Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 20:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
706feb2bf94464c8f33496effd90174cbb73a28ce6b7086b7e7d5873271a7d8aN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
706feb2bf94464c8f33496effd90174cbb73a28ce6b7086b7e7d5873271a7d8aN.exe
-
Size
454KB
-
MD5
cc905ab927fde0fbf1e47046e6903560
-
SHA1
4e170f185e80d5a095617d92aeb8e90ba64c9af6
-
SHA256
706feb2bf94464c8f33496effd90174cbb73a28ce6b7086b7e7d5873271a7d8a
-
SHA512
9dae4d1b9a00f614183ec7cd5b50cd202393eda5078b51833ec216cec2b9ed42a10a4b6b749035937ceae0e938b16e8e99860b8ee27e5155048066bbd8ddb704
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeX:q7Tc2NYHUrAwfMp3CDX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/528-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4284-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1428-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/576-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2112-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4120-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-706-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-902-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1336-1032-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-1270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4032 rllfxll.exe 1268 nhttbt.exe 224 bnnnhn.exe 3912 btbthb.exe 1884 5vdpp.exe 3744 thhbtn.exe 2256 3jjvv.exe 2008 tthbtt.exe 3448 dvdvp.exe 4592 fxxrllf.exe 3148 7xxxllf.exe 4284 7hnbbh.exe 2904 vdjdj.exe 1556 htbtnt.exe 3972 pvvdp.exe 1772 ffrrxxl.exe 4912 7ppjv.exe 968 jjjdv.exe 3844 xflfxxx.exe 3724 pvdpj.exe 576 pjpjd.exe 1428 tnnhbt.exe 4500 ntbtnn.exe 4624 lrfrffx.exe 4776 rxrlfrr.exe 3356 1rlfrrl.exe 4168 hnbtnh.exe 4548 1vpvv.exe 2700 9vjdj.exe 3512 rxrlxrf.exe 5076 vpvpd.exe 1540 jpvjv.exe 1900 btbnhb.exe 3332 ppvvj.exe 3528 vpjvp.exe 2888 rflxlfr.exe 3692 hhnbtn.exe 1224 tnhtnh.exe 2900 ddjdp.exe 2636 xrlfxrl.exe 4024 nnnhtt.exe 3040 vddvp.exe 3488 xlrfxrf.exe 4380 ntnhtt.exe 3896 pdppd.exe 720 fxfxllx.exe 4668 9xfxfrx.exe 3840 hhtnbt.exe 4188 rlfxrll.exe 1168 lfffflf.exe 2112 bbtbht.exe 1584 vjppv.exe 684 llrlffx.exe 1132 vjpjd.exe 408 7jjvp.exe 2616 lxxrllf.exe 3448 ttbnnh.exe 4968 dvdvj.exe 3036 1fxrrrl.exe 1392 vvpvj.exe 8 xflfxlx.exe 4632 vjpdd.exe 4952 pvvpd.exe 4928 xfrlrlf.exe -
resource yara_rule behavioral2/memory/528-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4284-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1428-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/576-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/576-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2112-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-547-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 528 wrote to memory of 4032 528 706feb2bf94464c8f33496effd90174cbb73a28ce6b7086b7e7d5873271a7d8aN.exe 82 PID 528 wrote to memory of 4032 528 706feb2bf94464c8f33496effd90174cbb73a28ce6b7086b7e7d5873271a7d8aN.exe 82 PID 528 wrote to memory of 4032 528 706feb2bf94464c8f33496effd90174cbb73a28ce6b7086b7e7d5873271a7d8aN.exe 82 PID 4032 wrote to memory of 1268 4032 rllfxll.exe 83 PID 4032 wrote to memory of 1268 4032 rllfxll.exe 83 PID 4032 wrote to memory of 1268 4032 rllfxll.exe 83 PID 1268 wrote to memory of 224 1268 nhttbt.exe 84 PID 1268 wrote to memory of 224 1268 nhttbt.exe 84 PID 1268 wrote to memory of 224 1268 nhttbt.exe 84 PID 224 wrote to memory of 3912 224 bnnnhn.exe 85 PID 224 wrote to memory of 3912 224 bnnnhn.exe 85 PID 224 wrote to memory of 3912 224 bnnnhn.exe 85 PID 3912 wrote to memory of 1884 3912 btbthb.exe 86 PID 3912 wrote to memory of 1884 3912 btbthb.exe 86 PID 3912 wrote to memory of 1884 3912 btbthb.exe 86 PID 1884 wrote to memory of 3744 1884 5vdpp.exe 87 PID 1884 wrote to memory of 3744 1884 5vdpp.exe 87 PID 1884 wrote to memory of 3744 1884 5vdpp.exe 87 PID 3744 wrote to memory of 2256 3744 thhbtn.exe 88 PID 3744 wrote to memory of 2256 3744 thhbtn.exe 88 PID 3744 wrote to memory of 2256 3744 thhbtn.exe 88 PID 2256 wrote to memory of 2008 2256 3jjvv.exe 89 PID 2256 wrote to memory of 2008 2256 3jjvv.exe 89 PID 2256 wrote to memory of 2008 2256 3jjvv.exe 89 PID 2008 wrote to memory of 3448 2008 tthbtt.exe 90 PID 2008 wrote to memory of 3448 2008 tthbtt.exe 90 PID 2008 wrote to memory of 3448 2008 tthbtt.exe 90 PID 3448 wrote to memory of 4592 3448 dvdvp.exe 91 PID 3448 wrote to memory of 4592 3448 dvdvp.exe 91 PID 3448 wrote to memory of 4592 3448 dvdvp.exe 91 PID 4592 wrote to memory of 3148 4592 fxxrllf.exe 92 PID 4592 wrote to memory of 3148 4592 fxxrllf.exe 92 PID 4592 wrote to memory of 3148 4592 fxxrllf.exe 92 PID 3148 wrote to memory of 4284 3148 7xxxllf.exe 93 PID 3148 wrote to memory of 4284 3148 7xxxllf.exe 93 PID 3148 wrote to memory of 4284 3148 7xxxllf.exe 93 PID 4284 wrote to memory of 2904 4284 7hnbbh.exe 94 PID 4284 wrote to memory of 2904 4284 7hnbbh.exe 94 PID 4284 wrote to memory of 2904 4284 7hnbbh.exe 94 PID 2904 wrote to memory of 1556 2904 vdjdj.exe 95 PID 2904 wrote to memory of 1556 2904 vdjdj.exe 95 PID 2904 wrote to memory of 1556 2904 vdjdj.exe 95 PID 1556 wrote to memory of 3972 1556 htbtnt.exe 96 PID 1556 wrote to memory of 3972 1556 htbtnt.exe 96 PID 1556 wrote to memory of 3972 1556 htbtnt.exe 96 PID 3972 wrote to memory of 1772 3972 pvvdp.exe 97 PID 3972 wrote to memory of 1772 3972 pvvdp.exe 97 PID 3972 wrote to memory of 1772 3972 pvvdp.exe 97 PID 1772 wrote to memory of 4912 1772 ffrrxxl.exe 98 PID 1772 wrote to memory of 4912 1772 ffrrxxl.exe 98 PID 1772 wrote to memory of 4912 1772 ffrrxxl.exe 98 PID 4912 wrote to memory of 968 4912 7ppjv.exe 99 PID 4912 wrote to memory of 968 4912 7ppjv.exe 99 PID 4912 wrote to memory of 968 4912 7ppjv.exe 99 PID 968 wrote to memory of 3844 968 jjjdv.exe 100 PID 968 wrote to memory of 3844 968 jjjdv.exe 100 PID 968 wrote to memory of 3844 968 jjjdv.exe 100 PID 3844 wrote to memory of 3724 3844 xflfxxx.exe 101 PID 3844 wrote to memory of 3724 3844 xflfxxx.exe 101 PID 3844 wrote to memory of 3724 3844 xflfxxx.exe 101 PID 3724 wrote to memory of 576 3724 pvdpj.exe 102 PID 3724 wrote to memory of 576 3724 pvdpj.exe 102 PID 3724 wrote to memory of 576 3724 pvdpj.exe 102 PID 576 wrote to memory of 1428 576 pjpjd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\706feb2bf94464c8f33496effd90174cbb73a28ce6b7086b7e7d5873271a7d8aN.exe"C:\Users\Admin\AppData\Local\Temp\706feb2bf94464c8f33496effd90174cbb73a28ce6b7086b7e7d5873271a7d8aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\rllfxll.exec:\rllfxll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\nhttbt.exec:\nhttbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\bnnnhn.exec:\bnnnhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\btbthb.exec:\btbthb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\5vdpp.exec:\5vdpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\thhbtn.exec:\thhbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\3jjvv.exec:\3jjvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\tthbtt.exec:\tthbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\dvdvp.exec:\dvdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\fxxrllf.exec:\fxxrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\7xxxllf.exec:\7xxxllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\7hnbbh.exec:\7hnbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\vdjdj.exec:\vdjdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\htbtnt.exec:\htbtnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\pvvdp.exec:\pvvdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\ffrrxxl.exec:\ffrrxxl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\7ppjv.exec:\7ppjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\jjjdv.exec:\jjjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\xflfxxx.exec:\xflfxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\pvdpj.exec:\pvdpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\pjpjd.exec:\pjpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\tnnhbt.exec:\tnnhbt.exe23⤵
- Executes dropped EXE
PID:1428 -
\??\c:\ntbtnn.exec:\ntbtnn.exe24⤵
- Executes dropped EXE
PID:4500 -
\??\c:\lrfrffx.exec:\lrfrffx.exe25⤵
- Executes dropped EXE
PID:4624 -
\??\c:\rxrlfrr.exec:\rxrlfrr.exe26⤵
- Executes dropped EXE
PID:4776 -
\??\c:\1rlfrrl.exec:\1rlfrrl.exe27⤵
- Executes dropped EXE
PID:3356 -
\??\c:\hnbtnh.exec:\hnbtnh.exe28⤵
- Executes dropped EXE
PID:4168 -
\??\c:\1vpvv.exec:\1vpvv.exe29⤵
- Executes dropped EXE
PID:4548 -
\??\c:\9vjdj.exec:\9vjdj.exe30⤵
- Executes dropped EXE
PID:2700 -
\??\c:\rxrlxrf.exec:\rxrlxrf.exe31⤵
- Executes dropped EXE
PID:3512 -
\??\c:\vpvpd.exec:\vpvpd.exe32⤵
- Executes dropped EXE
PID:5076 -
\??\c:\jpvjv.exec:\jpvjv.exe33⤵
- Executes dropped EXE
PID:1540 -
\??\c:\btbnhb.exec:\btbnhb.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1900 -
\??\c:\ppvvj.exec:\ppvvj.exe35⤵
- Executes dropped EXE
PID:3332 -
\??\c:\vpjvp.exec:\vpjvp.exe36⤵
- Executes dropped EXE
PID:3528 -
\??\c:\rflxlfr.exec:\rflxlfr.exe37⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hhnbtn.exec:\hhnbtn.exe38⤵
- Executes dropped EXE
PID:3692 -
\??\c:\tnhtnh.exec:\tnhtnh.exe39⤵
- Executes dropped EXE
PID:1224 -
\??\c:\ddjdp.exec:\ddjdp.exe40⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe41⤵
- Executes dropped EXE
PID:2636 -
\??\c:\nnnhtt.exec:\nnnhtt.exe42⤵
- Executes dropped EXE
PID:4024 -
\??\c:\vddvp.exec:\vddvp.exe43⤵
- Executes dropped EXE
PID:3040 -
\??\c:\xlrfxrf.exec:\xlrfxrf.exe44⤵
- Executes dropped EXE
PID:3488 -
\??\c:\ntnhtt.exec:\ntnhtt.exe45⤵
- Executes dropped EXE
PID:4380 -
\??\c:\pdppd.exec:\pdppd.exe46⤵
- Executes dropped EXE
PID:3896 -
\??\c:\fxfxllx.exec:\fxfxllx.exe47⤵
- Executes dropped EXE
PID:720 -
\??\c:\9xfxfrx.exec:\9xfxfrx.exe48⤵
- Executes dropped EXE
PID:4668 -
\??\c:\hhtnbt.exec:\hhtnbt.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3840 -
\??\c:\rlfxrll.exec:\rlfxrll.exe50⤵
- Executes dropped EXE
PID:4188 -
\??\c:\lfffflf.exec:\lfffflf.exe51⤵
- Executes dropped EXE
PID:1168 -
\??\c:\bbtbht.exec:\bbtbht.exe52⤵
- Executes dropped EXE
PID:2112 -
\??\c:\vjppv.exec:\vjppv.exe53⤵
- Executes dropped EXE
PID:1584 -
\??\c:\llrlffx.exec:\llrlffx.exe54⤵
- Executes dropped EXE
PID:684 -
\??\c:\vjpjd.exec:\vjpjd.exe55⤵
- Executes dropped EXE
PID:1132 -
\??\c:\7jjvp.exec:\7jjvp.exe56⤵
- Executes dropped EXE
PID:408 -
\??\c:\lxxrllf.exec:\lxxrllf.exe57⤵
- Executes dropped EXE
PID:2616 -
\??\c:\ttbnnh.exec:\ttbnnh.exe58⤵
- Executes dropped EXE
PID:3448 -
\??\c:\dvdvj.exec:\dvdvj.exe59⤵
- Executes dropped EXE
PID:4968 -
\??\c:\1fxrrrl.exec:\1fxrrrl.exe60⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vvpvj.exec:\vvpvj.exe61⤵
- Executes dropped EXE
PID:1392 -
\??\c:\xflfxlx.exec:\xflfxlx.exe62⤵
- Executes dropped EXE
PID:8 -
\??\c:\vjpdd.exec:\vjpdd.exe63⤵
- Executes dropped EXE
PID:4632 -
\??\c:\pvvpd.exec:\pvvpd.exe64⤵
- Executes dropped EXE
PID:4952 -
\??\c:\xfrlrlf.exec:\xfrlrlf.exe65⤵
- Executes dropped EXE
PID:4928 -
\??\c:\btnthh.exec:\btnthh.exe66⤵PID:3372
-
\??\c:\hhhbtn.exec:\hhhbtn.exe67⤵PID:4120
-
\??\c:\pdjvj.exec:\pdjvj.exe68⤵PID:1996
-
\??\c:\xrxrrll.exec:\xrxrrll.exe69⤵PID:4352
-
\??\c:\ntnnbb.exec:\ntnnbb.exe70⤵
- System Location Discovery: System Language Discovery
PID:4404 -
\??\c:\5jjdp.exec:\5jjdp.exe71⤵PID:4060
-
\??\c:\9lfrllx.exec:\9lfrllx.exe72⤵PID:2104
-
\??\c:\hhtthn.exec:\hhtthn.exe73⤵PID:3604
-
\??\c:\5pjvp.exec:\5pjvp.exe74⤵PID:3984
-
\??\c:\ppjjd.exec:\ppjjd.exe75⤵PID:2176
-
\??\c:\xrrlxfr.exec:\xrrlxfr.exe76⤵PID:2448
-
\??\c:\3tnhbb.exec:\3tnhbb.exe77⤵PID:1428
-
\??\c:\dvvvp.exec:\dvvvp.exe78⤵PID:3044
-
\??\c:\xlfxrlx.exec:\xlfxrlx.exe79⤵PID:1388
-
\??\c:\ttnhbt.exec:\ttnhbt.exe80⤵PID:5068
-
\??\c:\vvpjd.exec:\vvpjd.exe81⤵PID:1272
-
\??\c:\9xxrlxr.exec:\9xxrlxr.exe82⤵PID:1724
-
\??\c:\xllfxrl.exec:\xllfxrl.exe83⤵PID:3720
-
\??\c:\7tthbb.exec:\7tthbb.exe84⤵PID:4696
-
\??\c:\5ppjd.exec:\5ppjd.exe85⤵PID:4408
-
\??\c:\frxrlfx.exec:\frxrlfx.exe86⤵PID:780
-
\??\c:\rllxlfr.exec:\rllxlfr.exe87⤵PID:2216
-
\??\c:\ntbnbt.exec:\ntbnbt.exe88⤵PID:3028
-
\??\c:\vjjvp.exec:\vjjvp.exe89⤵PID:3280
-
\??\c:\pdjvp.exec:\pdjvp.exe90⤵PID:3272
-
\??\c:\llrlrrx.exec:\llrlrrx.exe91⤵PID:1708
-
\??\c:\thbhbn.exec:\thbhbn.exe92⤵PID:3736
-
\??\c:\hbhntn.exec:\hbhntn.exe93⤵PID:3332
-
\??\c:\vpjdp.exec:\vpjdp.exe94⤵PID:3528
-
\??\c:\flrlfxx.exec:\flrlfxx.exe95⤵PID:2344
-
\??\c:\xrlflfx.exec:\xrlflfx.exe96⤵PID:2236
-
\??\c:\bntntt.exec:\bntntt.exe97⤵PID:508
-
\??\c:\vdjvd.exec:\vdjvd.exe98⤵PID:2688
-
\??\c:\lllllff.exec:\lllllff.exe99⤵PID:4888
-
\??\c:\hnnhbb.exec:\hnnhbb.exe100⤵PID:5008
-
\??\c:\vvpjv.exec:\vvpjv.exe101⤵PID:4392
-
\??\c:\vppjv.exec:\vppjv.exe102⤵PID:3040
-
\??\c:\xrrfrlf.exec:\xrrfrlf.exe103⤵PID:4376
-
\??\c:\nnnbtt.exec:\nnnbtt.exe104⤵PID:524
-
\??\c:\7pdpj.exec:\7pdpj.exe105⤵PID:928
-
\??\c:\7xfxffr.exec:\7xfxffr.exe106⤵PID:4560
-
\??\c:\lxxxrrf.exec:\lxxxrrf.exe107⤵PID:4788
-
\??\c:\bnnhhh.exec:\bnnhhh.exe108⤵PID:4172
-
\??\c:\7pvvp.exec:\7pvvp.exe109⤵PID:1088
-
\??\c:\lxfrlfr.exec:\lxfrlfr.exe110⤵PID:1808
-
\??\c:\lxffxlf.exec:\lxffxlf.exe111⤵PID:1544
-
\??\c:\7bbbnn.exec:\7bbbnn.exe112⤵PID:4016
-
\??\c:\jvvpp.exec:\jvvpp.exe113⤵PID:5060
-
\??\c:\xxfxllf.exec:\xxfxllf.exe114⤵PID:3388
-
\??\c:\nnnhbb.exec:\nnnhbb.exe115⤵PID:1036
-
\??\c:\tbhbtt.exec:\tbhbtt.exe116⤵PID:1372
-
\??\c:\7ddpv.exec:\7ddpv.exe117⤵PID:2696
-
\??\c:\xlllffx.exec:\xlllffx.exe118⤵PID:5064
-
\??\c:\5fxrllf.exec:\5fxrllf.exe119⤵PID:2380
-
\??\c:\nthnnt.exec:\nthnnt.exe120⤵PID:4828
-
\??\c:\jvvpj.exec:\jvvpj.exe121⤵PID:1392
-
\??\c:\1pdvv.exec:\1pdvv.exe122⤵PID:4908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-