Analysis
-
max time kernel
120s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 16:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe
-
Size
453KB
-
MD5
4a7c807614c9973ab3156b4538a13d2a
-
SHA1
d4b88b9d2a3146583e1c60642f3a09e82359cdd0
-
SHA256
baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f
-
SHA512
37fd621f2af3f4c6e6ac02cd413270e749dc0dd2925e04f1d3808515ebccc9ebd3fa0055611359e5d05e51147b4a06024e48dc6e9f34d813a03716f66561ffd9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4936-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/460-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3420-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1148-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/720-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3792-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-692-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-747-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-763-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-852-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-972-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-1315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2596 hbhbth.exe 4188 tbtntt.exe 4972 pjjvd.exe 2236 lrxrrlf.exe 2604 xrrrllf.exe 3792 tnbtbb.exe 5004 vpvvp.exe 4700 vppjj.exe 3944 rllxrxx.exe 3056 1hhtnn.exe 4560 bnnhbb.exe 4000 vpvpd.exe 2728 frxrlff.exe 2120 9ttnhh.exe 720 tbbbtn.exe 3460 vjpjd.exe 4748 xrfxrrl.exe 3824 1fllllr.exe 3852 hnnnnt.exe 4028 1pdvv.exe 2880 pdjpj.exe 4492 9llfxxr.exe 3444 bhttnh.exe 4820 bnbnnh.exe 2976 jdddj.exe 2400 fxxrfff.exe 3912 xrxxrll.exe 3044 nnnhbb.exe 3972 vjppj.exe 640 7pvjv.exe 3132 xflfxrl.exe 3756 tthbhn.exe 228 tnnhbt.exe 4716 vpdvp.exe 3092 xxxrffx.exe 1240 5ffxrxr.exe 2152 thnhbb.exe 1148 1jjdv.exe 1280 vpdvp.exe 3700 1rrlffx.exe 3188 bttnhb.exe 364 hbhbhb.exe 3696 jvvpp.exe 4980 jdjdp.exe 2100 fxlflfx.exe 1704 tthhnn.exe 3920 nbbbtn.exe 3064 dvdvj.exe 1080 frffxrr.exe 2736 xrxrlrl.exe 1748 nbnhhb.exe 5100 dpvpj.exe 2428 dvdvp.exe 2384 lffxrlf.exe 4532 nthbtt.exe 3420 hntnhb.exe 3164 pjvpv.exe 3540 lrfxrrx.exe 4136 frrxrrr.exe 468 hbnhhh.exe 1980 pvjdv.exe 632 9pjdv.exe 4884 xflfxrr.exe 2832 bnthbb.exe -
resource yara_rule behavioral2/memory/4936-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2604-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/460-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/720-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3792-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-747-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ffxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4936 wrote to memory of 2596 4936 baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe 83 PID 4936 wrote to memory of 2596 4936 baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe 83 PID 4936 wrote to memory of 2596 4936 baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe 83 PID 2596 wrote to memory of 4188 2596 hbhbth.exe 84 PID 2596 wrote to memory of 4188 2596 hbhbth.exe 84 PID 2596 wrote to memory of 4188 2596 hbhbth.exe 84 PID 4188 wrote to memory of 4972 4188 tbtntt.exe 85 PID 4188 wrote to memory of 4972 4188 tbtntt.exe 85 PID 4188 wrote to memory of 4972 4188 tbtntt.exe 85 PID 4972 wrote to memory of 2236 4972 pjjvd.exe 86 PID 4972 wrote to memory of 2236 4972 pjjvd.exe 86 PID 4972 wrote to memory of 2236 4972 pjjvd.exe 86 PID 2236 wrote to memory of 2604 2236 lrxrrlf.exe 87 PID 2236 wrote to memory of 2604 2236 lrxrrlf.exe 87 PID 2236 wrote to memory of 2604 2236 lrxrrlf.exe 87 PID 2604 wrote to memory of 3792 2604 xrrrllf.exe 88 PID 2604 wrote to memory of 3792 2604 xrrrllf.exe 88 PID 2604 wrote to memory of 3792 2604 xrrrllf.exe 88 PID 3792 wrote to memory of 5004 3792 tnbtbb.exe 89 PID 3792 wrote to memory of 5004 3792 tnbtbb.exe 89 PID 3792 wrote to memory of 5004 3792 tnbtbb.exe 89 PID 5004 wrote to memory of 4700 5004 vpvvp.exe 90 PID 5004 wrote to memory of 4700 5004 vpvvp.exe 90 PID 5004 wrote to memory of 4700 5004 vpvvp.exe 90 PID 4700 wrote to memory of 3944 4700 vppjj.exe 91 PID 4700 wrote to memory of 3944 4700 vppjj.exe 91 PID 4700 wrote to memory of 3944 4700 vppjj.exe 91 PID 3944 wrote to memory of 3056 3944 rllxrxx.exe 92 PID 3944 wrote to memory of 3056 3944 rllxrxx.exe 92 PID 3944 wrote to memory of 3056 3944 rllxrxx.exe 92 PID 3056 wrote to memory of 4560 3056 1hhtnn.exe 93 PID 3056 wrote to memory of 4560 3056 1hhtnn.exe 93 PID 3056 wrote to memory of 4560 3056 1hhtnn.exe 93 PID 4560 wrote to memory of 4000 4560 bnnhbb.exe 94 PID 4560 wrote to memory of 4000 4560 bnnhbb.exe 94 PID 4560 wrote to memory of 4000 4560 bnnhbb.exe 94 PID 4000 wrote to memory of 2728 4000 vpvpd.exe 95 PID 4000 wrote to memory of 2728 4000 vpvpd.exe 95 PID 4000 wrote to memory of 2728 4000 vpvpd.exe 95 PID 2728 wrote to memory of 2120 2728 frxrlff.exe 96 PID 2728 wrote to memory of 2120 2728 frxrlff.exe 96 PID 2728 wrote to memory of 2120 2728 frxrlff.exe 96 PID 2120 wrote to memory of 720 2120 9ttnhh.exe 97 PID 2120 wrote to memory of 720 2120 9ttnhh.exe 97 PID 2120 wrote to memory of 720 2120 9ttnhh.exe 97 PID 720 wrote to memory of 3460 720 tbbbtn.exe 98 PID 720 wrote to memory of 3460 720 tbbbtn.exe 98 PID 720 wrote to memory of 3460 720 tbbbtn.exe 98 PID 3460 wrote to memory of 4748 3460 vjpjd.exe 99 PID 3460 wrote to memory of 4748 3460 vjpjd.exe 99 PID 3460 wrote to memory of 4748 3460 vjpjd.exe 99 PID 4748 wrote to memory of 3824 4748 xrfxrrl.exe 100 PID 4748 wrote to memory of 3824 4748 xrfxrrl.exe 100 PID 4748 wrote to memory of 3824 4748 xrfxrrl.exe 100 PID 3824 wrote to memory of 3852 3824 1fllllr.exe 101 PID 3824 wrote to memory of 3852 3824 1fllllr.exe 101 PID 3824 wrote to memory of 3852 3824 1fllllr.exe 101 PID 3852 wrote to memory of 4028 3852 hnnnnt.exe 102 PID 3852 wrote to memory of 4028 3852 hnnnnt.exe 102 PID 3852 wrote to memory of 4028 3852 hnnnnt.exe 102 PID 4028 wrote to memory of 2880 4028 1pdvv.exe 103 PID 4028 wrote to memory of 2880 4028 1pdvv.exe 103 PID 4028 wrote to memory of 2880 4028 1pdvv.exe 103 PID 2880 wrote to memory of 4492 2880 pdjpj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe"C:\Users\Admin\AppData\Local\Temp\baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\hbhbth.exec:\hbhbth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\tbtntt.exec:\tbtntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\pjjvd.exec:\pjjvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\lrxrrlf.exec:\lrxrrlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\xrrrllf.exec:\xrrrllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\tnbtbb.exec:\tnbtbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\vpvvp.exec:\vpvvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\vppjj.exec:\vppjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\rllxrxx.exec:\rllxrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\1hhtnn.exec:\1hhtnn.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\bnnhbb.exec:\bnnhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\vpvpd.exec:\vpvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\frxrlff.exec:\frxrlff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\9ttnhh.exec:\9ttnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\tbbbtn.exec:\tbbbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\vjpjd.exec:\vjpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\1fllllr.exec:\1fllllr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\hnnnnt.exec:\hnnnnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\1pdvv.exec:\1pdvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\pdjpj.exec:\pdjpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\9llfxxr.exec:\9llfxxr.exe23⤵
- Executes dropped EXE
PID:4492 -
\??\c:\bhttnh.exec:\bhttnh.exe24⤵
- Executes dropped EXE
PID:3444 -
\??\c:\bnbnnh.exec:\bnbnnh.exe25⤵
- Executes dropped EXE
PID:4820 -
\??\c:\jdddj.exec:\jdddj.exe26⤵
- Executes dropped EXE
PID:2976 -
\??\c:\fxxrfff.exec:\fxxrfff.exe27⤵
- Executes dropped EXE
PID:2400 -
\??\c:\xrxxrll.exec:\xrxxrll.exe28⤵
- Executes dropped EXE
PID:3912 -
\??\c:\nnnhbb.exec:\nnnhbb.exe29⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vjppj.exec:\vjppj.exe30⤵
- Executes dropped EXE
PID:3972 -
\??\c:\7pvjv.exec:\7pvjv.exe31⤵
- Executes dropped EXE
PID:640 -
\??\c:\xflfxrl.exec:\xflfxrl.exe32⤵
- Executes dropped EXE
PID:3132 -
\??\c:\tthbhn.exec:\tthbhn.exe33⤵
- Executes dropped EXE
PID:3756 -
\??\c:\tnnhbt.exec:\tnnhbt.exe34⤵
- Executes dropped EXE
PID:228 -
\??\c:\vpdvp.exec:\vpdvp.exe35⤵
- Executes dropped EXE
PID:4716 -
\??\c:\xxxrffx.exec:\xxxrffx.exe36⤵
- Executes dropped EXE
PID:3092 -
\??\c:\5ffxrxr.exec:\5ffxrxr.exe37⤵
- Executes dropped EXE
PID:1240 -
\??\c:\thnhbb.exec:\thnhbb.exe38⤵
- Executes dropped EXE
PID:2152 -
\??\c:\1jjdv.exec:\1jjdv.exe39⤵
- Executes dropped EXE
PID:1148 -
\??\c:\vpdvp.exec:\vpdvp.exe40⤵
- Executes dropped EXE
PID:1280 -
\??\c:\1rrlffx.exec:\1rrlffx.exe41⤵
- Executes dropped EXE
PID:3700 -
\??\c:\bttnhb.exec:\bttnhb.exe42⤵
- Executes dropped EXE
PID:3188 -
\??\c:\hbhbhb.exec:\hbhbhb.exe43⤵
- Executes dropped EXE
PID:364 -
\??\c:\jvvpp.exec:\jvvpp.exe44⤵
- Executes dropped EXE
PID:3696 -
\??\c:\jdjdp.exec:\jdjdp.exe45⤵
- Executes dropped EXE
PID:4980 -
\??\c:\fxlflfx.exec:\fxlflfx.exe46⤵
- Executes dropped EXE
PID:2100 -
\??\c:\tthhnn.exec:\tthhnn.exe47⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nbbbtn.exec:\nbbbtn.exe48⤵
- Executes dropped EXE
PID:3920 -
\??\c:\dvdvj.exec:\dvdvj.exe49⤵
- Executes dropped EXE
PID:3064 -
\??\c:\frffxrr.exec:\frffxrr.exe50⤵
- Executes dropped EXE
PID:1080 -
\??\c:\xrxrlrl.exec:\xrxrlrl.exe51⤵
- Executes dropped EXE
PID:2736 -
\??\c:\nbnhhb.exec:\nbnhhb.exe52⤵
- Executes dropped EXE
PID:1748 -
\??\c:\dpvpj.exec:\dpvpj.exe53⤵
- Executes dropped EXE
PID:5100 -
\??\c:\dvdvp.exec:\dvdvp.exe54⤵
- Executes dropped EXE
PID:2428 -
\??\c:\lffxrlf.exec:\lffxrlf.exe55⤵
- Executes dropped EXE
PID:2384 -
\??\c:\nthbtt.exec:\nthbtt.exe56⤵
- Executes dropped EXE
PID:4532 -
\??\c:\hntnhb.exec:\hntnhb.exe57⤵
- Executes dropped EXE
PID:3420 -
\??\c:\pjvpv.exec:\pjvpv.exe58⤵
- Executes dropped EXE
PID:3164 -
\??\c:\lrfxrrx.exec:\lrfxrrx.exe59⤵
- Executes dropped EXE
PID:3540 -
\??\c:\frrxrrr.exec:\frrxrrr.exe60⤵
- Executes dropped EXE
PID:4136 -
\??\c:\hbnhhh.exec:\hbnhhh.exe61⤵
- Executes dropped EXE
PID:468 -
\??\c:\pvjdv.exec:\pvjdv.exe62⤵
- Executes dropped EXE
PID:1980 -
\??\c:\9pjdv.exec:\9pjdv.exe63⤵
- Executes dropped EXE
PID:632 -
\??\c:\xflfxrr.exec:\xflfxrr.exe64⤵
- Executes dropped EXE
PID:4884 -
\??\c:\bnthbb.exec:\bnthbb.exe65⤵
- Executes dropped EXE
PID:2832 -
\??\c:\htbtnt.exec:\htbtnt.exe66⤵PID:3744
-
\??\c:\vdjdv.exec:\vdjdv.exe67⤵PID:3468
-
\??\c:\tnbnhn.exec:\tnbnhn.exe68⤵PID:2920
-
\??\c:\jdpjd.exec:\jdpjd.exe69⤵PID:460
-
\??\c:\5ppjd.exec:\5ppjd.exe70⤵PID:3980
-
\??\c:\xlrlfff.exec:\xlrlfff.exe71⤵PID:4104
-
\??\c:\hnbnhh.exec:\hnbnhh.exe72⤵PID:2996
-
\??\c:\bntnbb.exec:\bntnbb.exe73⤵PID:3548
-
\??\c:\jvppp.exec:\jvppp.exe74⤵PID:4896
-
\??\c:\fflfffl.exec:\fflfffl.exe75⤵PID:4748
-
\??\c:\9hbbhh.exec:\9hbbhh.exe76⤵PID:388
-
\??\c:\dpvpj.exec:\dpvpj.exe77⤵PID:520
-
\??\c:\jjpjj.exec:\jjpjj.exe78⤵PID:2632
-
\??\c:\llrxrrr.exec:\llrxrrr.exe79⤵PID:4008
-
\??\c:\tthtnt.exec:\tthtnt.exe80⤵PID:3264
-
\??\c:\5dddd.exec:\5dddd.exe81⤵PID:3100
-
\??\c:\xlllllf.exec:\xlllllf.exe82⤵PID:2976
-
\??\c:\htbtnn.exec:\htbtnn.exe83⤵PID:3688
-
\??\c:\btttnn.exec:\btttnn.exe84⤵PID:1924
-
\??\c:\dvvjd.exec:\dvvjd.exe85⤵PID:1312
-
\??\c:\rlrlffr.exec:\rlrlffr.exe86⤵PID:3168
-
\??\c:\xfxxxrl.exec:\xfxxxrl.exe87⤵PID:3756
-
\??\c:\tthbbn.exec:\tthbbn.exe88⤵PID:2652
-
\??\c:\dvjdp.exec:\dvjdp.exe89⤵PID:3976
-
\??\c:\llrlllr.exec:\llrlllr.exe90⤵PID:2020
-
\??\c:\nhhbtb.exec:\nhhbtb.exe91⤵PID:1240
-
\??\c:\tbttnn.exec:\tbttnn.exe92⤵
- System Location Discovery: System Language Discovery
PID:3440 -
\??\c:\djvpd.exec:\djvpd.exe93⤵PID:2424
-
\??\c:\xllffff.exec:\xllffff.exe94⤵PID:2364
-
\??\c:\7tbttn.exec:\7tbttn.exe95⤵PID:2892
-
\??\c:\jppjd.exec:\jppjd.exe96⤵PID:4296
-
\??\c:\fllllll.exec:\fllllll.exe97⤵PID:4088
-
\??\c:\nhnhbb.exec:\nhnhbb.exe98⤵PID:2664
-
\??\c:\frxrxxr.exec:\frxrxxr.exe99⤵PID:1536
-
\??\c:\rflfxxr.exec:\rflfxxr.exe100⤵PID:2228
-
\??\c:\1nhhtt.exec:\1nhhtt.exe101⤵PID:1448
-
\??\c:\jjppv.exec:\jjppv.exe102⤵PID:1640
-
\??\c:\xfrlfff.exec:\xfrlfff.exe103⤵PID:3736
-
\??\c:\nhnbhh.exec:\nhnbhh.exe104⤵PID:3692
-
\??\c:\1vvpd.exec:\1vvpd.exe105⤵PID:4236
-
\??\c:\5flffff.exec:\5flffff.exe106⤵PID:4844
-
\??\c:\htnntt.exec:\htnntt.exe107⤵PID:2540
-
\??\c:\1vvpp.exec:\1vvpp.exe108⤵PID:836
-
\??\c:\5llrffx.exec:\5llrffx.exe109⤵PID:2692
-
\??\c:\thnnbb.exec:\thnnbb.exe110⤵PID:1856
-
\??\c:\pjjpj.exec:\pjjpj.exe111⤵PID:4536
-
\??\c:\xlrrfll.exec:\xlrrfll.exe112⤵PID:2936
-
\??\c:\ntbbtt.exec:\ntbbtt.exe113⤵PID:3848
-
\??\c:\dvdpj.exec:\dvdpj.exe114⤵PID:2708
-
\??\c:\llrlfff.exec:\llrlfff.exe115⤵PID:4552
-
\??\c:\tnhhnt.exec:\tnhhnt.exe116⤵PID:4380
-
\??\c:\ppjdv.exec:\ppjdv.exe117⤵PID:5020
-
\??\c:\1xxxrrr.exec:\1xxxrrr.exe118⤵PID:4188
-
\??\c:\lfrlfxx.exec:\lfrlfxx.exe119⤵PID:2336
-
\??\c:\thnnhh.exec:\thnnhh.exe120⤵PID:2604
-
\??\c:\9djdp.exec:\9djdp.exe121⤵PID:3792
-
\??\c:\rlrlfff.exec:\rlrlfff.exe122⤵PID:1356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-