Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 20:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1b20cbb20515a213c4e56ca340320d5dfeddd49c19d7cda489e388d6964cc700.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
1b20cbb20515a213c4e56ca340320d5dfeddd49c19d7cda489e388d6964cc700.exe
-
Size
455KB
-
MD5
2a74a74bb38709ce2c79d188f35b77e6
-
SHA1
f128e7d851e3e7d7fcec55fc1de33375f3ed4dc7
-
SHA256
1b20cbb20515a213c4e56ca340320d5dfeddd49c19d7cda489e388d6964cc700
-
SHA512
ea7bbb896489ee7704d0ee2da4a636782cced0577d53115e6e93b2dc798a369f920cd3b9c8f031e8325a4d491e1750e5b5b3a1ec1abb37d40d7ada589fd80433
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRG:q7Tc2NYHUrAwfMp3CDRG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3304-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1336-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2492-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/744-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1840-763-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-818-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-881-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-1364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1336 9frllrr.exe 1172 hhhhtb.exe 4152 7pdvv.exe 3436 ttntnn.exe 4908 nhbbtt.exe 3648 vdpdv.exe 4536 lfrlrfr.exe 2884 pdvpv.exe 4748 xrfxxff.exe 1288 9fflxxf.exe 1564 hhbhhn.exe 3216 hhnnnn.exe 3584 ddvvd.exe 4880 djppj.exe 1656 rrrxxff.exe 228 thtttb.exe 3456 xrrrfrf.exe 1788 pjppv.exe 2492 hthhbh.exe 3744 xxrrflx.exe 316 lrxxffl.exe 3404 9nbnnt.exe 3000 ddjdd.exe 3028 ddjjj.exe 4008 tnbbtb.exe 3472 vpvpd.exe 4816 9hnntb.exe 4680 lfxxlff.exe 4052 hhtttb.exe 1668 rfrrrrl.exe 3008 vpvjj.exe 4952 frxxrrl.exe 444 pvdjv.exe 744 flxrlxr.exe 4764 hbhnhb.exe 1780 tttnnn.exe 1516 jdddd.exe 4204 lffxxxr.exe 1792 bhhhbt.exe 2780 dvvpp.exe 464 rflfllf.exe 3452 1hnhbb.exe 1608 3rrlfff.exe 1884 nnnnbb.exe 1152 hhhnhh.exe 3512 rffrxxx.exe 4256 xrlrlfx.exe 548 vjdpv.exe 4740 rrrlrff.exe 3876 rfflffx.exe 4868 bbtthh.exe 4484 vpvpj.exe 3620 rrxrrrf.exe 1804 nbbnnb.exe 3220 dddjj.exe 4788 xxlfrxx.exe 4152 nhbbth.exe 3928 dpddv.exe 4068 lxlfxxr.exe 4908 llrrxxf.exe 4648 thnhhh.exe 3340 3vdjv.exe 3148 xrffrrx.exe 4796 tnhhhn.exe -
resource yara_rule behavioral2/memory/3304-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1336-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2492-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/744-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1536-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1840-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-818-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lllrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3304 wrote to memory of 1336 3304 1b20cbb20515a213c4e56ca340320d5dfeddd49c19d7cda489e388d6964cc700.exe 82 PID 3304 wrote to memory of 1336 3304 1b20cbb20515a213c4e56ca340320d5dfeddd49c19d7cda489e388d6964cc700.exe 82 PID 3304 wrote to memory of 1336 3304 1b20cbb20515a213c4e56ca340320d5dfeddd49c19d7cda489e388d6964cc700.exe 82 PID 1336 wrote to memory of 1172 1336 9frllrr.exe 83 PID 1336 wrote to memory of 1172 1336 9frllrr.exe 83 PID 1336 wrote to memory of 1172 1336 9frllrr.exe 83 PID 1172 wrote to memory of 4152 1172 hhhhtb.exe 84 PID 1172 wrote to memory of 4152 1172 hhhhtb.exe 84 PID 1172 wrote to memory of 4152 1172 hhhhtb.exe 84 PID 4152 wrote to memory of 3436 4152 7pdvv.exe 85 PID 4152 wrote to memory of 3436 4152 7pdvv.exe 85 PID 4152 wrote to memory of 3436 4152 7pdvv.exe 85 PID 3436 wrote to memory of 4908 3436 ttntnn.exe 86 PID 3436 wrote to memory of 4908 3436 ttntnn.exe 86 PID 3436 wrote to memory of 4908 3436 ttntnn.exe 86 PID 4908 wrote to memory of 3648 4908 nhbbtt.exe 87 PID 4908 wrote to memory of 3648 4908 nhbbtt.exe 87 PID 4908 wrote to memory of 3648 4908 nhbbtt.exe 87 PID 3648 wrote to memory of 4536 3648 vdpdv.exe 88 PID 3648 wrote to memory of 4536 3648 vdpdv.exe 88 PID 3648 wrote to memory of 4536 3648 vdpdv.exe 88 PID 4536 wrote to memory of 2884 4536 lfrlrfr.exe 89 PID 4536 wrote to memory of 2884 4536 lfrlrfr.exe 89 PID 4536 wrote to memory of 2884 4536 lfrlrfr.exe 89 PID 2884 wrote to memory of 4748 2884 pdvpv.exe 90 PID 2884 wrote to memory of 4748 2884 pdvpv.exe 90 PID 2884 wrote to memory of 4748 2884 pdvpv.exe 90 PID 4748 wrote to memory of 1288 4748 xrfxxff.exe 91 PID 4748 wrote to memory of 1288 4748 xrfxxff.exe 91 PID 4748 wrote to memory of 1288 4748 xrfxxff.exe 91 PID 1288 wrote to memory of 1564 1288 9fflxxf.exe 92 PID 1288 wrote to memory of 1564 1288 9fflxxf.exe 92 PID 1288 wrote to memory of 1564 1288 9fflxxf.exe 92 PID 1564 wrote to memory of 3216 1564 hhbhhn.exe 93 PID 1564 wrote to memory of 3216 1564 hhbhhn.exe 93 PID 1564 wrote to memory of 3216 1564 hhbhhn.exe 93 PID 3216 wrote to memory of 3584 3216 hhnnnn.exe 94 PID 3216 wrote to memory of 3584 3216 hhnnnn.exe 94 PID 3216 wrote to memory of 3584 3216 hhnnnn.exe 94 PID 3584 wrote to memory of 4880 3584 ddvvd.exe 95 PID 3584 wrote to memory of 4880 3584 ddvvd.exe 95 PID 3584 wrote to memory of 4880 3584 ddvvd.exe 95 PID 4880 wrote to memory of 1656 4880 djppj.exe 96 PID 4880 wrote to memory of 1656 4880 djppj.exe 96 PID 4880 wrote to memory of 1656 4880 djppj.exe 96 PID 1656 wrote to memory of 228 1656 rrrxxff.exe 97 PID 1656 wrote to memory of 228 1656 rrrxxff.exe 97 PID 1656 wrote to memory of 228 1656 rrrxxff.exe 97 PID 228 wrote to memory of 3456 228 thtttb.exe 98 PID 228 wrote to memory of 3456 228 thtttb.exe 98 PID 228 wrote to memory of 3456 228 thtttb.exe 98 PID 3456 wrote to memory of 1788 3456 xrrrfrf.exe 99 PID 3456 wrote to memory of 1788 3456 xrrrfrf.exe 99 PID 3456 wrote to memory of 1788 3456 xrrrfrf.exe 99 PID 1788 wrote to memory of 2492 1788 pjppv.exe 100 PID 1788 wrote to memory of 2492 1788 pjppv.exe 100 PID 1788 wrote to memory of 2492 1788 pjppv.exe 100 PID 2492 wrote to memory of 3744 2492 hthhbh.exe 101 PID 2492 wrote to memory of 3744 2492 hthhbh.exe 101 PID 2492 wrote to memory of 3744 2492 hthhbh.exe 101 PID 3744 wrote to memory of 316 3744 xxrrflx.exe 102 PID 3744 wrote to memory of 316 3744 xxrrflx.exe 102 PID 3744 wrote to memory of 316 3744 xxrrflx.exe 102 PID 316 wrote to memory of 3404 316 lrxxffl.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b20cbb20515a213c4e56ca340320d5dfeddd49c19d7cda489e388d6964cc700.exe"C:\Users\Admin\AppData\Local\Temp\1b20cbb20515a213c4e56ca340320d5dfeddd49c19d7cda489e388d6964cc700.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\9frllrr.exec:\9frllrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\hhhhtb.exec:\hhhhtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\7pdvv.exec:\7pdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\ttntnn.exec:\ttntnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\nhbbtt.exec:\nhbbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\vdpdv.exec:\vdpdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\lfrlrfr.exec:\lfrlrfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\pdvpv.exec:\pdvpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\xrfxxff.exec:\xrfxxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\9fflxxf.exec:\9fflxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\hhbhhn.exec:\hhbhhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\hhnnnn.exec:\hhnnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\ddvvd.exec:\ddvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\djppj.exec:\djppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\rrrxxff.exec:\rrrxxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\thtttb.exec:\thtttb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\xrrrfrf.exec:\xrrrfrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\pjppv.exec:\pjppv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\hthhbh.exec:\hthhbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\xxrrflx.exec:\xxrrflx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\lrxxffl.exec:\lrxxffl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\9nbnnt.exec:\9nbnnt.exe23⤵
- Executes dropped EXE
PID:3404 -
\??\c:\ddjdd.exec:\ddjdd.exe24⤵
- Executes dropped EXE
PID:3000 -
\??\c:\ddjjj.exec:\ddjjj.exe25⤵
- Executes dropped EXE
PID:3028 -
\??\c:\tnbbtb.exec:\tnbbtb.exe26⤵
- Executes dropped EXE
PID:4008 -
\??\c:\vpvpd.exec:\vpvpd.exe27⤵
- Executes dropped EXE
PID:3472 -
\??\c:\9hnntb.exec:\9hnntb.exe28⤵
- Executes dropped EXE
PID:4816 -
\??\c:\lfxxlff.exec:\lfxxlff.exe29⤵
- Executes dropped EXE
PID:4680 -
\??\c:\hhtttb.exec:\hhtttb.exe30⤵
- Executes dropped EXE
PID:4052 -
\??\c:\rfrrrrl.exec:\rfrrrrl.exe31⤵
- Executes dropped EXE
PID:1668 -
\??\c:\vpvjj.exec:\vpvjj.exe32⤵
- Executes dropped EXE
PID:3008 -
\??\c:\frxxrrl.exec:\frxxrrl.exe33⤵
- Executes dropped EXE
PID:4952 -
\??\c:\pvdjv.exec:\pvdjv.exe34⤵
- Executes dropped EXE
PID:444 -
\??\c:\flxrlxr.exec:\flxrlxr.exe35⤵
- Executes dropped EXE
PID:744 -
\??\c:\hbhnhb.exec:\hbhnhb.exe36⤵
- Executes dropped EXE
PID:4764 -
\??\c:\tttnnn.exec:\tttnnn.exe37⤵
- Executes dropped EXE
PID:1780 -
\??\c:\jdddd.exec:\jdddd.exe38⤵
- Executes dropped EXE
PID:1516 -
\??\c:\lffxxxr.exec:\lffxxxr.exe39⤵
- Executes dropped EXE
PID:4204 -
\??\c:\bhhhbt.exec:\bhhhbt.exe40⤵
- Executes dropped EXE
PID:1792 -
\??\c:\dvvpp.exec:\dvvpp.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\rflfllf.exec:\rflfllf.exe42⤵
- Executes dropped EXE
PID:464 -
\??\c:\1hnhbb.exec:\1hnhbb.exe43⤵
- Executes dropped EXE
PID:3452 -
\??\c:\3rrlfff.exec:\3rrlfff.exe44⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nnnnbb.exec:\nnnnbb.exe45⤵
- Executes dropped EXE
PID:1884 -
\??\c:\hhhnhh.exec:\hhhnhh.exe46⤵
- Executes dropped EXE
PID:1152 -
\??\c:\rffrxxx.exec:\rffrxxx.exe47⤵
- Executes dropped EXE
PID:3512 -
\??\c:\xrlrlfx.exec:\xrlrlfx.exe48⤵
- Executes dropped EXE
PID:4256 -
\??\c:\vjdpv.exec:\vjdpv.exe49⤵
- Executes dropped EXE
PID:548 -
\??\c:\rrrlrff.exec:\rrrlrff.exe50⤵
- Executes dropped EXE
PID:4740 -
\??\c:\rfflffx.exec:\rfflffx.exe51⤵
- Executes dropped EXE
PID:3876 -
\??\c:\bbtthh.exec:\bbtthh.exe52⤵
- Executes dropped EXE
PID:4868 -
\??\c:\vpvpj.exec:\vpvpj.exe53⤵
- Executes dropped EXE
PID:4484 -
\??\c:\rrxrrrf.exec:\rrxrrrf.exe54⤵
- Executes dropped EXE
PID:3620 -
\??\c:\nbbnnb.exec:\nbbnnb.exe55⤵
- Executes dropped EXE
PID:1804 -
\??\c:\dddjj.exec:\dddjj.exe56⤵
- Executes dropped EXE
PID:3220 -
\??\c:\xxlfrxx.exec:\xxlfrxx.exe57⤵
- Executes dropped EXE
PID:4788 -
\??\c:\nhbbth.exec:\nhbbth.exe58⤵
- Executes dropped EXE
PID:4152 -
\??\c:\dpddv.exec:\dpddv.exe59⤵
- Executes dropped EXE
PID:3928 -
\??\c:\lxlfxxr.exec:\lxlfxxr.exe60⤵
- Executes dropped EXE
PID:4068 -
\??\c:\llrrxxf.exec:\llrrxxf.exe61⤵
- Executes dropped EXE
PID:4908 -
\??\c:\thnhhh.exec:\thnhhh.exe62⤵
- Executes dropped EXE
PID:4648 -
\??\c:\3vdjv.exec:\3vdjv.exe63⤵
- Executes dropped EXE
PID:3340 -
\??\c:\xrffrrx.exec:\xrffrrx.exe64⤵
- Executes dropped EXE
PID:3148 -
\??\c:\tnhhhn.exec:\tnhhhn.exe65⤵
- Executes dropped EXE
PID:4796 -
\??\c:\7vvvv.exec:\7vvvv.exe66⤵PID:1104
-
\??\c:\rffffll.exec:\rffffll.exe67⤵PID:1176
-
\??\c:\bhtttb.exec:\bhtttb.exe68⤵PID:1100
-
\??\c:\ddvpj.exec:\ddvpj.exe69⤵PID:4968
-
\??\c:\rllfxrl.exec:\rllfxrl.exe70⤵PID:1456
-
\??\c:\nthhnn.exec:\nthhnn.exe71⤵PID:3032
-
\??\c:\jddvp.exec:\jddvp.exe72⤵PID:2100
-
\??\c:\xxrrxfl.exec:\xxrrxfl.exe73⤵PID:5036
-
\??\c:\hbttbh.exec:\hbttbh.exe74⤵PID:544
-
\??\c:\dpvpv.exec:\dpvpv.exe75⤵PID:3484
-
\??\c:\vdjjj.exec:\vdjjj.exe76⤵PID:1180
-
\??\c:\rlrfxrl.exec:\rlrfxrl.exe77⤵PID:3004
-
\??\c:\nhbbtt.exec:\nhbbtt.exe78⤵PID:228
-
\??\c:\pvddv.exec:\pvddv.exe79⤵PID:220
-
\??\c:\llfxxrr.exec:\llfxxrr.exe80⤵PID:4452
-
\??\c:\3bttnt.exec:\3bttnt.exe81⤵PID:4820
-
\??\c:\jddjd.exec:\jddjd.exe82⤵PID:764
-
\??\c:\rlrfflr.exec:\rlrfflr.exe83⤵PID:2332
-
\??\c:\nnthhn.exec:\nnthhn.exe84⤵PID:4848
-
\??\c:\pdddp.exec:\pdddp.exe85⤵PID:4104
-
\??\c:\xrflfll.exec:\xrflfll.exe86⤵PID:1588
-
\??\c:\hhnnnt.exec:\hhnnnt.exe87⤵PID:3508
-
\??\c:\vvddd.exec:\vvddd.exe88⤵PID:1824
-
\??\c:\pvddd.exec:\pvddd.exe89⤵PID:2812
-
\??\c:\llxfflr.exec:\llxfflr.exe90⤵PID:1536
-
\??\c:\httnhn.exec:\httnhn.exe91⤵PID:1272
-
\??\c:\jvvvv.exec:\jvvvv.exe92⤵PID:5080
-
\??\c:\lllfrfx.exec:\lllfrfx.exe93⤵PID:2392
-
\??\c:\hhnnnh.exec:\hhnnnh.exe94⤵PID:1860
-
\??\c:\dpdvv.exec:\dpdvv.exe95⤵PID:2484
-
\??\c:\llflrxl.exec:\llflrxl.exe96⤵PID:4584
-
\??\c:\frlfffr.exec:\frlfffr.exe97⤵PID:3944
-
\??\c:\bbbbhn.exec:\bbbbhn.exe98⤵PID:4952
-
\??\c:\jdppp.exec:\jdppp.exe99⤵PID:444
-
\??\c:\fxlfffx.exec:\fxlfffx.exe100⤵PID:1948
-
\??\c:\5tnnnn.exec:\5tnnnn.exe101⤵PID:4760
-
\??\c:\vjvvv.exec:\vjvvv.exe102⤵PID:2916
-
\??\c:\9llrlxx.exec:\9llrlxx.exe103⤵PID:2044
-
\??\c:\llrrllr.exec:\llrrllr.exe104⤵PID:3976
-
\??\c:\nttttt.exec:\nttttt.exe105⤵PID:3652
-
\??\c:\jdddj.exec:\jdddj.exe106⤵PID:5040
-
\??\c:\lxllllx.exec:\lxllllx.exe107⤵PID:2208
-
\??\c:\thbttb.exec:\thbttb.exe108⤵PID:1032
-
\??\c:\ttthhh.exec:\ttthhh.exe109⤵PID:5048
-
\??\c:\dvjdj.exec:\dvjdj.exe110⤵PID:3100
-
\??\c:\rlfffrf.exec:\rlfffrf.exe111⤵PID:2568
-
\??\c:\nbnnnn.exec:\nbnnnn.exe112⤵PID:832
-
\??\c:\bhnnhn.exec:\bhnnhn.exe113⤵PID:3512
-
\??\c:\jjvdv.exec:\jjvdv.exe114⤵PID:1584
-
\??\c:\xlrxrxx.exec:\xlrxrxx.exe115⤵PID:548
-
\??\c:\hbntbh.exec:\hbntbh.exe116⤵PID:1700
-
\??\c:\9hnnhn.exec:\9hnnhn.exe117⤵PID:4520
-
\??\c:\jjdpp.exec:\jjdpp.exe118⤵PID:4476
-
\??\c:\ddppj.exec:\ddppj.exe119⤵PID:4448
-
\??\c:\lfxxflx.exec:\lfxxflx.exe120⤵PID:4484
-
\??\c:\nhnhhh.exec:\nhnhhh.exe121⤵PID:1372
-
\??\c:\3pjjj.exec:\3pjjj.exe122⤵PID:4012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-