Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 22:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
26b4bbe783d77b1d5f2a039c546c1d72d42ba38e8e5e56f55a251af72982bb71.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
26b4bbe783d77b1d5f2a039c546c1d72d42ba38e8e5e56f55a251af72982bb71.exe
-
Size
456KB
-
MD5
a03453537332aac2cf2583f7d3231a76
-
SHA1
2f704022dd4c0e3080e8fcd801644de660540697
-
SHA256
26b4bbe783d77b1d5f2a039c546c1d72d42ba38e8e5e56f55a251af72982bb71
-
SHA512
b9123e847b2e62dd76dca9fb0bd9a38491eb8e4cc4af4af21fd206ae89947e0f4d07cf221c75e612e5e85c1c4dc1e22d654ed42c238c23abedc6cd6fc2163c2e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRs:q7Tc2NYHUrAwfMp3CDRs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1172-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1148-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/800-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-683-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-708-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-718-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-783-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1860 bttnbn.exe 3048 7pdpd.exe 8 9nhthb.exe 3164 dvvpp.exe 1432 7lrrlfx.exe 4984 7tnnhb.exe 3192 fxfxfxf.exe 1508 5pvpj.exe 4572 lflrlfr.exe 2544 3vpdv.exe 4856 3lxlrll.exe 4868 lxrfffx.exe 4944 xrxlxrl.exe 3596 9jpdd.exe 2136 5fflxrf.exe 3456 frlxllx.exe 1204 jvdpp.exe 400 7fxlxxf.exe 2208 thbnbb.exe 2352 frxlfxl.exe 1148 ththtn.exe 4404 pjvjv.exe 3200 5rxlxrf.exe 4724 jjjvp.exe 800 3xxrffx.exe 2596 jdvjv.exe 3480 1djvv.exe 2484 1hhthb.exe 3728 7vjdj.exe 4652 5pvjp.exe 980 7rlxlfr.exe 3360 5vpdv.exe 4660 xxxlfrx.exe 4188 xffrfxl.exe 3252 tbbnbt.exe 2328 1vjdv.exe 4576 5llfxrl.exe 2036 hbtnnh.exe 3940 3dvdp.exe 4752 7nhtnh.exe 1416 7hhthb.exe 4420 pjpdp.exe 2396 frllxff.exe 4716 dpvjd.exe 3668 fllxrfx.exe 4820 ntnhbb.exe 752 ppppj.exe 1772 dvpjv.exe 2460 1lfxrlf.exe 4508 bbbthb.exe 2348 dddpj.exe 1548 jpvjv.exe 2528 rxfrxxl.exe 3468 7bnhhb.exe 3224 vjjpd.exe 4828 1ddpp.exe 876 fflxrlf.exe 1680 5tnthb.exe 4984 5pjvp.exe 2064 lxflrxf.exe 2768 frrlxxf.exe 4208 hnnhbh.exe 4832 5pvjd.exe 2144 5tbnhb.exe -
resource yara_rule behavioral2/memory/1172-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1432-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/800-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-708-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ththbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1172 wrote to memory of 1860 1172 26b4bbe783d77b1d5f2a039c546c1d72d42ba38e8e5e56f55a251af72982bb71.exe 82 PID 1172 wrote to memory of 1860 1172 26b4bbe783d77b1d5f2a039c546c1d72d42ba38e8e5e56f55a251af72982bb71.exe 82 PID 1172 wrote to memory of 1860 1172 26b4bbe783d77b1d5f2a039c546c1d72d42ba38e8e5e56f55a251af72982bb71.exe 82 PID 1860 wrote to memory of 3048 1860 bttnbn.exe 83 PID 1860 wrote to memory of 3048 1860 bttnbn.exe 83 PID 1860 wrote to memory of 3048 1860 bttnbn.exe 83 PID 3048 wrote to memory of 8 3048 7pdpd.exe 84 PID 3048 wrote to memory of 8 3048 7pdpd.exe 84 PID 3048 wrote to memory of 8 3048 7pdpd.exe 84 PID 8 wrote to memory of 3164 8 9nhthb.exe 85 PID 8 wrote to memory of 3164 8 9nhthb.exe 85 PID 8 wrote to memory of 3164 8 9nhthb.exe 85 PID 3164 wrote to memory of 1432 3164 dvvpp.exe 86 PID 3164 wrote to memory of 1432 3164 dvvpp.exe 86 PID 3164 wrote to memory of 1432 3164 dvvpp.exe 86 PID 1432 wrote to memory of 4984 1432 7lrrlfx.exe 87 PID 1432 wrote to memory of 4984 1432 7lrrlfx.exe 87 PID 1432 wrote to memory of 4984 1432 7lrrlfx.exe 87 PID 4984 wrote to memory of 3192 4984 7tnnhb.exe 88 PID 4984 wrote to memory of 3192 4984 7tnnhb.exe 88 PID 4984 wrote to memory of 3192 4984 7tnnhb.exe 88 PID 3192 wrote to memory of 1508 3192 fxfxfxf.exe 89 PID 3192 wrote to memory of 1508 3192 fxfxfxf.exe 89 PID 3192 wrote to memory of 1508 3192 fxfxfxf.exe 89 PID 1508 wrote to memory of 4572 1508 5pvpj.exe 90 PID 1508 wrote to memory of 4572 1508 5pvpj.exe 90 PID 1508 wrote to memory of 4572 1508 5pvpj.exe 90 PID 4572 wrote to memory of 2544 4572 lflrlfr.exe 91 PID 4572 wrote to memory of 2544 4572 lflrlfr.exe 91 PID 4572 wrote to memory of 2544 4572 lflrlfr.exe 91 PID 2544 wrote to memory of 4856 2544 3vpdv.exe 92 PID 2544 wrote to memory of 4856 2544 3vpdv.exe 92 PID 2544 wrote to memory of 4856 2544 3vpdv.exe 92 PID 4856 wrote to memory of 4868 4856 3lxlrll.exe 93 PID 4856 wrote to memory of 4868 4856 3lxlrll.exe 93 PID 4856 wrote to memory of 4868 4856 3lxlrll.exe 93 PID 4868 wrote to memory of 4944 4868 lxrfffx.exe 94 PID 4868 wrote to memory of 4944 4868 lxrfffx.exe 94 PID 4868 wrote to memory of 4944 4868 lxrfffx.exe 94 PID 4944 wrote to memory of 3596 4944 xrxlxrl.exe 95 PID 4944 wrote to memory of 3596 4944 xrxlxrl.exe 95 PID 4944 wrote to memory of 3596 4944 xrxlxrl.exe 95 PID 3596 wrote to memory of 2136 3596 9jpdd.exe 96 PID 3596 wrote to memory of 2136 3596 9jpdd.exe 96 PID 3596 wrote to memory of 2136 3596 9jpdd.exe 96 PID 2136 wrote to memory of 3456 2136 5fflxrf.exe 97 PID 2136 wrote to memory of 3456 2136 5fflxrf.exe 97 PID 2136 wrote to memory of 3456 2136 5fflxrf.exe 97 PID 3456 wrote to memory of 1204 3456 frlxllx.exe 98 PID 3456 wrote to memory of 1204 3456 frlxllx.exe 98 PID 3456 wrote to memory of 1204 3456 frlxllx.exe 98 PID 1204 wrote to memory of 400 1204 jvdpp.exe 99 PID 1204 wrote to memory of 400 1204 jvdpp.exe 99 PID 1204 wrote to memory of 400 1204 jvdpp.exe 99 PID 400 wrote to memory of 2208 400 7fxlxxf.exe 100 PID 400 wrote to memory of 2208 400 7fxlxxf.exe 100 PID 400 wrote to memory of 2208 400 7fxlxxf.exe 100 PID 2208 wrote to memory of 2352 2208 thbnbb.exe 101 PID 2208 wrote to memory of 2352 2208 thbnbb.exe 101 PID 2208 wrote to memory of 2352 2208 thbnbb.exe 101 PID 2352 wrote to memory of 1148 2352 frxlfxl.exe 102 PID 2352 wrote to memory of 1148 2352 frxlfxl.exe 102 PID 2352 wrote to memory of 1148 2352 frxlfxl.exe 102 PID 1148 wrote to memory of 4404 1148 ththtn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\26b4bbe783d77b1d5f2a039c546c1d72d42ba38e8e5e56f55a251af72982bb71.exe"C:\Users\Admin\AppData\Local\Temp\26b4bbe783d77b1d5f2a039c546c1d72d42ba38e8e5e56f55a251af72982bb71.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\bttnbn.exec:\bttnbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\7pdpd.exec:\7pdpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\9nhthb.exec:\9nhthb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\dvvpp.exec:\dvvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\7lrrlfx.exec:\7lrrlfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\7tnnhb.exec:\7tnnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\fxfxfxf.exec:\fxfxfxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\5pvpj.exec:\5pvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\lflrlfr.exec:\lflrlfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\3vpdv.exec:\3vpdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\3lxlrll.exec:\3lxlrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\lxrfffx.exec:\lxrfffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\xrxlxrl.exec:\xrxlxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\9jpdd.exec:\9jpdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\5fflxrf.exec:\5fflxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\frlxllx.exec:\frlxllx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\jvdpp.exec:\jvdpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\7fxlxxf.exec:\7fxlxxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\thbnbb.exec:\thbnbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\frxlfxl.exec:\frxlfxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\ththtn.exec:\ththtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\pjvjv.exec:\pjvjv.exe23⤵
- Executes dropped EXE
PID:4404 -
\??\c:\5rxlxrf.exec:\5rxlxrf.exe24⤵
- Executes dropped EXE
PID:3200 -
\??\c:\jjjvp.exec:\jjjvp.exe25⤵
- Executes dropped EXE
PID:4724 -
\??\c:\3xxrffx.exec:\3xxrffx.exe26⤵
- Executes dropped EXE
PID:800 -
\??\c:\jdvjv.exec:\jdvjv.exe27⤵
- Executes dropped EXE
PID:2596 -
\??\c:\1djvv.exec:\1djvv.exe28⤵
- Executes dropped EXE
PID:3480 -
\??\c:\1hhthb.exec:\1hhthb.exe29⤵
- Executes dropped EXE
PID:2484 -
\??\c:\7vjdj.exec:\7vjdj.exe30⤵
- Executes dropped EXE
PID:3728 -
\??\c:\5pvjp.exec:\5pvjp.exe31⤵
- Executes dropped EXE
PID:4652 -
\??\c:\7rlxlfr.exec:\7rlxlfr.exe32⤵
- Executes dropped EXE
PID:980 -
\??\c:\5vpdv.exec:\5vpdv.exe33⤵
- Executes dropped EXE
PID:3360 -
\??\c:\xxxlfrx.exec:\xxxlfrx.exe34⤵
- Executes dropped EXE
PID:4660 -
\??\c:\xffrfxl.exec:\xffrfxl.exe35⤵
- Executes dropped EXE
PID:4188 -
\??\c:\tbbnbt.exec:\tbbnbt.exe36⤵
- Executes dropped EXE
PID:3252 -
\??\c:\1vjdv.exec:\1vjdv.exe37⤵
- Executes dropped EXE
PID:2328 -
\??\c:\5llfxrl.exec:\5llfxrl.exe38⤵
- Executes dropped EXE
PID:4576 -
\??\c:\hbtnnh.exec:\hbtnnh.exe39⤵
- Executes dropped EXE
PID:2036 -
\??\c:\3dvdp.exec:\3dvdp.exe40⤵
- Executes dropped EXE
PID:3940 -
\??\c:\7nhtnh.exec:\7nhtnh.exe41⤵
- Executes dropped EXE
PID:4752 -
\??\c:\7hhthb.exec:\7hhthb.exe42⤵
- Executes dropped EXE
PID:1416 -
\??\c:\pjpdp.exec:\pjpdp.exe43⤵
- Executes dropped EXE
PID:4420 -
\??\c:\frllxff.exec:\frllxff.exe44⤵
- Executes dropped EXE
PID:2396 -
\??\c:\dpvjd.exec:\dpvjd.exe45⤵
- Executes dropped EXE
PID:4716 -
\??\c:\fllxrfx.exec:\fllxrfx.exe46⤵
- Executes dropped EXE
PID:3668 -
\??\c:\ntnhbb.exec:\ntnhbb.exe47⤵
- Executes dropped EXE
PID:4820 -
\??\c:\ppppj.exec:\ppppj.exe48⤵
- Executes dropped EXE
PID:752 -
\??\c:\dvpjv.exec:\dvpjv.exe49⤵
- Executes dropped EXE
PID:1772 -
\??\c:\1lfxrlf.exec:\1lfxrlf.exe50⤵
- Executes dropped EXE
PID:2460 -
\??\c:\bbbthb.exec:\bbbthb.exe51⤵
- Executes dropped EXE
PID:4508 -
\??\c:\dddpj.exec:\dddpj.exe52⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jpvjv.exec:\jpvjv.exe53⤵
- Executes dropped EXE
PID:1548 -
\??\c:\rxfrxxl.exec:\rxfrxxl.exe54⤵
- Executes dropped EXE
PID:2528 -
\??\c:\7bnhhb.exec:\7bnhhb.exe55⤵
- Executes dropped EXE
PID:3468 -
\??\c:\vjjpd.exec:\vjjpd.exe56⤵
- Executes dropped EXE
PID:3224 -
\??\c:\1ddpp.exec:\1ddpp.exe57⤵
- Executes dropped EXE
PID:4828 -
\??\c:\fflxrlf.exec:\fflxrlf.exe58⤵
- Executes dropped EXE
PID:876 -
\??\c:\5tnthb.exec:\5tnthb.exe59⤵
- Executes dropped EXE
PID:1680 -
\??\c:\5pjvp.exec:\5pjvp.exe60⤵
- Executes dropped EXE
PID:4984 -
\??\c:\lxflrxf.exec:\lxflrxf.exe61⤵
- Executes dropped EXE
PID:2064 -
\??\c:\frrlxxf.exec:\frrlxxf.exe62⤵
- Executes dropped EXE
PID:2768 -
\??\c:\hnnhbh.exec:\hnnhbh.exe63⤵
- Executes dropped EXE
PID:4208 -
\??\c:\5pvjd.exec:\5pvjd.exe64⤵
- Executes dropped EXE
PID:4832 -
\??\c:\5tbnhb.exec:\5tbnhb.exe65⤵
- Executes dropped EXE
PID:2144 -
\??\c:\thbntn.exec:\thbntn.exe66⤵PID:2608
-
\??\c:\vjjvj.exec:\vjjvj.exe67⤵PID:3064
-
\??\c:\5xlxrxl.exec:\5xlxrxl.exe68⤵PID:4940
-
\??\c:\nnnbnh.exec:\nnnbnh.exe69⤵PID:2088
-
\??\c:\vpddj.exec:\vpddj.exe70⤵PID:4924
-
\??\c:\xrxrfxr.exec:\xrxrfxr.exe71⤵PID:2868
-
\??\c:\rxrlxrf.exec:\rxrlxrf.exe72⤵PID:4840
-
\??\c:\hthbnh.exec:\hthbnh.exe73⤵PID:4472
-
\??\c:\jjdvd.exec:\jjdvd.exe74⤵PID:552
-
\??\c:\lrrfrlx.exec:\lrrfrlx.exe75⤵PID:1072
-
\??\c:\frlxrlf.exec:\frlxrlf.exe76⤵PID:4860
-
\??\c:\tbbnbn.exec:\tbbnbn.exe77⤵PID:632
-
\??\c:\5vjdp.exec:\5vjdp.exe78⤵PID:5016
-
\??\c:\1vpvd.exec:\1vpvd.exe79⤵PID:3532
-
\??\c:\1frrfxl.exec:\1frrfxl.exe80⤵PID:400
-
\??\c:\httnbt.exec:\httnbt.exe81⤵PID:1520
-
\??\c:\9jvpd.exec:\9jvpd.exe82⤵PID:4816
-
\??\c:\xxrxllf.exec:\xxrxllf.exe83⤵PID:3944
-
\??\c:\xllfrlf.exec:\xllfrlf.exe84⤵PID:4364
-
\??\c:\btbttn.exec:\btbttn.exe85⤵PID:5024
-
\??\c:\jvpvj.exec:\jvpvj.exe86⤵PID:3980
-
\??\c:\lrfxrlf.exec:\lrfxrlf.exe87⤵PID:4928
-
\??\c:\9rxlfxr.exec:\9rxlfxr.exe88⤵PID:3548
-
\??\c:\7bnbnn.exec:\7bnbnn.exe89⤵PID:536
-
\??\c:\djpvd.exec:\djpvd.exe90⤵PID:800
-
\??\c:\fxrfrlx.exec:\fxrfrlx.exe91⤵PID:728
-
\??\c:\hnthbt.exec:\hnthbt.exe92⤵PID:3500
-
\??\c:\hntnnh.exec:\hntnnh.exe93⤵PID:3480
-
\??\c:\jjdvj.exec:\jjdvj.exe94⤵PID:1220
-
\??\c:\rxxrfrf.exec:\rxxrfrf.exe95⤵PID:1932
-
\??\c:\7nnbtb.exec:\7nnbtb.exe96⤵PID:1512
-
\??\c:\bhtttb.exec:\bhtttb.exe97⤵PID:4844
-
\??\c:\vddpj.exec:\vddpj.exe98⤵PID:3964
-
\??\c:\lrfrxrf.exec:\lrfrxrf.exe99⤵PID:3540
-
\??\c:\nbnnnh.exec:\nbnnnh.exe100⤵PID:4660
-
\??\c:\dvpdp.exec:\dvpdp.exe101⤵PID:2232
-
\??\c:\jvdvp.exec:\jvdvp.exe102⤵PID:4780
-
\??\c:\rllrfrf.exec:\rllrfrf.exe103⤵PID:2292
-
\??\c:\bntnhb.exec:\bntnhb.exe104⤵PID:1664
-
\??\c:\htbnnh.exec:\htbnnh.exe105⤵PID:3008
-
\??\c:\pddjv.exec:\pddjv.exe106⤵PID:3936
-
\??\c:\xrfxxlx.exec:\xrfxxlx.exe107⤵PID:1592
-
\??\c:\1fxrfxr.exec:\1fxrfxr.exe108⤵PID:4352
-
\??\c:\7bbtbt.exec:\7bbtbt.exe109⤵PID:3112
-
\??\c:\3jvjp.exec:\3jvjp.exe110⤵PID:2264
-
\??\c:\3ddvd.exec:\3ddvd.exe111⤵PID:2396
-
\??\c:\rlxlrfl.exec:\rlxlrfl.exe112⤵PID:4892
-
\??\c:\nbthbt.exec:\nbthbt.exe113⤵PID:1484
-
\??\c:\pjjdp.exec:\pjjdp.exe114⤵PID:1244
-
\??\c:\9lfrfxl.exec:\9lfrfxl.exe115⤵PID:4380
-
\??\c:\lxfrllf.exec:\lxfrllf.exe116⤵PID:4480
-
\??\c:\vjjvj.exec:\vjjvj.exe117⤵PID:4568
-
\??\c:\vjvpj.exec:\vjvpj.exe118⤵PID:3396
-
\??\c:\xrlxfff.exec:\xrlxfff.exe119⤵PID:3048
-
\??\c:\hbhbtn.exec:\hbhbtn.exe120⤵PID:3232
-
\??\c:\ttthth.exec:\ttthth.exe121⤵PID:2900
-
\??\c:\vdddp.exec:\vdddp.exe122⤵PID:2440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-