Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 21:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
80b3c31162699734c9e1845479a6fe369e74105d14f5a12706f0656a326d962b.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
80b3c31162699734c9e1845479a6fe369e74105d14f5a12706f0656a326d962b.exe
-
Size
454KB
-
MD5
3924eb19bd5c7b2164c4345dd65e67b1
-
SHA1
7acc0f02067e34a48d1d0d558e963104ff951037
-
SHA256
80b3c31162699734c9e1845479a6fe369e74105d14f5a12706f0656a326d962b
-
SHA512
49a916105cfa1bb61247a5a72953b69e4c9565c324b9bbd3e41efee670443320ff0e4b4a5ae54fb4b79032150b460644e2cfac2f8fce3f44f2e7c4593e18099e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeG:q7Tc2NYHUrAwfMp3CDG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4876-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1148-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/992-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1840-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-656-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-755-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-797-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-840-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-853-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-950-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-1493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-1596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5112 nbbtnn.exe 224 3ttntn.exe 4752 pjvpp.exe 212 ppjvp.exe 1532 bthbbb.exe 3832 7pjvp.exe 4716 xxxlfxl.exe 1148 pdpdp.exe 1060 rflfxrl.exe 3716 tnhbth.exe 1624 thbnbh.exe 3620 vdjdv.exe 3060 1nnhnn.exe 2548 nbbttt.exe 992 vpdvv.exe 2440 dvppj.exe 4404 lrrlxrf.exe 3548 jdddv.exe 3508 jpvjd.exe 624 xrrllff.exe 2040 ppvjd.exe 4748 xrxrrll.exe 4760 bbbbbb.exe 5064 tttttt.exe 2012 xfllfff.exe 2796 3hhbtn.exe 4484 xxrlffx.exe 3520 thhbtt.exe 668 ppdpj.exe 2096 hbnnhh.exe 1776 vpjdj.exe 4804 5bbttt.exe 2712 7llfxxl.exe 960 rxxxrrr.exe 1964 tbnhhb.exe 5072 ppddv.exe 4852 frrllfx.exe 1636 htbnbt.exe 4372 pdddv.exe 5000 vjdpd.exe 5116 rflfxxf.exe 3500 bthbth.exe 1584 lffxrlf.exe 1168 xlllffx.exe 1840 nhbttb.exe 4912 llfrffr.exe 4352 llxxrff.exe 988 hbbbbb.exe 1448 9tbbtb.exe 3264 jddvp.exe 3280 rrrfrrx.exe 1472 5bhnhh.exe 220 dpdvp.exe 2452 lffxxrr.exe 1856 nhnhbh.exe 2264 hnbtnt.exe 4420 jvdvp.exe 3844 xrrlffx.exe 364 tntnhh.exe 1044 nbhbtn.exe 4604 jvjdj.exe 2016 fxllffx.exe 2692 fxllrrx.exe 1468 nhtnnh.exe -
resource yara_rule behavioral2/memory/4876-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/992-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1840-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1568-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-797-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-840-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-853-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4876 wrote to memory of 5112 4876 80b3c31162699734c9e1845479a6fe369e74105d14f5a12706f0656a326d962b.exe 82 PID 4876 wrote to memory of 5112 4876 80b3c31162699734c9e1845479a6fe369e74105d14f5a12706f0656a326d962b.exe 82 PID 4876 wrote to memory of 5112 4876 80b3c31162699734c9e1845479a6fe369e74105d14f5a12706f0656a326d962b.exe 82 PID 5112 wrote to memory of 224 5112 nbbtnn.exe 83 PID 5112 wrote to memory of 224 5112 nbbtnn.exe 83 PID 5112 wrote to memory of 224 5112 nbbtnn.exe 83 PID 224 wrote to memory of 4752 224 3ttntn.exe 84 PID 224 wrote to memory of 4752 224 3ttntn.exe 84 PID 224 wrote to memory of 4752 224 3ttntn.exe 84 PID 4752 wrote to memory of 212 4752 pjvpp.exe 85 PID 4752 wrote to memory of 212 4752 pjvpp.exe 85 PID 4752 wrote to memory of 212 4752 pjvpp.exe 85 PID 212 wrote to memory of 1532 212 ppjvp.exe 86 PID 212 wrote to memory of 1532 212 ppjvp.exe 86 PID 212 wrote to memory of 1532 212 ppjvp.exe 86 PID 1532 wrote to memory of 3832 1532 bthbbb.exe 87 PID 1532 wrote to memory of 3832 1532 bthbbb.exe 87 PID 1532 wrote to memory of 3832 1532 bthbbb.exe 87 PID 3832 wrote to memory of 4716 3832 7pjvp.exe 88 PID 3832 wrote to memory of 4716 3832 7pjvp.exe 88 PID 3832 wrote to memory of 4716 3832 7pjvp.exe 88 PID 4716 wrote to memory of 1148 4716 xxxlfxl.exe 89 PID 4716 wrote to memory of 1148 4716 xxxlfxl.exe 89 PID 4716 wrote to memory of 1148 4716 xxxlfxl.exe 89 PID 1148 wrote to memory of 1060 1148 pdpdp.exe 90 PID 1148 wrote to memory of 1060 1148 pdpdp.exe 90 PID 1148 wrote to memory of 1060 1148 pdpdp.exe 90 PID 1060 wrote to memory of 3716 1060 rflfxrl.exe 91 PID 1060 wrote to memory of 3716 1060 rflfxrl.exe 91 PID 1060 wrote to memory of 3716 1060 rflfxrl.exe 91 PID 3716 wrote to memory of 1624 3716 tnhbth.exe 92 PID 3716 wrote to memory of 1624 3716 tnhbth.exe 92 PID 3716 wrote to memory of 1624 3716 tnhbth.exe 92 PID 1624 wrote to memory of 3620 1624 thbnbh.exe 93 PID 1624 wrote to memory of 3620 1624 thbnbh.exe 93 PID 1624 wrote to memory of 3620 1624 thbnbh.exe 93 PID 3620 wrote to memory of 3060 3620 vdjdv.exe 94 PID 3620 wrote to memory of 3060 3620 vdjdv.exe 94 PID 3620 wrote to memory of 3060 3620 vdjdv.exe 94 PID 3060 wrote to memory of 2548 3060 1nnhnn.exe 95 PID 3060 wrote to memory of 2548 3060 1nnhnn.exe 95 PID 3060 wrote to memory of 2548 3060 1nnhnn.exe 95 PID 2548 wrote to memory of 992 2548 nbbttt.exe 96 PID 2548 wrote to memory of 992 2548 nbbttt.exe 96 PID 2548 wrote to memory of 992 2548 nbbttt.exe 96 PID 992 wrote to memory of 2440 992 vpdvv.exe 97 PID 992 wrote to memory of 2440 992 vpdvv.exe 97 PID 992 wrote to memory of 2440 992 vpdvv.exe 97 PID 2440 wrote to memory of 4404 2440 dvppj.exe 98 PID 2440 wrote to memory of 4404 2440 dvppj.exe 98 PID 2440 wrote to memory of 4404 2440 dvppj.exe 98 PID 4404 wrote to memory of 3548 4404 lrrlxrf.exe 99 PID 4404 wrote to memory of 3548 4404 lrrlxrf.exe 99 PID 4404 wrote to memory of 3548 4404 lrrlxrf.exe 99 PID 3548 wrote to memory of 3508 3548 jdddv.exe 100 PID 3548 wrote to memory of 3508 3548 jdddv.exe 100 PID 3548 wrote to memory of 3508 3548 jdddv.exe 100 PID 3508 wrote to memory of 624 3508 jpvjd.exe 101 PID 3508 wrote to memory of 624 3508 jpvjd.exe 101 PID 3508 wrote to memory of 624 3508 jpvjd.exe 101 PID 624 wrote to memory of 2040 624 xrrllff.exe 102 PID 624 wrote to memory of 2040 624 xrrllff.exe 102 PID 624 wrote to memory of 2040 624 xrrllff.exe 102 PID 2040 wrote to memory of 4748 2040 ppvjd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\80b3c31162699734c9e1845479a6fe369e74105d14f5a12706f0656a326d962b.exe"C:\Users\Admin\AppData\Local\Temp\80b3c31162699734c9e1845479a6fe369e74105d14f5a12706f0656a326d962b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\nbbtnn.exec:\nbbtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\3ttntn.exec:\3ttntn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\pjvpp.exec:\pjvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\ppjvp.exec:\ppjvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\bthbbb.exec:\bthbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\7pjvp.exec:\7pjvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\xxxlfxl.exec:\xxxlfxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\pdpdp.exec:\pdpdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\rflfxrl.exec:\rflfxrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\tnhbth.exec:\tnhbth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\thbnbh.exec:\thbnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\vdjdv.exec:\vdjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\1nnhnn.exec:\1nnhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\nbbttt.exec:\nbbttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\vpdvv.exec:\vpdvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\dvppj.exec:\dvppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\lrrlxrf.exec:\lrrlxrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\jdddv.exec:\jdddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\jpvjd.exec:\jpvjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\xrrllff.exec:\xrrllff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\ppvjd.exec:\ppvjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\xrxrrll.exec:\xrxrrll.exe23⤵
- Executes dropped EXE
PID:4748 -
\??\c:\bbbbbb.exec:\bbbbbb.exe24⤵
- Executes dropped EXE
PID:4760 -
\??\c:\tttttt.exec:\tttttt.exe25⤵
- Executes dropped EXE
PID:5064 -
\??\c:\xfllfff.exec:\xfllfff.exe26⤵
- Executes dropped EXE
PID:2012 -
\??\c:\3hhbtn.exec:\3hhbtn.exe27⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xxrlffx.exec:\xxrlffx.exe28⤵
- Executes dropped EXE
PID:4484 -
\??\c:\thhbtt.exec:\thhbtt.exe29⤵
- Executes dropped EXE
PID:3520 -
\??\c:\ppdpj.exec:\ppdpj.exe30⤵
- Executes dropped EXE
PID:668 -
\??\c:\hbnnhh.exec:\hbnnhh.exe31⤵
- Executes dropped EXE
PID:2096 -
\??\c:\vpjdj.exec:\vpjdj.exe32⤵
- Executes dropped EXE
PID:1776 -
\??\c:\5bbttt.exec:\5bbttt.exe33⤵
- Executes dropped EXE
PID:4804 -
\??\c:\7llfxxl.exec:\7llfxxl.exe34⤵
- Executes dropped EXE
PID:2712 -
\??\c:\rxxxrrr.exec:\rxxxrrr.exe35⤵
- Executes dropped EXE
PID:960 -
\??\c:\tbnhhb.exec:\tbnhhb.exe36⤵
- Executes dropped EXE
PID:1964 -
\??\c:\ppddv.exec:\ppddv.exe37⤵
- Executes dropped EXE
PID:5072 -
\??\c:\frrllfx.exec:\frrllfx.exe38⤵
- Executes dropped EXE
PID:4852 -
\??\c:\htbnbt.exec:\htbnbt.exe39⤵
- Executes dropped EXE
PID:1636 -
\??\c:\pdddv.exec:\pdddv.exe40⤵
- Executes dropped EXE
PID:4372 -
\??\c:\vjdpd.exec:\vjdpd.exe41⤵
- Executes dropped EXE
PID:5000 -
\??\c:\rflfxxf.exec:\rflfxxf.exe42⤵
- Executes dropped EXE
PID:5116 -
\??\c:\bthbth.exec:\bthbth.exe43⤵
- Executes dropped EXE
PID:3500 -
\??\c:\lffxrlf.exec:\lffxrlf.exe44⤵
- Executes dropped EXE
PID:1584 -
\??\c:\xlllffx.exec:\xlllffx.exe45⤵
- Executes dropped EXE
PID:1168 -
\??\c:\nhbttb.exec:\nhbttb.exe46⤵
- Executes dropped EXE
PID:1840 -
\??\c:\llfrffr.exec:\llfrffr.exe47⤵
- Executes dropped EXE
PID:4912 -
\??\c:\llxxrff.exec:\llxxrff.exe48⤵
- Executes dropped EXE
PID:4352 -
\??\c:\hbbbbb.exec:\hbbbbb.exe49⤵
- Executes dropped EXE
PID:988 -
\??\c:\9tbbtb.exec:\9tbbtb.exe50⤵
- Executes dropped EXE
PID:1448 -
\??\c:\jddvp.exec:\jddvp.exe51⤵
- Executes dropped EXE
PID:3264 -
\??\c:\rrrfrrx.exec:\rrrfrrx.exe52⤵
- Executes dropped EXE
PID:3280 -
\??\c:\5bhnhh.exec:\5bhnhh.exe53⤵
- Executes dropped EXE
PID:1472 -
\??\c:\dpdvp.exec:\dpdvp.exe54⤵
- Executes dropped EXE
PID:220 -
\??\c:\lffxxrr.exec:\lffxxrr.exe55⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nhnhbh.exec:\nhnhbh.exe56⤵
- Executes dropped EXE
PID:1856 -
\??\c:\hnbtnt.exec:\hnbtnt.exe57⤵
- Executes dropped EXE
PID:2264 -
\??\c:\jvdvp.exec:\jvdvp.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4420 -
\??\c:\xrrlffx.exec:\xrrlffx.exe59⤵
- Executes dropped EXE
PID:3844 -
\??\c:\tntnhh.exec:\tntnhh.exe60⤵
- Executes dropped EXE
PID:364 -
\??\c:\nbhbtn.exec:\nbhbtn.exe61⤵
- Executes dropped EXE
PID:1044 -
\??\c:\jvjdj.exec:\jvjdj.exe62⤵
- Executes dropped EXE
PID:4604 -
\??\c:\fxllffx.exec:\fxllffx.exe63⤵
- Executes dropped EXE
PID:2016 -
\??\c:\fxllrrx.exec:\fxllrrx.exe64⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nhtnnh.exec:\nhtnnh.exe65⤵
- Executes dropped EXE
PID:1468 -
\??\c:\vpvvp.exec:\vpvvp.exe66⤵PID:3328
-
\??\c:\xlrlxxx.exec:\xlrlxxx.exe67⤵PID:2180
-
\??\c:\fflflfl.exec:\fflflfl.exe68⤵PID:4680
-
\??\c:\btbbtt.exec:\btbbtt.exe69⤵PID:628
-
\??\c:\nntnhh.exec:\nntnhh.exe70⤵PID:2032
-
\??\c:\vjpjd.exec:\vjpjd.exe71⤵PID:2508
-
\??\c:\flxfxxr.exec:\flxfxxr.exe72⤵PID:1328
-
\??\c:\9nhbhb.exec:\9nhbhb.exe73⤵PID:4504
-
\??\c:\pdjjd.exec:\pdjjd.exe74⤵PID:4404
-
\??\c:\pjjjd.exec:\pjjjd.exe75⤵PID:228
-
\??\c:\7xxxxxx.exec:\7xxxxxx.exe76⤵PID:4256
-
\??\c:\tbnhbb.exec:\tbnhbb.exe77⤵PID:3636
-
\??\c:\pvdvp.exec:\pvdvp.exe78⤵PID:3064
-
\??\c:\xflfffx.exec:\xflfffx.exe79⤵PID:4656
-
\??\c:\jvdvj.exec:\jvdvj.exe80⤵PID:848
-
\??\c:\ffxrrrr.exec:\ffxrrrr.exe81⤵PID:3348
-
\??\c:\rrxrlfr.exec:\rrxrlfr.exe82⤵PID:1628
-
\??\c:\nhtbhh.exec:\nhtbhh.exe83⤵PID:4048
-
\??\c:\bntnhb.exec:\bntnhb.exe84⤵PID:724
-
\??\c:\ddvvd.exec:\ddvvd.exe85⤵PID:2336
-
\??\c:\llfxxrl.exec:\llfxxrl.exe86⤵PID:2012
-
\??\c:\bhnttb.exec:\bhnttb.exe87⤵PID:2796
-
\??\c:\pjjdp.exec:\pjjdp.exe88⤵PID:4260
-
\??\c:\vpvpj.exec:\vpvpj.exe89⤵PID:3904
-
\??\c:\llfxxxx.exec:\llfxxxx.exe90⤵PID:900
-
\??\c:\1tbtnt.exec:\1tbtnt.exe91⤵PID:908
-
\??\c:\jpdvd.exec:\jpdvd.exe92⤵PID:1568
-
\??\c:\5pdvd.exec:\5pdvd.exe93⤵PID:864
-
\??\c:\xxlxlll.exec:\xxlxlll.exe94⤵PID:1776
-
\??\c:\nthbnn.exec:\nthbnn.exe95⤵PID:868
-
\??\c:\9jjdv.exec:\9jjdv.exe96⤵PID:2900
-
\??\c:\vdjdj.exec:\vdjdj.exe97⤵PID:960
-
\??\c:\xrrlxxx.exec:\xrrlxxx.exe98⤵PID:3704
-
\??\c:\bnntnn.exec:\bnntnn.exe99⤵PID:1632
-
\??\c:\vpvpp.exec:\vpvpp.exe100⤵PID:4940
-
\??\c:\jjppv.exec:\jjppv.exe101⤵PID:1028
-
\??\c:\ffrlfxr.exec:\ffrlfxr.exe102⤵PID:3168
-
\??\c:\nhnhbn.exec:\nhnhbn.exe103⤵PID:3132
-
\??\c:\btbtnh.exec:\btbtnh.exe104⤵PID:3592
-
\??\c:\pjpjd.exec:\pjpjd.exe105⤵PID:748
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe106⤵PID:2864
-
\??\c:\1nnhhh.exec:\1nnhhh.exe107⤵PID:2380
-
\??\c:\jdjdp.exec:\jdjdp.exe108⤵PID:4488
-
\??\c:\lxflxlf.exec:\lxflxlf.exe109⤵PID:4344
-
\??\c:\lfxrllf.exec:\lfxrllf.exe110⤵PID:4908
-
\??\c:\9nnnhh.exec:\9nnnhh.exe111⤵PID:5040
-
\??\c:\djvpj.exec:\djvpj.exe112⤵PID:1404
-
\??\c:\rflfrrl.exec:\rflfrrl.exe113⤵PID:2428
-
\??\c:\btbttb.exec:\btbttb.exe114⤵PID:2628
-
\??\c:\pdjdv.exec:\pdjdv.exe115⤵PID:1400
-
\??\c:\3vvvv.exec:\3vvvv.exe116⤵
- System Location Discovery: System Language Discovery
PID:1804 -
\??\c:\rrflxrx.exec:\rrflxrx.exe117⤵PID:3640
-
\??\c:\nnhnhn.exec:\nnhnhn.exe118⤵PID:3424
-
\??\c:\jjddd.exec:\jjddd.exe119⤵PID:3624
-
\??\c:\vjvpd.exec:\vjvpd.exe120⤵PID:1588
-
\??\c:\rlrlffx.exec:\rlrlffx.exe121⤵PID:3832
-
\??\c:\tnnttt.exec:\tnnttt.exe122⤵PID:3844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-