Analysis
-
max time kernel
120s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 17:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
91bde3be8ab2b3014191ea5095f79e306739cfe5b953eb0e3bced36d75256663.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
91bde3be8ab2b3014191ea5095f79e306739cfe5b953eb0e3bced36d75256663.exe
-
Size
456KB
-
MD5
e01d204123035678471348998c5733e5
-
SHA1
f11e6158e6621bb4bdfc232ac564cbf64153b5f9
-
SHA256
91bde3be8ab2b3014191ea5095f79e306739cfe5b953eb0e3bced36d75256663
-
SHA512
75659ef95524bc261d66b2473e4654bfda6c6bfdeb6c67fff98394d3c86ce17c8d4f448d3cd760046e4127fd4e30c31276bcb3ba36d64e341eab56d908d0debd
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRC:q7Tc2NYHUrAwfMp3CDRC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4616-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/312-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1344-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/664-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-801-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-962-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-1065-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/828-1192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-1214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-1470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5076 3vvjv.exe 2320 fffxrxx.exe 3728 tntttt.exe 928 btbbtt.exe 4052 ppvdd.exe 536 nhnhbt.exe 2212 pddpd.exe 4600 xllxrlf.exe 312 5fxxrlf.exe 4564 5nbnhh.exe 1920 jdddj.exe 4048 5dvjd.exe 380 lxfxrll.exe 1036 rrrfrfx.exe 3452 tnnhbn.exe 212 ddvvv.exe 2756 lffxlfr.exe 2324 bnbbtt.exe 2792 pdjdp.exe 1704 rxfxllf.exe 2328 ntbtht.exe 4716 pdjvp.exe 1344 btbtnh.exe 3776 9dvvp.exe 3440 bbhthb.exe 4808 vdjpp.exe 740 3bttnn.exe 4832 3fxxrrr.exe 4384 dvvjd.exe 5016 djjvj.exe 4664 1dpjd.exe 3076 tbhtnh.exe 1512 lxxrxrl.exe 1620 jjdvj.exe 4736 xrxlfxx.exe 4804 hthbhh.exe 2656 9dpjv.exe 4308 3xrxfff.exe 2244 nbhthb.exe 244 vvdvv.exe 2404 1rrxlrf.exe 4860 hbhhbb.exe 1616 dvdvd.exe 4320 xxxrlfr.exe 4764 bnhbtt.exe 3028 btbthb.exe 452 7lrflff.exe 4152 bhtnnn.exe 2180 7djdd.exe 928 rfrxlfx.exe 3432 xlxlfxx.exe 4824 bnnhtt.exe 4068 ppppj.exe 4204 fffrlxr.exe 4584 tbhhnn.exe 1988 htthtb.exe 3132 pdjvp.exe 1424 7rfrrll.exe 2504 httnhb.exe 3596 tttnhb.exe 4916 pjvpd.exe 4724 lllxrlx.exe 4172 tbnhnn.exe 1540 pdjpj.exe -
resource yara_rule behavioral2/memory/4616-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/312-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1344-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2604-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/664-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-676-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4616 wrote to memory of 5076 4616 91bde3be8ab2b3014191ea5095f79e306739cfe5b953eb0e3bced36d75256663.exe 83 PID 4616 wrote to memory of 5076 4616 91bde3be8ab2b3014191ea5095f79e306739cfe5b953eb0e3bced36d75256663.exe 83 PID 4616 wrote to memory of 5076 4616 91bde3be8ab2b3014191ea5095f79e306739cfe5b953eb0e3bced36d75256663.exe 83 PID 5076 wrote to memory of 2320 5076 3vvjv.exe 84 PID 5076 wrote to memory of 2320 5076 3vvjv.exe 84 PID 5076 wrote to memory of 2320 5076 3vvjv.exe 84 PID 2320 wrote to memory of 3728 2320 fffxrxx.exe 85 PID 2320 wrote to memory of 3728 2320 fffxrxx.exe 85 PID 2320 wrote to memory of 3728 2320 fffxrxx.exe 85 PID 3728 wrote to memory of 928 3728 tntttt.exe 86 PID 3728 wrote to memory of 928 3728 tntttt.exe 86 PID 3728 wrote to memory of 928 3728 tntttt.exe 86 PID 928 wrote to memory of 4052 928 btbbtt.exe 87 PID 928 wrote to memory of 4052 928 btbbtt.exe 87 PID 928 wrote to memory of 4052 928 btbbtt.exe 87 PID 4052 wrote to memory of 536 4052 ppvdd.exe 88 PID 4052 wrote to memory of 536 4052 ppvdd.exe 88 PID 4052 wrote to memory of 536 4052 ppvdd.exe 88 PID 536 wrote to memory of 2212 536 nhnhbt.exe 89 PID 536 wrote to memory of 2212 536 nhnhbt.exe 89 PID 536 wrote to memory of 2212 536 nhnhbt.exe 89 PID 2212 wrote to memory of 4600 2212 pddpd.exe 90 PID 2212 wrote to memory of 4600 2212 pddpd.exe 90 PID 2212 wrote to memory of 4600 2212 pddpd.exe 90 PID 4600 wrote to memory of 312 4600 xllxrlf.exe 91 PID 4600 wrote to memory of 312 4600 xllxrlf.exe 91 PID 4600 wrote to memory of 312 4600 xllxrlf.exe 91 PID 312 wrote to memory of 4564 312 5fxxrlf.exe 92 PID 312 wrote to memory of 4564 312 5fxxrlf.exe 92 PID 312 wrote to memory of 4564 312 5fxxrlf.exe 92 PID 4564 wrote to memory of 1920 4564 5nbnhh.exe 93 PID 4564 wrote to memory of 1920 4564 5nbnhh.exe 93 PID 4564 wrote to memory of 1920 4564 5nbnhh.exe 93 PID 1920 wrote to memory of 4048 1920 jdddj.exe 94 PID 1920 wrote to memory of 4048 1920 jdddj.exe 94 PID 1920 wrote to memory of 4048 1920 jdddj.exe 94 PID 4048 wrote to memory of 380 4048 5dvjd.exe 95 PID 4048 wrote to memory of 380 4048 5dvjd.exe 95 PID 4048 wrote to memory of 380 4048 5dvjd.exe 95 PID 380 wrote to memory of 1036 380 lxfxrll.exe 96 PID 380 wrote to memory of 1036 380 lxfxrll.exe 96 PID 380 wrote to memory of 1036 380 lxfxrll.exe 96 PID 1036 wrote to memory of 3452 1036 rrrfrfx.exe 97 PID 1036 wrote to memory of 3452 1036 rrrfrfx.exe 97 PID 1036 wrote to memory of 3452 1036 rrrfrfx.exe 97 PID 3452 wrote to memory of 212 3452 tnnhbn.exe 98 PID 3452 wrote to memory of 212 3452 tnnhbn.exe 98 PID 3452 wrote to memory of 212 3452 tnnhbn.exe 98 PID 212 wrote to memory of 2756 212 ddvvv.exe 99 PID 212 wrote to memory of 2756 212 ddvvv.exe 99 PID 212 wrote to memory of 2756 212 ddvvv.exe 99 PID 2756 wrote to memory of 2324 2756 lffxlfr.exe 100 PID 2756 wrote to memory of 2324 2756 lffxlfr.exe 100 PID 2756 wrote to memory of 2324 2756 lffxlfr.exe 100 PID 2324 wrote to memory of 2792 2324 bnbbtt.exe 101 PID 2324 wrote to memory of 2792 2324 bnbbtt.exe 101 PID 2324 wrote to memory of 2792 2324 bnbbtt.exe 101 PID 2792 wrote to memory of 1704 2792 pdjdp.exe 102 PID 2792 wrote to memory of 1704 2792 pdjdp.exe 102 PID 2792 wrote to memory of 1704 2792 pdjdp.exe 102 PID 1704 wrote to memory of 2328 1704 rxfxllf.exe 103 PID 1704 wrote to memory of 2328 1704 rxfxllf.exe 103 PID 1704 wrote to memory of 2328 1704 rxfxllf.exe 103 PID 2328 wrote to memory of 4716 2328 ntbtht.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\91bde3be8ab2b3014191ea5095f79e306739cfe5b953eb0e3bced36d75256663.exe"C:\Users\Admin\AppData\Local\Temp\91bde3be8ab2b3014191ea5095f79e306739cfe5b953eb0e3bced36d75256663.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\3vvjv.exec:\3vvjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\fffxrxx.exec:\fffxrxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\tntttt.exec:\tntttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\btbbtt.exec:\btbbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\ppvdd.exec:\ppvdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\nhnhbt.exec:\nhnhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\pddpd.exec:\pddpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\xllxrlf.exec:\xllxrlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\5fxxrlf.exec:\5fxxrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\5nbnhh.exec:\5nbnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\jdddj.exec:\jdddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\5dvjd.exec:\5dvjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\lxfxrll.exec:\lxfxrll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\rrrfrfx.exec:\rrrfrfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\tnnhbn.exec:\tnnhbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\ddvvv.exec:\ddvvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\lffxlfr.exec:\lffxlfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\bnbbtt.exec:\bnbbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\pdjdp.exec:\pdjdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\rxfxllf.exec:\rxfxllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\ntbtht.exec:\ntbtht.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\pdjvp.exec:\pdjvp.exe23⤵
- Executes dropped EXE
PID:4716 -
\??\c:\btbtnh.exec:\btbtnh.exe24⤵
- Executes dropped EXE
PID:1344 -
\??\c:\9dvvp.exec:\9dvvp.exe25⤵
- Executes dropped EXE
PID:3776 -
\??\c:\bbhthb.exec:\bbhthb.exe26⤵
- Executes dropped EXE
PID:3440 -
\??\c:\vdjpp.exec:\vdjpp.exe27⤵
- Executes dropped EXE
PID:4808 -
\??\c:\3bttnn.exec:\3bttnn.exe28⤵
- Executes dropped EXE
PID:740 -
\??\c:\3fxxrrr.exec:\3fxxrrr.exe29⤵
- Executes dropped EXE
PID:4832 -
\??\c:\dvvjd.exec:\dvvjd.exe30⤵
- Executes dropped EXE
PID:4384 -
\??\c:\djjvj.exec:\djjvj.exe31⤵
- Executes dropped EXE
PID:5016 -
\??\c:\1dpjd.exec:\1dpjd.exe32⤵
- Executes dropped EXE
PID:4664 -
\??\c:\tbhtnh.exec:\tbhtnh.exe33⤵
- Executes dropped EXE
PID:3076 -
\??\c:\lxxrxrl.exec:\lxxrxrl.exe34⤵
- Executes dropped EXE
PID:1512 -
\??\c:\jjdvj.exec:\jjdvj.exe35⤵
- Executes dropped EXE
PID:1620 -
\??\c:\xrxlfxx.exec:\xrxlfxx.exe36⤵
- Executes dropped EXE
PID:4736 -
\??\c:\hthbhh.exec:\hthbhh.exe37⤵
- Executes dropped EXE
PID:4804 -
\??\c:\9dpjv.exec:\9dpjv.exe38⤵
- Executes dropped EXE
PID:2656 -
\??\c:\3xrxfff.exec:\3xrxfff.exe39⤵
- Executes dropped EXE
PID:4308 -
\??\c:\nbhthb.exec:\nbhthb.exe40⤵
- Executes dropped EXE
PID:2244 -
\??\c:\vvdvv.exec:\vvdvv.exe41⤵
- Executes dropped EXE
PID:244 -
\??\c:\1rrxlrf.exec:\1rrxlrf.exe42⤵
- Executes dropped EXE
PID:2404 -
\??\c:\hbhhbb.exec:\hbhhbb.exe43⤵
- Executes dropped EXE
PID:4860 -
\??\c:\dvdvd.exec:\dvdvd.exe44⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xxxrlfr.exec:\xxxrlfr.exe45⤵
- Executes dropped EXE
PID:4320 -
\??\c:\bnhbtt.exec:\bnhbtt.exe46⤵
- Executes dropped EXE
PID:4764 -
\??\c:\btbthb.exec:\btbthb.exe47⤵
- Executes dropped EXE
PID:3028 -
\??\c:\7lrflff.exec:\7lrflff.exe48⤵
- Executes dropped EXE
PID:452 -
\??\c:\bhtnnn.exec:\bhtnnn.exe49⤵
- Executes dropped EXE
PID:4152 -
\??\c:\7djdd.exec:\7djdd.exe50⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rfrxlfx.exec:\rfrxlfx.exe51⤵
- Executes dropped EXE
PID:928 -
\??\c:\xlxlfxx.exec:\xlxlfxx.exe52⤵
- Executes dropped EXE
PID:3432 -
\??\c:\bnnhtt.exec:\bnnhtt.exe53⤵
- Executes dropped EXE
PID:4824 -
\??\c:\ppppj.exec:\ppppj.exe54⤵
- Executes dropped EXE
PID:4068 -
\??\c:\fffrlxr.exec:\fffrlxr.exe55⤵
- Executes dropped EXE
PID:4204 -
\??\c:\tbhhnn.exec:\tbhhnn.exe56⤵
- Executes dropped EXE
PID:4584 -
\??\c:\htthtb.exec:\htthtb.exe57⤵
- Executes dropped EXE
PID:1988 -
\??\c:\pdjvp.exec:\pdjvp.exe58⤵
- Executes dropped EXE
PID:3132 -
\??\c:\7rfrrll.exec:\7rfrrll.exe59⤵
- Executes dropped EXE
PID:1424 -
\??\c:\httnhb.exec:\httnhb.exe60⤵
- Executes dropped EXE
PID:2504 -
\??\c:\tttnhb.exec:\tttnhb.exe61⤵
- Executes dropped EXE
PID:3596 -
\??\c:\pjvpd.exec:\pjvpd.exe62⤵
- Executes dropped EXE
PID:4916 -
\??\c:\lllxrlx.exec:\lllxrlx.exe63⤵
- Executes dropped EXE
PID:4724 -
\??\c:\tbnhnn.exec:\tbnhnn.exe64⤵
- Executes dropped EXE
PID:4172 -
\??\c:\pdjpj.exec:\pdjpj.exe65⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jjpdp.exec:\jjpdp.exe66⤵PID:4844
-
\??\c:\frrfxxr.exec:\frrfxxr.exe67⤵PID:1848
-
\??\c:\tnnbbt.exec:\tnnbbt.exe68⤵PID:1992
-
\??\c:\jdjdd.exec:\jdjdd.exe69⤵PID:2756
-
\??\c:\ffrlffr.exec:\ffrlffr.exe70⤵PID:3772
-
\??\c:\3xlxllx.exec:\3xlxllx.exe71⤵PID:2940
-
\??\c:\1bbbtt.exec:\1bbbtt.exe72⤵PID:4960
-
\??\c:\pjdvp.exec:\pjdvp.exe73⤵PID:2056
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe74⤵PID:2032
-
\??\c:\hbbnbt.exec:\hbbnbt.exe75⤵PID:388
-
\??\c:\5ddvj.exec:\5ddvj.exe76⤵PID:1060
-
\??\c:\rrrllfx.exec:\rrrllfx.exe77⤵PID:1360
-
\??\c:\fxxfxlf.exec:\fxxfxlf.exe78⤵PID:1000
-
\??\c:\3bhbbb.exec:\3bhbbb.exe79⤵PID:4588
-
\??\c:\vpddj.exec:\vpddj.exe80⤵PID:3172
-
\??\c:\frrfrrf.exec:\frrfrrf.exe81⤵PID:1304
-
\??\c:\htbtnh.exec:\htbtnh.exe82⤵PID:1884
-
\??\c:\pjjpp.exec:\pjjpp.exe83⤵PID:4208
-
\??\c:\ddvpd.exec:\ddvpd.exe84⤵PID:756
-
\??\c:\rfffrrl.exec:\rfffrrl.exe85⤵PID:4800
-
\??\c:\nhhbtt.exec:\nhhbtt.exe86⤵PID:5036
-
\??\c:\pjjvp.exec:\pjjvp.exe87⤵PID:5016
-
\??\c:\djjdv.exec:\djjdv.exe88⤵PID:4664
-
\??\c:\xffrffx.exec:\xffrffx.exe89⤵PID:4376
-
\??\c:\tnnhtn.exec:\tnnhtn.exe90⤵PID:4876
-
\??\c:\ddpjv.exec:\ddpjv.exe91⤵PID:2604
-
\??\c:\fxfxrxr.exec:\fxfxrxr.exe92⤵PID:868
-
\??\c:\bnbttt.exec:\bnbttt.exe93⤵PID:1740
-
\??\c:\jdjdj.exec:\jdjdj.exe94⤵PID:4508
-
\??\c:\3vpdp.exec:\3vpdp.exe95⤵PID:4732
-
\??\c:\llxxflr.exec:\llxxflr.exe96⤵PID:4348
-
\??\c:\nnbbtn.exec:\nnbbtn.exe97⤵PID:4620
-
\??\c:\5dpjd.exec:\5dpjd.exe98⤵PID:664
-
\??\c:\rrrllrr.exec:\rrrllrr.exe99⤵PID:2404
-
\??\c:\rlrlxxr.exec:\rlrlxxr.exe100⤵PID:4316
-
\??\c:\3ttbtb.exec:\3ttbtb.exe101⤵PID:4896
-
\??\c:\jjjdv.exec:\jjjdv.exe102⤵PID:3240
-
\??\c:\lllfxxx.exec:\lllfxxx.exe103⤵PID:4764
-
\??\c:\hnntht.exec:\hnntht.exe104⤵PID:3028
-
\??\c:\nbnhtt.exec:\nbnhtt.exe105⤵PID:4560
-
\??\c:\1pvpj.exec:\1pvpj.exe106⤵PID:4152
-
\??\c:\5fffrrr.exec:\5fffrrr.exe107⤵PID:2180
-
\??\c:\frxrllf.exec:\frxrllf.exe108⤵PID:928
-
\??\c:\1nhnhh.exec:\1nhnhh.exe109⤵PID:4276
-
\??\c:\9vjdv.exec:\9vjdv.exe110⤵PID:4824
-
\??\c:\pjjdp.exec:\pjjdp.exe111⤵PID:1716
-
\??\c:\lflxrrx.exec:\lflxrrx.exe112⤵PID:1164
-
\??\c:\bttnhh.exec:\bttnhh.exe113⤵PID:4584
-
\??\c:\vpdvv.exec:\vpdvv.exe114⤵PID:312
-
\??\c:\rrrlffx.exec:\rrrlffx.exe115⤵PID:1516
-
\??\c:\nnbtbb.exec:\nnbtbb.exe116⤵PID:4964
-
\??\c:\vvjvv.exec:\vvjvv.exe117⤵PID:1652
-
\??\c:\9flxxrr.exec:\9flxxrr.exe118⤵PID:4524
-
\??\c:\hhhbtt.exec:\hhhbtt.exe119⤵PID:3516
-
\??\c:\bnttnt.exec:\bnttnt.exe120⤵PID:1588
-
\??\c:\ppvjj.exec:\ppvjj.exe121⤵PID:3252
-
\??\c:\xrfrrrx.exec:\xrfrrrx.exe122⤵PID:2316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-