Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 07:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a637de6b59a123e34c9d149c837c779822441203488932df4d8685f557fe1b9d.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a637de6b59a123e34c9d149c837c779822441203488932df4d8685f557fe1b9d.exe
-
Size
454KB
-
MD5
682a866a9617a41b8139c7238ec95490
-
SHA1
fd51118a2272be4a3c5481b9a476ec3d7d8e3bb3
-
SHA256
a637de6b59a123e34c9d149c837c779822441203488932df4d8685f557fe1b9d
-
SHA512
7b14ec573b74120ec677ba9b808408008c001e9faa42bb541acb2462e09c5de8319d42b04013d58563d97b59ac868360a8b2d2f1b63755698b82b2d7a5ff3202
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeZ:q7Tc2NYHUrAwfMp3CDZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3964-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3884-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/756-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/816-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/424-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/460-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3848-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/772-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3816-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-715-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-762-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-766-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-861-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-904-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-1004-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-1350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-1368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4984 htttnh.exe 3884 vppjp.exe 4656 7pdvp.exe 1896 7vpdd.exe 756 rffxrrl.exe 1164 bhnhbt.exe 4852 bnnnhn.exe 1116 fxxxrrl.exe 1388 pvjvp.exe 4632 jdvpj.exe 816 xlrfxxr.exe 1348 btnhhh.exe 724 5vdpj.exe 2960 rxxrlfx.exe 3008 bttbtb.exe 2004 7ppjd.exe 3632 9djdv.exe 1168 vvddd.exe 424 djpjd.exe 1604 nnnnnt.exe 1188 dpvvp.exe 1888 nbtnnh.exe 4380 bnthbt.exe 3644 5vvpj.exe 2208 1llxrrl.exe 2728 btbbnh.exe 4152 3vpjd.exe 1144 jvjdj.exe 1320 fflflfx.exe 3176 djppj.exe 1980 fxlfllr.exe 4904 5ffxrrr.exe 4640 thtttt.exe 460 dpdvp.exe 3848 rlfxffx.exe 2240 vjdpj.exe 4216 llrlfxr.exe 3572 bhnnhn.exe 376 rffxrlf.exe 4576 nhnhhh.exe 2284 3jdpd.exe 1556 fxrrllf.exe 4324 hbnbhb.exe 2980 1vpjd.exe 3964 xrlfxlf.exe 2732 frxxrll.exe 772 9tbttn.exe 3996 nbbbbt.exe 4128 vppjd.exe 2688 frxxflr.exe 4140 5bhbbb.exe 2820 djpjv.exe 388 3pvjd.exe 4076 rxxrfff.exe 3696 tnntnb.exe 3748 vvdvp.exe 3436 lxfrrxf.exe 1956 rflflxx.exe 4788 9thbnh.exe 2076 5jdvp.exe 1540 rxlfrrf.exe 1792 nbbthb.exe 4448 3pjvj.exe 4888 xrrfxrl.exe -
resource yara_rule behavioral2/memory/3964-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3884-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3884-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1164-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1388-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1388-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/816-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/424-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/460-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3848-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/772-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3816-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1444-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-766-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfffrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rffxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3964 wrote to memory of 4984 3964 a637de6b59a123e34c9d149c837c779822441203488932df4d8685f557fe1b9d.exe 82 PID 3964 wrote to memory of 4984 3964 a637de6b59a123e34c9d149c837c779822441203488932df4d8685f557fe1b9d.exe 82 PID 3964 wrote to memory of 4984 3964 a637de6b59a123e34c9d149c837c779822441203488932df4d8685f557fe1b9d.exe 82 PID 4984 wrote to memory of 3884 4984 htttnh.exe 83 PID 4984 wrote to memory of 3884 4984 htttnh.exe 83 PID 4984 wrote to memory of 3884 4984 htttnh.exe 83 PID 3884 wrote to memory of 4656 3884 vppjp.exe 84 PID 3884 wrote to memory of 4656 3884 vppjp.exe 84 PID 3884 wrote to memory of 4656 3884 vppjp.exe 84 PID 4656 wrote to memory of 1896 4656 7pdvp.exe 85 PID 4656 wrote to memory of 1896 4656 7pdvp.exe 85 PID 4656 wrote to memory of 1896 4656 7pdvp.exe 85 PID 1896 wrote to memory of 756 1896 7vpdd.exe 86 PID 1896 wrote to memory of 756 1896 7vpdd.exe 86 PID 1896 wrote to memory of 756 1896 7vpdd.exe 86 PID 756 wrote to memory of 1164 756 rffxrrl.exe 87 PID 756 wrote to memory of 1164 756 rffxrrl.exe 87 PID 756 wrote to memory of 1164 756 rffxrrl.exe 87 PID 1164 wrote to memory of 4852 1164 bhnhbt.exe 88 PID 1164 wrote to memory of 4852 1164 bhnhbt.exe 88 PID 1164 wrote to memory of 4852 1164 bhnhbt.exe 88 PID 4852 wrote to memory of 1116 4852 bnnnhn.exe 89 PID 4852 wrote to memory of 1116 4852 bnnnhn.exe 89 PID 4852 wrote to memory of 1116 4852 bnnnhn.exe 89 PID 1116 wrote to memory of 1388 1116 fxxxrrl.exe 90 PID 1116 wrote to memory of 1388 1116 fxxxrrl.exe 90 PID 1116 wrote to memory of 1388 1116 fxxxrrl.exe 90 PID 1388 wrote to memory of 4632 1388 pvjvp.exe 91 PID 1388 wrote to memory of 4632 1388 pvjvp.exe 91 PID 1388 wrote to memory of 4632 1388 pvjvp.exe 91 PID 4632 wrote to memory of 816 4632 jdvpj.exe 92 PID 4632 wrote to memory of 816 4632 jdvpj.exe 92 PID 4632 wrote to memory of 816 4632 jdvpj.exe 92 PID 816 wrote to memory of 1348 816 xlrfxxr.exe 93 PID 816 wrote to memory of 1348 816 xlrfxxr.exe 93 PID 816 wrote to memory of 1348 816 xlrfxxr.exe 93 PID 1348 wrote to memory of 724 1348 btnhhh.exe 94 PID 1348 wrote to memory of 724 1348 btnhhh.exe 94 PID 1348 wrote to memory of 724 1348 btnhhh.exe 94 PID 724 wrote to memory of 2960 724 5vdpj.exe 95 PID 724 wrote to memory of 2960 724 5vdpj.exe 95 PID 724 wrote to memory of 2960 724 5vdpj.exe 95 PID 2960 wrote to memory of 3008 2960 rxxrlfx.exe 96 PID 2960 wrote to memory of 3008 2960 rxxrlfx.exe 96 PID 2960 wrote to memory of 3008 2960 rxxrlfx.exe 96 PID 3008 wrote to memory of 2004 3008 bttbtb.exe 97 PID 3008 wrote to memory of 2004 3008 bttbtb.exe 97 PID 3008 wrote to memory of 2004 3008 bttbtb.exe 97 PID 2004 wrote to memory of 3632 2004 7ppjd.exe 98 PID 2004 wrote to memory of 3632 2004 7ppjd.exe 98 PID 2004 wrote to memory of 3632 2004 7ppjd.exe 98 PID 3632 wrote to memory of 1168 3632 9djdv.exe 99 PID 3632 wrote to memory of 1168 3632 9djdv.exe 99 PID 3632 wrote to memory of 1168 3632 9djdv.exe 99 PID 1168 wrote to memory of 424 1168 vvddd.exe 100 PID 1168 wrote to memory of 424 1168 vvddd.exe 100 PID 1168 wrote to memory of 424 1168 vvddd.exe 100 PID 424 wrote to memory of 1604 424 djpjd.exe 101 PID 424 wrote to memory of 1604 424 djpjd.exe 101 PID 424 wrote to memory of 1604 424 djpjd.exe 101 PID 1604 wrote to memory of 1188 1604 nnnnnt.exe 102 PID 1604 wrote to memory of 1188 1604 nnnnnt.exe 102 PID 1604 wrote to memory of 1188 1604 nnnnnt.exe 102 PID 1188 wrote to memory of 1888 1188 dpvvp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a637de6b59a123e34c9d149c837c779822441203488932df4d8685f557fe1b9d.exe"C:\Users\Admin\AppData\Local\Temp\a637de6b59a123e34c9d149c837c779822441203488932df4d8685f557fe1b9d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\htttnh.exec:\htttnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\vppjp.exec:\vppjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\7pdvp.exec:\7pdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\7vpdd.exec:\7vpdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\rffxrrl.exec:\rffxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\bhnhbt.exec:\bhnhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\bnnnhn.exec:\bnnnhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\pvjvp.exec:\pvjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\jdvpj.exec:\jdvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\xlrfxxr.exec:\xlrfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\btnhhh.exec:\btnhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\5vdpj.exec:\5vdpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
\??\c:\rxxrlfx.exec:\rxxrlfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\bttbtb.exec:\bttbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\7ppjd.exec:\7ppjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\9djdv.exec:\9djdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\vvddd.exec:\vvddd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\djpjd.exec:\djpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424 -
\??\c:\nnnnnt.exec:\nnnnnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\dpvvp.exec:\dpvvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\nbtnnh.exec:\nbtnnh.exe23⤵
- Executes dropped EXE
PID:1888 -
\??\c:\bnthbt.exec:\bnthbt.exe24⤵
- Executes dropped EXE
PID:4380 -
\??\c:\5vvpj.exec:\5vvpj.exe25⤵
- Executes dropped EXE
PID:3644 -
\??\c:\1llxrrl.exec:\1llxrrl.exe26⤵
- Executes dropped EXE
PID:2208 -
\??\c:\btbbnh.exec:\btbbnh.exe27⤵
- Executes dropped EXE
PID:2728 -
\??\c:\3vpjd.exec:\3vpjd.exe28⤵
- Executes dropped EXE
PID:4152 -
\??\c:\jvjdj.exec:\jvjdj.exe29⤵
- Executes dropped EXE
PID:1144 -
\??\c:\fflflfx.exec:\fflflfx.exe30⤵
- Executes dropped EXE
PID:1320 -
\??\c:\djppj.exec:\djppj.exe31⤵
- Executes dropped EXE
PID:3176 -
\??\c:\fxlfllr.exec:\fxlfllr.exe32⤵
- Executes dropped EXE
PID:1980 -
\??\c:\5ffxrrr.exec:\5ffxrrr.exe33⤵
- Executes dropped EXE
PID:4904 -
\??\c:\thtttt.exec:\thtttt.exe34⤵
- Executes dropped EXE
PID:4640 -
\??\c:\dpdvp.exec:\dpdvp.exe35⤵
- Executes dropped EXE
PID:460 -
\??\c:\rlfxffx.exec:\rlfxffx.exe36⤵
- Executes dropped EXE
PID:3848 -
\??\c:\vjdpj.exec:\vjdpj.exe37⤵
- Executes dropped EXE
PID:2240 -
\??\c:\llrlfxr.exec:\llrlfxr.exe38⤵
- Executes dropped EXE
PID:4216 -
\??\c:\bhnnhn.exec:\bhnnhn.exe39⤵
- Executes dropped EXE
PID:3572 -
\??\c:\rffxrlf.exec:\rffxrlf.exe40⤵
- Executes dropped EXE
PID:376 -
\??\c:\nhnhhh.exec:\nhnhhh.exe41⤵
- Executes dropped EXE
PID:4576 -
\??\c:\3jdpd.exec:\3jdpd.exe42⤵
- Executes dropped EXE
PID:2284 -
\??\c:\fxrrllf.exec:\fxrrllf.exe43⤵
- Executes dropped EXE
PID:1556 -
\??\c:\hbnbhb.exec:\hbnbhb.exe44⤵
- Executes dropped EXE
PID:4324 -
\??\c:\1vpjd.exec:\1vpjd.exe45⤵
- Executes dropped EXE
PID:2980 -
\??\c:\xrlfxlf.exec:\xrlfxlf.exe46⤵
- Executes dropped EXE
PID:3964 -
\??\c:\frxxrll.exec:\frxxrll.exe47⤵
- Executes dropped EXE
PID:2732 -
\??\c:\9tbttn.exec:\9tbttn.exe48⤵
- Executes dropped EXE
PID:772 -
\??\c:\nbbbbt.exec:\nbbbbt.exe49⤵
- Executes dropped EXE
PID:3996 -
\??\c:\vppjd.exec:\vppjd.exe50⤵
- Executes dropped EXE
PID:4128 -
\??\c:\frxxflr.exec:\frxxflr.exe51⤵
- Executes dropped EXE
PID:2688 -
\??\c:\5bhbbb.exec:\5bhbbb.exe52⤵
- Executes dropped EXE
PID:4140 -
\??\c:\djpjv.exec:\djpjv.exe53⤵
- Executes dropped EXE
PID:2820 -
\??\c:\3pvjd.exec:\3pvjd.exe54⤵
- Executes dropped EXE
PID:388 -
\??\c:\rxxrfff.exec:\rxxrfff.exe55⤵
- Executes dropped EXE
PID:4076 -
\??\c:\tnntnb.exec:\tnntnb.exe56⤵
- Executes dropped EXE
PID:3696 -
\??\c:\vvdvp.exec:\vvdvp.exe57⤵
- Executes dropped EXE
PID:3748 -
\??\c:\lxfrrxf.exec:\lxfrrxf.exe58⤵
- Executes dropped EXE
PID:3436 -
\??\c:\rflflxx.exec:\rflflxx.exe59⤵
- Executes dropped EXE
PID:1956 -
\??\c:\9thbnh.exec:\9thbnh.exe60⤵
- Executes dropped EXE
PID:4788 -
\??\c:\5jdvp.exec:\5jdvp.exe61⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rxlfrrf.exec:\rxlfrrf.exe62⤵
- Executes dropped EXE
PID:1540 -
\??\c:\nbbthb.exec:\nbbthb.exe63⤵
- Executes dropped EXE
PID:1792 -
\??\c:\3pjvj.exec:\3pjvj.exe64⤵
- Executes dropped EXE
PID:4448 -
\??\c:\xrrfxrl.exec:\xrrfxrl.exe65⤵
- Executes dropped EXE
PID:4888 -
\??\c:\lfrfrlf.exec:\lfrfrlf.exe66⤵PID:4476
-
\??\c:\hhhbtt.exec:\hhhbtt.exe67⤵PID:2960
-
\??\c:\vjppj.exec:\vjppj.exe68⤵PID:2424
-
\??\c:\ppvpd.exec:\ppvpd.exe69⤵PID:2816
-
\??\c:\rllfllf.exec:\rllfllf.exe70⤵PID:4260
-
\??\c:\bntnhb.exec:\bntnhb.exe71⤵PID:3372
-
\??\c:\3jpjv.exec:\3jpjv.exe72⤵PID:5016
-
\??\c:\rxfrxrl.exec:\rxfrxrl.exe73⤵PID:988
-
\??\c:\rrlfxfl.exec:\rrlfxfl.exe74⤵PID:4792
-
\??\c:\nhhnhn.exec:\nhhnhn.exe75⤵PID:5108
-
\??\c:\nhttbt.exec:\nhttbt.exe76⤵PID:3548
-
\??\c:\vjjdp.exec:\vjjdp.exe77⤵PID:1888
-
\??\c:\fffxrfr.exec:\fffxrfr.exe78⤵PID:4380
-
\??\c:\ntbbtt.exec:\ntbbtt.exe79⤵PID:3896
-
\??\c:\hbbhbb.exec:\hbbhbb.exe80⤵PID:3644
-
\??\c:\1ddpj.exec:\1ddpj.exe81⤵
- System Location Discovery: System Language Discovery
PID:3528 -
\??\c:\fffxrrr.exec:\fffxrrr.exe82⤵PID:4392
-
\??\c:\thhbtn.exec:\thhbtn.exe83⤵PID:3816
-
\??\c:\hntnhb.exec:\hntnhb.exe84⤵PID:2684
-
\??\c:\pvvpj.exec:\pvvpj.exe85⤵PID:408
-
\??\c:\7xxlrlx.exec:\7xxlrlx.exe86⤵PID:3252
-
\??\c:\tthtnn.exec:\tthtnn.exe87⤵PID:3480
-
\??\c:\7ntnnn.exec:\7ntnnn.exe88⤵PID:2456
-
\??\c:\vpvpj.exec:\vpvpj.exe89⤵PID:4712
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe90⤵PID:552
-
\??\c:\ththbt.exec:\ththbt.exe91⤵PID:4428
-
\??\c:\bbhhhh.exec:\bbhhhh.exe92⤵PID:2056
-
\??\c:\7ppvp.exec:\7ppvp.exe93⤵PID:460
-
\??\c:\dvvjd.exec:\dvvjd.exe94⤵PID:2172
-
\??\c:\lffxlfx.exec:\lffxlfx.exe95⤵PID:4528
-
\??\c:\nbthth.exec:\nbthth.exe96⤵PID:5008
-
\??\c:\pjdpd.exec:\pjdpd.exe97⤵PID:4216
-
\??\c:\rffrfxx.exec:\rffrfxx.exe98⤵PID:2972
-
\??\c:\3nbbtt.exec:\3nbbtt.exe99⤵PID:376
-
\??\c:\7jjvv.exec:\7jjvv.exe100⤵PID:4860
-
\??\c:\vppvp.exec:\vppvp.exe101⤵PID:5072
-
\??\c:\rxfrfxl.exec:\rxfrfxl.exe102⤵PID:4352
-
\??\c:\9nhbtn.exec:\9nhbtn.exe103⤵PID:1444
-
\??\c:\hntnbb.exec:\hntnbb.exe104⤵PID:1996
-
\??\c:\ddjdv.exec:\ddjdv.exe105⤵PID:3248
-
\??\c:\xflfxrl.exec:\xflfxrl.exe106⤵PID:2612
-
\??\c:\rxfxllx.exec:\rxfxllx.exe107⤵PID:2732
-
\??\c:\hbtnhb.exec:\hbtnhb.exe108⤵PID:4832
-
\??\c:\1pjdv.exec:\1pjdv.exe109⤵PID:2988
-
\??\c:\5rrlfxr.exec:\5rrlfxr.exe110⤵PID:4656
-
\??\c:\9ttbth.exec:\9ttbth.exe111⤵PID:4896
-
\??\c:\dppdv.exec:\dppdv.exe112⤵PID:1856
-
\??\c:\ddpdj.exec:\ddpdj.exe113⤵PID:4240
-
\??\c:\xrxxllf.exec:\xrxxllf.exe114⤵PID:1500
-
\??\c:\nnnhhb.exec:\nnnhhb.exe115⤵PID:3612
-
\??\c:\tttntn.exec:\tttntn.exe116⤵PID:1592
-
\??\c:\1pdvv.exec:\1pdvv.exe117⤵PID:3856
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe118⤵PID:3664
-
\??\c:\9xxrrrl.exec:\9xxrrrl.exe119⤵PID:1388
-
\??\c:\hbbthb.exec:\hbbthb.exe120⤵PID:4564
-
\??\c:\pjjdv.exec:\pjjdv.exe121⤵PID:1404
-
\??\c:\fxxlffx.exec:\fxxlffx.exe122⤵PID:4788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-