Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-12-2024 00:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b0db86b53327b0bdb2003783bdd7ef8b7b4dcd5a112e1e44f8052b40c5625cf7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b0db86b53327b0bdb2003783bdd7ef8b7b4dcd5a112e1e44f8052b40c5625cf7.exe
-
Size
452KB
-
MD5
45115564f4bb5a0b7b752ba5b37bf35f
-
SHA1
c1df5882aca87af580cd84719e329d7dceb69186
-
SHA256
b0db86b53327b0bdb2003783bdd7ef8b7b4dcd5a112e1e44f8052b40c5625cf7
-
SHA512
1c09d280a778b947cb926aa725c8295cdcd1ccc2059cfb4128767f2b1a61812b598dd3be0fdb9bef3095fe35b2222d1913ff73e453b93b378a09c922c4c8b22f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe8:q7Tc2NYHUrAwfMp3CD8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/404-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2012-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2524-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3788-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3140-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/888-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/592-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3788-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1572-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-674-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-756-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-967-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2916-1044-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4248-1379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/888-1684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4996 btnhhh.exe 3764 vdjpp.exe 2352 3ffllxx.exe 2012 hbtthh.exe 4864 rxrfflr.exe 2848 djvvv.exe 3504 ddppv.exe 4212 lxrrxff.exe 2892 1vpvd.exe 4888 djjpp.exe 2944 ttnnnt.exe 2648 hhttbh.exe 2080 dvddp.exe 3020 tnhbbh.exe 2292 pvpdv.exe 3736 9flrrff.exe 1144 bbtntn.exe 4324 dpvpp.exe 3168 tbbhnb.exe 3416 jvddj.exe 2524 hhttbb.exe 2360 vpjdj.exe 2704 ffxrxxr.exe 4200 thbtnb.exe 4424 ddddd.exe 2112 pvjjv.exe 3788 vjppj.exe 3356 vdpvv.exe 2768 9vppv.exe 4208 bnbhhh.exe 1224 tbbtnt.exe 2400 flrxxlr.exe 4668 1tbtnn.exe 4620 7lrrfrr.exe 4456 hbbbtt.exe 372 pvjjv.exe 3652 dvvdj.exe 3772 3frrllx.exe 2376 hhntnb.exe 4636 djjjd.exe 2368 vpddv.exe 3140 3llfxrl.exe 4348 1tnbbb.exe 2644 jjjpp.exe 4020 tthnnt.exe 4500 dddvp.exe 2352 pvvdd.exe 60 xrxxfll.exe 3500 tbhhhn.exe 4232 vjjvp.exe 4064 ffrrrxx.exe 3488 tnbttt.exe 3496 vvjvd.exe 1860 ddjpv.exe 4392 xfrrxfl.exe 888 7thnnb.exe 3948 jpvdd.exe 4836 lxxlxff.exe 1696 9bhbbb.exe 4388 btbtbt.exe 1992 jdppp.exe 2544 xlfxxxr.exe 1088 nhbbtt.exe 2080 dvddd.exe -
resource yara_rule behavioral2/memory/404-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2012-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2524-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3788-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3140-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/888-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/592-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3788-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1572-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-967-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-980-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 404 wrote to memory of 4996 404 b0db86b53327b0bdb2003783bdd7ef8b7b4dcd5a112e1e44f8052b40c5625cf7.exe 82 PID 404 wrote to memory of 4996 404 b0db86b53327b0bdb2003783bdd7ef8b7b4dcd5a112e1e44f8052b40c5625cf7.exe 82 PID 404 wrote to memory of 4996 404 b0db86b53327b0bdb2003783bdd7ef8b7b4dcd5a112e1e44f8052b40c5625cf7.exe 82 PID 4996 wrote to memory of 3764 4996 btnhhh.exe 83 PID 4996 wrote to memory of 3764 4996 btnhhh.exe 83 PID 4996 wrote to memory of 3764 4996 btnhhh.exe 83 PID 3764 wrote to memory of 2352 3764 vdjpp.exe 84 PID 3764 wrote to memory of 2352 3764 vdjpp.exe 84 PID 3764 wrote to memory of 2352 3764 vdjpp.exe 84 PID 2352 wrote to memory of 2012 2352 3ffllxx.exe 85 PID 2352 wrote to memory of 2012 2352 3ffllxx.exe 85 PID 2352 wrote to memory of 2012 2352 3ffllxx.exe 85 PID 2012 wrote to memory of 4864 2012 hbtthh.exe 86 PID 2012 wrote to memory of 4864 2012 hbtthh.exe 86 PID 2012 wrote to memory of 4864 2012 hbtthh.exe 86 PID 4864 wrote to memory of 2848 4864 rxrfflr.exe 87 PID 4864 wrote to memory of 2848 4864 rxrfflr.exe 87 PID 4864 wrote to memory of 2848 4864 rxrfflr.exe 87 PID 2848 wrote to memory of 3504 2848 djvvv.exe 88 PID 2848 wrote to memory of 3504 2848 djvvv.exe 88 PID 2848 wrote to memory of 3504 2848 djvvv.exe 88 PID 3504 wrote to memory of 4212 3504 ddppv.exe 89 PID 3504 wrote to memory of 4212 3504 ddppv.exe 89 PID 3504 wrote to memory of 4212 3504 ddppv.exe 89 PID 4212 wrote to memory of 2892 4212 lxrrxff.exe 90 PID 4212 wrote to memory of 2892 4212 lxrrxff.exe 90 PID 4212 wrote to memory of 2892 4212 lxrrxff.exe 90 PID 2892 wrote to memory of 4888 2892 1vpvd.exe 91 PID 2892 wrote to memory of 4888 2892 1vpvd.exe 91 PID 2892 wrote to memory of 4888 2892 1vpvd.exe 91 PID 4888 wrote to memory of 2944 4888 djjpp.exe 92 PID 4888 wrote to memory of 2944 4888 djjpp.exe 92 PID 4888 wrote to memory of 2944 4888 djjpp.exe 92 PID 2944 wrote to memory of 2648 2944 ttnnnt.exe 93 PID 2944 wrote to memory of 2648 2944 ttnnnt.exe 93 PID 2944 wrote to memory of 2648 2944 ttnnnt.exe 93 PID 2648 wrote to memory of 2080 2648 hhttbh.exe 94 PID 2648 wrote to memory of 2080 2648 hhttbh.exe 94 PID 2648 wrote to memory of 2080 2648 hhttbh.exe 94 PID 2080 wrote to memory of 3020 2080 dvddp.exe 95 PID 2080 wrote to memory of 3020 2080 dvddp.exe 95 PID 2080 wrote to memory of 3020 2080 dvddp.exe 95 PID 3020 wrote to memory of 2292 3020 tnhbbh.exe 96 PID 3020 wrote to memory of 2292 3020 tnhbbh.exe 96 PID 3020 wrote to memory of 2292 3020 tnhbbh.exe 96 PID 2292 wrote to memory of 3736 2292 pvpdv.exe 97 PID 2292 wrote to memory of 3736 2292 pvpdv.exe 97 PID 2292 wrote to memory of 3736 2292 pvpdv.exe 97 PID 3736 wrote to memory of 1144 3736 9flrrff.exe 98 PID 3736 wrote to memory of 1144 3736 9flrrff.exe 98 PID 3736 wrote to memory of 1144 3736 9flrrff.exe 98 PID 1144 wrote to memory of 4324 1144 bbtntn.exe 99 PID 1144 wrote to memory of 4324 1144 bbtntn.exe 99 PID 1144 wrote to memory of 4324 1144 bbtntn.exe 99 PID 4324 wrote to memory of 3168 4324 dpvpp.exe 100 PID 4324 wrote to memory of 3168 4324 dpvpp.exe 100 PID 4324 wrote to memory of 3168 4324 dpvpp.exe 100 PID 3168 wrote to memory of 3416 3168 tbbhnb.exe 101 PID 3168 wrote to memory of 3416 3168 tbbhnb.exe 101 PID 3168 wrote to memory of 3416 3168 tbbhnb.exe 101 PID 3416 wrote to memory of 2524 3416 jvddj.exe 102 PID 3416 wrote to memory of 2524 3416 jvddj.exe 102 PID 3416 wrote to memory of 2524 3416 jvddj.exe 102 PID 2524 wrote to memory of 2360 2524 hhttbb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0db86b53327b0bdb2003783bdd7ef8b7b4dcd5a112e1e44f8052b40c5625cf7.exe"C:\Users\Admin\AppData\Local\Temp\b0db86b53327b0bdb2003783bdd7ef8b7b4dcd5a112e1e44f8052b40c5625cf7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\btnhhh.exec:\btnhhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\vdjpp.exec:\vdjpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\3ffllxx.exec:\3ffllxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\hbtthh.exec:\hbtthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\rxrfflr.exec:\rxrfflr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\djvvv.exec:\djvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\ddppv.exec:\ddppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\lxrrxff.exec:\lxrrxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\1vpvd.exec:\1vpvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\djjpp.exec:\djjpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\ttnnnt.exec:\ttnnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\hhttbh.exec:\hhttbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\dvddp.exec:\dvddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\tnhbbh.exec:\tnhbbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\pvpdv.exec:\pvpdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\9flrrff.exec:\9flrrff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\bbtntn.exec:\bbtntn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\dpvpp.exec:\dpvpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\tbbhnb.exec:\tbbhnb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\jvddj.exec:\jvddj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\hhttbb.exec:\hhttbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\vpjdj.exec:\vpjdj.exe23⤵
- Executes dropped EXE
PID:2360 -
\??\c:\ffxrxxr.exec:\ffxrxxr.exe24⤵
- Executes dropped EXE
PID:2704 -
\??\c:\thbtnb.exec:\thbtnb.exe25⤵
- Executes dropped EXE
PID:4200 -
\??\c:\ddddd.exec:\ddddd.exe26⤵
- Executes dropped EXE
PID:4424 -
\??\c:\pvjjv.exec:\pvjjv.exe27⤵
- Executes dropped EXE
PID:2112 -
\??\c:\vjppj.exec:\vjppj.exe28⤵
- Executes dropped EXE
PID:3788 -
\??\c:\vdpvv.exec:\vdpvv.exe29⤵
- Executes dropped EXE
PID:3356 -
\??\c:\9vppv.exec:\9vppv.exe30⤵
- Executes dropped EXE
PID:2768 -
\??\c:\bnbhhh.exec:\bnbhhh.exe31⤵
- Executes dropped EXE
PID:4208 -
\??\c:\tbbtnt.exec:\tbbtnt.exe32⤵
- Executes dropped EXE
PID:1224 -
\??\c:\flrxxlr.exec:\flrxxlr.exe33⤵
- Executes dropped EXE
PID:2400 -
\??\c:\1tbtnn.exec:\1tbtnn.exe34⤵
- Executes dropped EXE
PID:4668 -
\??\c:\7lrrfrr.exec:\7lrrfrr.exe35⤵
- Executes dropped EXE
PID:4620 -
\??\c:\hbbbtt.exec:\hbbbtt.exe36⤵
- Executes dropped EXE
PID:4456 -
\??\c:\pvjjv.exec:\pvjjv.exe37⤵
- Executes dropped EXE
PID:372 -
\??\c:\dvvdj.exec:\dvvdj.exe38⤵
- Executes dropped EXE
PID:3652 -
\??\c:\3frrllx.exec:\3frrllx.exe39⤵
- Executes dropped EXE
PID:3772 -
\??\c:\hhntnb.exec:\hhntnb.exe40⤵
- Executes dropped EXE
PID:2376 -
\??\c:\djjjd.exec:\djjjd.exe41⤵
- Executes dropped EXE
PID:4636 -
\??\c:\vpddv.exec:\vpddv.exe42⤵
- Executes dropped EXE
PID:2368 -
\??\c:\3llfxrl.exec:\3llfxrl.exe43⤵
- Executes dropped EXE
PID:3140 -
\??\c:\1tnbbb.exec:\1tnbbb.exe44⤵
- Executes dropped EXE
PID:4348 -
\??\c:\jjjpp.exec:\jjjpp.exe45⤵
- Executes dropped EXE
PID:2644 -
\??\c:\tthnnt.exec:\tthnnt.exe46⤵
- Executes dropped EXE
PID:4020 -
\??\c:\dddvp.exec:\dddvp.exe47⤵
- Executes dropped EXE
PID:4500 -
\??\c:\pvvdd.exec:\pvvdd.exe48⤵
- Executes dropped EXE
PID:2352 -
\??\c:\xrxxfll.exec:\xrxxfll.exe49⤵
- Executes dropped EXE
PID:60 -
\??\c:\tbhhhn.exec:\tbhhhn.exe50⤵
- Executes dropped EXE
PID:3500 -
\??\c:\vjjvp.exec:\vjjvp.exe51⤵
- Executes dropped EXE
PID:4232 -
\??\c:\ffrrrxx.exec:\ffrrrxx.exe52⤵
- Executes dropped EXE
PID:4064 -
\??\c:\tnbttt.exec:\tnbttt.exe53⤵
- Executes dropped EXE
PID:3488 -
\??\c:\vvjvd.exec:\vvjvd.exe54⤵
- Executes dropped EXE
PID:3496 -
\??\c:\ddjpv.exec:\ddjpv.exe55⤵
- Executes dropped EXE
PID:1860 -
\??\c:\xfrrxfl.exec:\xfrrxfl.exe56⤵
- Executes dropped EXE
PID:4392 -
\??\c:\7thnnb.exec:\7thnnb.exe57⤵
- Executes dropped EXE
PID:888 -
\??\c:\jpvdd.exec:\jpvdd.exe58⤵
- Executes dropped EXE
PID:3948 -
\??\c:\lxxlxff.exec:\lxxlxff.exe59⤵
- Executes dropped EXE
PID:4836 -
\??\c:\9bhbbb.exec:\9bhbbb.exe60⤵
- Executes dropped EXE
PID:1696 -
\??\c:\btbtbt.exec:\btbtbt.exe61⤵
- Executes dropped EXE
PID:4388 -
\??\c:\jdppp.exec:\jdppp.exe62⤵
- Executes dropped EXE
PID:1992 -
\??\c:\xlfxxxr.exec:\xlfxxxr.exe63⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nhbbtt.exec:\nhbbtt.exe64⤵
- Executes dropped EXE
PID:1088 -
\??\c:\dvddd.exec:\dvddd.exe65⤵
- Executes dropped EXE
PID:2080 -
\??\c:\rrfflll.exec:\rrfflll.exe66⤵PID:2452
-
\??\c:\hhbbhn.exec:\hhbbhn.exe67⤵PID:592
-
\??\c:\9pdvv.exec:\9pdvv.exe68⤵PID:3736
-
\??\c:\fxllxff.exec:\fxllxff.exe69⤵PID:232
-
\??\c:\xrflfll.exec:\xrflfll.exe70⤵PID:2300
-
\??\c:\7htbbn.exec:\7htbbn.exe71⤵PID:5016
-
\??\c:\jddvp.exec:\jddvp.exe72⤵PID:1116
-
\??\c:\9flfxxx.exec:\9flfxxx.exe73⤵PID:4040
-
\??\c:\hbhhnb.exec:\hbhhnb.exe74⤵PID:3416
-
\??\c:\bthhhn.exec:\bthhhn.exe75⤵PID:4868
-
\??\c:\jdjjd.exec:\jdjjd.exe76⤵PID:3936
-
\??\c:\xxlrrxx.exec:\xxlrrxx.exe77⤵PID:2360
-
\??\c:\hhtbbn.exec:\hhtbbn.exe78⤵PID:2496
-
\??\c:\vjpjv.exec:\vjpjv.exe79⤵PID:3364
-
\??\c:\rrrlxxf.exec:\rrrlxxf.exe80⤵PID:1604
-
\??\c:\7bhhhn.exec:\7bhhhn.exe81⤵PID:4400
-
\??\c:\dvvdj.exec:\dvvdj.exe82⤵PID:4216
-
\??\c:\dvddd.exec:\dvddd.exe83⤵PID:212
-
\??\c:\llxrrfx.exec:\llxrrfx.exe84⤵PID:1772
-
\??\c:\nnttbb.exec:\nnttbb.exe85⤵PID:3788
-
\??\c:\jdpjd.exec:\jdpjd.exe86⤵PID:1572
-
\??\c:\xrrlffl.exec:\xrrlffl.exe87⤵PID:2188
-
\??\c:\htbttn.exec:\htbttn.exe88⤵PID:2700
-
\??\c:\dvvvj.exec:\dvvvj.exe89⤵PID:2088
-
\??\c:\jjpjj.exec:\jjpjj.exe90⤵PID:4208
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe91⤵PID:3172
-
\??\c:\bnhhbb.exec:\bnhhbb.exe92⤵PID:624
-
\??\c:\vvddd.exec:\vvddd.exe93⤵PID:2400
-
\??\c:\jdddd.exec:\jdddd.exe94⤵PID:5008
-
\??\c:\xlfxlxr.exec:\xlfxlxr.exe95⤵PID:3600
-
\??\c:\tnbhbt.exec:\tnbhbt.exe96⤵PID:632
-
\??\c:\7pppj.exec:\7pppj.exe97⤵PID:4932
-
\??\c:\xxlllrx.exec:\xxlllrx.exe98⤵PID:3992
-
\??\c:\lxlfrrx.exec:\lxlfrrx.exe99⤵PID:3692
-
\??\c:\hhttbb.exec:\hhttbb.exe100⤵PID:3772
-
\??\c:\ppvdj.exec:\ppvdj.exe101⤵PID:2376
-
\??\c:\vvvpp.exec:\vvvpp.exe102⤵PID:3348
-
\??\c:\7lllfff.exec:\7lllfff.exe103⤵PID:4276
-
\??\c:\bhnnht.exec:\bhnnht.exe104⤵PID:4284
-
\??\c:\ddvdp.exec:\ddvdp.exe105⤵PID:404
-
\??\c:\flxxxfx.exec:\flxxxfx.exe106⤵PID:3924
-
\??\c:\hnnnnh.exec:\hnnnnh.exe107⤵PID:4996
-
\??\c:\djdvj.exec:\djdvj.exe108⤵PID:5104
-
\??\c:\fxlfflf.exec:\fxlfflf.exe109⤵PID:4436
-
\??\c:\tbnnhh.exec:\tbnnhh.exe110⤵PID:1584
-
\??\c:\ppvdv.exec:\ppvdv.exe111⤵PID:4688
-
\??\c:\lflfrrr.exec:\lflfrrr.exe112⤵PID:4404
-
\??\c:\ttnnbb.exec:\ttnnbb.exe113⤵PID:1640
-
\??\c:\ddppv.exec:\ddppv.exe114⤵PID:2520
-
\??\c:\dvddv.exec:\dvddv.exe115⤵PID:2848
-
\??\c:\xxlfxlf.exec:\xxlfxlf.exe116⤵PID:4268
-
\??\c:\tbttnt.exec:\tbttnt.exe117⤵PID:4796
-
\??\c:\jddpd.exec:\jddpd.exe118⤵PID:3468
-
\??\c:\fxlllrr.exec:\fxlllrr.exe119⤵PID:1148
-
\??\c:\llrrrfx.exec:\llrrrfx.exe120⤵PID:2180
-
\??\c:\nbnnnt.exec:\nbnnnt.exe121⤵PID:8
-
\??\c:\9dvvp.exec:\9dvvp.exe122⤵PID:4272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-