Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 18:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
744c0547c80d08f578001c3442eac16a7e76ca1c3e2210b5324443379d1d5b1d.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
744c0547c80d08f578001c3442eac16a7e76ca1c3e2210b5324443379d1d5b1d.exe
-
Size
456KB
-
MD5
46c337bdd40d51b105801753017cabed
-
SHA1
5d8bda2facb4d8c7e4ef37aa8598f9c1d0820186
-
SHA256
744c0547c80d08f578001c3442eac16a7e76ca1c3e2210b5324443379d1d5b1d
-
SHA512
546f8a904c8f2ecd3b520c5e6065937013452b716464698e78eb8f1a6e7f21ba271ccc0075e727d561ac90aba9c6be77643c587102b1e9fc6a128c4d956d9ba6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRs:q7Tc2NYHUrAwfMp3CDRs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2100-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/932-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3788-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/884-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3880-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1140-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2072-658-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-865-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-902-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-1057-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-1112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-1482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-1532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3420-1970-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5036 5ttttt.exe 2592 xrfxfff.exe 1584 nbntnt.exe 4180 jdppp.exe 2440 llxxffl.exe 2384 5vddv.exe 3932 ffrrlrr.exe 1200 1dvpp.exe 932 hhtnnt.exe 4468 9nhhnt.exe 1488 jvjpp.exe 1920 vvjjp.exe 2096 xlrrxxf.exe 4964 ntbhhh.exe 3520 flxfflr.exe 592 dvjdd.exe 4992 xlflrlx.exe 4324 xrlrfxr.exe 3168 thtnhh.exe 2392 vjppj.exe 2616 bnhhhh.exe 3080 hnttbh.exe 1536 hhnntt.exe 4200 jvvpj.exe 4424 frxlffx.exe 4520 rlxxrxl.exe 3788 nttttt.exe 884 bbhbbt.exe 4088 nhbbbh.exe 3104 jjpvp.exe 3196 5jdvv.exe 676 vvvjj.exe 4620 7rllfll.exe 5012 5tnhbb.exe 540 xxfxxxx.exe 2468 9btnht.exe 3136 vpvvv.exe 3568 5fxrrrl.exe 2376 1hnnnt.exe 4532 dpdvv.exe 1040 llffrfr.exe 3108 bbhnnh.exe 1788 3fxxrrr.exe 4676 hbnnnt.exe 1332 ddvdp.exe 2328 3rrrrff.exe 3428 nntttt.exe 1124 pjvpj.exe 2492 3xfllxf.exe 3252 tnbbbb.exe 3944 9jddd.exe 3464 rxfxrrr.exe 3536 ttnhtt.exe 4812 dpvjp.exe 4052 1ppjj.exe 1384 3fllfff.exe 932 nhnnnn.exe 2648 dpvpj.exe 2032 jddvp.exe 4920 xlxrrrl.exe 1132 hbhbbh.exe 3412 ddpjd.exe 2484 lxffrxx.exe 2452 tnbttt.exe -
resource yara_rule behavioral2/memory/2100-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/932-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1536-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3788-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/884-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1140-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2072-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-865-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-902-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-1020-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 5036 2100 744c0547c80d08f578001c3442eac16a7e76ca1c3e2210b5324443379d1d5b1d.exe 82 PID 2100 wrote to memory of 5036 2100 744c0547c80d08f578001c3442eac16a7e76ca1c3e2210b5324443379d1d5b1d.exe 82 PID 2100 wrote to memory of 5036 2100 744c0547c80d08f578001c3442eac16a7e76ca1c3e2210b5324443379d1d5b1d.exe 82 PID 5036 wrote to memory of 2592 5036 5ttttt.exe 83 PID 5036 wrote to memory of 2592 5036 5ttttt.exe 83 PID 5036 wrote to memory of 2592 5036 5ttttt.exe 83 PID 2592 wrote to memory of 1584 2592 xrfxfff.exe 84 PID 2592 wrote to memory of 1584 2592 xrfxfff.exe 84 PID 2592 wrote to memory of 1584 2592 xrfxfff.exe 84 PID 1584 wrote to memory of 4180 1584 nbntnt.exe 85 PID 1584 wrote to memory of 4180 1584 nbntnt.exe 85 PID 1584 wrote to memory of 4180 1584 nbntnt.exe 85 PID 4180 wrote to memory of 2440 4180 jdppp.exe 86 PID 4180 wrote to memory of 2440 4180 jdppp.exe 86 PID 4180 wrote to memory of 2440 4180 jdppp.exe 86 PID 2440 wrote to memory of 2384 2440 llxxffl.exe 87 PID 2440 wrote to memory of 2384 2440 llxxffl.exe 87 PID 2440 wrote to memory of 2384 2440 llxxffl.exe 87 PID 2384 wrote to memory of 3932 2384 5vddv.exe 88 PID 2384 wrote to memory of 3932 2384 5vddv.exe 88 PID 2384 wrote to memory of 3932 2384 5vddv.exe 88 PID 3932 wrote to memory of 1200 3932 ffrrlrr.exe 89 PID 3932 wrote to memory of 1200 3932 ffrrlrr.exe 89 PID 3932 wrote to memory of 1200 3932 ffrrlrr.exe 89 PID 1200 wrote to memory of 932 1200 1dvpp.exe 90 PID 1200 wrote to memory of 932 1200 1dvpp.exe 90 PID 1200 wrote to memory of 932 1200 1dvpp.exe 90 PID 932 wrote to memory of 4468 932 hhtnnt.exe 91 PID 932 wrote to memory of 4468 932 hhtnnt.exe 91 PID 932 wrote to memory of 4468 932 hhtnnt.exe 91 PID 4468 wrote to memory of 1488 4468 9nhhnt.exe 92 PID 4468 wrote to memory of 1488 4468 9nhhnt.exe 92 PID 4468 wrote to memory of 1488 4468 9nhhnt.exe 92 PID 1488 wrote to memory of 1920 1488 jvjpp.exe 93 PID 1488 wrote to memory of 1920 1488 jvjpp.exe 93 PID 1488 wrote to memory of 1920 1488 jvjpp.exe 93 PID 1920 wrote to memory of 2096 1920 vvjjp.exe 94 PID 1920 wrote to memory of 2096 1920 vvjjp.exe 94 PID 1920 wrote to memory of 2096 1920 vvjjp.exe 94 PID 2096 wrote to memory of 4964 2096 xlrrxxf.exe 95 PID 2096 wrote to memory of 4964 2096 xlrrxxf.exe 95 PID 2096 wrote to memory of 4964 2096 xlrrxxf.exe 95 PID 4964 wrote to memory of 3520 4964 ntbhhh.exe 96 PID 4964 wrote to memory of 3520 4964 ntbhhh.exe 96 PID 4964 wrote to memory of 3520 4964 ntbhhh.exe 96 PID 3520 wrote to memory of 592 3520 flxfflr.exe 97 PID 3520 wrote to memory of 592 3520 flxfflr.exe 97 PID 3520 wrote to memory of 592 3520 flxfflr.exe 97 PID 592 wrote to memory of 4992 592 dvjdd.exe 98 PID 592 wrote to memory of 4992 592 dvjdd.exe 98 PID 592 wrote to memory of 4992 592 dvjdd.exe 98 PID 4992 wrote to memory of 4324 4992 xlflrlx.exe 99 PID 4992 wrote to memory of 4324 4992 xlflrlx.exe 99 PID 4992 wrote to memory of 4324 4992 xlflrlx.exe 99 PID 4324 wrote to memory of 3168 4324 xrlrfxr.exe 100 PID 4324 wrote to memory of 3168 4324 xrlrfxr.exe 100 PID 4324 wrote to memory of 3168 4324 xrlrfxr.exe 100 PID 3168 wrote to memory of 2392 3168 thtnhh.exe 101 PID 3168 wrote to memory of 2392 3168 thtnhh.exe 101 PID 3168 wrote to memory of 2392 3168 thtnhh.exe 101 PID 2392 wrote to memory of 2616 2392 vjppj.exe 102 PID 2392 wrote to memory of 2616 2392 vjppj.exe 102 PID 2392 wrote to memory of 2616 2392 vjppj.exe 102 PID 2616 wrote to memory of 3080 2616 bnhhhh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\744c0547c80d08f578001c3442eac16a7e76ca1c3e2210b5324443379d1d5b1d.exe"C:\Users\Admin\AppData\Local\Temp\744c0547c80d08f578001c3442eac16a7e76ca1c3e2210b5324443379d1d5b1d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\5ttttt.exec:\5ttttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\xrfxfff.exec:\xrfxfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\nbntnt.exec:\nbntnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\jdppp.exec:\jdppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\llxxffl.exec:\llxxffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\5vddv.exec:\5vddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\ffrrlrr.exec:\ffrrlrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\1dvpp.exec:\1dvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\hhtnnt.exec:\hhtnnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\9nhhnt.exec:\9nhhnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\jvjpp.exec:\jvjpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\vvjjp.exec:\vvjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\xlrrxxf.exec:\xlrrxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\ntbhhh.exec:\ntbhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\flxfflr.exec:\flxfflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\dvjdd.exec:\dvjdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\xlflrlx.exec:\xlflrlx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\xrlrfxr.exec:\xrlrfxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\thtnhh.exec:\thtnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\vjppj.exec:\vjppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\bnhhhh.exec:\bnhhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\hnttbh.exec:\hnttbh.exe23⤵
- Executes dropped EXE
PID:3080 -
\??\c:\hhnntt.exec:\hhnntt.exe24⤵
- Executes dropped EXE
PID:1536 -
\??\c:\jvvpj.exec:\jvvpj.exe25⤵
- Executes dropped EXE
PID:4200 -
\??\c:\frxlffx.exec:\frxlffx.exe26⤵
- Executes dropped EXE
PID:4424 -
\??\c:\rlxxrxl.exec:\rlxxrxl.exe27⤵
- Executes dropped EXE
PID:4520 -
\??\c:\nttttt.exec:\nttttt.exe28⤵
- Executes dropped EXE
PID:3788 -
\??\c:\bbhbbt.exec:\bbhbbt.exe29⤵
- Executes dropped EXE
PID:884 -
\??\c:\nhbbbh.exec:\nhbbbh.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4088 -
\??\c:\jjpvp.exec:\jjpvp.exe31⤵
- Executes dropped EXE
PID:3104 -
\??\c:\5jdvv.exec:\5jdvv.exe32⤵
- Executes dropped EXE
PID:3196 -
\??\c:\vvvjj.exec:\vvvjj.exe33⤵
- Executes dropped EXE
PID:676 -
\??\c:\7rllfll.exec:\7rllfll.exe34⤵
- Executes dropped EXE
PID:4620 -
\??\c:\5tnhbb.exec:\5tnhbb.exe35⤵
- Executes dropped EXE
PID:5012 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe36⤵
- Executes dropped EXE
PID:540 -
\??\c:\9btnht.exec:\9btnht.exe37⤵
- Executes dropped EXE
PID:2468 -
\??\c:\vpvvv.exec:\vpvvv.exe38⤵
- Executes dropped EXE
PID:3136 -
\??\c:\5fxrrrl.exec:\5fxrrrl.exe39⤵
- Executes dropped EXE
PID:3568 -
\??\c:\1hnnnt.exec:\1hnnnt.exe40⤵
- Executes dropped EXE
PID:2376 -
\??\c:\dpdvv.exec:\dpdvv.exe41⤵
- Executes dropped EXE
PID:4532 -
\??\c:\llffrfr.exec:\llffrfr.exe42⤵
- Executes dropped EXE
PID:1040 -
\??\c:\bbhnnh.exec:\bbhnnh.exe43⤵
- Executes dropped EXE
PID:3108 -
\??\c:\jjvpp.exec:\jjvpp.exe44⤵PID:1500
-
\??\c:\3fxxrrr.exec:\3fxxrrr.exe45⤵
- Executes dropped EXE
PID:1788 -
\??\c:\hbnnnt.exec:\hbnnnt.exe46⤵
- Executes dropped EXE
PID:4676 -
\??\c:\ddvdp.exec:\ddvdp.exe47⤵
- Executes dropped EXE
PID:1332 -
\??\c:\3rrrrff.exec:\3rrrrff.exe48⤵
- Executes dropped EXE
PID:2328 -
\??\c:\nntttt.exec:\nntttt.exe49⤵
- Executes dropped EXE
PID:3428 -
\??\c:\pjvpj.exec:\pjvpj.exe50⤵
- Executes dropped EXE
PID:1124 -
\??\c:\3xfllxf.exec:\3xfllxf.exe51⤵
- Executes dropped EXE
PID:2492 -
\??\c:\tnbbbb.exec:\tnbbbb.exe52⤵
- Executes dropped EXE
PID:3252 -
\??\c:\9jddd.exec:\9jddd.exe53⤵
- Executes dropped EXE
PID:3944 -
\??\c:\rxfxrrr.exec:\rxfxrrr.exe54⤵
- Executes dropped EXE
PID:3464 -
\??\c:\ttnhtt.exec:\ttnhtt.exe55⤵
- Executes dropped EXE
PID:3536 -
\??\c:\dpvjp.exec:\dpvjp.exe56⤵
- Executes dropped EXE
PID:4812 -
\??\c:\1ppjj.exec:\1ppjj.exe57⤵
- Executes dropped EXE
PID:4052 -
\??\c:\3fllfff.exec:\3fllfff.exe58⤵
- Executes dropped EXE
PID:1384 -
\??\c:\nhnnnn.exec:\nhnnnn.exe59⤵
- Executes dropped EXE
PID:932 -
\??\c:\dpvpj.exec:\dpvpj.exe60⤵
- Executes dropped EXE
PID:2648 -
\??\c:\jddvp.exec:\jddvp.exe61⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xlxrrrl.exec:\xlxrrrl.exe62⤵
- Executes dropped EXE
PID:4920 -
\??\c:\hbhbbh.exec:\hbhbbh.exe63⤵
- Executes dropped EXE
PID:1132 -
\??\c:\ddpjd.exec:\ddpjd.exe64⤵
- Executes dropped EXE
PID:3412 -
\??\c:\lxffrxx.exec:\lxffrxx.exe65⤵
- Executes dropped EXE
PID:2484 -
\??\c:\tnbttt.exec:\tnbttt.exe66⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vjdvp.exec:\vjdvp.exe67⤵PID:512
-
\??\c:\xrrfrrf.exec:\xrrfrrf.exe68⤵PID:1688
-
\??\c:\tnttnn.exec:\tnttnn.exe69⤵PID:4340
-
\??\c:\ppjdv.exec:\ppjdv.exe70⤵PID:4448
-
\??\c:\fxxxxxf.exec:\fxxxxxf.exe71⤵PID:2444
-
\??\c:\nhtnhh.exec:\nhtnhh.exe72⤵PID:1072
-
\??\c:\7vdpj.exec:\7vdpj.exe73⤵PID:3168
-
\??\c:\xxrlxxr.exec:\xxrlxxr.exe74⤵PID:3880
-
\??\c:\hbhhhh.exec:\hbhhhh.exe75⤵PID:4476
-
\??\c:\dddvv.exec:\dddvv.exe76⤵PID:2360
-
\??\c:\xxlllxf.exec:\xxlllxf.exe77⤵
- System Location Discovery: System Language Discovery
PID:1012 -
\??\c:\nhnnnn.exec:\nhnnnn.exe78⤵PID:2708
-
\??\c:\hbnnnn.exec:\hbnnnn.exe79⤵PID:3364
-
\??\c:\jddvp.exec:\jddvp.exe80⤵PID:4200
-
\??\c:\ffrllll.exec:\ffrllll.exe81⤵PID:1112
-
\??\c:\bbtnhh.exec:\bbtnhh.exe82⤵PID:1724
-
\??\c:\jpjvp.exec:\jpjvp.exe83⤵PID:4832
-
\??\c:\xrxrrxr.exec:\xrxrrxr.exe84⤵PID:3176
-
\??\c:\hnttbb.exec:\hnttbb.exe85⤵
- System Location Discovery: System Language Discovery
PID:884 -
\??\c:\dvdvp.exec:\dvdvp.exe86⤵PID:4168
-
\??\c:\dpvjj.exec:\dpvjj.exe87⤵PID:3212
-
\??\c:\fxxrllf.exec:\fxxrllf.exe88⤵PID:3352
-
\??\c:\1nhbtt.exec:\1nhbtt.exe89⤵PID:3200
-
\??\c:\vpjdd.exec:\vpjdd.exe90⤵PID:4668
-
\??\c:\lrxfflx.exec:\lrxfflx.exe91⤵PID:1308
-
\??\c:\fffxxxr.exec:\fffxxxr.exe92⤵PID:968
-
\??\c:\tthhhb.exec:\tthhhb.exe93⤵PID:4720
-
\??\c:\djjvv.exec:\djjvv.exe94⤵PID:1848
-
\??\c:\xlxffff.exec:\xlxffff.exe95⤵PID:3772
-
\??\c:\bthhnt.exec:\bthhnt.exe96⤵PID:1904
-
\??\c:\ddjdp.exec:\ddjdp.exe97⤵PID:1752
-
\??\c:\3rxrlfx.exec:\3rxrlfx.exe98⤵PID:4828
-
\??\c:\flrrrrl.exec:\flrrrrl.exe99⤵PID:4884
-
\??\c:\5nbbnn.exec:\5nbbnn.exe100⤵PID:2460
-
\??\c:\llllxfr.exec:\llllxfr.exe101⤵PID:4640
-
\??\c:\fxllrrx.exec:\fxllrrx.exe102⤵PID:2820
-
\??\c:\btttbb.exec:\btttbb.exe103⤵PID:2644
-
\??\c:\1pvvp.exec:\1pvvp.exe104⤵PID:5076
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe105⤵PID:4500
-
\??\c:\5tnnbh.exec:\5tnnbh.exe106⤵PID:1376
-
\??\c:\vvdjj.exec:\vvdjj.exe107⤵PID:4436
-
\??\c:\xxxlffx.exec:\xxxlffx.exe108⤵PID:2504
-
\??\c:\tnbtnn.exec:\tnbtnn.exe109⤵PID:1032
-
\??\c:\jdvjd.exec:\jdvjd.exe110⤵PID:2132
-
\??\c:\xrllffr.exec:\xrllffr.exe111⤵PID:3488
-
\??\c:\frlxrxx.exec:\frlxrxx.exe112⤵PID:3608
-
\??\c:\bbbbtb.exec:\bbbbtb.exe113⤵PID:3504
-
\??\c:\jdjjj.exec:\jdjjj.exe114⤵PID:4796
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe115⤵PID:3464
-
\??\c:\nhnhbn.exec:\nhnhbn.exe116⤵PID:1200
-
\??\c:\pjjdv.exec:\pjjdv.exe117⤵PID:4812
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe118⤵
- System Location Discovery: System Language Discovery
PID:4052 -
\??\c:\xrrrllf.exec:\xrrrllf.exe119⤵PID:1696
-
\??\c:\ttbbbh.exec:\ttbbbh.exe120⤵PID:4948
-
\??\c:\jpvvp.exec:\jpvvp.exe121⤵PID:3028
-
\??\c:\frxfxfx.exec:\frxfxfx.exe122⤵PID:2544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-