4160 xrllllf.exe 4564 bbbbbh.exe 1608 dvvpp.exe 2940 7vjjp.exe 1548 frfxllx.exe 2320 1bnttt.exe 2472 3dddv.exe 536 jpjjj.exe 4136 lrlfxff.exe -
resource yara_rule behavioral2/memory/4232-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2116-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1388-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1712-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1516-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1104-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1164-807-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrfxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4232 wrote to memory of 4928 4232 0dab2635379eaa90b29c3858e5b9ff21f82518da51cf661245a63f62981527b5.exe 83 PID 4232 wrote to memory of 4928 4232 0dab2635379eaa90b29c3858e5b9ff21f82518da51cf661245a63f62981527b5.exe 83 PID 4232 wrote to memory of 4928 4232 0dab2635379eaa90b29c3858e5b9ff21f82518da51cf661245a63f62981527b5.exe 83 PID 4928 wrote to memory of 2116 4928 hbttnt.exe 84 PID 4928 wrote to memory of 2116 4928 hbttnt.exe 84 PID 4928 wrote to memory of 2116 4928 hbttnt.exe 84 PID 2116 wrote to memory of 3660 2116 thnthh.exe 85 PID 2116 wrote to memory of 3660 2116 thnthh.exe 85 PID 2116 wrote to memory of 3660 2116 thnthh.exe 85 PID 3660 wrote to memory of 3504 3660 httttt.exe 86 PID 3660 wrote to memory of 3504 3660 httttt.exe 86 PID 3660 wrote to memory of 3504 3660 httttt.exe 86 PID 3504 wrote to memory of 1064 3504 5vjjp.exe 87 PID 3504 wrote to memory of 1064 3504 5vjjp.exe 87 PID 3504 wrote to memory of 1064 3504 5vjjp.exe 87 PID 1064 wrote to memory of 2412 1064 htbthb.exe 88 PID 1064 wrote to memory of 2412 1064 htbthb.exe 88 PID 1064 wrote to memory of 2412 1064 htbthb.exe 88 PID 2412 wrote to memory of 2320 2412 xrflxll.exe 89 PID 2412 wrote to memory of 2320 2412 xrflxll.exe 89 PID 2412 wrote to memory of 2320 2412 xrflxll.exe 89 PID 2320 wrote to memory of 1388 2320 rxrrrrr.exe 90 PID 2320 wrote to memory of 1388 2320 rxrrrrr.exe 90 PID 2320 wrote to memory of 1388 2320 rxrrrrr.exe 90 PID 1388 wrote to memory of 3500 1388 xfffxfx.exe 91 PID 1388 wrote to memory of 3500 1388 xfffxfx.exe 91 PID 1388 wrote to memory of 3500 1388 xfffxfx.exe 91 PID 3500 wrote to memory of 5076 3500 hbbbbb.exe 92 PID 3500 wrote to memory of 5076 3500 hbbbbb.exe 92 PID 3500 wrote to memory of 5076 3500 hbbbbb.exe 92 PID 5076 wrote to memory of 3124 5076 htbhbt.exe 93 PID 5076 wrote to memory of 3124 5076 htbhbt.exe 93 PID 5076 wrote to memory of 3124 5076 htbhbt.exe 93 PID 3124 wrote to memory of 4476 3124 vpppp.exe 94 PID 3124 wrote to memory of 4476 3124 vpppp.exe 94 PID 3124 wrote to memory of 4476 3124 vpppp.exe 94 PID 4476 wrote to memory of 3732 4476 jjjdv.exe 95 PID 4476 wrote to memory of 3732 4476 jjjdv.exe 95 PID 4476 wrote to memory of 3732 4476 jjjdv.exe 95 PID 3732 wrote to memory of 4084 3732 lrxxrxf.exe 96 PID 3732 wrote to memory of 4084 3732 lrxxrxf.exe 96 PID 3732 wrote to memory of 4084 3732 lrxxrxf.exe 96 PID 4084 wrote to memory of 3712 4084 vdppp.exe 97 PID 4084 wrote to memory of 3712 4084 vdppp.exe 97 PID 4084 wrote to memory of 3712 4084 vdppp.exe 97 PID 3712 wrote to memory of 1712 3712 ffffflf.exe 98 PID 3712 wrote to memory of 1712 3712 ffffflf.exe 98 PID 3712 wrote to memory of 1712 3712 ffffflf.exe 98 PID 1712 wrote to memory of 4896 1712 xrxxxff.exe 99 PID 1712 wrote to memory of 4896 1712 xrxxxff.exe 99 PID 1712 wrote to memory of 4896 1712 xrxxxff.exe 99 PID 4896 wrote to memory of 1496 4896 xflrlrr.exe 100 PID 4896 wrote to memory of 1496 4896 xflrlrr.exe 100 PID 4896 wrote to memory of 1496 4896 xflrlrr.exe 100 PID 1496 wrote to memory of 2052 1496 5ntttt.exe 101 PID 1496 wrote to memory of 2052 1496 5ntttt.exe 101 PID 1496 wrote to memory of 2052 1496 5ntttt.exe 101 PID 2052 wrote to memory of 1460 2052 ppjdp.exe 102 PID 2052 wrote to memory of 1460 2052 ppjdp.exe 102 PID 2052 wrote to memory of 1460 2052 ppjdp.exe 102 PID 1460 wrote to memory of 2588 1460 jjvpv.exe 103 PID 1460 wrote to memory of 2588 1460 jjvpv.exe 103 PID 1460 wrote to memory of 2588 1460 jjvpv.exe 103 PID 2588 wrote to memory of 1104 2588 jjjjv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dab2635379eaa90b29c3858e5b9ff21f82518da51cf661245a63f62981527b5.exe"C:\Users\Admin\AppData\Local\Temp\0dab2635379eaa90b29c3858e5b9ff21f82518da51cf661245a63f62981527b5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\hbttnt.exec:\hbttnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\thnthh.exec:\thnthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\httttt.exec:\httttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\5vjjp.exec:\5vjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\htbthb.exec:\htbthb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\xrflxll.exec:\xrflxll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\rxrrrrr.exec:\rxrrrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\xfffxfx.exec:\xfffxfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\hbbbbb.exec:\hbbbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\htbhbt.exec:\htbhbt.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\vpppp.exec:\vpppp.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\jjjdv.exec:\jjjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\lrxxrxf.exec:\lrxxrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\vdppp.exec:\vdppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\ffffflf.exec:\ffffflf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\xrxxxff.exec:\xrxxxff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\xflrlrr.exec:\xflrlrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\5ntttt.exec:\5ntttt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\ppjdp.exec:\ppjdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\jjvpv.exec:\jjvpv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\jjjjv.exec:\jjjjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\ttbbhb.exec:\ttbbhb.exe23⤵
- Executes dropped EXE
PID:1104 -
\??\c:\rrlrxxl.exec:\rrlrxxl.exe24⤵
- Executes dropped EXE
PID:1516 -
\??\c:\tbhhhh.exec:\tbhhhh.exe25⤵
- Executes dropped EXE
PID:3016 -
\??\c:\fllffxx.exec:\fllffxx.exe26⤵
- Executes dropped EXE
PID:1504 -
\??\c:\jdjjd.exec:\jdjjd.exe27⤵
- Executes dropped EXE
PID:4652 -
\??\c:\nhnhbb.exec:\nhnhbb.exe28⤵
- Executes dropped EXE
PID:4088 -
\??\c:\dvvjd.exec:\dvvjd.exe29⤵
- Executes dropped EXE
PID:1188 -
\??\c:\rxrrxll.exec:\rxrrxll.exe30⤵
- Executes dropped EXE
PID:2308 -
\??\c:\9hnhbb.exec:\9hnhbb.exe31⤵
- Executes dropped EXE
PID:4472 -
\??\c:\dpvpp.exec:\dpvpp.exe32⤵
- Executes dropped EXE
PID:4664 -
\??\c:\xxlrxrr.exec:\xxlrxrr.exe33⤵
- Executes dropped EXE
PID:2448 -
\??\c:\tbbtnh.exec:\tbbtnh.exe34⤵
- Executes dropped EXE
PID:2656 -
\??\c:\7jpjj.exec:\7jpjj.exe35⤵
- Executes dropped EXE
PID:4968 -
\??\c:\llrrlll.exec:\llrrlll.exe36⤵
- Executes dropped EXE
PID:2356 -
\??\c:\bhhhbh.exec:\bhhhbh.exe37⤵
- Executes dropped EXE
PID:3840 -
\??\c:\ttttnt.exec:\ttttnt.exe38⤵
- Executes dropped EXE
PID:3624 -
\??\c:\1jdpp.exec:\1jdpp.exe39⤵
- Executes dropped EXE
PID:4296 -
\??\c:\1fllflf.exec:\1fllflf.exe40⤵
- Executes dropped EXE
PID:4644 -
\??\c:\hnnhbb.exec:\hnnhbb.exe41⤵
- Executes dropped EXE
PID:1416 -
\??\c:\dpdvd.exec:\dpdvd.exe42⤵
- Executes dropped EXE
PID:4556 -
\??\c:\ffflflr.exec:\ffflflr.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2928 -
\??\c:\thhbbb.exec:\thhbbb.exe44⤵
- Executes dropped EXE
PID:4436 -
\??\c:\ddddv.exec:\ddddv.exe45⤵
- Executes dropped EXE
PID:3460 -
\??\c:\xxxlflf.exec:\xxxlflf.exe46⤵
- Executes dropped EXE
PID:2872 -
\??\c:\bbbbbb.exec:\bbbbbb.exe47⤵
- Executes dropped EXE
PID:3872 -
\??\c:\xfflfff.exec:\xfflfff.exe48⤵
- Executes dropped EXE
PID:1400 -
\??\c:\fffffll.exec:\fffffll.exe49⤵
- Executes dropped EXE
PID:2860 -
\??\c:\ntbbbb.exec:\ntbbbb.exe50⤵
- Executes dropped EXE
PID:4692 -
\??\c:\vdjjd.exec:\vdjjd.exe51⤵
- Executes dropped EXE
PID:2644 -
\??\c:\rrrrrxr.exec:\rrrrrxr.exe52⤵
- Executes dropped EXE
PID:4500 -
\??\c:\5vvvp.exec:\5vvvp.exe53⤵
- Executes dropped EXE
PID:3736 -
\??\c:\ffllrxf.exec:\ffllrxf.exe54⤵
- Executes dropped EXE
PID:4832 -
\??\c:\1hnhhn.exec:\1hnhhn.exe55⤵
- Executes dropped EXE
PID:3852 -
\??\c:\3vjpp.exec:\3vjpp.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2312 -
\??\c:\xrllllf.exec:\xrllllf.exe57⤵
- Executes dropped EXE
PID:4160 -
\??\c:\bbbbbh.exec:\bbbbbh.exe58⤵
- Executes dropped EXE
PID:4564 -
\??\c:\dvvpp.exec:\dvvpp.exe59⤵
- Executes dropped EXE
PID:1608 -
\??\c:\7vjjp.exec:\7vjjp.exe60⤵
- Executes dropped EXE
PID:2940 -
\??\c:\frfxllx.exec:\frfxllx.exe61⤵
- Executes dropped EXE
PID:1548 -
\??\c:\1bnttt.exec:\1bnttt.exe62⤵
- Executes dropped EXE
PID:2320 -
\??\c:\3dddv.exec:\3dddv.exe63⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jpjjj.exec:\jpjjj.exe64⤵
- Executes dropped EXE
PID:536 -
\??\c:\lrlfxff.exec:\lrlfxff.exe65⤵
- Executes dropped EXE
PID:4136 -
\??\c:\bbtnnb.exec:\bbtnnb.exe66⤵PID:4988
-
\??\c:\vvpvp.exec:\vvpvp.exe67⤵PID:1444
-
\??\c:\xfxxxrr.exec:\xfxxxrr.exe68⤵PID:3060
-
\??\c:\9tbbbh.exec:\9tbbbh.exe69⤵PID:4376
-
\??\c:\jjppv.exec:\jjppv.exe70⤵PID:4828
-
\??\c:\rflfxxr.exec:\rflfxxr.exe71⤵PID:772
-
\??\c:\ffxxrrl.exec:\ffxxrrl.exe72⤵
- System Location Discovery: System Language Discovery
PID:756 -
\??\c:\bntnhh.exec:\bntnhh.exe73⤵
- System Location Discovery: System Language Discovery
PID:3756 -
\??\c:\jpdjd.exec:\jpdjd.exe74⤵PID:2628
-
\??\c:\xrrlllf.exec:\xrrlllf.exe75⤵PID:1712
-
\??\c:\hhbbtt.exec:\hhbbtt.exe76⤵PID:4640
-
\??\c:\9jjdd.exec:\9jjdd.exe77⤵PID:4300
-
\??\c:\xxxrffr.exec:\xxxrffr.exe78⤵PID:4960
-
\??\c:\lfffxxl.exec:\lfffxxl.exe79⤵PID:228
-
\??\c:\hbhbnn.exec:\hbhbnn.exe80⤵PID:2420
-
\??\c:\3vdvj.exec:\3vdvj.exe81⤵PID:4668
-
\??\c:\rllfxxr.exec:\rllfxxr.exe82⤵PID:4552
-
\??\c:\5hnntt.exec:\5hnntt.exe83⤵PID:3568
-
\??\c:\tntnnn.exec:\tntnnn.exe84⤵PID:4192
-
\??\c:\vvvvp.exec:\vvvvp.exe85⤵PID:4768
-
\??\c:\rfffrrl.exec:\rfffrrl.exe86⤵PID:1492
-
\??\c:\ffxxrxr.exec:\ffxxrxr.exe87⤵PID:1112
-
\??\c:\hbnhtt.exec:\hbnhtt.exe88⤵PID:1972
-
\??\c:\djdvp.exec:\djdvp.exe89⤵PID:3236
-
\??\c:\ffxrlfx.exec:\ffxrlfx.exe90⤵PID:4860
-
\??\c:\ffrlllf.exec:\ffrlllf.exe91⤵
- System Location Discovery: System Language Discovery
PID:3224 -
\??\c:\nnnhhn.exec:\nnnhhn.exe92⤵PID:4372
-
\??\c:\vvppj.exec:\vvppj.exe93⤵PID:3160
-
\??\c:\vpvdv.exec:\vpvdv.exe94⤵PID:1644
-
\??\c:\lrrrrrr.exec:\lrrrrrr.exe95⤵PID:3384
-
\??\c:\tbbnhh.exec:\tbbnhh.exe96⤵PID:4636
-
\??\c:\5jvpp.exec:\5jvpp.exe97⤵PID:3268
-
\??\c:\llfrxxr.exec:\llfrxxr.exe98⤵PID:4528
-
\??\c:\llxflxx.exec:\llxflxx.exe99⤵PID:5080
-
\??\c:\thbbnn.exec:\thbbnn.exe100⤵PID:3312
-
\??\c:\vdppp.exec:\vdppp.exe101⤵PID:3140
-
\??\c:\pvvvj.exec:\pvvvj.exe102⤵PID:2604
-
\??\c:\frrffrr.exec:\frrffrr.exe103⤵PID:4956
-
\??\c:\nhbnht.exec:\nhbnht.exe104⤵PID:8
-
\??\c:\ddjdv.exec:\ddjdv.exe105⤵PID:1416
-
\??\c:\vdvpp.exec:\vdvpp.exe106⤵PID:4556
-
\??\c:\xxrrflf.exec:\xxrrflf.exe107⤵PID:4912
-
\??\c:\btttnn.exec:\btttnn.exe108⤵PID:4304
-
\??\c:\ppddv.exec:\ppddv.exe109⤵PID:4320
-
\??\c:\rxxfxrf.exec:\rxxfxrf.exe110⤵PID:1304
-
\??\c:\xffxrrl.exec:\xffxrrl.exe111⤵PID:1672
-
\??\c:\hhnhnn.exec:\hhnhnn.exe112⤵PID:1400
-
\??\c:\vppjd.exec:\vppjd.exe113⤵PID:2892
-
\??\c:\rrlfxrr.exec:\rrlfxrr.exe114⤵PID:740
-
\??\c:\7nhhbh.exec:\7nhhbh.exe115⤵PID:4384
-
\??\c:\djjjj.exec:\djjjj.exe116⤵PID:1668
-
\??\c:\llrfrrx.exec:\llrfrrx.exe117⤵PID:3100
-
\??\c:\ntbbbb.exec:\ntbbbb.exe118⤵PID:3996
-
\??\c:\1nnhbn.exec:\1nnhbn.exe119⤵PID:2904
-
\??\c:\3jvvp.exec:\3jvvp.exe120⤵PID:4676
-
\??\c:\frxrffx.exec:\frxrffx.exe121⤵PID:3660
-
\??\c:\3tbtnh.exec:\3tbtnh.exe122⤵PID:2088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-