Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 00:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
81fbcdef13e98021f65872e9cc95a4a22cd754513de7eb687ea933143338a8c6.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
81fbcdef13e98021f65872e9cc95a4a22cd754513de7eb687ea933143338a8c6.exe
-
Size
454KB
-
MD5
ddbb08113a08f4e24b27d944c03a9245
-
SHA1
e7b0d4617d16e760c72661a6c6e4d77e58bb7fc2
-
SHA256
81fbcdef13e98021f65872e9cc95a4a22cd754513de7eb687ea933143338a8c6
-
SHA512
a7e756d20231933cbf8131bc238299c95a7f108db41565c5632cf15abdc55cad10daed9e7d9d7bef52e41175c0b2e48bc1107eb0b7c77027a47f918bdab1c2a5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT2:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1768-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1732-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1028-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2836-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1280-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/936-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2044-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1272-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/428-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-661-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-746-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-892-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-894-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-903-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-1006-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-1217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3148 ttnnnn.exe 4868 ppdpj.exe 2260 ddddj.exe 4784 llxxrrl.exe 4964 7nthnb.exe 1732 1btnbb.exe 4580 tnhbbt.exe 4280 dpjvj.exe 2764 jjvjd.exe 3424 hbbnnt.exe 4640 5fxrrlf.exe 3644 bbbbnn.exe 1772 pvjdd.exe 3708 vdvpj.exe 3540 lfffxxr.exe 4896 pjpjd.exe 4988 xrxrxxf.exe 4072 1nbbtt.exe 1056 lxxlfxx.exe 2020 nntntt.exe 432 llxxlrr.exe 4732 ppdvp.exe 4864 btthbb.exe 2632 vvpjv.exe 4512 bbhbtn.exe 1124 xfxxrxr.exe 976 jjdvp.exe 3088 vdvpd.exe 4356 hnnhbb.exe 1560 1nbtnb.exe 3740 rxxxllf.exe 3776 hnhbtn.exe 3732 llrllff.exe 3260 bbhbhh.exe 1028 7ppjv.exe 1596 flxrfxr.exe 3476 tbhtbt.exe 2660 nbbtnh.exe 3256 bbhbnn.exe 3744 vjpdv.exe 4684 rxrlffx.exe 4764 xffxxxr.exe 3124 tbntbn.exe 4232 bnntnn.exe 2676 pdvpj.exe 3680 3xrlffx.exe 4644 3tnhtt.exe 4340 pjvvv.exe 5100 rrfrfxr.exe 1360 lxrfxxr.exe 3844 httnnh.exe 4292 bhhbtn.exe 1424 jvpjd.exe 2068 xxlfxxr.exe 4964 ffllrrf.exe 4008 tbbtnn.exe 4572 jjdvj.exe 3904 pvjjj.exe 4500 fxxrrrr.exe 3984 1htnhb.exe 5084 bhhtnh.exe 2376 vjjdv.exe 4280 5rrlfxr.exe 3200 nhnhbt.exe -
resource yara_rule behavioral2/memory/1768-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1732-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1028-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1280-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/936-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2044-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1272-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/428-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-892-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-903-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1768 wrote to memory of 3148 1768 81fbcdef13e98021f65872e9cc95a4a22cd754513de7eb687ea933143338a8c6.exe 83 PID 1768 wrote to memory of 3148 1768 81fbcdef13e98021f65872e9cc95a4a22cd754513de7eb687ea933143338a8c6.exe 83 PID 1768 wrote to memory of 3148 1768 81fbcdef13e98021f65872e9cc95a4a22cd754513de7eb687ea933143338a8c6.exe 83 PID 3148 wrote to memory of 4868 3148 ttnnnn.exe 84 PID 3148 wrote to memory of 4868 3148 ttnnnn.exe 84 PID 3148 wrote to memory of 4868 3148 ttnnnn.exe 84 PID 4868 wrote to memory of 2260 4868 ppdpj.exe 85 PID 4868 wrote to memory of 2260 4868 ppdpj.exe 85 PID 4868 wrote to memory of 2260 4868 ppdpj.exe 85 PID 2260 wrote to memory of 4784 2260 ddddj.exe 86 PID 2260 wrote to memory of 4784 2260 ddddj.exe 86 PID 2260 wrote to memory of 4784 2260 ddddj.exe 86 PID 4784 wrote to memory of 4964 4784 llxxrrl.exe 87 PID 4784 wrote to memory of 4964 4784 llxxrrl.exe 87 PID 4784 wrote to memory of 4964 4784 llxxrrl.exe 87 PID 4964 wrote to memory of 1732 4964 7nthnb.exe 88 PID 4964 wrote to memory of 1732 4964 7nthnb.exe 88 PID 4964 wrote to memory of 1732 4964 7nthnb.exe 88 PID 1732 wrote to memory of 4580 1732 1btnbb.exe 89 PID 1732 wrote to memory of 4580 1732 1btnbb.exe 89 PID 1732 wrote to memory of 4580 1732 1btnbb.exe 89 PID 4580 wrote to memory of 4280 4580 tnhbbt.exe 90 PID 4580 wrote to memory of 4280 4580 tnhbbt.exe 90 PID 4580 wrote to memory of 4280 4580 tnhbbt.exe 90 PID 4280 wrote to memory of 2764 4280 dpjvj.exe 91 PID 4280 wrote to memory of 2764 4280 dpjvj.exe 91 PID 4280 wrote to memory of 2764 4280 dpjvj.exe 91 PID 2764 wrote to memory of 3424 2764 jjvjd.exe 92 PID 2764 wrote to memory of 3424 2764 jjvjd.exe 92 PID 2764 wrote to memory of 3424 2764 jjvjd.exe 92 PID 3424 wrote to memory of 4640 3424 hbbnnt.exe 93 PID 3424 wrote to memory of 4640 3424 hbbnnt.exe 93 PID 3424 wrote to memory of 4640 3424 hbbnnt.exe 93 PID 4640 wrote to memory of 3644 4640 5fxrrlf.exe 94 PID 4640 wrote to memory of 3644 4640 5fxrrlf.exe 94 PID 4640 wrote to memory of 3644 4640 5fxrrlf.exe 94 PID 3644 wrote to memory of 1772 3644 bbbbnn.exe 95 PID 3644 wrote to memory of 1772 3644 bbbbnn.exe 95 PID 3644 wrote to memory of 1772 3644 bbbbnn.exe 95 PID 1772 wrote to memory of 3708 1772 pvjdd.exe 96 PID 1772 wrote to memory of 3708 1772 pvjdd.exe 96 PID 1772 wrote to memory of 3708 1772 pvjdd.exe 96 PID 3708 wrote to memory of 3540 3708 vdvpj.exe 97 PID 3708 wrote to memory of 3540 3708 vdvpj.exe 97 PID 3708 wrote to memory of 3540 3708 vdvpj.exe 97 PID 3540 wrote to memory of 4896 3540 lfffxxr.exe 98 PID 3540 wrote to memory of 4896 3540 lfffxxr.exe 98 PID 3540 wrote to memory of 4896 3540 lfffxxr.exe 98 PID 4896 wrote to memory of 4988 4896 pjpjd.exe 99 PID 4896 wrote to memory of 4988 4896 pjpjd.exe 99 PID 4896 wrote to memory of 4988 4896 pjpjd.exe 99 PID 4988 wrote to memory of 4072 4988 xrxrxxf.exe 100 PID 4988 wrote to memory of 4072 4988 xrxrxxf.exe 100 PID 4988 wrote to memory of 4072 4988 xrxrxxf.exe 100 PID 4072 wrote to memory of 1056 4072 1nbbtt.exe 101 PID 4072 wrote to memory of 1056 4072 1nbbtt.exe 101 PID 4072 wrote to memory of 1056 4072 1nbbtt.exe 101 PID 1056 wrote to memory of 2020 1056 lxxlfxx.exe 102 PID 1056 wrote to memory of 2020 1056 lxxlfxx.exe 102 PID 1056 wrote to memory of 2020 1056 lxxlfxx.exe 102 PID 2020 wrote to memory of 432 2020 nntntt.exe 103 PID 2020 wrote to memory of 432 2020 nntntt.exe 103 PID 2020 wrote to memory of 432 2020 nntntt.exe 103 PID 432 wrote to memory of 4732 432 llxxlrr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\81fbcdef13e98021f65872e9cc95a4a22cd754513de7eb687ea933143338a8c6.exe"C:\Users\Admin\AppData\Local\Temp\81fbcdef13e98021f65872e9cc95a4a22cd754513de7eb687ea933143338a8c6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\ttnnnn.exec:\ttnnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\ppdpj.exec:\ppdpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\ddddj.exec:\ddddj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\llxxrrl.exec:\llxxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\7nthnb.exec:\7nthnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\1btnbb.exec:\1btnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\tnhbbt.exec:\tnhbbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\dpjvj.exec:\dpjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\jjvjd.exec:\jjvjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\hbbnnt.exec:\hbbnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\5fxrrlf.exec:\5fxrrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\bbbbnn.exec:\bbbbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\pvjdd.exec:\pvjdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\vdvpj.exec:\vdvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\lfffxxr.exec:\lfffxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\pjpjd.exec:\pjpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\xrxrxxf.exec:\xrxrxxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\1nbbtt.exec:\1nbbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\lxxlfxx.exec:\lxxlfxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\nntntt.exec:\nntntt.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\llxxlrr.exec:\llxxlrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\ppdvp.exec:\ppdvp.exe23⤵
- Executes dropped EXE
PID:4732 -
\??\c:\btthbb.exec:\btthbb.exe24⤵
- Executes dropped EXE
PID:4864 -
\??\c:\vvpjv.exec:\vvpjv.exe25⤵
- Executes dropped EXE
PID:2632 -
\??\c:\bbhbtn.exec:\bbhbtn.exe26⤵
- Executes dropped EXE
PID:4512 -
\??\c:\xfxxrxr.exec:\xfxxrxr.exe27⤵
- Executes dropped EXE
PID:1124 -
\??\c:\jjdvp.exec:\jjdvp.exe28⤵
- Executes dropped EXE
PID:976 -
\??\c:\vdvpd.exec:\vdvpd.exe29⤵
- Executes dropped EXE
PID:3088 -
\??\c:\hnnhbb.exec:\hnnhbb.exe30⤵
- Executes dropped EXE
PID:4356 -
\??\c:\1nbtnb.exec:\1nbtnb.exe31⤵
- Executes dropped EXE
PID:1560 -
\??\c:\rxxxllf.exec:\rxxxllf.exe32⤵
- Executes dropped EXE
PID:3740 -
\??\c:\hnhbtn.exec:\hnhbtn.exe33⤵
- Executes dropped EXE
PID:3776 -
\??\c:\llrllff.exec:\llrllff.exe34⤵
- Executes dropped EXE
PID:3732 -
\??\c:\bbhbhh.exec:\bbhbhh.exe35⤵
- Executes dropped EXE
PID:3260 -
\??\c:\7ppjv.exec:\7ppjv.exe36⤵
- Executes dropped EXE
PID:1028 -
\??\c:\flxrfxr.exec:\flxrfxr.exe37⤵
- Executes dropped EXE
PID:1596 -
\??\c:\tbhtbt.exec:\tbhtbt.exe38⤵
- Executes dropped EXE
PID:3476 -
\??\c:\nbbtnh.exec:\nbbtnh.exe39⤵
- Executes dropped EXE
PID:2660 -
\??\c:\bbhbnn.exec:\bbhbnn.exe40⤵
- Executes dropped EXE
PID:3256 -
\??\c:\vjpdv.exec:\vjpdv.exe41⤵
- Executes dropped EXE
PID:3744 -
\??\c:\rxrlffx.exec:\rxrlffx.exe42⤵
- Executes dropped EXE
PID:4684 -
\??\c:\xffxxxr.exec:\xffxxxr.exe43⤵
- Executes dropped EXE
PID:4764 -
\??\c:\tbntbn.exec:\tbntbn.exe44⤵
- Executes dropped EXE
PID:3124 -
\??\c:\bnntnn.exec:\bnntnn.exe45⤵
- Executes dropped EXE
PID:4232 -
\??\c:\pdvpj.exec:\pdvpj.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2676 -
\??\c:\3xrlffx.exec:\3xrlffx.exe47⤵
- Executes dropped EXE
PID:3680 -
\??\c:\3tnhtt.exec:\3tnhtt.exe48⤵
- Executes dropped EXE
PID:4644 -
\??\c:\pjvvv.exec:\pjvvv.exe49⤵
- Executes dropped EXE
PID:4340 -
\??\c:\rrfrfxr.exec:\rrfrfxr.exe50⤵
- Executes dropped EXE
PID:5100 -
\??\c:\lxrfxxr.exec:\lxrfxxr.exe51⤵
- Executes dropped EXE
PID:1360 -
\??\c:\httnnh.exec:\httnnh.exe52⤵
- Executes dropped EXE
PID:3844 -
\??\c:\bhhbtn.exec:\bhhbtn.exe53⤵
- Executes dropped EXE
PID:4292 -
\??\c:\jvpjd.exec:\jvpjd.exe54⤵
- Executes dropped EXE
PID:1424 -
\??\c:\xxlfxxr.exec:\xxlfxxr.exe55⤵
- Executes dropped EXE
PID:2068 -
\??\c:\ffllrrf.exec:\ffllrrf.exe56⤵
- Executes dropped EXE
PID:4964 -
\??\c:\tbbtnn.exec:\tbbtnn.exe57⤵
- Executes dropped EXE
PID:4008 -
\??\c:\jjdvj.exec:\jjdvj.exe58⤵
- Executes dropped EXE
PID:4572 -
\??\c:\pvjjj.exec:\pvjjj.exe59⤵
- Executes dropped EXE
PID:3904 -
\??\c:\fxxrrrr.exec:\fxxrrrr.exe60⤵
- Executes dropped EXE
PID:4500 -
\??\c:\1htnhb.exec:\1htnhb.exe61⤵
- Executes dropped EXE
PID:3984 -
\??\c:\bhhtnh.exec:\bhhtnh.exe62⤵
- Executes dropped EXE
PID:5084 -
\??\c:\vjjdv.exec:\vjjdv.exe63⤵
- Executes dropped EXE
PID:2376 -
\??\c:\5rrlfxr.exec:\5rrlfxr.exe64⤵
- Executes dropped EXE
PID:4280 -
\??\c:\nhnhbt.exec:\nhnhbt.exe65⤵
- Executes dropped EXE
PID:3200 -
\??\c:\tbttnh.exec:\tbttnh.exe66⤵PID:4856
-
\??\c:\pvppj.exec:\pvppj.exe67⤵PID:4740
-
\??\c:\llxrfxr.exec:\llxrfxr.exe68⤵PID:3108
-
\??\c:\bhhbtt.exec:\bhhbtt.exe69⤵PID:544
-
\??\c:\1tthtn.exec:\1tthtn.exe70⤵PID:1620
-
\??\c:\pvvvv.exec:\pvvvv.exe71⤵PID:2508
-
\??\c:\xxrfrlx.exec:\xxrfrlx.exe72⤵PID:5000
-
\??\c:\nhhbnn.exec:\nhhbnn.exe73⤵PID:2836
-
\??\c:\1dppj.exec:\1dppj.exe74⤵PID:1968
-
\??\c:\dddvd.exec:\dddvd.exe75⤵
- System Location Discovery: System Language Discovery
PID:2648 -
\??\c:\frrfxrl.exec:\frrfxrl.exe76⤵PID:1280
-
\??\c:\nnbtnh.exec:\nnbtnh.exe77⤵PID:4072
-
\??\c:\7tnhbb.exec:\7tnhbb.exe78⤵PID:2552
-
\??\c:\vvpjv.exec:\vvpjv.exe79⤵PID:376
-
\??\c:\rrflxlf.exec:\rrflxlf.exe80⤵PID:432
-
\??\c:\1rlfxxr.exec:\1rlfxxr.exe81⤵PID:2312
-
\??\c:\bbbtbt.exec:\bbbtbt.exe82⤵PID:2456
-
\??\c:\vjjdv.exec:\vjjdv.exe83⤵PID:936
-
\??\c:\djddv.exec:\djddv.exe84⤵PID:4316
-
\??\c:\nnhbtt.exec:\nnhbtt.exe85⤵PID:4900
-
\??\c:\bnnhtn.exec:\bnnhtn.exe86⤵PID:688
-
\??\c:\jdpdv.exec:\jdpdv.exe87⤵PID:1604
-
\??\c:\lrxxxxf.exec:\lrxxxxf.exe88⤵PID:4604
-
\??\c:\httnhb.exec:\httnhb.exe89⤵PID:3660
-
\??\c:\hhtntt.exec:\hhtntt.exe90⤵PID:3276
-
\??\c:\pvjdv.exec:\pvjdv.exe91⤵PID:2044
-
\??\c:\fxxrllf.exec:\fxxrllf.exe92⤵PID:1892
-
\??\c:\9nhbtt.exec:\9nhbtt.exe93⤵PID:2200
-
\??\c:\tnhnbn.exec:\tnhnbn.exe94⤵PID:1272
-
\??\c:\vppjd.exec:\vppjd.exe95⤵PID:4204
-
\??\c:\7xxrllf.exec:\7xxrllf.exe96⤵PID:632
-
\??\c:\thbtbt.exec:\thbtbt.exe97⤵PID:4616
-
\??\c:\ttnhbt.exec:\ttnhbt.exe98⤵PID:5048
-
\??\c:\jjdpj.exec:\jjdpj.exe99⤵PID:840
-
\??\c:\fllfxrl.exec:\fllfxrl.exe100⤵PID:1572
-
\??\c:\7nnnbb.exec:\7nnnbb.exe101⤵
- System Location Discovery: System Language Discovery
PID:2944 -
\??\c:\nbbbbb.exec:\nbbbbb.exe102⤵PID:4588
-
\??\c:\jdpjj.exec:\jdpjj.exe103⤵PID:4312
-
\??\c:\fffxfff.exec:\fffxfff.exe104⤵PID:5024
-
\??\c:\nnbthh.exec:\nnbthh.exe105⤵PID:244
-
\??\c:\nnhnhb.exec:\nnhnhb.exe106⤵PID:2388
-
\??\c:\ppvpp.exec:\ppvpp.exe107⤵
- System Location Discovery: System Language Discovery
PID:2468 -
\??\c:\xxrlffx.exec:\xxrlffx.exe108⤵PID:4232
-
\??\c:\lffxrlf.exec:\lffxrlf.exe109⤵PID:2676
-
\??\c:\9bbtnn.exec:\9bbtnn.exe110⤵PID:2576
-
\??\c:\ddvpj.exec:\ddvpj.exe111⤵PID:4348
-
\??\c:\rrlxlfx.exec:\rrlxlfx.exe112⤵PID:4328
-
\??\c:\1llflfx.exec:\1llflfx.exe113⤵PID:1768
-
\??\c:\nbbttn.exec:\nbbttn.exe114⤵PID:4860
-
\??\c:\1vvpv.exec:\1vvpv.exe115⤵PID:1440
-
\??\c:\vvvdp.exec:\vvvdp.exe116⤵PID:2260
-
\??\c:\fffxffx.exec:\fffxffx.exe117⤵PID:428
-
\??\c:\tttnhb.exec:\tttnhb.exe118⤵PID:1972
-
\??\c:\9btnbt.exec:\9btnbt.exe119⤵PID:392
-
\??\c:\vppjd.exec:\vppjd.exe120⤵PID:1952
-
\??\c:\rllfxrl.exec:\rllfxrl.exe121⤵PID:880
-
\??\c:\nhnnhn.exec:\nhnnhn.exe122⤵PID:1636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-