Analysis
-
max time kernel
120s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 17:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f0ccdc1089162a8f403fab61c0bbb432288685c636267bf7d46526a54a472df6.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
f0ccdc1089162a8f403fab61c0bbb432288685c636267bf7d46526a54a472df6.exe
-
Size
454KB
-
MD5
8165b3c2d204b1bc6101179c13e0d5f8
-
SHA1
535e615dc79a5d7f4e22621b99c6a985a5e545ed
-
SHA256
f0ccdc1089162a8f403fab61c0bbb432288685c636267bf7d46526a54a472df6
-
SHA512
57131deaab82bc337f8ac55c4667547bf8c694da3ac4831f5d089fb8cd712be155fc592f9d3f5660573823d2418ebd0b39d639eefff3524ed71b84ff85f3697a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeX:q7Tc2NYHUrAwfMp3CDX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2040-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2504-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/668-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/980-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2672-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/884-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3288-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/720-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2672-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-812-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-819-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-1078-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-1178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-1506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4828 ntbthh.exe 2504 rlfxlxl.exe 4844 lrxrffx.exe 2268 lxxrffr.exe 1788 7ntnhb.exe 1216 pjpjd.exe 668 3vvpp.exe 2300 lfrrxxf.exe 980 pjvdj.exe 924 lffrlfx.exe 1864 9bhtbn.exe 2824 3nhhhn.exe 4712 ddvjd.exe 2944 fxfxrrl.exe 4228 tnbthh.exe 3760 llfxrrl.exe 4956 thhnhb.exe 2232 7nnhtt.exe 3556 dpvjp.exe 4396 7ppdv.exe 4856 7dppp.exe 4728 pjjdd.exe 1400 nthtnh.exe 4708 vddpp.exe 3888 dpjdp.exe 2672 3pjjd.exe 532 jdjdp.exe 2836 rlfrllf.exe 216 httnbb.exe 4392 hthbtn.exe 884 9hhtnn.exe 4012 5hhbtn.exe 3972 lflfxrr.exe 1752 vvdvv.exe 3112 lffxrrl.exe 1560 lrxfflr.exe 2572 nhhbbb.exe 2424 vpdvv.exe 4004 ffflflr.exe 4000 nnnhht.exe 548 ddddd.exe 1824 xrxxrrl.exe 4128 nhbtnt.exe 2808 dpppp.exe 5068 xrxxxxx.exe 4900 xlrlfff.exe 3700 hbbttt.exe 5112 jjpjp.exe 5000 1rrlfxx.exe 4456 btbtnt.exe 2320 1tnnhh.exe 3288 jjjjd.exe 2472 flxrrrl.exe 3336 hbtnhh.exe 2316 vpjpp.exe 720 btttnh.exe 748 3vvpj.exe 4344 ffxrrrr.exe 2092 3nnhbb.exe 668 vpddv.exe 4872 rrxrrxr.exe 540 xfllffl.exe 980 bnnnhh.exe 4720 dvvpp.exe -
resource yara_rule behavioral2/memory/4828-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2504-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/668-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/980-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2672-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/884-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3288-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/720-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2672-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-812-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-819-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ththbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2040 wrote to memory of 4828 2040 f0ccdc1089162a8f403fab61c0bbb432288685c636267bf7d46526a54a472df6.exe 83 PID 2040 wrote to memory of 4828 2040 f0ccdc1089162a8f403fab61c0bbb432288685c636267bf7d46526a54a472df6.exe 83 PID 2040 wrote to memory of 4828 2040 f0ccdc1089162a8f403fab61c0bbb432288685c636267bf7d46526a54a472df6.exe 83 PID 4828 wrote to memory of 2504 4828 ntbthh.exe 84 PID 4828 wrote to memory of 2504 4828 ntbthh.exe 84 PID 4828 wrote to memory of 2504 4828 ntbthh.exe 84 PID 2504 wrote to memory of 4844 2504 rlfxlxl.exe 85 PID 2504 wrote to memory of 4844 2504 rlfxlxl.exe 85 PID 2504 wrote to memory of 4844 2504 rlfxlxl.exe 85 PID 4844 wrote to memory of 2268 4844 lrxrffx.exe 86 PID 4844 wrote to memory of 2268 4844 lrxrffx.exe 86 PID 4844 wrote to memory of 2268 4844 lrxrffx.exe 86 PID 2268 wrote to memory of 1788 2268 lxxrffr.exe 87 PID 2268 wrote to memory of 1788 2268 lxxrffr.exe 87 PID 2268 wrote to memory of 1788 2268 lxxrffr.exe 87 PID 1788 wrote to memory of 1216 1788 7ntnhb.exe 88 PID 1788 wrote to memory of 1216 1788 7ntnhb.exe 88 PID 1788 wrote to memory of 1216 1788 7ntnhb.exe 88 PID 1216 wrote to memory of 668 1216 pjpjd.exe 89 PID 1216 wrote to memory of 668 1216 pjpjd.exe 89 PID 1216 wrote to memory of 668 1216 pjpjd.exe 89 PID 668 wrote to memory of 2300 668 3vvpp.exe 90 PID 668 wrote to memory of 2300 668 3vvpp.exe 90 PID 668 wrote to memory of 2300 668 3vvpp.exe 90 PID 2300 wrote to memory of 980 2300 lfrrxxf.exe 91 PID 2300 wrote to memory of 980 2300 lfrrxxf.exe 91 PID 2300 wrote to memory of 980 2300 lfrrxxf.exe 91 PID 980 wrote to memory of 924 980 pjvdj.exe 92 PID 980 wrote to memory of 924 980 pjvdj.exe 92 PID 980 wrote to memory of 924 980 pjvdj.exe 92 PID 924 wrote to memory of 1864 924 lffrlfx.exe 93 PID 924 wrote to memory of 1864 924 lffrlfx.exe 93 PID 924 wrote to memory of 1864 924 lffrlfx.exe 93 PID 1864 wrote to memory of 2824 1864 9bhtbn.exe 94 PID 1864 wrote to memory of 2824 1864 9bhtbn.exe 94 PID 1864 wrote to memory of 2824 1864 9bhtbn.exe 94 PID 2824 wrote to memory of 4712 2824 3nhhhn.exe 95 PID 2824 wrote to memory of 4712 2824 3nhhhn.exe 95 PID 2824 wrote to memory of 4712 2824 3nhhhn.exe 95 PID 4712 wrote to memory of 2944 4712 ddvjd.exe 96 PID 4712 wrote to memory of 2944 4712 ddvjd.exe 96 PID 4712 wrote to memory of 2944 4712 ddvjd.exe 96 PID 2944 wrote to memory of 4228 2944 fxfxrrl.exe 97 PID 2944 wrote to memory of 4228 2944 fxfxrrl.exe 97 PID 2944 wrote to memory of 4228 2944 fxfxrrl.exe 97 PID 4228 wrote to memory of 3760 4228 tnbthh.exe 98 PID 4228 wrote to memory of 3760 4228 tnbthh.exe 98 PID 4228 wrote to memory of 3760 4228 tnbthh.exe 98 PID 3760 wrote to memory of 4956 3760 llfxrrl.exe 99 PID 3760 wrote to memory of 4956 3760 llfxrrl.exe 99 PID 3760 wrote to memory of 4956 3760 llfxrrl.exe 99 PID 4956 wrote to memory of 2232 4956 thhnhb.exe 100 PID 4956 wrote to memory of 2232 4956 thhnhb.exe 100 PID 4956 wrote to memory of 2232 4956 thhnhb.exe 100 PID 2232 wrote to memory of 3556 2232 7nnhtt.exe 101 PID 2232 wrote to memory of 3556 2232 7nnhtt.exe 101 PID 2232 wrote to memory of 3556 2232 7nnhtt.exe 101 PID 3556 wrote to memory of 4396 3556 dpvjp.exe 102 PID 3556 wrote to memory of 4396 3556 dpvjp.exe 102 PID 3556 wrote to memory of 4396 3556 dpvjp.exe 102 PID 4396 wrote to memory of 4856 4396 7ppdv.exe 103 PID 4396 wrote to memory of 4856 4396 7ppdv.exe 103 PID 4396 wrote to memory of 4856 4396 7ppdv.exe 103 PID 4856 wrote to memory of 4728 4856 7dppp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0ccdc1089162a8f403fab61c0bbb432288685c636267bf7d46526a54a472df6.exe"C:\Users\Admin\AppData\Local\Temp\f0ccdc1089162a8f403fab61c0bbb432288685c636267bf7d46526a54a472df6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\ntbthh.exec:\ntbthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\rlfxlxl.exec:\rlfxlxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\lrxrffx.exec:\lrxrffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\lxxrffr.exec:\lxxrffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\7ntnhb.exec:\7ntnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\pjpjd.exec:\pjpjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\3vvpp.exec:\3vvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\pjvdj.exec:\pjvdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\lffrlfx.exec:\lffrlfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\9bhtbn.exec:\9bhtbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\3nhhhn.exec:\3nhhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\ddvjd.exec:\ddvjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\tnbthh.exec:\tnbthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\llfxrrl.exec:\llfxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\thhnhb.exec:\thhnhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\7nnhtt.exec:\7nnhtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\dpvjp.exec:\dpvjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\7ppdv.exec:\7ppdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\7dppp.exec:\7dppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\pjjdd.exec:\pjjdd.exe23⤵
- Executes dropped EXE
PID:4728 -
\??\c:\nthtnh.exec:\nthtnh.exe24⤵
- Executes dropped EXE
PID:1400 -
\??\c:\vddpp.exec:\vddpp.exe25⤵
- Executes dropped EXE
PID:4708 -
\??\c:\dpjdp.exec:\dpjdp.exe26⤵
- Executes dropped EXE
PID:3888 -
\??\c:\3pjjd.exec:\3pjjd.exe27⤵
- Executes dropped EXE
PID:2672 -
\??\c:\jdjdp.exec:\jdjdp.exe28⤵
- Executes dropped EXE
PID:532 -
\??\c:\rlfrllf.exec:\rlfrllf.exe29⤵
- Executes dropped EXE
PID:2836 -
\??\c:\httnbb.exec:\httnbb.exe30⤵
- Executes dropped EXE
PID:216 -
\??\c:\hthbtn.exec:\hthbtn.exe31⤵
- Executes dropped EXE
PID:4392 -
\??\c:\9hhtnn.exec:\9hhtnn.exe32⤵
- Executes dropped EXE
PID:884 -
\??\c:\5hhbtn.exec:\5hhbtn.exe33⤵
- Executes dropped EXE
PID:4012 -
\??\c:\lflfxrr.exec:\lflfxrr.exe34⤵
- Executes dropped EXE
PID:3972 -
\??\c:\vvdvv.exec:\vvdvv.exe35⤵
- Executes dropped EXE
PID:1752 -
\??\c:\lffxrrl.exec:\lffxrrl.exe36⤵
- Executes dropped EXE
PID:3112 -
\??\c:\lrxfflr.exec:\lrxfflr.exe37⤵
- Executes dropped EXE
PID:1560 -
\??\c:\nhhbbb.exec:\nhhbbb.exe38⤵
- Executes dropped EXE
PID:2572 -
\??\c:\vpdvv.exec:\vpdvv.exe39⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ffflflr.exec:\ffflflr.exe40⤵
- Executes dropped EXE
PID:4004 -
\??\c:\nnnhht.exec:\nnnhht.exe41⤵
- Executes dropped EXE
PID:4000 -
\??\c:\ddddd.exec:\ddddd.exe42⤵
- Executes dropped EXE
PID:548 -
\??\c:\xrxxrrl.exec:\xrxxrrl.exe43⤵
- Executes dropped EXE
PID:1824 -
\??\c:\nhbtnt.exec:\nhbtnt.exe44⤵
- Executes dropped EXE
PID:4128 -
\??\c:\dpppp.exec:\dpppp.exe45⤵
- Executes dropped EXE
PID:2808 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe46⤵
- Executes dropped EXE
PID:5068 -
\??\c:\xlrlfff.exec:\xlrlfff.exe47⤵
- Executes dropped EXE
PID:4900 -
\??\c:\hbbttt.exec:\hbbttt.exe48⤵
- Executes dropped EXE
PID:3700 -
\??\c:\jjpjp.exec:\jjpjp.exe49⤵
- Executes dropped EXE
PID:5112 -
\??\c:\1rrlfxx.exec:\1rrlfxx.exe50⤵
- Executes dropped EXE
PID:5000 -
\??\c:\btbtnt.exec:\btbtnt.exe51⤵
- Executes dropped EXE
PID:4456 -
\??\c:\1tnnhh.exec:\1tnnhh.exe52⤵
- Executes dropped EXE
PID:2320 -
\??\c:\jjjjd.exec:\jjjjd.exe53⤵
- Executes dropped EXE
PID:3288 -
\??\c:\flxrrrl.exec:\flxrrrl.exe54⤵
- Executes dropped EXE
PID:2472 -
\??\c:\hbtnhh.exec:\hbtnhh.exe55⤵
- Executes dropped EXE
PID:3336 -
\??\c:\vpjpp.exec:\vpjpp.exe56⤵
- Executes dropped EXE
PID:2316 -
\??\c:\btttnh.exec:\btttnh.exe57⤵
- Executes dropped EXE
PID:720 -
\??\c:\3vvpj.exec:\3vvpj.exe58⤵
- Executes dropped EXE
PID:748 -
\??\c:\ffxrrrr.exec:\ffxrrrr.exe59⤵
- Executes dropped EXE
PID:4344 -
\??\c:\3nnhbb.exec:\3nnhbb.exe60⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vpddv.exec:\vpddv.exe61⤵
- Executes dropped EXE
PID:668 -
\??\c:\rrxrrxr.exec:\rrxrrxr.exe62⤵
- Executes dropped EXE
PID:4872 -
\??\c:\xfllffl.exec:\xfllffl.exe63⤵
- Executes dropped EXE
PID:540 -
\??\c:\bnnnhh.exec:\bnnnhh.exe64⤵
- Executes dropped EXE
PID:980 -
\??\c:\dvvpp.exec:\dvvpp.exe65⤵
- Executes dropped EXE
PID:4720 -
\??\c:\rxxxrxx.exec:\rxxxrxx.exe66⤵PID:924
-
\??\c:\xflxrrl.exec:\xflxrrl.exe67⤵PID:2240
-
\??\c:\hbhhbb.exec:\hbhhbb.exe68⤵PID:3116
-
\??\c:\pppjd.exec:\pppjd.exe69⤵PID:4620
-
\??\c:\7rxxxxx.exec:\7rxxxxx.exe70⤵PID:3848
-
\??\c:\btbbbb.exec:\btbbbb.exe71⤵PID:3788
-
\??\c:\bthbbb.exec:\bthbbb.exe72⤵PID:3640
-
\??\c:\pdjdd.exec:\pdjdd.exe73⤵PID:3656
-
\??\c:\llfxrrl.exec:\llfxrrl.exe74⤵PID:2104
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe75⤵PID:3760
-
\??\c:\hhhbbb.exec:\hhhbbb.exe76⤵PID:4956
-
\??\c:\pjpjd.exec:\pjpjd.exe77⤵PID:2232
-
\??\c:\9rfxxxf.exec:\9rfxxxf.exe78⤵PID:184
-
\??\c:\nhhtbb.exec:\nhhtbb.exe79⤵PID:1000
-
\??\c:\djvpj.exec:\djvpj.exe80⤵PID:3420
-
\??\c:\jvdvj.exec:\jvdvj.exe81⤵PID:4856
-
\??\c:\3flfxxx.exec:\3flfxxx.exe82⤵PID:1616
-
\??\c:\bbhbtt.exec:\bbhbtt.exe83⤵PID:3956
-
\??\c:\tntnnn.exec:\tntnnn.exe84⤵PID:4708
-
\??\c:\vppjv.exec:\vppjv.exe85⤵PID:5056
-
\??\c:\frxrxfr.exec:\frxrxfr.exe86⤵PID:2820
-
\??\c:\bttnnt.exec:\bttnnt.exe87⤵PID:2672
-
\??\c:\thtnhb.exec:\thtnhb.exe88⤵PID:4448
-
\??\c:\pjvdp.exec:\pjvdp.exe89⤵PID:2496
-
\??\c:\fxlflfl.exec:\fxlflfl.exe90⤵PID:4152
-
\??\c:\xrxrxxr.exec:\xrxrxxr.exe91⤵PID:812
-
\??\c:\3hhhbb.exec:\3hhhbb.exe92⤵PID:728
-
\??\c:\vppjd.exec:\vppjd.exe93⤵PID:3260
-
\??\c:\fxlrrff.exec:\fxlrrff.exe94⤵PID:3868
-
\??\c:\rlrlrrl.exec:\rlrlrrl.exe95⤵PID:2612
-
\??\c:\tnnnhb.exec:\tnnnhb.exe96⤵PID:1932
-
\??\c:\vvjjv.exec:\vvjjv.exe97⤵PID:3180
-
\??\c:\ffxrrrl.exec:\ffxrrrl.exe98⤵PID:4832
-
\??\c:\fxfxrff.exec:\fxfxrff.exe99⤵PID:3112
-
\??\c:\1bbttt.exec:\1bbttt.exe100⤵PID:1032
-
\??\c:\9vdvp.exec:\9vdvp.exe101⤵PID:2476
-
\??\c:\7lffrrf.exec:\7lffrrf.exe102⤵PID:2424
-
\??\c:\xrlllrl.exec:\xrlllrl.exe103⤵PID:4516
-
\??\c:\nbhbtt.exec:\nbhbtt.exe104⤵PID:3208
-
\??\c:\jppjj.exec:\jppjj.exe105⤵PID:5108
-
\??\c:\ffrrlff.exec:\ffrrlff.exe106⤵PID:1824
-
\??\c:\hhtntt.exec:\hhtntt.exe107⤵PID:796
-
\??\c:\hbbnhh.exec:\hbbnhh.exe108⤵PID:5028
-
\??\c:\pppjd.exec:\pppjd.exe109⤵PID:4920
-
\??\c:\7frrlll.exec:\7frrlll.exe110⤵PID:2196
-
\??\c:\hbbbbh.exec:\hbbbbh.exe111⤵PID:388
-
\??\c:\vdpjd.exec:\vdpjd.exe112⤵PID:640
-
\??\c:\pdpdp.exec:\pdpdp.exe113⤵PID:1172
-
\??\c:\rfllfff.exec:\rfllfff.exe114⤵PID:3856
-
\??\c:\3tbnhh.exec:\3tbnhh.exe115⤵PID:4824
-
\??\c:\vpddp.exec:\vpddp.exe116⤵PID:4616
-
\??\c:\rxlxlfx.exec:\rxlxlfx.exe117⤵PID:4944
-
\??\c:\1rfxllf.exec:\1rfxllf.exe118⤵PID:5032
-
\??\c:\nbnbhh.exec:\nbnbhh.exe119⤵PID:3908
-
\??\c:\vddvv.exec:\vddvv.exe120⤵PID:2316
-
\??\c:\jdjjd.exec:\jdjjd.exe121⤵PID:1260
-
\??\c:\lrfflff.exec:\lrfflff.exe122⤵PID:3660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-