Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 03:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9b8a4caf1ae03a8c8ff3187f0b6c995d4499cf6cf8fbfbcd48a15e953744f2f3N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9b8a4caf1ae03a8c8ff3187f0b6c995d4499cf6cf8fbfbcd48a15e953744f2f3N.exe
-
Size
456KB
-
MD5
ce3570d9f4d91ee1c97e7e78e77bb8a0
-
SHA1
5c67965794ac6e10955381e1588ef2d4162f2016
-
SHA256
9b8a4caf1ae03a8c8ff3187f0b6c995d4499cf6cf8fbfbcd48a15e953744f2f3
-
SHA512
2d1ea8396f930c20fa7dd912473112b608ab40e2dfa1e1b2447a34f5089b7719a4fe0fc66cc7e4515122639f833b85fe85acf2a19f02bf71c8092ca9f3138253
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe0:q7Tc2NYHUrAwfMp3CD0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2896-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/112-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/516-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1120-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-607-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-641-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-943-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-1772-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 396 ntbttt.exe 2676 rxllfrr.exe 3704 9tnhhh.exe 1676 jddvp.exe 2200 bnttbh.exe 2500 fxrrrrr.exe 116 jdjdp.exe 2892 rrrxxff.exe 760 hbhbbb.exe 1564 9jvpp.exe 2476 hhtttt.exe 4396 jjjjd.exe 2724 llrflfl.exe 1976 hbhbnn.exe 3020 htnhbn.exe 2400 vvjjj.exe 3184 lfrllff.exe 3616 hthnnn.exe 868 bnbbhh.exe 2612 9jdvp.exe 2396 ttttnn.exe 3448 fxxrlfx.exe 4508 lrlfffx.exe 3468 dvppp.exe 4784 xlrrxrx.exe 4540 rrrllll.exe 2096 1vpjv.exe 2120 hthbtt.exe 4064 vdjpd.exe 2652 hbnhbb.exe 848 nntnhb.exe 624 ddppj.exe 4440 xlfrxrr.exe 1376 3lxrxxf.exe 5052 ddppj.exe 4368 hbhbhn.exe 1472 nhhbnb.exe 2004 pdjdp.exe 3576 rrllfxx.exe 2900 bnntnb.exe 3948 vvjjd.exe 992 llrlfff.exe 4072 tbhhbb.exe 1716 thnnhn.exe 2880 1ppjd.exe 1896 9rllffx.exe 100 7lfrllf.exe 4348 bnnhhb.exe 940 jppdp.exe 2896 xxxrfxl.exe 396 thhbtb.exe 1428 5ddpv.exe 1692 lrrrffx.exe 4884 xrrllfx.exe 5036 htnhbb.exe 2936 djjdp.exe 112 1rrrffx.exe 4124 5ttntn.exe 1504 vpvpv.exe 2756 fxrlffx.exe 516 htnhbb.exe 4376 5jdjv.exe 1480 xrlfffl.exe 408 bhnnhh.exe -
resource yara_rule behavioral2/memory/2896-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3704-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/112-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-607-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ntnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2896 wrote to memory of 396 2896 9b8a4caf1ae03a8c8ff3187f0b6c995d4499cf6cf8fbfbcd48a15e953744f2f3N.exe 83 PID 2896 wrote to memory of 396 2896 9b8a4caf1ae03a8c8ff3187f0b6c995d4499cf6cf8fbfbcd48a15e953744f2f3N.exe 83 PID 2896 wrote to memory of 396 2896 9b8a4caf1ae03a8c8ff3187f0b6c995d4499cf6cf8fbfbcd48a15e953744f2f3N.exe 83 PID 396 wrote to memory of 2676 396 ntbttt.exe 84 PID 396 wrote to memory of 2676 396 ntbttt.exe 84 PID 396 wrote to memory of 2676 396 ntbttt.exe 84 PID 2676 wrote to memory of 3704 2676 rxllfrr.exe 85 PID 2676 wrote to memory of 3704 2676 rxllfrr.exe 85 PID 2676 wrote to memory of 3704 2676 rxllfrr.exe 85 PID 3704 wrote to memory of 1676 3704 9tnhhh.exe 86 PID 3704 wrote to memory of 1676 3704 9tnhhh.exe 86 PID 3704 wrote to memory of 1676 3704 9tnhhh.exe 86 PID 1676 wrote to memory of 2200 1676 jddvp.exe 87 PID 1676 wrote to memory of 2200 1676 jddvp.exe 87 PID 1676 wrote to memory of 2200 1676 jddvp.exe 87 PID 2200 wrote to memory of 2500 2200 bnttbh.exe 88 PID 2200 wrote to memory of 2500 2200 bnttbh.exe 88 PID 2200 wrote to memory of 2500 2200 bnttbh.exe 88 PID 2500 wrote to memory of 116 2500 fxrrrrr.exe 89 PID 2500 wrote to memory of 116 2500 fxrrrrr.exe 89 PID 2500 wrote to memory of 116 2500 fxrrrrr.exe 89 PID 116 wrote to memory of 2892 116 jdjdp.exe 90 PID 116 wrote to memory of 2892 116 jdjdp.exe 90 PID 116 wrote to memory of 2892 116 jdjdp.exe 90 PID 2892 wrote to memory of 760 2892 rrrxxff.exe 91 PID 2892 wrote to memory of 760 2892 rrrxxff.exe 91 PID 2892 wrote to memory of 760 2892 rrrxxff.exe 91 PID 760 wrote to memory of 1564 760 hbhbbb.exe 92 PID 760 wrote to memory of 1564 760 hbhbbb.exe 92 PID 760 wrote to memory of 1564 760 hbhbbb.exe 92 PID 1564 wrote to memory of 2476 1564 9jvpp.exe 93 PID 1564 wrote to memory of 2476 1564 9jvpp.exe 93 PID 1564 wrote to memory of 2476 1564 9jvpp.exe 93 PID 2476 wrote to memory of 4396 2476 hhtttt.exe 94 PID 2476 wrote to memory of 4396 2476 hhtttt.exe 94 PID 2476 wrote to memory of 4396 2476 hhtttt.exe 94 PID 4396 wrote to memory of 2724 4396 jjjjd.exe 95 PID 4396 wrote to memory of 2724 4396 jjjjd.exe 95 PID 4396 wrote to memory of 2724 4396 jjjjd.exe 95 PID 2724 wrote to memory of 1976 2724 llrflfl.exe 96 PID 2724 wrote to memory of 1976 2724 llrflfl.exe 96 PID 2724 wrote to memory of 1976 2724 llrflfl.exe 96 PID 1976 wrote to memory of 3020 1976 hbhbnn.exe 97 PID 1976 wrote to memory of 3020 1976 hbhbnn.exe 97 PID 1976 wrote to memory of 3020 1976 hbhbnn.exe 97 PID 3020 wrote to memory of 2400 3020 htnhbn.exe 98 PID 3020 wrote to memory of 2400 3020 htnhbn.exe 98 PID 3020 wrote to memory of 2400 3020 htnhbn.exe 98 PID 2400 wrote to memory of 3184 2400 vvjjj.exe 99 PID 2400 wrote to memory of 3184 2400 vvjjj.exe 99 PID 2400 wrote to memory of 3184 2400 vvjjj.exe 99 PID 3184 wrote to memory of 3616 3184 lfrllff.exe 100 PID 3184 wrote to memory of 3616 3184 lfrllff.exe 100 PID 3184 wrote to memory of 3616 3184 lfrllff.exe 100 PID 3616 wrote to memory of 868 3616 hthnnn.exe 101 PID 3616 wrote to memory of 868 3616 hthnnn.exe 101 PID 3616 wrote to memory of 868 3616 hthnnn.exe 101 PID 868 wrote to memory of 2612 868 bnbbhh.exe 102 PID 868 wrote to memory of 2612 868 bnbbhh.exe 102 PID 868 wrote to memory of 2612 868 bnbbhh.exe 102 PID 2612 wrote to memory of 2396 2612 9jdvp.exe 103 PID 2612 wrote to memory of 2396 2612 9jdvp.exe 103 PID 2612 wrote to memory of 2396 2612 9jdvp.exe 103 PID 2396 wrote to memory of 3448 2396 ttttnn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b8a4caf1ae03a8c8ff3187f0b6c995d4499cf6cf8fbfbcd48a15e953744f2f3N.exe"C:\Users\Admin\AppData\Local\Temp\9b8a4caf1ae03a8c8ff3187f0b6c995d4499cf6cf8fbfbcd48a15e953744f2f3N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\ntbttt.exec:\ntbttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\rxllfrr.exec:\rxllfrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\9tnhhh.exec:\9tnhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\jddvp.exec:\jddvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\bnttbh.exec:\bnttbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\fxrrrrr.exec:\fxrrrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\jdjdp.exec:\jdjdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\rrrxxff.exec:\rrrxxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\hbhbbb.exec:\hbhbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\9jvpp.exec:\9jvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\hhtttt.exec:\hhtttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\jjjjd.exec:\jjjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\llrflfl.exec:\llrflfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\hbhbnn.exec:\hbhbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\htnhbn.exec:\htnhbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\vvjjj.exec:\vvjjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\lfrllff.exec:\lfrllff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\hthnnn.exec:\hthnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\bnbbhh.exec:\bnbbhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\9jdvp.exec:\9jdvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\ttttnn.exec:\ttttnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe23⤵
- Executes dropped EXE
PID:3448 -
\??\c:\lrlfffx.exec:\lrlfffx.exe24⤵
- Executes dropped EXE
PID:4508 -
\??\c:\dvppp.exec:\dvppp.exe25⤵
- Executes dropped EXE
PID:3468 -
\??\c:\xlrrxrx.exec:\xlrrxrx.exe26⤵
- Executes dropped EXE
PID:4784 -
\??\c:\rrrllll.exec:\rrrllll.exe27⤵
- Executes dropped EXE
PID:4540 -
\??\c:\1vpjv.exec:\1vpjv.exe28⤵
- Executes dropped EXE
PID:2096 -
\??\c:\hthbtt.exec:\hthbtt.exe29⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vdjpd.exec:\vdjpd.exe30⤵
- Executes dropped EXE
PID:4064 -
\??\c:\hbnhbb.exec:\hbnhbb.exe31⤵
- Executes dropped EXE
PID:2652 -
\??\c:\nntnhb.exec:\nntnhb.exe32⤵
- Executes dropped EXE
PID:848 -
\??\c:\ddppj.exec:\ddppj.exe33⤵
- Executes dropped EXE
PID:624 -
\??\c:\xlfrxrr.exec:\xlfrxrr.exe34⤵
- Executes dropped EXE
PID:4440 -
\??\c:\3lxrxxf.exec:\3lxrxxf.exe35⤵
- Executes dropped EXE
PID:1376 -
\??\c:\ddppj.exec:\ddppj.exe36⤵
- Executes dropped EXE
PID:5052 -
\??\c:\hbhbhn.exec:\hbhbhn.exe37⤵
- Executes dropped EXE
PID:4368 -
\??\c:\nhhbnb.exec:\nhhbnb.exe38⤵
- Executes dropped EXE
PID:1472 -
\??\c:\pdjdp.exec:\pdjdp.exe39⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rrllfxx.exec:\rrllfxx.exe40⤵
- Executes dropped EXE
PID:3576 -
\??\c:\bnntnb.exec:\bnntnb.exe41⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vvjjd.exec:\vvjjd.exe42⤵
- Executes dropped EXE
PID:3948 -
\??\c:\llrlfff.exec:\llrlfff.exe43⤵
- Executes dropped EXE
PID:992 -
\??\c:\tbhhbb.exec:\tbhhbb.exe44⤵
- Executes dropped EXE
PID:4072 -
\??\c:\thnnhn.exec:\thnnhn.exe45⤵
- Executes dropped EXE
PID:1716 -
\??\c:\1ppjd.exec:\1ppjd.exe46⤵
- Executes dropped EXE
PID:2880 -
\??\c:\9rllffx.exec:\9rllffx.exe47⤵
- Executes dropped EXE
PID:1896 -
\??\c:\7lfrllf.exec:\7lfrllf.exe48⤵
- Executes dropped EXE
PID:100 -
\??\c:\bnnhhb.exec:\bnnhhb.exe49⤵
- Executes dropped EXE
PID:4348 -
\??\c:\jppdp.exec:\jppdp.exe50⤵
- Executes dropped EXE
PID:940 -
\??\c:\xxxrfxl.exec:\xxxrfxl.exe51⤵
- Executes dropped EXE
PID:2896 -
\??\c:\thhbtb.exec:\thhbtb.exe52⤵
- Executes dropped EXE
PID:396 -
\??\c:\5ddpv.exec:\5ddpv.exe53⤵
- Executes dropped EXE
PID:1428 -
\??\c:\lrrrffx.exec:\lrrrffx.exe54⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xrrllfx.exec:\xrrllfx.exe55⤵
- Executes dropped EXE
PID:4884 -
\??\c:\htnhbb.exec:\htnhbb.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5036 -
\??\c:\djjdp.exec:\djjdp.exe57⤵
- Executes dropped EXE
PID:2936 -
\??\c:\1rrrffx.exec:\1rrrffx.exe58⤵
- Executes dropped EXE
PID:112 -
\??\c:\5ttntn.exec:\5ttntn.exe59⤵
- Executes dropped EXE
PID:4124 -
\??\c:\vpvpv.exec:\vpvpv.exe60⤵
- Executes dropped EXE
PID:1504 -
\??\c:\fxrlffx.exec:\fxrlffx.exe61⤵
- Executes dropped EXE
PID:2756 -
\??\c:\htnhbb.exec:\htnhbb.exe62⤵
- Executes dropped EXE
PID:516 -
\??\c:\5jdjv.exec:\5jdjv.exe63⤵
- Executes dropped EXE
PID:4376 -
\??\c:\xrlfffl.exec:\xrlfffl.exe64⤵
- Executes dropped EXE
PID:1480 -
\??\c:\bhnnhh.exec:\bhnnhh.exe65⤵
- Executes dropped EXE
PID:408 -
\??\c:\pdvvp.exec:\pdvvp.exe66⤵PID:2520
-
\??\c:\dvvpj.exec:\dvvpj.exe67⤵
- System Location Discovery: System Language Discovery
PID:1824 -
\??\c:\1flfrff.exec:\1flfrff.exe68⤵PID:1688
-
\??\c:\hhnhbb.exec:\hhnhbb.exe69⤵PID:3064
-
\??\c:\jddvp.exec:\jddvp.exe70⤵PID:3604
-
\??\c:\ffrrllf.exec:\ffrrllf.exe71⤵PID:4920
-
\??\c:\hnhbtt.exec:\hnhbtt.exe72⤵PID:3184
-
\??\c:\jdvvp.exec:\jdvvp.exe73⤵PID:3300
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe74⤵PID:1368
-
\??\c:\lfrlffx.exec:\lfrlffx.exe75⤵PID:220
-
\??\c:\tnbnnh.exec:\tnbnnh.exe76⤵PID:1096
-
\??\c:\dddvv.exec:\dddvv.exe77⤵PID:3304
-
\??\c:\vpvjd.exec:\vpvjd.exe78⤵PID:872
-
\??\c:\rlfxlff.exec:\rlfxlff.exe79⤵PID:3744
-
\??\c:\tnttnn.exec:\tnttnn.exe80⤵PID:1084
-
\??\c:\1bthbb.exec:\1bthbb.exe81⤵PID:1004
-
\??\c:\djjvj.exec:\djjvj.exe82⤵PID:4276
-
\??\c:\pddjv.exec:\pddjv.exe83⤵PID:3864
-
\??\c:\lxlfxrl.exec:\lxlfxrl.exe84⤵PID:4540
-
\??\c:\nhhbth.exec:\nhhbth.exe85⤵PID:4620
-
\??\c:\pjpdp.exec:\pjpdp.exe86⤵PID:4148
-
\??\c:\rxxrrxr.exec:\rxxrrxr.exe87⤵PID:4636
-
\??\c:\xllrlfx.exec:\xllrlfx.exe88⤵PID:1616
-
\??\c:\hntnhh.exec:\hntnhh.exe89⤵PID:2332
-
\??\c:\vpjpd.exec:\vpjpd.exe90⤵PID:1644
-
\??\c:\rxrlfff.exec:\rxrlfff.exe91⤵PID:848
-
\??\c:\9hnhtt.exec:\9hnhtt.exe92⤵PID:1628
-
\??\c:\bhbtnn.exec:\bhbtnn.exe93⤵PID:2700
-
\??\c:\jpvjd.exec:\jpvjd.exe94⤵PID:1980
-
\??\c:\rfrxffr.exec:\rfrxffr.exe95⤵PID:1592
-
\??\c:\hhnhnh.exec:\hhnhnh.exe96⤵PID:960
-
\??\c:\7vdpd.exec:\7vdpd.exe97⤵PID:1928
-
\??\c:\3fxlfxr.exec:\3fxlfxr.exe98⤵PID:2860
-
\??\c:\bhnnhh.exec:\bhnnhh.exe99⤵PID:2012
-
\??\c:\hnnnth.exec:\hnnnth.exe100⤵PID:4720
-
\??\c:\rlrrlrl.exec:\rlrrlrl.exe101⤵PID:4112
-
\??\c:\ntbtnn.exec:\ntbtnn.exe102⤵PID:1560
-
\??\c:\thhthh.exec:\thhthh.exe103⤵PID:4528
-
\??\c:\pvjdv.exec:\pvjdv.exe104⤵PID:2008
-
\??\c:\rrxlfxr.exec:\rrxlfxr.exe105⤵PID:5040
-
\??\c:\nbnhnt.exec:\nbnhnt.exe106⤵PID:2556
-
\??\c:\bnnhbt.exec:\bnnhbt.exe107⤵PID:4332
-
\??\c:\vddvp.exec:\vddvp.exe108⤵PID:4484
-
\??\c:\fxlflll.exec:\fxlflll.exe109⤵PID:740
-
\??\c:\9rllffx.exec:\9rllffx.exe110⤵PID:2392
-
\??\c:\bnnhtb.exec:\bnnhtb.exe111⤵PID:4932
-
\??\c:\7bthbt.exec:\7bthbt.exe112⤵PID:396
-
\??\c:\pvdvj.exec:\pvdvj.exe113⤵PID:2592
-
\??\c:\flllrrr.exec:\flllrrr.exe114⤵PID:1692
-
\??\c:\nnnhnb.exec:\nnnhnb.exe115⤵PID:1120
-
\??\c:\jddvp.exec:\jddvp.exe116⤵PID:3740
-
\??\c:\jdpjj.exec:\jdpjj.exe117⤵PID:4456
-
\??\c:\nhhbbt.exec:\nhhbbt.exe118⤵PID:4800
-
\??\c:\nbttnn.exec:\nbttnn.exe119⤵PID:2500
-
\??\c:\vdpjd.exec:\vdpjd.exe120⤵PID:5100
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe121⤵PID:3532
-
\??\c:\fxrrllf.exec:\fxrrllf.exe122⤵PID:4472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-