Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 21:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
31951927f5f50f45a015eafa2698debb5e617f96de29e1e003caff00e33c1df3.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
31951927f5f50f45a015eafa2698debb5e617f96de29e1e003caff00e33c1df3.exe
-
Size
453KB
-
MD5
0e030f66bab6e47c11fb8503aec4bf28
-
SHA1
60caab9ea3d38603b9463c15d446ea9e6e0c9e9e
-
SHA256
31951927f5f50f45a015eafa2698debb5e617f96de29e1e003caff00e33c1df3
-
SHA512
17c4c510f53c3765cc699ec110d752a03f98172046062f7acb601db5bad4c711a22cfc42ea7f599594096b8b4801d9515f6db1874cd559a2db9ec4c91d982252
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeC:q7Tc2NYHUrAwfMp3CDC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/5012-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1236-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3140-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2704-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2332-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-691-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-734-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-750-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-892-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-947-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-957-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-1202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3804-1281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-1537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5096 hnhttb.exe 3968 3rxxrfx.exe 3264 bhhbtn.exe 2904 9ppjd.exe 1236 pvdpd.exe 3628 vpdvd.exe 448 vpddv.exe 2348 5lffxff.exe 2384 tbbttt.exe 2020 htnnbb.exe 2456 pjjjd.exe 3140 vjjjp.exe 1172 hhbbbh.exe 1876 vjpjj.exe 3128 rflflfx.exe 4712 thttbn.exe 3712 5jdvp.exe 4576 jdvpp.exe 4652 ffrrllf.exe 2280 thnhtn.exe 2436 vjjdd.exe 5036 lxfffff.exe 1892 btnhbb.exe 2884 thnbtb.exe 2704 9vdjd.exe 2324 fffxxrr.exe 2492 hthbtn.exe 2440 vpjjd.exe 908 ppjvd.exe 2192 llrlfrl.exe 2616 hhthbt.exe 3580 vddvv.exe 3816 pddpj.exe 940 rrrfxrf.exe 4316 hbtnhb.exe 2208 hnhhnn.exe 1044 ddvjp.exe 3396 rlxlxlr.exe 3708 thtnbb.exe 2780 nhthbt.exe 4268 pddvv.exe 4188 ffrlxfx.exe 4364 ntthhb.exe 4944 hthbtt.exe 1136 jjdvd.exe 4528 5flfffl.exe 4172 rlfrrrr.exe 4232 bbtnhb.exe 3540 5vdvv.exe 216 frflrxr.exe 4000 hnnnhn.exe 1268 bbhthb.exe 2788 vpvdv.exe 2804 xxrfxrf.exe 4728 thnnbh.exe 5088 pdddv.exe 3636 rlffrlx.exe 1476 vpjjd.exe 1816 llrlxxl.exe 1332 9hbtnn.exe 2952 3pjdd.exe 740 nnhbtn.exe 3980 bbbbtt.exe 3660 dddpj.exe -
resource yara_rule behavioral2/memory/5012-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1236-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3140-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2704-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2332-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-750-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-892-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-947-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-959-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fllffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5012 wrote to memory of 5096 5012 31951927f5f50f45a015eafa2698debb5e617f96de29e1e003caff00e33c1df3.exe 83 PID 5012 wrote to memory of 5096 5012 31951927f5f50f45a015eafa2698debb5e617f96de29e1e003caff00e33c1df3.exe 83 PID 5012 wrote to memory of 5096 5012 31951927f5f50f45a015eafa2698debb5e617f96de29e1e003caff00e33c1df3.exe 83 PID 5096 wrote to memory of 3968 5096 hnhttb.exe 84 PID 5096 wrote to memory of 3968 5096 hnhttb.exe 84 PID 5096 wrote to memory of 3968 5096 hnhttb.exe 84 PID 3968 wrote to memory of 3264 3968 3rxxrfx.exe 85 PID 3968 wrote to memory of 3264 3968 3rxxrfx.exe 85 PID 3968 wrote to memory of 3264 3968 3rxxrfx.exe 85 PID 3264 wrote to memory of 2904 3264 bhhbtn.exe 86 PID 3264 wrote to memory of 2904 3264 bhhbtn.exe 86 PID 3264 wrote to memory of 2904 3264 bhhbtn.exe 86 PID 2904 wrote to memory of 1236 2904 9ppjd.exe 87 PID 2904 wrote to memory of 1236 2904 9ppjd.exe 87 PID 2904 wrote to memory of 1236 2904 9ppjd.exe 87 PID 1236 wrote to memory of 3628 1236 pvdpd.exe 88 PID 1236 wrote to memory of 3628 1236 pvdpd.exe 88 PID 1236 wrote to memory of 3628 1236 pvdpd.exe 88 PID 3628 wrote to memory of 448 3628 vpdvd.exe 89 PID 3628 wrote to memory of 448 3628 vpdvd.exe 89 PID 3628 wrote to memory of 448 3628 vpdvd.exe 89 PID 448 wrote to memory of 2348 448 vpddv.exe 90 PID 448 wrote to memory of 2348 448 vpddv.exe 90 PID 448 wrote to memory of 2348 448 vpddv.exe 90 PID 2348 wrote to memory of 2384 2348 5lffxff.exe 91 PID 2348 wrote to memory of 2384 2348 5lffxff.exe 91 PID 2348 wrote to memory of 2384 2348 5lffxff.exe 91 PID 2384 wrote to memory of 2020 2384 tbbttt.exe 92 PID 2384 wrote to memory of 2020 2384 tbbttt.exe 92 PID 2384 wrote to memory of 2020 2384 tbbttt.exe 92 PID 2020 wrote to memory of 2456 2020 htnnbb.exe 93 PID 2020 wrote to memory of 2456 2020 htnnbb.exe 93 PID 2020 wrote to memory of 2456 2020 htnnbb.exe 93 PID 2456 wrote to memory of 3140 2456 pjjjd.exe 94 PID 2456 wrote to memory of 3140 2456 pjjjd.exe 94 PID 2456 wrote to memory of 3140 2456 pjjjd.exe 94 PID 3140 wrote to memory of 1172 3140 vjjjp.exe 95 PID 3140 wrote to memory of 1172 3140 vjjjp.exe 95 PID 3140 wrote to memory of 1172 3140 vjjjp.exe 95 PID 1172 wrote to memory of 1876 1172 hhbbbh.exe 96 PID 1172 wrote to memory of 1876 1172 hhbbbh.exe 96 PID 1172 wrote to memory of 1876 1172 hhbbbh.exe 96 PID 1876 wrote to memory of 3128 1876 vjpjj.exe 97 PID 1876 wrote to memory of 3128 1876 vjpjj.exe 97 PID 1876 wrote to memory of 3128 1876 vjpjj.exe 97 PID 3128 wrote to memory of 4712 3128 rflflfx.exe 98 PID 3128 wrote to memory of 4712 3128 rflflfx.exe 98 PID 3128 wrote to memory of 4712 3128 rflflfx.exe 98 PID 4712 wrote to memory of 3712 4712 thttbn.exe 99 PID 4712 wrote to memory of 3712 4712 thttbn.exe 99 PID 4712 wrote to memory of 3712 4712 thttbn.exe 99 PID 3712 wrote to memory of 4576 3712 5jdvp.exe 100 PID 3712 wrote to memory of 4576 3712 5jdvp.exe 100 PID 3712 wrote to memory of 4576 3712 5jdvp.exe 100 PID 4576 wrote to memory of 4652 4576 jdvpp.exe 101 PID 4576 wrote to memory of 4652 4576 jdvpp.exe 101 PID 4576 wrote to memory of 4652 4576 jdvpp.exe 101 PID 4652 wrote to memory of 2280 4652 ffrrllf.exe 102 PID 4652 wrote to memory of 2280 4652 ffrrllf.exe 102 PID 4652 wrote to memory of 2280 4652 ffrrllf.exe 102 PID 2280 wrote to memory of 2436 2280 thnhtn.exe 103 PID 2280 wrote to memory of 2436 2280 thnhtn.exe 103 PID 2280 wrote to memory of 2436 2280 thnhtn.exe 103 PID 2436 wrote to memory of 5036 2436 vjjdd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\31951927f5f50f45a015eafa2698debb5e617f96de29e1e003caff00e33c1df3.exe"C:\Users\Admin\AppData\Local\Temp\31951927f5f50f45a015eafa2698debb5e617f96de29e1e003caff00e33c1df3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\hnhttb.exec:\hnhttb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\3rxxrfx.exec:\3rxxrfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\bhhbtn.exec:\bhhbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\9ppjd.exec:\9ppjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\pvdpd.exec:\pvdpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\vpdvd.exec:\vpdvd.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\vpddv.exec:\vpddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\5lffxff.exec:\5lffxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\tbbttt.exec:\tbbttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\htnnbb.exec:\htnnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\pjjjd.exec:\pjjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\vjjjp.exec:\vjjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\hhbbbh.exec:\hhbbbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\vjpjj.exec:\vjpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\rflflfx.exec:\rflflfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\thttbn.exec:\thttbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\5jdvp.exec:\5jdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\jdvpp.exec:\jdvpp.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\ffrrllf.exec:\ffrrllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\thnhtn.exec:\thnhtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\vjjdd.exec:\vjjdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\lxfffff.exec:\lxfffff.exe23⤵
- Executes dropped EXE
PID:5036 -
\??\c:\btnhbb.exec:\btnhbb.exe24⤵
- Executes dropped EXE
PID:1892 -
\??\c:\thnbtb.exec:\thnbtb.exe25⤵
- Executes dropped EXE
PID:2884 -
\??\c:\9vdjd.exec:\9vdjd.exe26⤵
- Executes dropped EXE
PID:2704 -
\??\c:\fffxxrr.exec:\fffxxrr.exe27⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hthbtn.exec:\hthbtn.exe28⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vpjjd.exec:\vpjjd.exe29⤵
- Executes dropped EXE
PID:2440 -
\??\c:\ppjvd.exec:\ppjvd.exe30⤵
- Executes dropped EXE
PID:908 -
\??\c:\llrlfrl.exec:\llrlfrl.exe31⤵
- Executes dropped EXE
PID:2192 -
\??\c:\hhthbt.exec:\hhthbt.exe32⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vddvv.exec:\vddvv.exe33⤵
- Executes dropped EXE
PID:3580 -
\??\c:\pddpj.exec:\pddpj.exe34⤵
- Executes dropped EXE
PID:3816 -
\??\c:\rrrfxrf.exec:\rrrfxrf.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:940 -
\??\c:\hbtnhb.exec:\hbtnhb.exe36⤵
- Executes dropped EXE
PID:4316 -
\??\c:\hnhhnn.exec:\hnhhnn.exe37⤵
- Executes dropped EXE
PID:2208 -
\??\c:\ddvjp.exec:\ddvjp.exe38⤵
- Executes dropped EXE
PID:1044 -
\??\c:\rlxlxlr.exec:\rlxlxlr.exe39⤵
- Executes dropped EXE
PID:3396 -
\??\c:\thtnbb.exec:\thtnbb.exe40⤵
- Executes dropped EXE
PID:3708 -
\??\c:\nhthbt.exec:\nhthbt.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\pddvv.exec:\pddvv.exe42⤵
- Executes dropped EXE
PID:4268 -
\??\c:\ffrlxfx.exec:\ffrlxfx.exe43⤵
- Executes dropped EXE
PID:4188 -
\??\c:\ntthhb.exec:\ntthhb.exe44⤵
- Executes dropped EXE
PID:4364 -
\??\c:\hthbtt.exec:\hthbtt.exe45⤵
- Executes dropped EXE
PID:4944 -
\??\c:\jjdvd.exec:\jjdvd.exe46⤵
- Executes dropped EXE
PID:1136 -
\??\c:\5flfffl.exec:\5flfffl.exe47⤵
- Executes dropped EXE
PID:4528 -
\??\c:\rlfrrrr.exec:\rlfrrrr.exe48⤵
- Executes dropped EXE
PID:4172 -
\??\c:\bbtnhb.exec:\bbtnhb.exe49⤵
- Executes dropped EXE
PID:4232 -
\??\c:\5vdvv.exec:\5vdvv.exe50⤵
- Executes dropped EXE
PID:3540 -
\??\c:\frflrxr.exec:\frflrxr.exe51⤵
- Executes dropped EXE
PID:216 -
\??\c:\hnnnhn.exec:\hnnnhn.exe52⤵
- Executes dropped EXE
PID:4000 -
\??\c:\bbhthb.exec:\bbhthb.exe53⤵
- Executes dropped EXE
PID:1268 -
\??\c:\vpvdv.exec:\vpvdv.exe54⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xxrfxrf.exec:\xxrfxrf.exe55⤵
- Executes dropped EXE
PID:2804 -
\??\c:\thnnbh.exec:\thnnbh.exe56⤵
- Executes dropped EXE
PID:4728 -
\??\c:\pdddv.exec:\pdddv.exe57⤵
- Executes dropped EXE
PID:5088 -
\??\c:\rlffrlx.exec:\rlffrlx.exe58⤵
- Executes dropped EXE
PID:3636 -
\??\c:\vpjjd.exec:\vpjjd.exe59⤵
- Executes dropped EXE
PID:1476 -
\??\c:\llrlxxl.exec:\llrlxxl.exe60⤵
- Executes dropped EXE
PID:1816 -
\??\c:\9hbtnn.exec:\9hbtnn.exe61⤵
- Executes dropped EXE
PID:1332 -
\??\c:\3pjdd.exec:\3pjdd.exe62⤵
- Executes dropped EXE
PID:2952 -
\??\c:\nnhbtn.exec:\nnhbtn.exe63⤵
- Executes dropped EXE
PID:740 -
\??\c:\bbbbtt.exec:\bbbbtt.exe64⤵
- Executes dropped EXE
PID:3980 -
\??\c:\dddpj.exec:\dddpj.exe65⤵
- Executes dropped EXE
PID:3660 -
\??\c:\ntbbtn.exec:\ntbbtn.exe66⤵PID:4840
-
\??\c:\jppjj.exec:\jppjj.exe67⤵PID:3308
-
\??\c:\hbbbhn.exec:\hbbbhn.exe68⤵PID:2352
-
\??\c:\3bnhhh.exec:\3bnhhh.exe69⤵PID:4556
-
\??\c:\vvdjv.exec:\vvdjv.exe70⤵PID:3296
-
\??\c:\bhtttt.exec:\bhtttt.exe71⤵PID:2416
-
\??\c:\7jdvp.exec:\7jdvp.exe72⤵PID:1240
-
\??\c:\xlrlffx.exec:\xlrlffx.exe73⤵PID:696
-
\??\c:\hhtntt.exec:\hhtntt.exe74⤵PID:2872
-
\??\c:\5jvjd.exec:\5jvjd.exe75⤵PID:8
-
\??\c:\lfllxrl.exec:\lfllxrl.exe76⤵PID:3676
-
\??\c:\thhnnh.exec:\thhnnh.exe77⤵PID:1868
-
\??\c:\9vvvp.exec:\9vvvp.exe78⤵PID:4756
-
\??\c:\tnttnn.exec:\tnttnn.exe79⤵PID:3908
-
\??\c:\ttnntt.exec:\ttnntt.exe80⤵PID:5092
-
\??\c:\jjpjd.exec:\jjpjd.exe81⤵PID:3580
-
\??\c:\3nnnbh.exec:\3nnnbh.exe82⤵PID:2888
-
\??\c:\rxrlfff.exec:\rxrlfff.exe83⤵PID:2292
-
\??\c:\thnntb.exec:\thnntb.exe84⤵PID:876
-
\??\c:\jddvv.exec:\jddvv.exe85⤵PID:4520
-
\??\c:\rfxxrlf.exec:\rfxxrlf.exe86⤵PID:1044
-
\??\c:\jpvvp.exec:\jpvvp.exe87⤵PID:4376
-
\??\c:\xxlllrr.exec:\xxlllrr.exe88⤵PID:3708
-
\??\c:\bthhhh.exec:\bthhhh.exe89⤵PID:1600
-
\??\c:\xxxfffl.exec:\xxxfffl.exe90⤵PID:3592
-
\??\c:\7jjdp.exec:\7jjdp.exe91⤵PID:1524
-
\??\c:\xrxffff.exec:\xrxffff.exe92⤵PID:4188
-
\??\c:\9tbbth.exec:\9tbbth.exe93⤵PID:4364
-
\??\c:\vjjdd.exec:\vjjdd.exe94⤵PID:3024
-
\??\c:\3xxxrff.exec:\3xxxrff.exe95⤵PID:4944
-
\??\c:\ntbhtn.exec:\ntbhtn.exe96⤵PID:4640
-
\??\c:\hhnttn.exec:\hhnttn.exe97⤵PID:4528
-
\??\c:\1pppp.exec:\1pppp.exe98⤵PID:5096
-
\??\c:\1lffflf.exec:\1lffflf.exe99⤵PID:4340
-
\??\c:\9tbbbh.exec:\9tbbbh.exe100⤵PID:3880
-
\??\c:\pjdvd.exec:\pjdvd.exe101⤵PID:4008
-
\??\c:\3frrlrr.exec:\3frrlrr.exe102⤵PID:1168
-
\??\c:\3nhhhh.exec:\3nhhhh.exe103⤵PID:2128
-
\??\c:\jpddp.exec:\jpddp.exe104⤵PID:3416
-
\??\c:\pvjjv.exec:\pvjjv.exe105⤵PID:3224
-
\??\c:\rxfffll.exec:\rxfffll.exe106⤵PID:3444
-
\??\c:\tthhbh.exec:\tthhbh.exe107⤵PID:3988
-
\??\c:\nhhhtt.exec:\nhhhtt.exe108⤵PID:3852
-
\??\c:\fxxxxff.exec:\fxxxxff.exe109⤵PID:3572
-
\??\c:\lrfxxff.exec:\lrfxxff.exe110⤵PID:1668
-
\??\c:\ttbtnn.exec:\ttbtnn.exe111⤵PID:1340
-
\??\c:\vvvvv.exec:\vvvvv.exe112⤵PID:2856
-
\??\c:\lfffxxr.exec:\lfffxxr.exe113⤵PID:832
-
\??\c:\7bbhhb.exec:\7bbhhb.exe114⤵PID:2272
-
\??\c:\httnnn.exec:\httnnn.exe115⤵PID:4380
-
\??\c:\pvppp.exec:\pvppp.exe116⤵PID:4912
-
\??\c:\fxxxrfl.exec:\fxxxrfl.exe117⤵PID:3048
-
\??\c:\ttbttt.exec:\ttbttt.exe118⤵PID:3932
-
\??\c:\hhhhhn.exec:\hhhhhn.exe119⤵PID:2332
-
\??\c:\9rrrxxx.exec:\9rrrxxx.exe120⤵PID:2028
-
\??\c:\1nhbnb.exec:\1nhbnb.exe121⤵PID:3692
-
\??\c:\vjpjj.exec:\vjpjj.exe122⤵PID:1096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-