Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 16:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
805c064fbac273e844a0ff2f36db59cca8121e4fb83f12d4f78b17fe9c3a038fN.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
120 seconds
General
-
Target
805c064fbac273e844a0ff2f36db59cca8121e4fb83f12d4f78b17fe9c3a038fN.exe
-
Size
453KB
-
MD5
9cd837c44820eacae660047c82ce1fb0
-
SHA1
833e809c1e7d0ad910cc431b5d8669ebc320195e
-
SHA256
805c064fbac273e844a0ff2f36db59cca8121e4fb83f12d4f78b17fe9c3a038f
-
SHA512
47c5ec0797469e94559b9c6e803eb489abf807330f897951010c52875357969cb7bf096227ebd99b7b94d84c4590cd0c27fc8994e29668dc34c6a8d2f1890c32
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeB:q7Tc2NYHUrAwfMp3CDB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3268-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2680-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/848-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2704-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-746-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-762-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-844-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-878-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-1236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-1339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-1584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2456 ttttnh.exe 808 bnbbtt.exe 4652 pjvpj.exe 3932 djppj.exe 2680 tntnnn.exe 4716 ffrxfrx.exe 4824 vjpjd.exe 3952 htbtnh.exe 2856 rfrlrxx.exe 1652 hbbtnn.exe 3800 rlrlrlf.exe 3532 hhhbtt.exe 2904 fxrfrxr.exe 2980 3lxxrxx.exe 972 vddvv.exe 4376 7xrrllf.exe 4472 nbhbtt.exe 4912 vvvpp.exe 2252 xflfxxr.exe 1440 dpvvd.exe 4136 xlrffxr.exe 2356 bhnnhh.exe 1980 vjjvv.exe 2240 xrrrrxx.exe 2532 nbnhhh.exe 764 hhhbtn.exe 2140 dpjdj.exe 4084 jppdv.exe 544 rllfxxx.exe 4456 btbtnt.exe 3920 hbbbtt.exe 2000 7jpjd.exe 4924 frxrllf.exe 1648 lrxrlff.exe 436 nbhbtt.exe 1600 tnnnhn.exe 2704 dvvpj.exe 1136 1xxfxxr.exe 3928 fxxfxlf.exe 2496 btbttt.exe 4224 1dvpj.exe 2208 dvdjp.exe 4348 1fllrxf.exe 848 rfflrlr.exe 4700 nhntnt.exe 1468 vvjjp.exe 2132 7pppj.exe 1620 xrfxffr.exe 3068 hbhbbb.exe 556 nbntnh.exe 1864 pdddv.exe 788 lrfxxxx.exe 232 ntnbnt.exe 4716 dpdvd.exe 3984 flxrlfx.exe 3544 nbhhtt.exe 244 jdjjd.exe 3700 flrlfxr.exe 1484 3rxrffl.exe 2204 btttnn.exe 3940 pdvvv.exe 4152 fflrrrr.exe 2164 hbhnnn.exe 2216 vpvpp.exe -
resource yara_rule behavioral2/memory/3268-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/848-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2704-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2252-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/244-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-844-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllffxr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3268 wrote to memory of 2456 3268 805c064fbac273e844a0ff2f36db59cca8121e4fb83f12d4f78b17fe9c3a038fN.exe 83 PID 3268 wrote to memory of 2456 3268 805c064fbac273e844a0ff2f36db59cca8121e4fb83f12d4f78b17fe9c3a038fN.exe 83 PID 3268 wrote to memory of 2456 3268 805c064fbac273e844a0ff2f36db59cca8121e4fb83f12d4f78b17fe9c3a038fN.exe 83 PID 2456 wrote to memory of 808 2456 ttttnh.exe 84 PID 2456 wrote to memory of 808 2456 ttttnh.exe 84 PID 2456 wrote to memory of 808 2456 ttttnh.exe 84 PID 808 wrote to memory of 4652 808 bnbbtt.exe 85 PID 808 wrote to memory of 4652 808 bnbbtt.exe 85 PID 808 wrote to memory of 4652 808 bnbbtt.exe 85 PID 4652 wrote to memory of 3932 4652 pjvpj.exe 86 PID 4652 wrote to memory of 3932 4652 pjvpj.exe 86 PID 4652 wrote to memory of 3932 4652 pjvpj.exe 86 PID 3932 wrote to memory of 2680 3932 djppj.exe 87 PID 3932 wrote to memory of 2680 3932 djppj.exe 87 PID 3932 wrote to memory of 2680 3932 djppj.exe 87 PID 2680 wrote to memory of 4716 2680 tntnnn.exe 88 PID 2680 wrote to memory of 4716 2680 tntnnn.exe 88 PID 2680 wrote to memory of 4716 2680 tntnnn.exe 88 PID 4716 wrote to memory of 4824 4716 ffrxfrx.exe 89 PID 4716 wrote to memory of 4824 4716 ffrxfrx.exe 89 PID 4716 wrote to memory of 4824 4716 ffrxfrx.exe 89 PID 4824 wrote to memory of 3952 4824 vjpjd.exe 90 PID 4824 wrote to memory of 3952 4824 vjpjd.exe 90 PID 4824 wrote to memory of 3952 4824 vjpjd.exe 90 PID 3952 wrote to memory of 2856 3952 htbtnh.exe 91 PID 3952 wrote to memory of 2856 3952 htbtnh.exe 91 PID 3952 wrote to memory of 2856 3952 htbtnh.exe 91 PID 2856 wrote to memory of 1652 2856 rfrlrxx.exe 92 PID 2856 wrote to memory of 1652 2856 rfrlrxx.exe 92 PID 2856 wrote to memory of 1652 2856 rfrlrxx.exe 92 PID 1652 wrote to memory of 3800 1652 hbbtnn.exe 93 PID 1652 wrote to memory of 3800 1652 hbbtnn.exe 93 PID 1652 wrote to memory of 3800 1652 hbbtnn.exe 93 PID 3800 wrote to memory of 3532 3800 rlrlrlf.exe 94 PID 3800 wrote to memory of 3532 3800 rlrlrlf.exe 94 PID 3800 wrote to memory of 3532 3800 rlrlrlf.exe 94 PID 3532 wrote to memory of 2904 3532 hhhbtt.exe 95 PID 3532 wrote to memory of 2904 3532 hhhbtt.exe 95 PID 3532 wrote to memory of 2904 3532 hhhbtt.exe 95 PID 2904 wrote to memory of 2980 2904 fxrfrxr.exe 96 PID 2904 wrote to memory of 2980 2904 fxrfrxr.exe 96 PID 2904 wrote to memory of 2980 2904 fxrfrxr.exe 96 PID 2980 wrote to memory of 972 2980 3lxxrxx.exe 97 PID 2980 wrote to memory of 972 2980 3lxxrxx.exe 97 PID 2980 wrote to memory of 972 2980 3lxxrxx.exe 97 PID 972 wrote to memory of 4376 972 vddvv.exe 98 PID 972 wrote to memory of 4376 972 vddvv.exe 98 PID 972 wrote to memory of 4376 972 vddvv.exe 98 PID 4376 wrote to memory of 4472 4376 7xrrllf.exe 99 PID 4376 wrote to memory of 4472 4376 7xrrllf.exe 99 PID 4376 wrote to memory of 4472 4376 7xrrllf.exe 99 PID 4472 wrote to memory of 4912 4472 nbhbtt.exe 100 PID 4472 wrote to memory of 4912 4472 nbhbtt.exe 100 PID 4472 wrote to memory of 4912 4472 nbhbtt.exe 100 PID 4912 wrote to memory of 2252 4912 vvvpp.exe 101 PID 4912 wrote to memory of 2252 4912 vvvpp.exe 101 PID 4912 wrote to memory of 2252 4912 vvvpp.exe 101 PID 2252 wrote to memory of 1440 2252 xflfxxr.exe 102 PID 2252 wrote to memory of 1440 2252 xflfxxr.exe 102 PID 2252 wrote to memory of 1440 2252 xflfxxr.exe 102 PID 1440 wrote to memory of 4136 1440 dpvvd.exe 103 PID 1440 wrote to memory of 4136 1440 dpvvd.exe 103 PID 1440 wrote to memory of 4136 1440 dpvvd.exe 103 PID 4136 wrote to memory of 2356 4136 xlrffxr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\805c064fbac273e844a0ff2f36db59cca8121e4fb83f12d4f78b17fe9c3a038fN.exe"C:\Users\Admin\AppData\Local\Temp\805c064fbac273e844a0ff2f36db59cca8121e4fb83f12d4f78b17fe9c3a038fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\ttttnh.exec:\ttttnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\bnbbtt.exec:\bnbbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\pjvpj.exec:\pjvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\djppj.exec:\djppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\tntnnn.exec:\tntnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\ffrxfrx.exec:\ffrxfrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\vjpjd.exec:\vjpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\htbtnh.exec:\htbtnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\rfrlrxx.exec:\rfrlrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\hbbtnn.exec:\hbbtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\rlrlrlf.exec:\rlrlrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\hhhbtt.exec:\hhhbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\fxrfrxr.exec:\fxrfrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\3lxxrxx.exec:\3lxxrxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\vddvv.exec:\vddvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\7xrrllf.exec:\7xrrllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\nbhbtt.exec:\nbhbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\vvvpp.exec:\vvvpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\xflfxxr.exec:\xflfxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\dpvvd.exec:\dpvvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\xlrffxr.exec:\xlrffxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\bhnnhh.exec:\bhnnhh.exe23⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vjjvv.exec:\vjjvv.exe24⤵
- Executes dropped EXE
PID:1980 -
\??\c:\xrrrrxx.exec:\xrrrrxx.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2240 -
\??\c:\nbnhhh.exec:\nbnhhh.exe26⤵
- Executes dropped EXE
PID:2532 -
\??\c:\hhhbtn.exec:\hhhbtn.exe27⤵
- Executes dropped EXE
PID:764 -
\??\c:\dpjdj.exec:\dpjdj.exe28⤵
- Executes dropped EXE
PID:2140 -
\??\c:\jppdv.exec:\jppdv.exe29⤵
- Executes dropped EXE
PID:4084 -
\??\c:\rllfxxx.exec:\rllfxxx.exe30⤵
- Executes dropped EXE
PID:544 -
\??\c:\btbtnt.exec:\btbtnt.exe31⤵
- Executes dropped EXE
PID:4456 -
\??\c:\hbbbtt.exec:\hbbbtt.exe32⤵
- Executes dropped EXE
PID:3920 -
\??\c:\7jpjd.exec:\7jpjd.exe33⤵
- Executes dropped EXE
PID:2000 -
\??\c:\frxrllf.exec:\frxrllf.exe34⤵
- Executes dropped EXE
PID:4924 -
\??\c:\lrxrlff.exec:\lrxrlff.exe35⤵
- Executes dropped EXE
PID:1648 -
\??\c:\nbhbtt.exec:\nbhbtt.exe36⤵
- Executes dropped EXE
PID:436 -
\??\c:\tnnnhn.exec:\tnnnhn.exe37⤵
- Executes dropped EXE
PID:1600 -
\??\c:\dvvpj.exec:\dvvpj.exe38⤵
- Executes dropped EXE
PID:2704 -
\??\c:\1xxfxxr.exec:\1xxfxxr.exe39⤵
- Executes dropped EXE
PID:1136 -
\??\c:\fxxfxlf.exec:\fxxfxlf.exe40⤵
- Executes dropped EXE
PID:3928 -
\??\c:\btbttt.exec:\btbttt.exe41⤵
- Executes dropped EXE
PID:2496 -
\??\c:\1dvpj.exec:\1dvpj.exe42⤵
- Executes dropped EXE
PID:4224 -
\??\c:\dvdjp.exec:\dvdjp.exe43⤵
- Executes dropped EXE
PID:2208 -
\??\c:\1fllrxf.exec:\1fllrxf.exe44⤵
- Executes dropped EXE
PID:4348 -
\??\c:\rfflrlr.exec:\rfflrlr.exe45⤵
- Executes dropped EXE
PID:848 -
\??\c:\nhntnt.exec:\nhntnt.exe46⤵
- Executes dropped EXE
PID:4700 -
\??\c:\vvjjp.exec:\vvjjp.exe47⤵
- Executes dropped EXE
PID:1468 -
\??\c:\7pppj.exec:\7pppj.exe48⤵
- Executes dropped EXE
PID:2132 -
\??\c:\xrfxffr.exec:\xrfxffr.exe49⤵
- Executes dropped EXE
PID:1620 -
\??\c:\hbhbbb.exec:\hbhbbb.exe50⤵
- Executes dropped EXE
PID:3068 -
\??\c:\nbntnh.exec:\nbntnh.exe51⤵
- Executes dropped EXE
PID:556 -
\??\c:\pdddv.exec:\pdddv.exe52⤵
- Executes dropped EXE
PID:1864 -
\??\c:\lrfxxxx.exec:\lrfxxxx.exe53⤵
- Executes dropped EXE
PID:788 -
\??\c:\ntnbnt.exec:\ntnbnt.exe54⤵
- Executes dropped EXE
PID:232 -
\??\c:\dpdvd.exec:\dpdvd.exe55⤵
- Executes dropped EXE
PID:4716 -
\??\c:\flxrlfx.exec:\flxrlfx.exe56⤵
- Executes dropped EXE
PID:3984 -
\??\c:\nbhhtt.exec:\nbhhtt.exe57⤵
- Executes dropped EXE
PID:3544 -
\??\c:\jdjjd.exec:\jdjjd.exe58⤵
- Executes dropped EXE
PID:244 -
\??\c:\flrlfxr.exec:\flrlfxr.exe59⤵
- Executes dropped EXE
PID:3700 -
\??\c:\3rxrffl.exec:\3rxrffl.exe60⤵
- Executes dropped EXE
PID:1484 -
\??\c:\btttnn.exec:\btttnn.exe61⤵
- Executes dropped EXE
PID:2204 -
\??\c:\pdvvv.exec:\pdvvv.exe62⤵
- Executes dropped EXE
PID:3940 -
\??\c:\fflrrrr.exec:\fflrrrr.exe63⤵
- Executes dropped EXE
PID:4152 -
\??\c:\hbhnnn.exec:\hbhnnn.exe64⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vpvpp.exec:\vpvpp.exe65⤵
- Executes dropped EXE
PID:2216 -
\??\c:\ddvvp.exec:\ddvvp.exe66⤵PID:3032
-
\??\c:\9tbbbh.exec:\9tbbbh.exe67⤵PID:1952
-
\??\c:\vjddd.exec:\vjddd.exe68⤵
- System Location Discovery: System Language Discovery
PID:5092 -
\??\c:\lrxrlff.exec:\lrxrlff.exe69⤵PID:1772
-
\??\c:\1nhhbb.exec:\1nhhbb.exe70⤵PID:4364
-
\??\c:\djvpp.exec:\djvpp.exe71⤵PID:4040
-
\??\c:\frxrrrr.exec:\frxrrrr.exe72⤵PID:4384
-
\??\c:\thnnnt.exec:\thnnnt.exe73⤵PID:3644
-
\??\c:\pjjdv.exec:\pjjdv.exe74⤵PID:3480
-
\??\c:\rllllxx.exec:\rllllxx.exe75⤵
- System Location Discovery: System Language Discovery
PID:4136 -
\??\c:\nbnhbb.exec:\nbnhbb.exe76⤵PID:1344
-
\??\c:\bttnhh.exec:\bttnhh.exe77⤵PID:2500
-
\??\c:\djvpj.exec:\djvpj.exe78⤵PID:2960
-
\??\c:\fxlrrrl.exec:\fxlrrrl.exe79⤵PID:2972
-
\??\c:\hthbtt.exec:\hthbtt.exe80⤵PID:1436
-
\??\c:\pjvpj.exec:\pjvpj.exe81⤵PID:2892
-
\??\c:\vpdvp.exec:\vpdvp.exe82⤵PID:2932
-
\??\c:\rlllfff.exec:\rlllfff.exe83⤵PID:1736
-
\??\c:\hbtnnh.exec:\hbtnnh.exe84⤵PID:2292
-
\??\c:\vpvpp.exec:\vpvpp.exe85⤵PID:5100
-
\??\c:\djvpv.exec:\djvpv.exe86⤵PID:1172
-
\??\c:\lllfrrx.exec:\lllfrrx.exe87⤵PID:4924
-
\??\c:\jjdvv.exec:\jjdvv.exe88⤵PID:1648
-
\??\c:\xffxrxr.exec:\xffxrxr.exe89⤵PID:4708
-
\??\c:\1rxxxff.exec:\1rxxxff.exe90⤵PID:1156
-
\??\c:\1hbtbb.exec:\1hbtbb.exe91⤵PID:4660
-
\??\c:\ppdvd.exec:\ppdvd.exe92⤵PID:4696
-
\??\c:\lfrfxxl.exec:\lfrfxxl.exe93⤵PID:5116
-
\??\c:\nbnhbb.exec:\nbnhbb.exe94⤵PID:1092
-
\??\c:\djpjj.exec:\djpjj.exe95⤵PID:2052
-
\??\c:\rlrrrff.exec:\rlrrrff.exe96⤵PID:2620
-
\??\c:\nhbtnb.exec:\nhbtnb.exe97⤵PID:1892
-
\??\c:\dvpjd.exec:\dvpjd.exe98⤵PID:1408
-
\??\c:\rlxfffl.exec:\rlxfffl.exe99⤵PID:2976
-
\??\c:\nhbtbb.exec:\nhbtbb.exe100⤵PID:1528
-
\??\c:\pdpjd.exec:\pdpjd.exe101⤵PID:3976
-
\??\c:\lrflrlr.exec:\lrflrlr.exe102⤵PID:2708
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe103⤵PID:3680
-
\??\c:\bnbtnn.exec:\bnbtnn.exe104⤵PID:3676
-
\??\c:\jvdvv.exec:\jvdvv.exe105⤵PID:3116
-
\??\c:\xllffxr.exec:\xllffxr.exe106⤵
- System Location Discovery: System Language Discovery
PID:1424 -
\??\c:\5tnnhh.exec:\5tnnhh.exe107⤵PID:2108
-
\??\c:\9pjdv.exec:\9pjdv.exe108⤵PID:2680
-
\??\c:\ffrfrlx.exec:\ffrfrlx.exe109⤵PID:644
-
\??\c:\fxfxrfx.exec:\fxfxrfx.exe110⤵PID:3508
-
\??\c:\nhbhbt.exec:\nhbhbt.exe111⤵PID:1124
-
\??\c:\pvjvp.exec:\pvjvp.exe112⤵PID:3912
-
\??\c:\fllfxrl.exec:\fllfxrl.exe113⤵PID:224
-
\??\c:\frrflll.exec:\frrflll.exe114⤵PID:2692
-
\??\c:\btbtnh.exec:\btbtnh.exe115⤵PID:2856
-
\??\c:\dvvpd.exec:\dvvpd.exe116⤵
- System Location Discovery: System Language Discovery
PID:700 -
\??\c:\lxlfxrr.exec:\lxlfxrr.exe117⤵PID:1788
-
\??\c:\nhnhbt.exec:\nhnhbt.exe118⤵PID:368
-
\??\c:\nhhbtn.exec:\nhhbtn.exe119⤵PID:4184
-
\??\c:\jddvp.exec:\jddvp.exe120⤵PID:2064
-
\??\c:\ffrfxrl.exec:\ffrfxrl.exe121⤵PID:2904
-
\??\c:\1lxlfrl.exec:\1lxlfrl.exe122⤵PID:4528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-