Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 04:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
833f637dbbadf4989ceb10085240016054914c342d788290afe78c12f07379c8N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
833f637dbbadf4989ceb10085240016054914c342d788290afe78c12f07379c8N.exe
-
Size
454KB
-
MD5
eb49d564f56ee1bfb2e565d14bdc1170
-
SHA1
b31cd2d75517e4eaa1a11f0183c2a6953f4f9d52
-
SHA256
833f637dbbadf4989ceb10085240016054914c342d788290afe78c12f07379c8
-
SHA512
61fb7ba092c82c6c77c9102d9aeb5c712e2322561018ecf335856fb292a832568b35626eb5240adceb77f35933a79761fbd01bd8222a17862d22d39a09fd62b6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbez:q7Tc2NYHUrAwfMp3CDz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4800-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1276-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1184-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2504-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/856-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4208-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3344-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-805-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-848-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-891-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-931-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-992-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-1005-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-1048-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-1284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1856-1814-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2208 tnbtnn.exe 3088 vjvjv.exe 2284 btbbnn.exe 4192 vjpjj.exe 3896 5frlrrx.exe 1560 lffxxrr.exe 3404 dddvp.exe 2812 5xxrxxx.exe 2380 jdjvp.exe 1276 rflfxff.exe 1396 hnhhbb.exe 2104 5jpjd.exe 1964 jpvpj.exe 4972 hbthth.exe 2032 vjpjj.exe 2056 jvjjd.exe 2728 lxfxrlx.exe 1184 1bthtn.exe 3036 jvddv.exe 2504 9hbnbn.exe 4920 lflrxxr.exe 3944 jppdp.exe 1664 vpdjv.exe 856 fxxlxrl.exe 4944 dvddj.exe 960 lxfrfxl.exe 4432 vddvj.exe 3636 dvdpp.exe 4364 hhbnnh.exe 2664 7xxlfxr.exe 2984 7rrfrlf.exe 1640 jpjvj.exe 5108 jvjvj.exe 4704 pjvjd.exe 4208 fxxrffx.exe 3520 rxxlxrl.exe 2376 dvpjd.exe 1040 7rxlrlr.exe 4424 ntttht.exe 1236 jjvdj.exe 3428 jjpvd.exe 4968 xffxflf.exe 5096 thtnbb.exe 4916 jdvpv.exe 1528 3ppjv.exe 2688 frrfrlx.exe 704 bbtnnn.exe 3260 pppjd.exe 4328 fxfxfxf.exe 3216 3ffxrlf.exe 3652 9bbbth.exe 2172 vdjdj.exe 5084 lxrxlxl.exe 3348 xfxfrll.exe 3396 tbhbbt.exe 1480 1vjvj.exe 4408 lxrrxrl.exe 3412 tttbtn.exe 1928 dddjv.exe 1560 vddpd.exe 2988 flllxxl.exe 3404 3bhhhh.exe 4312 jjjpj.exe 4044 lxrfrfl.exe -
resource yara_rule behavioral2/memory/4800-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1276-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1184-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2504-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/856-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2664-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4208-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3344-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-805-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-848-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-891-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-931-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-992-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4800 wrote to memory of 2208 4800 833f637dbbadf4989ceb10085240016054914c342d788290afe78c12f07379c8N.exe 82 PID 4800 wrote to memory of 2208 4800 833f637dbbadf4989ceb10085240016054914c342d788290afe78c12f07379c8N.exe 82 PID 4800 wrote to memory of 2208 4800 833f637dbbadf4989ceb10085240016054914c342d788290afe78c12f07379c8N.exe 82 PID 2208 wrote to memory of 3088 2208 tnbtnn.exe 83 PID 2208 wrote to memory of 3088 2208 tnbtnn.exe 83 PID 2208 wrote to memory of 3088 2208 tnbtnn.exe 83 PID 3088 wrote to memory of 2284 3088 vjvjv.exe 84 PID 3088 wrote to memory of 2284 3088 vjvjv.exe 84 PID 3088 wrote to memory of 2284 3088 vjvjv.exe 84 PID 2284 wrote to memory of 4192 2284 btbbnn.exe 85 PID 2284 wrote to memory of 4192 2284 btbbnn.exe 85 PID 2284 wrote to memory of 4192 2284 btbbnn.exe 85 PID 4192 wrote to memory of 3896 4192 vjpjj.exe 86 PID 4192 wrote to memory of 3896 4192 vjpjj.exe 86 PID 4192 wrote to memory of 3896 4192 vjpjj.exe 86 PID 3896 wrote to memory of 1560 3896 5frlrrx.exe 87 PID 3896 wrote to memory of 1560 3896 5frlrrx.exe 87 PID 3896 wrote to memory of 1560 3896 5frlrrx.exe 87 PID 1560 wrote to memory of 3404 1560 lffxxrr.exe 88 PID 1560 wrote to memory of 3404 1560 lffxxrr.exe 88 PID 1560 wrote to memory of 3404 1560 lffxxrr.exe 88 PID 3404 wrote to memory of 2812 3404 dddvp.exe 89 PID 3404 wrote to memory of 2812 3404 dddvp.exe 89 PID 3404 wrote to memory of 2812 3404 dddvp.exe 89 PID 2812 wrote to memory of 2380 2812 5xxrxxx.exe 90 PID 2812 wrote to memory of 2380 2812 5xxrxxx.exe 90 PID 2812 wrote to memory of 2380 2812 5xxrxxx.exe 90 PID 2380 wrote to memory of 1276 2380 jdjvp.exe 91 PID 2380 wrote to memory of 1276 2380 jdjvp.exe 91 PID 2380 wrote to memory of 1276 2380 jdjvp.exe 91 PID 1276 wrote to memory of 1396 1276 rflfxff.exe 92 PID 1276 wrote to memory of 1396 1276 rflfxff.exe 92 PID 1276 wrote to memory of 1396 1276 rflfxff.exe 92 PID 1396 wrote to memory of 2104 1396 hnhhbb.exe 93 PID 1396 wrote to memory of 2104 1396 hnhhbb.exe 93 PID 1396 wrote to memory of 2104 1396 hnhhbb.exe 93 PID 2104 wrote to memory of 1964 2104 5jpjd.exe 94 PID 2104 wrote to memory of 1964 2104 5jpjd.exe 94 PID 2104 wrote to memory of 1964 2104 5jpjd.exe 94 PID 1964 wrote to memory of 4972 1964 jpvpj.exe 95 PID 1964 wrote to memory of 4972 1964 jpvpj.exe 95 PID 1964 wrote to memory of 4972 1964 jpvpj.exe 95 PID 4972 wrote to memory of 2032 4972 hbthth.exe 96 PID 4972 wrote to memory of 2032 4972 hbthth.exe 96 PID 4972 wrote to memory of 2032 4972 hbthth.exe 96 PID 2032 wrote to memory of 2056 2032 vjpjj.exe 97 PID 2032 wrote to memory of 2056 2032 vjpjj.exe 97 PID 2032 wrote to memory of 2056 2032 vjpjj.exe 97 PID 2056 wrote to memory of 2728 2056 jvjjd.exe 98 PID 2056 wrote to memory of 2728 2056 jvjjd.exe 98 PID 2056 wrote to memory of 2728 2056 jvjjd.exe 98 PID 2728 wrote to memory of 1184 2728 lxfxrlx.exe 99 PID 2728 wrote to memory of 1184 2728 lxfxrlx.exe 99 PID 2728 wrote to memory of 1184 2728 lxfxrlx.exe 99 PID 1184 wrote to memory of 3036 1184 1bthtn.exe 100 PID 1184 wrote to memory of 3036 1184 1bthtn.exe 100 PID 1184 wrote to memory of 3036 1184 1bthtn.exe 100 PID 3036 wrote to memory of 2504 3036 jvddv.exe 101 PID 3036 wrote to memory of 2504 3036 jvddv.exe 101 PID 3036 wrote to memory of 2504 3036 jvddv.exe 101 PID 2504 wrote to memory of 4920 2504 9hbnbn.exe 102 PID 2504 wrote to memory of 4920 2504 9hbnbn.exe 102 PID 2504 wrote to memory of 4920 2504 9hbnbn.exe 102 PID 4920 wrote to memory of 3944 4920 lflrxxr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\833f637dbbadf4989ceb10085240016054914c342d788290afe78c12f07379c8N.exe"C:\Users\Admin\AppData\Local\Temp\833f637dbbadf4989ceb10085240016054914c342d788290afe78c12f07379c8N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\tnbtnn.exec:\tnbtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\vjvjv.exec:\vjvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\btbbnn.exec:\btbbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\vjpjj.exec:\vjpjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\5frlrrx.exec:\5frlrrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\lffxxrr.exec:\lffxxrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\dddvp.exec:\dddvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\5xxrxxx.exec:\5xxrxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\jdjvp.exec:\jdjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\rflfxff.exec:\rflfxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\hnhhbb.exec:\hnhhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\5jpjd.exec:\5jpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\jpvpj.exec:\jpvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\hbthth.exec:\hbthth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\vjpjj.exec:\vjpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\jvjjd.exec:\jvjjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\lxfxrlx.exec:\lxfxrlx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\1bthtn.exec:\1bthtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\jvddv.exec:\jvddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\9hbnbn.exec:\9hbnbn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\lflrxxr.exec:\lflrxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\jppdp.exec:\jppdp.exe23⤵
- Executes dropped EXE
PID:3944 -
\??\c:\vpdjv.exec:\vpdjv.exe24⤵
- Executes dropped EXE
PID:1664 -
\??\c:\fxxlxrl.exec:\fxxlxrl.exe25⤵
- Executes dropped EXE
PID:856 -
\??\c:\dvddj.exec:\dvddj.exe26⤵
- Executes dropped EXE
PID:4944 -
\??\c:\lxfrfxl.exec:\lxfrfxl.exe27⤵
- Executes dropped EXE
PID:960 -
\??\c:\vddvj.exec:\vddvj.exe28⤵
- Executes dropped EXE
PID:4432 -
\??\c:\dvdpp.exec:\dvdpp.exe29⤵
- Executes dropped EXE
PID:3636 -
\??\c:\hhbnnh.exec:\hhbnnh.exe30⤵
- Executes dropped EXE
PID:4364 -
\??\c:\7xxlfxr.exec:\7xxlfxr.exe31⤵
- Executes dropped EXE
PID:2664 -
\??\c:\7rrfrlf.exec:\7rrfrlf.exe32⤵
- Executes dropped EXE
PID:2984 -
\??\c:\jpjvj.exec:\jpjvj.exe33⤵
- Executes dropped EXE
PID:1640 -
\??\c:\jvjvj.exec:\jvjvj.exe34⤵
- Executes dropped EXE
PID:5108 -
\??\c:\pjvjd.exec:\pjvjd.exe35⤵
- Executes dropped EXE
PID:4704 -
\??\c:\fxxrffx.exec:\fxxrffx.exe36⤵
- Executes dropped EXE
PID:4208 -
\??\c:\rxxlxrl.exec:\rxxlxrl.exe37⤵
- Executes dropped EXE
PID:3520 -
\??\c:\dvpjd.exec:\dvpjd.exe38⤵
- Executes dropped EXE
PID:2376 -
\??\c:\7rxlrlr.exec:\7rxlrlr.exe39⤵
- Executes dropped EXE
PID:1040 -
\??\c:\ntttht.exec:\ntttht.exe40⤵
- Executes dropped EXE
PID:4424 -
\??\c:\jjvdj.exec:\jjvdj.exe41⤵
- Executes dropped EXE
PID:1236 -
\??\c:\jjpvd.exec:\jjpvd.exe42⤵
- Executes dropped EXE
PID:3428 -
\??\c:\xffxflf.exec:\xffxflf.exe43⤵
- Executes dropped EXE
PID:4968 -
\??\c:\thtnbb.exec:\thtnbb.exe44⤵
- Executes dropped EXE
PID:5096 -
\??\c:\jdvpv.exec:\jdvpv.exe45⤵
- Executes dropped EXE
PID:4916 -
\??\c:\3ppjv.exec:\3ppjv.exe46⤵
- Executes dropped EXE
PID:1528 -
\??\c:\frrfrlx.exec:\frrfrlx.exe47⤵
- Executes dropped EXE
PID:2688 -
\??\c:\bbtnnn.exec:\bbtnnn.exe48⤵
- Executes dropped EXE
PID:704 -
\??\c:\pppjd.exec:\pppjd.exe49⤵
- Executes dropped EXE
PID:3260 -
\??\c:\fxfxfxf.exec:\fxfxfxf.exe50⤵
- Executes dropped EXE
PID:4328 -
\??\c:\3ffxrlf.exec:\3ffxrlf.exe51⤵
- Executes dropped EXE
PID:3216 -
\??\c:\9bbbth.exec:\9bbbth.exe52⤵
- Executes dropped EXE
PID:3652 -
\??\c:\vdjdj.exec:\vdjdj.exe53⤵
- Executes dropped EXE
PID:2172 -
\??\c:\lxrxlxl.exec:\lxrxlxl.exe54⤵
- Executes dropped EXE
PID:5084 -
\??\c:\xfxfrll.exec:\xfxfrll.exe55⤵
- Executes dropped EXE
PID:3348 -
\??\c:\tbhbbt.exec:\tbhbbt.exe56⤵
- Executes dropped EXE
PID:3396 -
\??\c:\1vjvj.exec:\1vjvj.exe57⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lxrrxrl.exec:\lxrrxrl.exe58⤵
- Executes dropped EXE
PID:4408 -
\??\c:\tttbtn.exec:\tttbtn.exe59⤵
- Executes dropped EXE
PID:3412 -
\??\c:\dddjv.exec:\dddjv.exe60⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vddpd.exec:\vddpd.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1560 -
\??\c:\flllxxl.exec:\flllxxl.exe62⤵
- Executes dropped EXE
PID:2988 -
\??\c:\3bhhhh.exec:\3bhhhh.exe63⤵
- Executes dropped EXE
PID:3404 -
\??\c:\jjjpj.exec:\jjjpj.exe64⤵
- Executes dropped EXE
PID:4312 -
\??\c:\lxrfrfl.exec:\lxrfrfl.exe65⤵
- Executes dropped EXE
PID:4044 -
\??\c:\fxlxfxf.exec:\fxlxfxf.exe66⤵PID:3388
-
\??\c:\1tthtn.exec:\1tthtn.exe67⤵PID:1276
-
\??\c:\jdpjp.exec:\jdpjp.exe68⤵PID:3284
-
\??\c:\dvjvj.exec:\dvjvj.exe69⤵PID:1916
-
\??\c:\1xffffx.exec:\1xffffx.exe70⤵PID:1444
-
\??\c:\9nhnbh.exec:\9nhnbh.exe71⤵PID:1964
-
\??\c:\pdddp.exec:\pdddp.exe72⤵PID:3492
-
\??\c:\vpjvd.exec:\vpjvd.exe73⤵PID:2032
-
\??\c:\xrxrxrx.exec:\xrxrxrx.exe74⤵PID:2096
-
\??\c:\nntnbb.exec:\nntnbb.exe75⤵PID:4952
-
\??\c:\jppjp.exec:\jppjp.exe76⤵PID:2604
-
\??\c:\fxxrllf.exec:\fxxrllf.exe77⤵PID:2888
-
\??\c:\3fxrfff.exec:\3fxrfff.exe78⤵PID:3036
-
\??\c:\bhtbbh.exec:\bhtbbh.exe79⤵PID:2404
-
\??\c:\dvddv.exec:\dvddv.exe80⤵
- System Location Discovery: System Language Discovery
PID:1520 -
\??\c:\frlxrlf.exec:\frlxrlf.exe81⤵PID:4268
-
\??\c:\vpvdv.exec:\vpvdv.exe82⤵PID:4264
-
\??\c:\lllfrlx.exec:\lllfrlx.exe83⤵PID:2036
-
\??\c:\bnthnh.exec:\bnthnh.exe84⤵PID:628
-
\??\c:\tbbbnn.exec:\tbbbnn.exe85⤵PID:4744
-
\??\c:\jjddv.exec:\jjddv.exe86⤵
- System Location Discovery: System Language Discovery
PID:4980 -
\??\c:\3rlxlfx.exec:\3rlxlfx.exe87⤵PID:1628
-
\??\c:\3ntnnn.exec:\3ntnnn.exe88⤵PID:1616
-
\??\c:\vvpjd.exec:\vvpjd.exe89⤵PID:960
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe90⤵PID:3668
-
\??\c:\9rxrlfx.exec:\9rxrlfx.exe91⤵PID:3612
-
\??\c:\3hhthb.exec:\3hhthb.exe92⤵PID:4792
-
\??\c:\dddvd.exec:\dddvd.exe93⤵PID:4148
-
\??\c:\5vdpd.exec:\5vdpd.exe94⤵PID:3320
-
\??\c:\xrlrffr.exec:\xrlrffr.exe95⤵PID:3744
-
\??\c:\7nnnhh.exec:\7nnnhh.exe96⤵PID:2984
-
\??\c:\9pddj.exec:\9pddj.exe97⤵PID:4824
-
\??\c:\fxffxrl.exec:\fxffxrl.exe98⤵PID:3836
-
\??\c:\ntntnb.exec:\ntntnb.exe99⤵PID:1716
-
\??\c:\vvvjj.exec:\vvvjj.exe100⤵PID:1092
-
\??\c:\dvpdv.exec:\dvpdv.exe101⤵PID:912
-
\??\c:\9llxrrl.exec:\9llxrrl.exe102⤵PID:4720
-
\??\c:\nhtntt.exec:\nhtntt.exe103⤵PID:2736
-
\??\c:\pvddd.exec:\pvddd.exe104⤵PID:3472
-
\??\c:\rxxlfrl.exec:\rxxlfrl.exe105⤵PID:3092
-
\??\c:\xxfxlfr.exec:\xxfxlfr.exe106⤵PID:1324
-
\??\c:\7nhbnh.exec:\7nhbnh.exe107⤵PID:3344
-
\??\c:\vjdvp.exec:\vjdvp.exe108⤵PID:3952
-
\??\c:\5djvd.exec:\5djvd.exe109⤵PID:3956
-
\??\c:\xlrfrlx.exec:\xlrfrlx.exe110⤵PID:2720
-
\??\c:\9tthtn.exec:\9tthtn.exe111⤵PID:3832
-
\??\c:\ppjdj.exec:\ppjdj.exe112⤵PID:4108
-
\??\c:\lxxxxff.exec:\lxxxxff.exe113⤵PID:752
-
\??\c:\3llrxrf.exec:\3llrxrf.exe114⤵PID:4396
-
\??\c:\nnbthb.exec:\nnbthb.exe115⤵PID:612
-
\??\c:\9vpdv.exec:\9vpdv.exe116⤵PID:4800
-
\??\c:\5xllrxf.exec:\5xllrxf.exe117⤵PID:3652
-
\??\c:\hntnhb.exec:\hntnhb.exe118⤵PID:2172
-
\??\c:\9ppdv.exec:\9ppdv.exe119⤵PID:2788
-
\??\c:\xxlxfxf.exec:\xxlxfxf.exe120⤵PID:3596
-
\??\c:\5ffxxxx.exec:\5ffxxxx.exe121⤵PID:2212
-
\??\c:\1ttnhb.exec:\1ttnhb.exe122⤵PID:2308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-