Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 06:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
66b27b7e584a0698dfbd546cbe47e7847ad708b5a50286e6c33d1d3da9db7892.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
66b27b7e584a0698dfbd546cbe47e7847ad708b5a50286e6c33d1d3da9db7892.exe
-
Size
454KB
-
MD5
61a8293543a51a05efa89493181f5dcd
-
SHA1
27684c669666b7065ed8f179c331466c03eb2b69
-
SHA256
66b27b7e584a0698dfbd546cbe47e7847ad708b5a50286e6c33d1d3da9db7892
-
SHA512
c82fbc85ea70256926a5f14a2d73b6d2483c5341721c34a45a78e85b425f6db5ff350064b77703944e393e7c4df10010786361caa81314da5441dce0078683a7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1y:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4720-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/320-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1432-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/744-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2480-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/648-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1148-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/676-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1768-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/620-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-705-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-751-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-782-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-1605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2424 bttnbb.exe 4672 rffxrrl.exe 4360 bbnhbt.exe 2088 hhthhb.exe 3552 dvppd.exe 376 xxxlrrx.exe 3732 9hbbhh.exe 1788 1btnhb.exe 320 dpdvp.exe 3712 fxxrffx.exe 3484 3xxlllx.exe 5092 pjjdv.exe 116 1httbb.exe 4252 xflxrlx.exe 4960 tttnhh.exe 1980 nbbnhb.exe 532 jvdvd.exe 2172 xlfxlfr.exe 2108 5pjdp.exe 2892 bttnnn.exe 1432 pdjvd.exe 3520 3flffff.exe 1116 vjpjd.exe 3300 frrlfxr.exe 744 thhtnh.exe 3136 3tnhbt.exe 4768 jdpvj.exe 2480 rfrlrxr.exe 4728 1tthbt.exe 8 3vdvv.exe 2464 7nthbt.exe 4564 pvdvd.exe 2448 5pvpj.exe 1664 pjjdv.exe 1812 fxrrllr.exe 752 bntnhb.exe 648 5bbtnh.exe 1108 1jjdv.exe 1600 xrrlllr.exe 4176 nhhbtt.exe 4404 3nbtbb.exe 4172 vdpdp.exe 2596 lflfxrl.exe 2000 bttnbb.exe 3040 1jjdv.exe 3628 ddjdd.exe 3720 rffrffr.exe 4392 htbtbt.exe 4400 dppdp.exe 4720 3djvj.exe 1148 5lffrlf.exe 3496 1rrlxxl.exe 3632 bntnbb.exe 1528 pjvpd.exe 3584 fxfrrll.exe 1548 rffxllx.exe 376 bntnhb.exe 3732 1jjdv.exe 676 pdpjv.exe 4856 fxlfrrx.exe 3532 lfllrlx.exe 3244 jpvpj.exe 4996 7jvjj.exe 3132 fxxlffx.exe -
resource yara_rule behavioral2/memory/4720-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4252-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1432-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3300-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/744-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/752-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/648-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1108-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/676-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/620-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-751-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxlrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrlrr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4720 wrote to memory of 2424 4720 66b27b7e584a0698dfbd546cbe47e7847ad708b5a50286e6c33d1d3da9db7892.exe 82 PID 4720 wrote to memory of 2424 4720 66b27b7e584a0698dfbd546cbe47e7847ad708b5a50286e6c33d1d3da9db7892.exe 82 PID 4720 wrote to memory of 2424 4720 66b27b7e584a0698dfbd546cbe47e7847ad708b5a50286e6c33d1d3da9db7892.exe 82 PID 2424 wrote to memory of 4672 2424 bttnbb.exe 83 PID 2424 wrote to memory of 4672 2424 bttnbb.exe 83 PID 2424 wrote to memory of 4672 2424 bttnbb.exe 83 PID 4672 wrote to memory of 4360 4672 rffxrrl.exe 84 PID 4672 wrote to memory of 4360 4672 rffxrrl.exe 84 PID 4672 wrote to memory of 4360 4672 rffxrrl.exe 84 PID 4360 wrote to memory of 2088 4360 bbnhbt.exe 85 PID 4360 wrote to memory of 2088 4360 bbnhbt.exe 85 PID 4360 wrote to memory of 2088 4360 bbnhbt.exe 85 PID 2088 wrote to memory of 3552 2088 hhthhb.exe 86 PID 2088 wrote to memory of 3552 2088 hhthhb.exe 86 PID 2088 wrote to memory of 3552 2088 hhthhb.exe 86 PID 3552 wrote to memory of 376 3552 dvppd.exe 87 PID 3552 wrote to memory of 376 3552 dvppd.exe 87 PID 3552 wrote to memory of 376 3552 dvppd.exe 87 PID 376 wrote to memory of 3732 376 xxxlrrx.exe 88 PID 376 wrote to memory of 3732 376 xxxlrrx.exe 88 PID 376 wrote to memory of 3732 376 xxxlrrx.exe 88 PID 3732 wrote to memory of 1788 3732 9hbbhh.exe 89 PID 3732 wrote to memory of 1788 3732 9hbbhh.exe 89 PID 3732 wrote to memory of 1788 3732 9hbbhh.exe 89 PID 1788 wrote to memory of 320 1788 1btnhb.exe 90 PID 1788 wrote to memory of 320 1788 1btnhb.exe 90 PID 1788 wrote to memory of 320 1788 1btnhb.exe 90 PID 320 wrote to memory of 3712 320 dpdvp.exe 91 PID 320 wrote to memory of 3712 320 dpdvp.exe 91 PID 320 wrote to memory of 3712 320 dpdvp.exe 91 PID 3712 wrote to memory of 3484 3712 fxxrffx.exe 92 PID 3712 wrote to memory of 3484 3712 fxxrffx.exe 92 PID 3712 wrote to memory of 3484 3712 fxxrffx.exe 92 PID 3484 wrote to memory of 5092 3484 3xxlllx.exe 93 PID 3484 wrote to memory of 5092 3484 3xxlllx.exe 93 PID 3484 wrote to memory of 5092 3484 3xxlllx.exe 93 PID 5092 wrote to memory of 116 5092 pjjdv.exe 94 PID 5092 wrote to memory of 116 5092 pjjdv.exe 94 PID 5092 wrote to memory of 116 5092 pjjdv.exe 94 PID 116 wrote to memory of 4252 116 1httbb.exe 95 PID 116 wrote to memory of 4252 116 1httbb.exe 95 PID 116 wrote to memory of 4252 116 1httbb.exe 95 PID 4252 wrote to memory of 4960 4252 xflxrlx.exe 96 PID 4252 wrote to memory of 4960 4252 xflxrlx.exe 96 PID 4252 wrote to memory of 4960 4252 xflxrlx.exe 96 PID 4960 wrote to memory of 1980 4960 tttnhh.exe 97 PID 4960 wrote to memory of 1980 4960 tttnhh.exe 97 PID 4960 wrote to memory of 1980 4960 tttnhh.exe 97 PID 1980 wrote to memory of 532 1980 nbbnhb.exe 98 PID 1980 wrote to memory of 532 1980 nbbnhb.exe 98 PID 1980 wrote to memory of 532 1980 nbbnhb.exe 98 PID 532 wrote to memory of 2172 532 jvdvd.exe 99 PID 532 wrote to memory of 2172 532 jvdvd.exe 99 PID 532 wrote to memory of 2172 532 jvdvd.exe 99 PID 2172 wrote to memory of 2108 2172 xlfxlfr.exe 100 PID 2172 wrote to memory of 2108 2172 xlfxlfr.exe 100 PID 2172 wrote to memory of 2108 2172 xlfxlfr.exe 100 PID 2108 wrote to memory of 2892 2108 5pjdp.exe 101 PID 2108 wrote to memory of 2892 2108 5pjdp.exe 101 PID 2108 wrote to memory of 2892 2108 5pjdp.exe 101 PID 2892 wrote to memory of 1432 2892 bttnnn.exe 102 PID 2892 wrote to memory of 1432 2892 bttnnn.exe 102 PID 2892 wrote to memory of 1432 2892 bttnnn.exe 102 PID 1432 wrote to memory of 3520 1432 pdjvd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\66b27b7e584a0698dfbd546cbe47e7847ad708b5a50286e6c33d1d3da9db7892.exe"C:\Users\Admin\AppData\Local\Temp\66b27b7e584a0698dfbd546cbe47e7847ad708b5a50286e6c33d1d3da9db7892.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\bttnbb.exec:\bttnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\rffxrrl.exec:\rffxrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\bbnhbt.exec:\bbnhbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\hhthhb.exec:\hhthhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\dvppd.exec:\dvppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\xxxlrrx.exec:\xxxlrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\9hbbhh.exec:\9hbbhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\1btnhb.exec:\1btnhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\dpdvp.exec:\dpdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\fxxrffx.exec:\fxxrffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\3xxlllx.exec:\3xxlllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\pjjdv.exec:\pjjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\1httbb.exec:\1httbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\xflxrlx.exec:\xflxrlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\tttnhh.exec:\tttnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\nbbnhb.exec:\nbbnhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\jvdvd.exec:\jvdvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\xlfxlfr.exec:\xlfxlfr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\5pjdp.exec:\5pjdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\bttnnn.exec:\bttnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\pdjvd.exec:\pdjvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\3flffff.exec:\3flffff.exe23⤵
- Executes dropped EXE
PID:3520 -
\??\c:\vjpjd.exec:\vjpjd.exe24⤵
- Executes dropped EXE
PID:1116 -
\??\c:\frrlfxr.exec:\frrlfxr.exe25⤵
- Executes dropped EXE
PID:3300 -
\??\c:\thhtnh.exec:\thhtnh.exe26⤵
- Executes dropped EXE
PID:744 -
\??\c:\3tnhbt.exec:\3tnhbt.exe27⤵
- Executes dropped EXE
PID:3136 -
\??\c:\jdpvj.exec:\jdpvj.exe28⤵
- Executes dropped EXE
PID:4768 -
\??\c:\rfrlrxr.exec:\rfrlrxr.exe29⤵
- Executes dropped EXE
PID:2480 -
\??\c:\1tthbt.exec:\1tthbt.exe30⤵
- Executes dropped EXE
PID:4728 -
\??\c:\3vdvv.exec:\3vdvv.exe31⤵
- Executes dropped EXE
PID:8 -
\??\c:\7nthbt.exec:\7nthbt.exe32⤵
- Executes dropped EXE
PID:2464 -
\??\c:\pvdvd.exec:\pvdvd.exe33⤵
- Executes dropped EXE
PID:4564 -
\??\c:\5pvpj.exec:\5pvpj.exe34⤵
- Executes dropped EXE
PID:2448 -
\??\c:\pjjdv.exec:\pjjdv.exe35⤵
- Executes dropped EXE
PID:1664 -
\??\c:\fxrrllr.exec:\fxrrllr.exe36⤵
- Executes dropped EXE
PID:1812 -
\??\c:\bntnhb.exec:\bntnhb.exe37⤵
- Executes dropped EXE
PID:752 -
\??\c:\5bbtnh.exec:\5bbtnh.exe38⤵
- Executes dropped EXE
PID:648 -
\??\c:\1jjdv.exec:\1jjdv.exe39⤵
- Executes dropped EXE
PID:1108 -
\??\c:\xrrlllr.exec:\xrrlllr.exe40⤵
- Executes dropped EXE
PID:1600 -
\??\c:\nhhbtt.exec:\nhhbtt.exe41⤵
- Executes dropped EXE
PID:4176 -
\??\c:\3nbtbb.exec:\3nbtbb.exe42⤵
- Executes dropped EXE
PID:4404 -
\??\c:\vdpdp.exec:\vdpdp.exe43⤵
- Executes dropped EXE
PID:4172 -
\??\c:\lflfxrl.exec:\lflfxrl.exe44⤵
- Executes dropped EXE
PID:2596 -
\??\c:\bttnbb.exec:\bttnbb.exe45⤵
- Executes dropped EXE
PID:2000 -
\??\c:\1jjdv.exec:\1jjdv.exe46⤵
- Executes dropped EXE
PID:3040 -
\??\c:\ddjdd.exec:\ddjdd.exe47⤵
- Executes dropped EXE
PID:3628 -
\??\c:\rffrffr.exec:\rffrffr.exe48⤵
- Executes dropped EXE
PID:3720 -
\??\c:\htbtbt.exec:\htbtbt.exe49⤵
- Executes dropped EXE
PID:4392 -
\??\c:\dppdp.exec:\dppdp.exe50⤵
- Executes dropped EXE
PID:4400 -
\??\c:\3djvj.exec:\3djvj.exe51⤵
- Executes dropped EXE
PID:4720 -
\??\c:\5lffrlf.exec:\5lffrlf.exe52⤵
- Executes dropped EXE
PID:1148 -
\??\c:\1rrlxxl.exec:\1rrlxxl.exe53⤵
- Executes dropped EXE
PID:3496 -
\??\c:\bntnbb.exec:\bntnbb.exe54⤵
- Executes dropped EXE
PID:3632 -
\??\c:\pjvpd.exec:\pjvpd.exe55⤵
- Executes dropped EXE
PID:1528 -
\??\c:\fxfrrll.exec:\fxfrrll.exe56⤵
- Executes dropped EXE
PID:3584 -
\??\c:\rffxllx.exec:\rffxllx.exe57⤵
- Executes dropped EXE
PID:1548 -
\??\c:\bntnhb.exec:\bntnhb.exe58⤵
- Executes dropped EXE
PID:376 -
\??\c:\1jjdv.exec:\1jjdv.exe59⤵
- Executes dropped EXE
PID:3732 -
\??\c:\pdpjv.exec:\pdpjv.exe60⤵
- Executes dropped EXE
PID:676 -
\??\c:\fxlfrrx.exec:\fxlfrrx.exe61⤵
- Executes dropped EXE
PID:4856 -
\??\c:\lfllrlx.exec:\lfllrlx.exe62⤵
- Executes dropped EXE
PID:3532 -
\??\c:\jpvpj.exec:\jpvpj.exe63⤵
- Executes dropped EXE
PID:3244 -
\??\c:\7jvjj.exec:\7jvjj.exe64⤵
- Executes dropped EXE
PID:4996 -
\??\c:\fxxlffx.exec:\fxxlffx.exe65⤵
- Executes dropped EXE
PID:3132 -
\??\c:\nbhbbt.exec:\nbhbbt.exe66⤵PID:1636
-
\??\c:\hbhbht.exec:\hbhbht.exe67⤵PID:3264
-
\??\c:\9vjvp.exec:\9vjvp.exe68⤵PID:1768
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe69⤵PID:4136
-
\??\c:\7rxxxff.exec:\7rxxxff.exe70⤵PID:4420
-
\??\c:\9tbthh.exec:\9tbthh.exe71⤵PID:3664
-
\??\c:\pdpjj.exec:\pdpjj.exe72⤵PID:2720
-
\??\c:\llrfxrl.exec:\llrfxrl.exe73⤵PID:4756
-
\??\c:\btbbnn.exec:\btbbnn.exe74⤵PID:4884
-
\??\c:\vvvpp.exec:\vvvpp.exe75⤵PID:5068
-
\??\c:\fflfxxr.exec:\fflfxxr.exe76⤵PID:112
-
\??\c:\bntnhh.exec:\bntnhh.exe77⤵PID:2244
-
\??\c:\pvpdj.exec:\pvpdj.exe78⤵PID:2140
-
\??\c:\rfxrfxr.exec:\rfxrfxr.exe79⤵PID:4164
-
\??\c:\lfrllll.exec:\lfrllll.exe80⤵PID:2080
-
\??\c:\tttbnn.exec:\tttbnn.exe81⤵PID:4580
-
\??\c:\pjppj.exec:\pjppj.exe82⤵PID:4708
-
\??\c:\jvvpj.exec:\jvvpj.exe83⤵PID:1560
-
\??\c:\fxlffff.exec:\fxlffff.exe84⤵
- System Location Discovery: System Language Discovery
PID:3416 -
\??\c:\5hhbtt.exec:\5hhbtt.exe85⤵PID:4904
-
\??\c:\vjvvp.exec:\vjvvp.exe86⤵PID:2492
-
\??\c:\pppjd.exec:\pppjd.exe87⤵PID:2724
-
\??\c:\lflfffx.exec:\lflfffx.exe88⤵PID:3736
-
\??\c:\hbhbbt.exec:\hbhbbt.exe89⤵PID:1984
-
\??\c:\dppjd.exec:\dppjd.exe90⤵PID:2608
-
\??\c:\llrlxxr.exec:\llrlxxr.exe91⤵PID:1232
-
\??\c:\llrlffx.exec:\llrlffx.exe92⤵PID:620
-
\??\c:\1ntnbh.exec:\1ntnbh.exe93⤵PID:5112
-
\??\c:\7pvpv.exec:\7pvpv.exe94⤵PID:212
-
\??\c:\frrrfxr.exec:\frrrfxr.exe95⤵PID:2464
-
\??\c:\fxrfxrl.exec:\fxrfxrl.exe96⤵PID:1624
-
\??\c:\3hnbbt.exec:\3hnbbt.exe97⤵PID:4564
-
\??\c:\djpdp.exec:\djpdp.exe98⤵PID:1584
-
\??\c:\7jpjj.exec:\7jpjj.exe99⤵PID:4784
-
\??\c:\1lrffrl.exec:\1lrffrl.exe100⤵PID:4796
-
\??\c:\rrfxxxf.exec:\rrfxxxf.exe101⤵PID:1792
-
\??\c:\nbbtnn.exec:\nbbtnn.exe102⤵PID:4424
-
\??\c:\thntnh.exec:\thntnh.exe103⤵PID:4464
-
\??\c:\pppdv.exec:\pppdv.exe104⤵PID:3472
-
\??\c:\rxfxllf.exec:\rxfxllf.exe105⤵PID:4452
-
\??\c:\thnhbb.exec:\thnhbb.exe106⤵
- System Location Discovery: System Language Discovery
PID:1840 -
\??\c:\nttntn.exec:\nttntn.exe107⤵PID:4404
-
\??\c:\pvdpv.exec:\pvdpv.exe108⤵PID:2124
-
\??\c:\1xrlxxr.exec:\1xrlxxr.exe109⤵PID:3436
-
\??\c:\lxfxfff.exec:\lxfxfff.exe110⤵PID:864
-
\??\c:\nnnbnh.exec:\nnnbnh.exe111⤵PID:60
-
\??\c:\vjdvj.exec:\vjdvj.exe112⤵PID:1444
-
\??\c:\9xlrfrl.exec:\9xlrfrl.exe113⤵PID:3292
-
\??\c:\xllfrrr.exec:\xllfrrr.exe114⤵PID:404
-
\??\c:\1tnbnh.exec:\1tnbnh.exe115⤵PID:1048
-
\??\c:\jdjdp.exec:\jdjdp.exe116⤵PID:2400
-
\??\c:\pjvpd.exec:\pjvpd.exe117⤵PID:2424
-
\??\c:\lxrlxrl.exec:\lxrlxrl.exe118⤵PID:448
-
\??\c:\nhnhbb.exec:\nhnhbb.exe119⤵PID:3876
-
\??\c:\pjdpd.exec:\pjdpd.exe120⤵PID:3552
-
\??\c:\7dvvj.exec:\7dvvj.exe121⤵PID:3860
-
\??\c:\rlrrxxr.exec:\rlrrxxr.exe122⤵PID:3008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-