Analysis
-
max time kernel
120s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 15:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15N.exe
-
Size
456KB
-
MD5
abc45e7e40bded452877935ebac8a4f0
-
SHA1
777244ab61d2fcb45f499325cc8e615aafe55560
-
SHA256
86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15
-
SHA512
bbda582bbaff8c3fa546bebaff30223bc84b8539104c40b53bd91fd31f346c04c6f89048c4e991aa9eee9a19dd03d8766b6a775b5b52aa301d15e18cd87138c4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRl:q7Tc2NYHUrAwfMp3CDRl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1668-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1344-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3368-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2988-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/704-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-661-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-828-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-916-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-1093-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-1608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1676 bttnhh.exe 1344 fxlfffx.exe 3508 tbnntb.exe 4604 xxffrrr.exe 3376 tbhhbh.exe 3024 pvddd.exe 5024 llrllll.exe 2184 pjjdv.exe 3368 bthhnn.exe 628 3pvvd.exe 5004 dvvdd.exe 972 7rffxrl.exe 2788 hhhnhn.exe 636 bbtttb.exe 3996 jdjjj.exe 3012 bhhhhh.exe 2988 7xxrrrl.exe 2052 bbtnhh.exe 1984 lfrlllf.exe 4512 bnnnnt.exe 1192 ffxxrll.exe 4632 jpjdv.exe 1904 vddpv.exe 1656 hnbbtt.exe 4840 flflfxr.exe 1048 ntntth.exe 5020 hhbbtt.exe 4624 frfxrrx.exe 832 pvvvv.exe 5116 vjjpj.exe 844 xfxxxxl.exe 404 djvpj.exe 216 jjppj.exe 1252 rlrxrlx.exe 704 3tnhbb.exe 928 ppvvp.exe 4008 xxrxrxx.exe 1760 1ttttt.exe 4344 vpvvv.exe 2064 llfllfx.exe 8 ntbtnn.exe 4496 ddjvp.exe 760 rrllfff.exe 3508 7tbhhn.exe 4364 jpdvj.exe 3308 ffffxrr.exe 1608 nnhtnb.exe 116 pdppp.exe 4804 frxrllf.exe 4280 xffrxxx.exe 2492 5hbthh.exe 408 pvjdv.exe 2284 5frrllf.exe 1528 tbhhhn.exe 2440 jjjdd.exe 628 jjjjj.exe 1808 9rxrrrr.exe 2872 bhhhnh.exe 972 5ddvv.exe 5048 xrfxflf.exe 4600 1ntnbb.exe 1968 nhnhhh.exe 2188 jjdvp.exe 1280 frxfffx.exe -
resource yara_rule behavioral2/memory/1668-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1344-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2988-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/704-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-665-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1668 wrote to memory of 1676 1668 86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15N.exe 83 PID 1668 wrote to memory of 1676 1668 86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15N.exe 83 PID 1668 wrote to memory of 1676 1668 86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15N.exe 83 PID 1676 wrote to memory of 1344 1676 bttnhh.exe 84 PID 1676 wrote to memory of 1344 1676 bttnhh.exe 84 PID 1676 wrote to memory of 1344 1676 bttnhh.exe 84 PID 1344 wrote to memory of 3508 1344 fxlfffx.exe 85 PID 1344 wrote to memory of 3508 1344 fxlfffx.exe 85 PID 1344 wrote to memory of 3508 1344 fxlfffx.exe 85 PID 3508 wrote to memory of 4604 3508 tbnntb.exe 86 PID 3508 wrote to memory of 4604 3508 tbnntb.exe 86 PID 3508 wrote to memory of 4604 3508 tbnntb.exe 86 PID 4604 wrote to memory of 3376 4604 xxffrrr.exe 87 PID 4604 wrote to memory of 3376 4604 xxffrrr.exe 87 PID 4604 wrote to memory of 3376 4604 xxffrrr.exe 87 PID 3376 wrote to memory of 3024 3376 tbhhbh.exe 88 PID 3376 wrote to memory of 3024 3376 tbhhbh.exe 88 PID 3376 wrote to memory of 3024 3376 tbhhbh.exe 88 PID 3024 wrote to memory of 5024 3024 pvddd.exe 89 PID 3024 wrote to memory of 5024 3024 pvddd.exe 89 PID 3024 wrote to memory of 5024 3024 pvddd.exe 89 PID 5024 wrote to memory of 2184 5024 llrllll.exe 90 PID 5024 wrote to memory of 2184 5024 llrllll.exe 90 PID 5024 wrote to memory of 2184 5024 llrllll.exe 90 PID 2184 wrote to memory of 3368 2184 pjjdv.exe 91 PID 2184 wrote to memory of 3368 2184 pjjdv.exe 91 PID 2184 wrote to memory of 3368 2184 pjjdv.exe 91 PID 3368 wrote to memory of 628 3368 bthhnn.exe 92 PID 3368 wrote to memory of 628 3368 bthhnn.exe 92 PID 3368 wrote to memory of 628 3368 bthhnn.exe 92 PID 628 wrote to memory of 5004 628 3pvvd.exe 93 PID 628 wrote to memory of 5004 628 3pvvd.exe 93 PID 628 wrote to memory of 5004 628 3pvvd.exe 93 PID 5004 wrote to memory of 972 5004 dvvdd.exe 94 PID 5004 wrote to memory of 972 5004 dvvdd.exe 94 PID 5004 wrote to memory of 972 5004 dvvdd.exe 94 PID 972 wrote to memory of 2788 972 7rffxrl.exe 95 PID 972 wrote to memory of 2788 972 7rffxrl.exe 95 PID 972 wrote to memory of 2788 972 7rffxrl.exe 95 PID 2788 wrote to memory of 636 2788 hhhnhn.exe 96 PID 2788 wrote to memory of 636 2788 hhhnhn.exe 96 PID 2788 wrote to memory of 636 2788 hhhnhn.exe 96 PID 636 wrote to memory of 3996 636 bbtttb.exe 97 PID 636 wrote to memory of 3996 636 bbtttb.exe 97 PID 636 wrote to memory of 3996 636 bbtttb.exe 97 PID 3996 wrote to memory of 3012 3996 jdjjj.exe 98 PID 3996 wrote to memory of 3012 3996 jdjjj.exe 98 PID 3996 wrote to memory of 3012 3996 jdjjj.exe 98 PID 3012 wrote to memory of 2988 3012 bhhhhh.exe 99 PID 3012 wrote to memory of 2988 3012 bhhhhh.exe 99 PID 3012 wrote to memory of 2988 3012 bhhhhh.exe 99 PID 2988 wrote to memory of 2052 2988 7xxrrrl.exe 100 PID 2988 wrote to memory of 2052 2988 7xxrrrl.exe 100 PID 2988 wrote to memory of 2052 2988 7xxrrrl.exe 100 PID 2052 wrote to memory of 1984 2052 bbtnhh.exe 101 PID 2052 wrote to memory of 1984 2052 bbtnhh.exe 101 PID 2052 wrote to memory of 1984 2052 bbtnhh.exe 101 PID 1984 wrote to memory of 4512 1984 lfrlllf.exe 102 PID 1984 wrote to memory of 4512 1984 lfrlllf.exe 102 PID 1984 wrote to memory of 4512 1984 lfrlllf.exe 102 PID 4512 wrote to memory of 1192 4512 bnnnnt.exe 103 PID 4512 wrote to memory of 1192 4512 bnnnnt.exe 103 PID 4512 wrote to memory of 1192 4512 bnnnnt.exe 103 PID 1192 wrote to memory of 4632 1192 ffxxrll.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15N.exe"C:\Users\Admin\AppData\Local\Temp\86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\bttnhh.exec:\bttnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\fxlfffx.exec:\fxlfffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\tbnntb.exec:\tbnntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\xxffrrr.exec:\xxffrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\tbhhbh.exec:\tbhhbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\pvddd.exec:\pvddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\llrllll.exec:\llrllll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\pjjdv.exec:\pjjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\bthhnn.exec:\bthhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\3pvvd.exec:\3pvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\dvvdd.exec:\dvvdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\7rffxrl.exec:\7rffxrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\hhhnhn.exec:\hhhnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\bbtttb.exec:\bbtttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\jdjjj.exec:\jdjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\bhhhhh.exec:\bhhhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\7xxrrrl.exec:\7xxrrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\bbtnhh.exec:\bbtnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\lfrlllf.exec:\lfrlllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\bnnnnt.exec:\bnnnnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\ffxxrll.exec:\ffxxrll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\jpjdv.exec:\jpjdv.exe23⤵
- Executes dropped EXE
PID:4632 -
\??\c:\vddpv.exec:\vddpv.exe24⤵
- Executes dropped EXE
PID:1904 -
\??\c:\hnbbtt.exec:\hnbbtt.exe25⤵
- Executes dropped EXE
PID:1656 -
\??\c:\flflfxr.exec:\flflfxr.exe26⤵
- Executes dropped EXE
PID:4840 -
\??\c:\ntntth.exec:\ntntth.exe27⤵
- Executes dropped EXE
PID:1048 -
\??\c:\hhbbtt.exec:\hhbbtt.exe28⤵
- Executes dropped EXE
PID:5020 -
\??\c:\frfxrrx.exec:\frfxrrx.exe29⤵
- Executes dropped EXE
PID:4624 -
\??\c:\pvvvv.exec:\pvvvv.exe30⤵
- Executes dropped EXE
PID:832 -
\??\c:\vjjpj.exec:\vjjpj.exe31⤵
- Executes dropped EXE
PID:5116 -
\??\c:\xfxxxxl.exec:\xfxxxxl.exe32⤵
- Executes dropped EXE
PID:844 -
\??\c:\djvpj.exec:\djvpj.exe33⤵
- Executes dropped EXE
PID:404 -
\??\c:\jjppj.exec:\jjppj.exe34⤵
- Executes dropped EXE
PID:216 -
\??\c:\rlrxrlx.exec:\rlrxrlx.exe35⤵
- Executes dropped EXE
PID:1252 -
\??\c:\3tnhbb.exec:\3tnhbb.exe36⤵
- Executes dropped EXE
PID:704 -
\??\c:\ppvvp.exec:\ppvvp.exe37⤵
- Executes dropped EXE
PID:928 -
\??\c:\xxrxrxx.exec:\xxrxrxx.exe38⤵
- Executes dropped EXE
PID:4008 -
\??\c:\1ttttt.exec:\1ttttt.exe39⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vpvvv.exec:\vpvvv.exe40⤵
- Executes dropped EXE
PID:4344 -
\??\c:\llfllfx.exec:\llfllfx.exe41⤵
- Executes dropped EXE
PID:2064 -
\??\c:\ntbtnn.exec:\ntbtnn.exe42⤵
- Executes dropped EXE
PID:8 -
\??\c:\ddjvp.exec:\ddjvp.exe43⤵
- Executes dropped EXE
PID:4496 -
\??\c:\rrllfff.exec:\rrllfff.exe44⤵
- Executes dropped EXE
PID:760 -
\??\c:\7tbhhn.exec:\7tbhhn.exe45⤵
- Executes dropped EXE
PID:3508 -
\??\c:\jpdvj.exec:\jpdvj.exe46⤵
- Executes dropped EXE
PID:4364 -
\??\c:\ffffxrr.exec:\ffffxrr.exe47⤵
- Executes dropped EXE
PID:3308 -
\??\c:\nnhtnb.exec:\nnhtnb.exe48⤵
- Executes dropped EXE
PID:1608 -
\??\c:\pdppp.exec:\pdppp.exe49⤵
- Executes dropped EXE
PID:116 -
\??\c:\frxrllf.exec:\frxrllf.exe50⤵
- Executes dropped EXE
PID:4804 -
\??\c:\xffrxxx.exec:\xffrxxx.exe51⤵
- Executes dropped EXE
PID:4280 -
\??\c:\5hbthh.exec:\5hbthh.exe52⤵
- Executes dropped EXE
PID:2492 -
\??\c:\pvjdv.exec:\pvjdv.exe53⤵
- Executes dropped EXE
PID:408 -
\??\c:\5frrllf.exec:\5frrllf.exe54⤵
- Executes dropped EXE
PID:2284 -
\??\c:\tbhhhn.exec:\tbhhhn.exe55⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jjjdd.exec:\jjjdd.exe56⤵
- Executes dropped EXE
PID:2440 -
\??\c:\jjjjj.exec:\jjjjj.exe57⤵
- Executes dropped EXE
PID:628 -
\??\c:\9rxrrrr.exec:\9rxrrrr.exe58⤵
- Executes dropped EXE
PID:1808 -
\??\c:\bhhhnh.exec:\bhhhnh.exe59⤵
- Executes dropped EXE
PID:2872 -
\??\c:\5ddvv.exec:\5ddvv.exe60⤵
- Executes dropped EXE
PID:972 -
\??\c:\xrfxflf.exec:\xrfxflf.exe61⤵
- Executes dropped EXE
PID:5048 -
\??\c:\1ntnbb.exec:\1ntnbb.exe62⤵
- Executes dropped EXE
PID:4600 -
\??\c:\nhnhhh.exec:\nhnhhh.exe63⤵
- Executes dropped EXE
PID:1968 -
\??\c:\jjdvp.exec:\jjdvp.exe64⤵
- Executes dropped EXE
PID:2188 -
\??\c:\frxfffx.exec:\frxfffx.exe65⤵
- Executes dropped EXE
PID:1280 -
\??\c:\nhhhbb.exec:\nhhhbb.exe66⤵PID:2952
-
\??\c:\vpvvv.exec:\vpvvv.exe67⤵PID:2988
-
\??\c:\pvvvp.exec:\pvvvp.exe68⤵PID:1632
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe69⤵PID:3152
-
\??\c:\3hhhbh.exec:\3hhhbh.exe70⤵PID:2500
-
\??\c:\djjjd.exec:\djjjd.exe71⤵PID:4304
-
\??\c:\rfrxlxl.exec:\rfrxlxl.exe72⤵PID:2028
-
\??\c:\3nhhhh.exec:\3nhhhh.exe73⤵PID:4156
-
\??\c:\vvppp.exec:\vvppp.exe74⤵PID:3636
-
\??\c:\xlllflf.exec:\xlllflf.exe75⤵PID:4620
-
\??\c:\9nbbnn.exec:\9nbbnn.exe76⤵PID:3788
-
\??\c:\vdjjp.exec:\vdjjp.exe77⤵PID:3464
-
\??\c:\xxlxflr.exec:\xxlxflr.exe78⤵PID:1536
-
\??\c:\lrxxrxr.exec:\lrxxrxr.exe79⤵PID:1604
-
\??\c:\ttnhbb.exec:\ttnhbb.exe80⤵PID:4884
-
\??\c:\jdppp.exec:\jdppp.exe81⤵PID:5020
-
\??\c:\9xfxxfx.exec:\9xfxxfx.exe82⤵PID:2152
-
\??\c:\1bnhhh.exec:\1bnhhh.exe83⤵PID:4612
-
\??\c:\djppj.exec:\djppj.exe84⤵PID:5116
-
\??\c:\flfrlll.exec:\flfrlll.exe85⤵PID:448
-
\??\c:\hhnhhh.exec:\hhnhhh.exe86⤵PID:844
-
\??\c:\ppddj.exec:\ppddj.exe87⤵PID:3324
-
\??\c:\jpppp.exec:\jpppp.exe88⤵PID:1620
-
\??\c:\ffllrrl.exec:\ffllrrl.exe89⤵PID:4368
-
\??\c:\nnnhbb.exec:\nnnhbb.exe90⤵PID:3884
-
\??\c:\ddddd.exec:\ddddd.exe91⤵PID:4392
-
\??\c:\xxrlrxl.exec:\xxrlrxl.exe92⤵PID:704
-
\??\c:\1xrrrrr.exec:\1xrrrrr.exe93⤵PID:4444
-
\??\c:\tbhbtt.exec:\tbhbtt.exe94⤵PID:1804
-
\??\c:\vpdvp.exec:\vpdvp.exe95⤵PID:4348
-
\??\c:\rrflllf.exec:\rrflllf.exe96⤵PID:2420
-
\??\c:\bbttnn.exec:\bbttnn.exe97⤵PID:4332
-
\??\c:\pjvpj.exec:\pjvpj.exe98⤵PID:5092
-
\??\c:\5rxrrrl.exec:\5rxrrrl.exe99⤵PID:3360
-
\??\c:\tbtnbb.exec:\tbtnbb.exe100⤵PID:3616
-
\??\c:\vppjj.exec:\vppjj.exe101⤵PID:4256
-
\??\c:\llxrrrl.exec:\llxrrrl.exe102⤵PID:3604
-
\??\c:\httnbb.exec:\httnbb.exe103⤵PID:760
-
\??\c:\djpjd.exec:\djpjd.exe104⤵PID:3508
-
\??\c:\dvdvp.exec:\dvdvp.exe105⤵PID:1400
-
\??\c:\xfllflx.exec:\xfllflx.exe106⤵PID:4640
-
\??\c:\hbbnnn.exec:\hbbnnn.exe107⤵PID:2640
-
\??\c:\jvdvv.exec:\jvdvv.exe108⤵PID:2612
-
\??\c:\fxlfxrl.exec:\fxlfxrl.exe109⤵PID:3024
-
\??\c:\llfrlxr.exec:\llfrlxr.exe110⤵PID:1208
-
\??\c:\9bhbbh.exec:\9bhbbh.exe111⤵PID:2160
-
\??\c:\9vddj.exec:\9vddj.exe112⤵PID:4864
-
\??\c:\lxxrllf.exec:\lxxrllf.exe113⤵PID:1640
-
\??\c:\hhtttt.exec:\hhtttt.exe114⤵PID:4524
-
\??\c:\vvpjj.exec:\vvpjj.exe115⤵PID:4308
-
\??\c:\pjdjp.exec:\pjdjp.exe116⤵PID:1516
-
\??\c:\lllxrrl.exec:\lllxrrl.exe117⤵PID:5004
-
\??\c:\ntttbt.exec:\ntttbt.exe118⤵PID:4124
-
\??\c:\dddvp.exec:\dddvp.exe119⤵PID:2076
-
\??\c:\rrrllll.exec:\rrrllll.exe120⤵PID:2596
-
\??\c:\9rxrrrl.exec:\9rxrrrl.exe121⤵PID:1544
-
\??\c:\5tttnn.exec:\5tttnn.exe122⤵PID:3996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-