Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 03:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
def77ccef9d5c3bcedc6135fc12e072d3c93b07220d23816be9bb1428273f073.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
def77ccef9d5c3bcedc6135fc12e072d3c93b07220d23816be9bb1428273f073.exe
-
Size
455KB
-
MD5
77bcfa006d7016c0715c28ef224606fd
-
SHA1
715bb07b62bbc273c8433c6d516b5000354a2cd4
-
SHA256
def77ccef9d5c3bcedc6135fc12e072d3c93b07220d23816be9bb1428273f073
-
SHA512
55949b925a5ca2cfbd954a125f7e845cf4bd8edaa90cb01a525ddc82c5495d8350c456131930086bc4124e6f6f97c33fc1aa87e80f7de230c61f76a99b311223
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR3:q7Tc2NYHUrAwfMp3CDR3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3788-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3884-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2092-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/676-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/460-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1760-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2624-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3880-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1264-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3792-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3420-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1852-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-897-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-901-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-920-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-1599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-1719-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1908 3rllfff.exe 3168 thnbtt.exe 452 thnhhb.exe 3884 rxrrlrl.exe 2136 pjppj.exe 2980 hthttt.exe 4924 3dpjd.exe 3576 bhbthh.exe 4364 ffrrxxr.exe 3920 bthhnh.exe 1108 jvjdd.exe 32 9jjjd.exe 5008 ppjjd.exe 2092 1fxxrxr.exe 3880 fffxrrl.exe 4296 hbtbhh.exe 5100 dpppd.exe 1152 xrxlrrr.exe 4208 tnthnn.exe 4420 9nttbb.exe 3488 9jppj.exe 3476 fxxrffx.exe 4176 rrlffxr.exe 4860 ththbh.exe 2624 vpppd.exe 3928 dpvpp.exe 2872 rfffxxx.exe 4588 nnntth.exe 4484 nnnhbt.exe 3396 dpvvp.exe 3400 lrffxxx.exe 4544 fffxxxr.exe 3080 btnhbb.exe 2212 jdvpd.exe 2996 djpdv.exe 1608 ffrlrrx.exe 3980 hhnntt.exe 5076 hnhbtt.exe 1760 9djjj.exe 460 rrxrrrr.exe 4876 rfrrrrr.exe 4540 thnhbb.exe 676 dddvd.exe 4516 frfxxxr.exe 3140 5xlfffx.exe 548 3ttnhh.exe 1228 vvdvv.exe 4232 rlrllll.exe 520 rfffxxl.exe 400 7ntnbh.exe 3632 ppvpj.exe 1716 rfxxrrr.exe 4300 xrfllll.exe 4304 tththh.exe 3788 dvppj.exe 316 lllfxxr.exe 4780 hhbbbh.exe 4988 rfrlfxx.exe 1264 hnttnn.exe 4388 pjjdj.exe 3124 nhnhbb.exe 5112 pdpjj.exe 628 3nhbtb.exe 3792 ttthth.exe -
resource yara_rule behavioral2/memory/3788-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3884-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1108-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2092-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/676-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/460-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2624-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1108-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/32-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1264-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3792-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1852-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-897-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-901-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3788 wrote to memory of 1908 3788 def77ccef9d5c3bcedc6135fc12e072d3c93b07220d23816be9bb1428273f073.exe 82 PID 3788 wrote to memory of 1908 3788 def77ccef9d5c3bcedc6135fc12e072d3c93b07220d23816be9bb1428273f073.exe 82 PID 3788 wrote to memory of 1908 3788 def77ccef9d5c3bcedc6135fc12e072d3c93b07220d23816be9bb1428273f073.exe 82 PID 1908 wrote to memory of 3168 1908 3rllfff.exe 83 PID 1908 wrote to memory of 3168 1908 3rllfff.exe 83 PID 1908 wrote to memory of 3168 1908 3rllfff.exe 83 PID 3168 wrote to memory of 452 3168 thnbtt.exe 84 PID 3168 wrote to memory of 452 3168 thnbtt.exe 84 PID 3168 wrote to memory of 452 3168 thnbtt.exe 84 PID 452 wrote to memory of 3884 452 thnhhb.exe 85 PID 452 wrote to memory of 3884 452 thnhhb.exe 85 PID 452 wrote to memory of 3884 452 thnhhb.exe 85 PID 3884 wrote to memory of 2136 3884 rxrrlrl.exe 86 PID 3884 wrote to memory of 2136 3884 rxrrlrl.exe 86 PID 3884 wrote to memory of 2136 3884 rxrrlrl.exe 86 PID 2136 wrote to memory of 2980 2136 pjppj.exe 87 PID 2136 wrote to memory of 2980 2136 pjppj.exe 87 PID 2136 wrote to memory of 2980 2136 pjppj.exe 87 PID 2980 wrote to memory of 4924 2980 hthttt.exe 88 PID 2980 wrote to memory of 4924 2980 hthttt.exe 88 PID 2980 wrote to memory of 4924 2980 hthttt.exe 88 PID 4924 wrote to memory of 3576 4924 3dpjd.exe 89 PID 4924 wrote to memory of 3576 4924 3dpjd.exe 89 PID 4924 wrote to memory of 3576 4924 3dpjd.exe 89 PID 3576 wrote to memory of 4364 3576 bhbthh.exe 90 PID 3576 wrote to memory of 4364 3576 bhbthh.exe 90 PID 3576 wrote to memory of 4364 3576 bhbthh.exe 90 PID 4364 wrote to memory of 3920 4364 ffrrxxr.exe 91 PID 4364 wrote to memory of 3920 4364 ffrrxxr.exe 91 PID 4364 wrote to memory of 3920 4364 ffrrxxr.exe 91 PID 3920 wrote to memory of 1108 3920 bthhnh.exe 92 PID 3920 wrote to memory of 1108 3920 bthhnh.exe 92 PID 3920 wrote to memory of 1108 3920 bthhnh.exe 92 PID 1108 wrote to memory of 32 1108 jvjdd.exe 93 PID 1108 wrote to memory of 32 1108 jvjdd.exe 93 PID 1108 wrote to memory of 32 1108 jvjdd.exe 93 PID 32 wrote to memory of 5008 32 9jjjd.exe 94 PID 32 wrote to memory of 5008 32 9jjjd.exe 94 PID 32 wrote to memory of 5008 32 9jjjd.exe 94 PID 5008 wrote to memory of 2092 5008 ppjjd.exe 95 PID 5008 wrote to memory of 2092 5008 ppjjd.exe 95 PID 5008 wrote to memory of 2092 5008 ppjjd.exe 95 PID 2092 wrote to memory of 3880 2092 1fxxrxr.exe 96 PID 2092 wrote to memory of 3880 2092 1fxxrxr.exe 96 PID 2092 wrote to memory of 3880 2092 1fxxrxr.exe 96 PID 3880 wrote to memory of 4296 3880 fffxrrl.exe 97 PID 3880 wrote to memory of 4296 3880 fffxrrl.exe 97 PID 3880 wrote to memory of 4296 3880 fffxrrl.exe 97 PID 4296 wrote to memory of 5100 4296 hbtbhh.exe 98 PID 4296 wrote to memory of 5100 4296 hbtbhh.exe 98 PID 4296 wrote to memory of 5100 4296 hbtbhh.exe 98 PID 5100 wrote to memory of 1152 5100 dpppd.exe 99 PID 5100 wrote to memory of 1152 5100 dpppd.exe 99 PID 5100 wrote to memory of 1152 5100 dpppd.exe 99 PID 1152 wrote to memory of 4208 1152 xrxlrrr.exe 100 PID 1152 wrote to memory of 4208 1152 xrxlrrr.exe 100 PID 1152 wrote to memory of 4208 1152 xrxlrrr.exe 100 PID 4208 wrote to memory of 4420 4208 tnthnn.exe 101 PID 4208 wrote to memory of 4420 4208 tnthnn.exe 101 PID 4208 wrote to memory of 4420 4208 tnthnn.exe 101 PID 4420 wrote to memory of 3488 4420 9nttbb.exe 102 PID 4420 wrote to memory of 3488 4420 9nttbb.exe 102 PID 4420 wrote to memory of 3488 4420 9nttbb.exe 102 PID 3488 wrote to memory of 3476 3488 9jppj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\def77ccef9d5c3bcedc6135fc12e072d3c93b07220d23816be9bb1428273f073.exe"C:\Users\Admin\AppData\Local\Temp\def77ccef9d5c3bcedc6135fc12e072d3c93b07220d23816be9bb1428273f073.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\3rllfff.exec:\3rllfff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\thnbtt.exec:\thnbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\thnhhb.exec:\thnhhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\rxrrlrl.exec:\rxrrlrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\pjppj.exec:\pjppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\hthttt.exec:\hthttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\3dpjd.exec:\3dpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\bhbthh.exec:\bhbthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\ffrrxxr.exec:\ffrrxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\bthhnh.exec:\bthhnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\jvjdd.exec:\jvjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\9jjjd.exec:\9jjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\ppjjd.exec:\ppjjd.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\1fxxrxr.exec:\1fxxrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\fffxrrl.exec:\fffxrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\hbtbhh.exec:\hbtbhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\dpppd.exec:\dpppd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\xrxlrrr.exec:\xrxlrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\tnthnn.exec:\tnthnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\9nttbb.exec:\9nttbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\9jppj.exec:\9jppj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\fxxrffx.exec:\fxxrffx.exe23⤵
- Executes dropped EXE
PID:3476 -
\??\c:\rrlffxr.exec:\rrlffxr.exe24⤵
- Executes dropped EXE
PID:4176 -
\??\c:\ththbh.exec:\ththbh.exe25⤵
- Executes dropped EXE
PID:4860 -
\??\c:\vpppd.exec:\vpppd.exe26⤵
- Executes dropped EXE
PID:2624 -
\??\c:\dpvpp.exec:\dpvpp.exe27⤵
- Executes dropped EXE
PID:3928 -
\??\c:\rfffxxx.exec:\rfffxxx.exe28⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nnntth.exec:\nnntth.exe29⤵
- Executes dropped EXE
PID:4588 -
\??\c:\nnnhbt.exec:\nnnhbt.exe30⤵
- Executes dropped EXE
PID:4484 -
\??\c:\dpvvp.exec:\dpvvp.exe31⤵
- Executes dropped EXE
PID:3396 -
\??\c:\lrffxxx.exec:\lrffxxx.exe32⤵
- Executes dropped EXE
PID:3400 -
\??\c:\fffxxxr.exec:\fffxxxr.exe33⤵
- Executes dropped EXE
PID:4544 -
\??\c:\btnhbb.exec:\btnhbb.exe34⤵
- Executes dropped EXE
PID:3080 -
\??\c:\jdvpd.exec:\jdvpd.exe35⤵
- Executes dropped EXE
PID:2212 -
\??\c:\djpdv.exec:\djpdv.exe36⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ffrlrrx.exec:\ffrlrrx.exe37⤵
- Executes dropped EXE
PID:1608 -
\??\c:\hhnntt.exec:\hhnntt.exe38⤵
- Executes dropped EXE
PID:3980 -
\??\c:\hnhbtt.exec:\hnhbtt.exe39⤵
- Executes dropped EXE
PID:5076 -
\??\c:\9djjj.exec:\9djjj.exe40⤵
- Executes dropped EXE
PID:1760 -
\??\c:\rrxrrrr.exec:\rrxrrrr.exe41⤵
- Executes dropped EXE
PID:460 -
\??\c:\rfrrrrr.exec:\rfrrrrr.exe42⤵
- Executes dropped EXE
PID:4876 -
\??\c:\thnhbb.exec:\thnhbb.exe43⤵
- Executes dropped EXE
PID:4540 -
\??\c:\dddvd.exec:\dddvd.exe44⤵
- Executes dropped EXE
PID:676 -
\??\c:\frfxxxr.exec:\frfxxxr.exe45⤵
- Executes dropped EXE
PID:4516 -
\??\c:\5xlfffx.exec:\5xlfffx.exe46⤵
- Executes dropped EXE
PID:3140 -
\??\c:\3ttnhh.exec:\3ttnhh.exe47⤵
- Executes dropped EXE
PID:548 -
\??\c:\vvdvv.exec:\vvdvv.exe48⤵
- Executes dropped EXE
PID:1228 -
\??\c:\rlrllll.exec:\rlrllll.exe49⤵
- Executes dropped EXE
PID:4232 -
\??\c:\rfffxxl.exec:\rfffxxl.exe50⤵
- Executes dropped EXE
PID:520 -
\??\c:\7ntnbh.exec:\7ntnbh.exe51⤵
- Executes dropped EXE
PID:400 -
\??\c:\ppvpj.exec:\ppvpj.exe52⤵
- Executes dropped EXE
PID:3632 -
\??\c:\rfxxrrr.exec:\rfxxrrr.exe53⤵
- Executes dropped EXE
PID:1716 -
\??\c:\xrfllll.exec:\xrfllll.exe54⤵
- Executes dropped EXE
PID:4300 -
\??\c:\tththh.exec:\tththh.exe55⤵
- Executes dropped EXE
PID:4304 -
\??\c:\dvppj.exec:\dvppj.exe56⤵
- Executes dropped EXE
PID:3788 -
\??\c:\lllfxxr.exec:\lllfxxr.exe57⤵
- Executes dropped EXE
PID:316 -
\??\c:\hhbbbh.exec:\hhbbbh.exe58⤵
- Executes dropped EXE
PID:4780 -
\??\c:\rfrlfxx.exec:\rfrlfxx.exe59⤵
- Executes dropped EXE
PID:4988 -
\??\c:\hnttnn.exec:\hnttnn.exe60⤵
- Executes dropped EXE
PID:1264 -
\??\c:\pjjdj.exec:\pjjdj.exe61⤵
- Executes dropped EXE
PID:4388 -
\??\c:\nhnhbb.exec:\nhnhbb.exe62⤵
- Executes dropped EXE
PID:3124 -
\??\c:\pdpjj.exec:\pdpjj.exe63⤵
- Executes dropped EXE
PID:5112 -
\??\c:\3nhbtb.exec:\3nhbtb.exe64⤵
- Executes dropped EXE
PID:628 -
\??\c:\ttthth.exec:\ttthth.exe65⤵
- Executes dropped EXE
PID:3792 -
\??\c:\jjjjd.exec:\jjjjd.exe66⤵PID:184
-
\??\c:\xxflffl.exec:\xxflffl.exe67⤵PID:2428
-
\??\c:\nbbhbb.exec:\nbbhbb.exe68⤵
- System Location Discovery: System Language Discovery
PID:4216 -
\??\c:\3rxrlff.exec:\3rxrlff.exe69⤵PID:3920
-
\??\c:\vvdvv.exec:\vvdvv.exe70⤵PID:4332
-
\??\c:\3nbhhn.exec:\3nbhhn.exe71⤵PID:2120
-
\??\c:\xxllrrf.exec:\xxllrrf.exe72⤵PID:3180
-
\??\c:\nhtttn.exec:\nhtttn.exe73⤵PID:3056
-
\??\c:\pjpjp.exec:\pjpjp.exe74⤵PID:3944
-
\??\c:\3lrlrxf.exec:\3lrlrxf.exe75⤵PID:4480
-
\??\c:\btbhhh.exec:\btbhhh.exe76⤵PID:3852
-
\??\c:\xfxrlxr.exec:\xfxrlxr.exe77⤵PID:4296
-
\??\c:\pddvp.exec:\pddvp.exe78⤵PID:4992
-
\??\c:\frrlffx.exec:\frrlffx.exe79⤵PID:5040
-
\??\c:\nnnthh.exec:\nnnthh.exe80⤵PID:416
-
\??\c:\vvddv.exec:\vvddv.exe81⤵PID:2388
-
\??\c:\xrrlflf.exec:\xrrlflf.exe82⤵PID:3420
-
\??\c:\nbnnhn.exec:\nbnnhn.exe83⤵PID:4228
-
\??\c:\vdjjj.exec:\vdjjj.exe84⤵PID:4772
-
\??\c:\7vdvv.exec:\7vdvv.exe85⤵PID:4860
-
\??\c:\ddddv.exec:\ddddv.exe86⤵PID:2620
-
\??\c:\llfxfff.exec:\llfxfff.exe87⤵PID:2332
-
\??\c:\bbhbbb.exec:\bbhbbb.exe88⤵PID:2872
-
\??\c:\nthbnh.exec:\nthbnh.exe89⤵PID:4816
-
\??\c:\pdjvp.exec:\pdjvp.exe90⤵PID:3508
-
\??\c:\rxffrrl.exec:\rxffrrl.exe91⤵PID:2744
-
\??\c:\hbhbtt.exec:\hbhbtt.exe92⤵PID:3400
-
\??\c:\nhhbtn.exec:\nhhbtn.exe93⤵PID:1204
-
\??\c:\ddvpd.exec:\ddvpd.exe94⤵PID:4424
-
\??\c:\rfxxrrl.exec:\rfxxrrl.exe95⤵PID:4496
-
\??\c:\tbbbtt.exec:\tbbbtt.exe96⤵PID:1816
-
\??\c:\bbthtt.exec:\bbthtt.exe97⤵PID:3688
-
\??\c:\dddvd.exec:\dddvd.exe98⤵PID:1136
-
\??\c:\ffrlffx.exec:\ffrlffx.exe99⤵PID:5076
-
\??\c:\nnbttt.exec:\nnbttt.exe100⤵PID:4960
-
\??\c:\vvpjv.exec:\vvpjv.exe101⤵PID:2040
-
\??\c:\1lfrrlf.exec:\1lfrrlf.exe102⤵PID:516
-
\??\c:\nbbtbt.exec:\nbbtbt.exe103⤵PID:4540
-
\??\c:\dpdvp.exec:\dpdvp.exe104⤵PID:220
-
\??\c:\vvjvp.exec:\vvjvp.exe105⤵PID:4640
-
\??\c:\fxfxrll.exec:\fxfxrll.exe106⤵PID:3584
-
\??\c:\htttnn.exec:\htttnn.exe107⤵PID:4188
-
\??\c:\pvjvv.exec:\pvjvv.exe108⤵PID:3140
-
\??\c:\xlxrrll.exec:\xlxrrll.exe109⤵PID:1852
-
\??\c:\hbnhbt.exec:\hbnhbt.exe110⤵PID:1228
-
\??\c:\pjddv.exec:\pjddv.exe111⤵PID:4232
-
\??\c:\xrrrlfx.exec:\xrrrlfx.exe112⤵PID:520
-
\??\c:\flrfxrl.exec:\flrfxrl.exe113⤵PID:4088
-
\??\c:\bnthbt.exec:\bnthbt.exe114⤵PID:928
-
\??\c:\7pvvv.exec:\7pvvv.exe115⤵PID:2672
-
\??\c:\vvjdv.exec:\vvjdv.exe116⤵PID:2764
-
\??\c:\flrxxff.exec:\flrxxff.exe117⤵PID:3204
-
\??\c:\3tnbtt.exec:\3tnbtt.exe118⤵PID:4280
-
\??\c:\9djvp.exec:\9djvp.exe119⤵PID:812
-
\??\c:\xllfffx.exec:\xllfffx.exe120⤵PID:1416
-
\??\c:\rrfxxrr.exec:\rrfxxrr.exe121⤵PID:4004
-
\??\c:\nnnhhb.exec:\nnnhhb.exe122⤵PID:540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-