Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 16:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ac239fd5cb0eee6c9f14545a97508f835dd2f19c946373ba0e8141c5f6dc5621N.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
ac239fd5cb0eee6c9f14545a97508f835dd2f19c946373ba0e8141c5f6dc5621N.exe
-
Size
453KB
-
MD5
d98d859789f1662d4b8cd89add0dbf10
-
SHA1
4ea41397451ba57ce3b5e6a378ba0d118beba343
-
SHA256
ac239fd5cb0eee6c9f14545a97508f835dd2f19c946373ba0e8141c5f6dc5621
-
SHA512
0a22f8b40fec8c7cbb8a906c9cb837a4c7f9516adf661e648741a3c8f7770f846038791786668b3c0a0a5561c5731fd4b554f5246da09b7d7fbc1cc7ad9214e3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAber:q7Tc2NYHUrAwfMp3CDr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/3080-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1512-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/608-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1764-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3880-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1760-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-752-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-765-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-832-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-836-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4460 3tbtnt.exe 5100 bntnnn.exe 4780 3hnnhh.exe 4796 xlxlfrr.exe 3120 9rlfffx.exe 1992 vppjj.exe 4312 rxllllf.exe 4272 fxllrrx.exe 4304 vvvpp.exe 1172 vpppd.exe 1736 dvvdd.exe 1512 htttnn.exe 4976 9pvpj.exe 2636 nttnhb.exe 3752 vjdpj.exe 3740 dvdpj.exe 4564 rffxrrr.exe 3248 nbnhbt.exe 2436 5pvvp.exe 1792 9frlfff.exe 3260 fffxxrf.exe 2148 1ppjj.exe 2344 xxlxfxl.exe 3532 pjvpv.exe 3496 xlxrlll.exe 608 1hnnhh.exe 4472 pvvpj.exe 4520 lflxfxf.exe 368 1tbttt.exe 1972 9tbbbb.exe 3888 ttbbhh.exe 1764 tnhhbn.exe 4016 rffrfxr.exe 4900 ntbtnb.exe 1368 ppvpp.exe 3880 xfxflfl.exe 1748 3tbtnt.exe 4756 djjdv.exe 1488 9jvpv.exe 4972 rllfxxr.exe 3844 bntnhb.exe 1968 5ddvv.exe 2948 5lfxxrl.exe 636 7hbbtt.exe 3296 dvvdv.exe 4792 rlrfxxl.exe 532 tbbtnh.exe 4352 httnhb.exe 4172 dpvjd.exe 1144 9flfxxr.exe 1444 nnnnhh.exe 4064 nbbtnh.exe 2160 ppvjd.exe 1584 rrrlfxr.exe 4688 9tttnn.exe 1252 7ntnhh.exe 2240 1dvpp.exe 2512 lffxrrl.exe 3000 3flfffx.exe 1268 hnbbtt.exe 3048 7ppjv.exe 3520 fllffxx.exe 984 xlllffx.exe 3840 5tttnn.exe -
resource yara_rule behavioral2/memory/3080-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1512-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/608-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1764-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3336-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3300-639-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5btnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3080 wrote to memory of 4460 3080 ac239fd5cb0eee6c9f14545a97508f835dd2f19c946373ba0e8141c5f6dc5621N.exe 82 PID 3080 wrote to memory of 4460 3080 ac239fd5cb0eee6c9f14545a97508f835dd2f19c946373ba0e8141c5f6dc5621N.exe 82 PID 3080 wrote to memory of 4460 3080 ac239fd5cb0eee6c9f14545a97508f835dd2f19c946373ba0e8141c5f6dc5621N.exe 82 PID 4460 wrote to memory of 5100 4460 3tbtnt.exe 83 PID 4460 wrote to memory of 5100 4460 3tbtnt.exe 83 PID 4460 wrote to memory of 5100 4460 3tbtnt.exe 83 PID 5100 wrote to memory of 4780 5100 bntnnn.exe 84 PID 5100 wrote to memory of 4780 5100 bntnnn.exe 84 PID 5100 wrote to memory of 4780 5100 bntnnn.exe 84 PID 4780 wrote to memory of 4796 4780 3hnnhh.exe 85 PID 4780 wrote to memory of 4796 4780 3hnnhh.exe 85 PID 4780 wrote to memory of 4796 4780 3hnnhh.exe 85 PID 4796 wrote to memory of 3120 4796 xlxlfrr.exe 86 PID 4796 wrote to memory of 3120 4796 xlxlfrr.exe 86 PID 4796 wrote to memory of 3120 4796 xlxlfrr.exe 86 PID 3120 wrote to memory of 1992 3120 9rlfffx.exe 87 PID 3120 wrote to memory of 1992 3120 9rlfffx.exe 87 PID 3120 wrote to memory of 1992 3120 9rlfffx.exe 87 PID 1992 wrote to memory of 4312 1992 vppjj.exe 88 PID 1992 wrote to memory of 4312 1992 vppjj.exe 88 PID 1992 wrote to memory of 4312 1992 vppjj.exe 88 PID 4312 wrote to memory of 4272 4312 rxllllf.exe 89 PID 4312 wrote to memory of 4272 4312 rxllllf.exe 89 PID 4312 wrote to memory of 4272 4312 rxllllf.exe 89 PID 4272 wrote to memory of 4304 4272 fxllrrx.exe 90 PID 4272 wrote to memory of 4304 4272 fxllrrx.exe 90 PID 4272 wrote to memory of 4304 4272 fxllrrx.exe 90 PID 4304 wrote to memory of 1172 4304 vvvpp.exe 91 PID 4304 wrote to memory of 1172 4304 vvvpp.exe 91 PID 4304 wrote to memory of 1172 4304 vvvpp.exe 91 PID 1172 wrote to memory of 1736 1172 vpppd.exe 92 PID 1172 wrote to memory of 1736 1172 vpppd.exe 92 PID 1172 wrote to memory of 1736 1172 vpppd.exe 92 PID 1736 wrote to memory of 1512 1736 dvvdd.exe 93 PID 1736 wrote to memory of 1512 1736 dvvdd.exe 93 PID 1736 wrote to memory of 1512 1736 dvvdd.exe 93 PID 1512 wrote to memory of 4976 1512 htttnn.exe 94 PID 1512 wrote to memory of 4976 1512 htttnn.exe 94 PID 1512 wrote to memory of 4976 1512 htttnn.exe 94 PID 4976 wrote to memory of 2636 4976 9pvpj.exe 95 PID 4976 wrote to memory of 2636 4976 9pvpj.exe 95 PID 4976 wrote to memory of 2636 4976 9pvpj.exe 95 PID 2636 wrote to memory of 3752 2636 nttnhb.exe 96 PID 2636 wrote to memory of 3752 2636 nttnhb.exe 96 PID 2636 wrote to memory of 3752 2636 nttnhb.exe 96 PID 3752 wrote to memory of 3740 3752 vjdpj.exe 97 PID 3752 wrote to memory of 3740 3752 vjdpj.exe 97 PID 3752 wrote to memory of 3740 3752 vjdpj.exe 97 PID 3740 wrote to memory of 4564 3740 dvdpj.exe 98 PID 3740 wrote to memory of 4564 3740 dvdpj.exe 98 PID 3740 wrote to memory of 4564 3740 dvdpj.exe 98 PID 4564 wrote to memory of 3248 4564 rffxrrr.exe 99 PID 4564 wrote to memory of 3248 4564 rffxrrr.exe 99 PID 4564 wrote to memory of 3248 4564 rffxrrr.exe 99 PID 3248 wrote to memory of 2436 3248 nbnhbt.exe 100 PID 3248 wrote to memory of 2436 3248 nbnhbt.exe 100 PID 3248 wrote to memory of 2436 3248 nbnhbt.exe 100 PID 2436 wrote to memory of 1792 2436 5pvvp.exe 101 PID 2436 wrote to memory of 1792 2436 5pvvp.exe 101 PID 2436 wrote to memory of 1792 2436 5pvvp.exe 101 PID 1792 wrote to memory of 3260 1792 9frlfff.exe 102 PID 1792 wrote to memory of 3260 1792 9frlfff.exe 102 PID 1792 wrote to memory of 3260 1792 9frlfff.exe 102 PID 3260 wrote to memory of 2148 3260 fffxxrf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac239fd5cb0eee6c9f14545a97508f835dd2f19c946373ba0e8141c5f6dc5621N.exe"C:\Users\Admin\AppData\Local\Temp\ac239fd5cb0eee6c9f14545a97508f835dd2f19c946373ba0e8141c5f6dc5621N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\3tbtnt.exec:\3tbtnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\bntnnn.exec:\bntnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\3hnnhh.exec:\3hnnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\xlxlfrr.exec:\xlxlfrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\9rlfffx.exec:\9rlfffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\vppjj.exec:\vppjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\rxllllf.exec:\rxllllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\fxllrrx.exec:\fxllrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\vvvpp.exec:\vvvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\vpppd.exec:\vpppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\dvvdd.exec:\dvvdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\htttnn.exec:\htttnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\9pvpj.exec:\9pvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\nttnhb.exec:\nttnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\vjdpj.exec:\vjdpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\dvdpj.exec:\dvdpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\rffxrrr.exec:\rffxrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\nbnhbt.exec:\nbnhbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\5pvvp.exec:\5pvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\9frlfff.exec:\9frlfff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\fffxxrf.exec:\fffxxrf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\1ppjj.exec:\1ppjj.exe23⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xxlxfxl.exec:\xxlxfxl.exe24⤵
- Executes dropped EXE
PID:2344 -
\??\c:\pjvpv.exec:\pjvpv.exe25⤵
- Executes dropped EXE
PID:3532 -
\??\c:\xlxrlll.exec:\xlxrlll.exe26⤵
- Executes dropped EXE
PID:3496 -
\??\c:\1hnnhh.exec:\1hnnhh.exe27⤵
- Executes dropped EXE
PID:608 -
\??\c:\pvvpj.exec:\pvvpj.exe28⤵
- Executes dropped EXE
PID:4472 -
\??\c:\lflxfxf.exec:\lflxfxf.exe29⤵
- Executes dropped EXE
PID:4520 -
\??\c:\1tbttt.exec:\1tbttt.exe30⤵
- Executes dropped EXE
PID:368 -
\??\c:\9tbbbb.exec:\9tbbbb.exe31⤵
- Executes dropped EXE
PID:1972 -
\??\c:\ttbbhh.exec:\ttbbhh.exe32⤵
- Executes dropped EXE
PID:3888 -
\??\c:\tnhhbn.exec:\tnhhbn.exe33⤵
- Executes dropped EXE
PID:1764 -
\??\c:\rffrfxr.exec:\rffrfxr.exe34⤵
- Executes dropped EXE
PID:4016 -
\??\c:\ntbtnb.exec:\ntbtnb.exe35⤵
- Executes dropped EXE
PID:4900 -
\??\c:\ppvpp.exec:\ppvpp.exe36⤵
- Executes dropped EXE
PID:1368 -
\??\c:\xfxflfl.exec:\xfxflfl.exe37⤵
- Executes dropped EXE
PID:3880 -
\??\c:\3tbtnt.exec:\3tbtnt.exe38⤵
- Executes dropped EXE
PID:1748 -
\??\c:\djjdv.exec:\djjdv.exe39⤵
- Executes dropped EXE
PID:4756 -
\??\c:\9jvpv.exec:\9jvpv.exe40⤵
- Executes dropped EXE
PID:1488 -
\??\c:\rllfxxr.exec:\rllfxxr.exe41⤵
- Executes dropped EXE
PID:4972 -
\??\c:\bntnhb.exec:\bntnhb.exe42⤵
- Executes dropped EXE
PID:3844 -
\??\c:\5ddvv.exec:\5ddvv.exe43⤵
- Executes dropped EXE
PID:1968 -
\??\c:\5lfxxrl.exec:\5lfxxrl.exe44⤵
- Executes dropped EXE
PID:2948 -
\??\c:\7hbbtt.exec:\7hbbtt.exe45⤵
- Executes dropped EXE
PID:636 -
\??\c:\dvvdv.exec:\dvvdv.exe46⤵
- Executes dropped EXE
PID:3296 -
\??\c:\rlrfxxl.exec:\rlrfxxl.exe47⤵
- Executes dropped EXE
PID:4792 -
\??\c:\tbbtnh.exec:\tbbtnh.exe48⤵
- Executes dropped EXE
PID:532 -
\??\c:\httnhb.exec:\httnhb.exe49⤵
- Executes dropped EXE
PID:4352 -
\??\c:\dpvjd.exec:\dpvjd.exe50⤵
- Executes dropped EXE
PID:4172 -
\??\c:\9flfxxr.exec:\9flfxxr.exe51⤵
- Executes dropped EXE
PID:1144 -
\??\c:\nnnnhh.exec:\nnnnhh.exe52⤵
- Executes dropped EXE
PID:1444 -
\??\c:\nbbtnh.exec:\nbbtnh.exe53⤵
- Executes dropped EXE
PID:4064 -
\??\c:\ppvjd.exec:\ppvjd.exe54⤵
- Executes dropped EXE
PID:2160 -
\??\c:\rrrlfxr.exec:\rrrlfxr.exe55⤵
- Executes dropped EXE
PID:1584 -
\??\c:\9tttnn.exec:\9tttnn.exe56⤵
- Executes dropped EXE
PID:4688 -
\??\c:\7ntnhh.exec:\7ntnhh.exe57⤵
- Executes dropped EXE
PID:1252 -
\??\c:\1dvpp.exec:\1dvpp.exe58⤵
- Executes dropped EXE
PID:2240 -
\??\c:\lffxrrl.exec:\lffxrrl.exe59⤵
- Executes dropped EXE
PID:2512 -
\??\c:\3flfffx.exec:\3flfffx.exe60⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hnbbtt.exec:\hnbbtt.exe61⤵
- Executes dropped EXE
PID:1268 -
\??\c:\7ppjv.exec:\7ppjv.exe62⤵
- Executes dropped EXE
PID:3048 -
\??\c:\fllffxx.exec:\fllffxx.exe63⤵
- Executes dropped EXE
PID:3520 -
\??\c:\xlllffx.exec:\xlllffx.exe64⤵
- Executes dropped EXE
PID:984 -
\??\c:\5tttnn.exec:\5tttnn.exe65⤵
- Executes dropped EXE
PID:3840 -
\??\c:\flrlffr.exec:\flrlffr.exe66⤵PID:4204
-
\??\c:\tthhbb.exec:\tthhbb.exe67⤵PID:2076
-
\??\c:\vppjv.exec:\vppjv.exe68⤵PID:1172
-
\??\c:\vvpjj.exec:\vvpjj.exe69⤵PID:1928
-
\??\c:\5xfxxxr.exec:\5xfxxxr.exe70⤵PID:2324
-
\??\c:\5bbtnn.exec:\5bbtnn.exe71⤵PID:4844
-
\??\c:\5djvp.exec:\5djvp.exe72⤵PID:1776
-
\??\c:\3rlfxrl.exec:\3rlfxrl.exe73⤵PID:100
-
\??\c:\htttnn.exec:\htttnn.exe74⤵PID:5068
-
\??\c:\ppvvv.exec:\ppvvv.exe75⤵PID:3632
-
\??\c:\xlfffff.exec:\xlfffff.exe76⤵PID:212
-
\??\c:\xrfxrll.exec:\xrfxrll.exe77⤵PID:1476
-
\??\c:\tntnhb.exec:\tntnhb.exe78⤵PID:4500
-
\??\c:\jpdvv.exec:\jpdvv.exe79⤵PID:3656
-
\??\c:\1ffxrrl.exec:\1ffxrrl.exe80⤵PID:1680
-
\??\c:\bnnttt.exec:\bnnttt.exe81⤵PID:3352
-
\??\c:\nhhhbh.exec:\nhhhbh.exe82⤵PID:1520
-
\??\c:\ppvvd.exec:\ppvvd.exe83⤵PID:2588
-
\??\c:\xlfrllf.exec:\xlfrllf.exe84⤵PID:640
-
\??\c:\btttnn.exec:\btttnn.exe85⤵PID:1388
-
\??\c:\3ppvp.exec:\3ppvp.exe86⤵PID:556
-
\??\c:\rlrlfff.exec:\rlrlfff.exe87⤵PID:436
-
\??\c:\xrrlrlr.exec:\xrrlrlr.exe88⤵PID:3548
-
\??\c:\1bhbtt.exec:\1bhbtt.exe89⤵PID:2876
-
\??\c:\jdjdp.exec:\jdjdp.exe90⤵PID:1548
-
\??\c:\9dvdj.exec:\9dvdj.exe91⤵PID:3088
-
\??\c:\xlrlllf.exec:\xlrlllf.exe92⤵PID:5064
-
\??\c:\tbhhbb.exec:\tbhhbb.exe93⤵PID:1432
-
\??\c:\jjdvv.exec:\jjdvv.exe94⤵PID:3540
-
\??\c:\rllfrrf.exec:\rllfrrf.exe95⤵PID:1176
-
\??\c:\btbnhh.exec:\btbnhh.exe96⤵PID:3264
-
\??\c:\nthntt.exec:\nthntt.exe97⤵PID:4112
-
\??\c:\dvdvp.exec:\dvdvp.exe98⤵PID:964
-
\??\c:\rfxlfff.exec:\rfxlfff.exe99⤵PID:4808
-
\??\c:\7hnbhh.exec:\7hnbhh.exe100⤵PID:1288
-
\??\c:\pvvpv.exec:\pvvpv.exe101⤵
- System Location Discovery: System Language Discovery
PID:3784 -
\??\c:\7rlfrlx.exec:\7rlfrlx.exe102⤵PID:392
-
\??\c:\nntnhb.exec:\nntnhb.exe103⤵PID:1368
-
\??\c:\1bhttt.exec:\1bhttt.exe104⤵PID:4816
-
\??\c:\pjvpv.exec:\pjvpv.exe105⤵PID:2172
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe106⤵PID:4756
-
\??\c:\tnntnn.exec:\tnntnn.exe107⤵PID:1488
-
\??\c:\jjdpj.exec:\jjdpj.exe108⤵PID:4684
-
\??\c:\flrrlfx.exec:\flrrlfx.exe109⤵
- System Location Discovery: System Language Discovery
PID:4788 -
\??\c:\lfrlfxf.exec:\lfrlfxf.exe110⤵PID:1820
-
\??\c:\hnhbtn.exec:\hnhbtn.exe111⤵PID:3336
-
\??\c:\vjjdp.exec:\vjjdp.exe112⤵PID:4136
-
\??\c:\fxlfrlx.exec:\fxlfrlx.exe113⤵PID:864
-
\??\c:\ntbnbt.exec:\ntbnbt.exe114⤵PID:1760
-
\??\c:\3pjdv.exec:\3pjdv.exe115⤵PID:4336
-
\??\c:\7xfxrrr.exec:\7xfxrrr.exe116⤵PID:2764
-
\??\c:\frxxfxl.exec:\frxxfxl.exe117⤵PID:512
-
\??\c:\1bnhbb.exec:\1bnhbb.exe118⤵PID:4460
-
\??\c:\jjdjv.exec:\jjdjv.exe119⤵PID:1332
-
\??\c:\jdddp.exec:\jdddp.exe120⤵PID:872
-
\??\c:\xlrfxrl.exec:\xlrfxrl.exe121⤵PID:2260
-
\??\c:\btthbb.exec:\btthbb.exe122⤵PID:1308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-