Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 07:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
071cdcb23fab9c80ceca53ad879630159ec9c9386e4e69acbda99e5355629e51.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
General
-
Target
071cdcb23fab9c80ceca53ad879630159ec9c9386e4e69acbda99e5355629e51.exe
-
Size
456KB
-
MD5
8f178be0ca9f752e558bd8b9d85b64a0
-
SHA1
47d9337a31b23dae5f5f2ffe9fa700b13a82ab9f
-
SHA256
071cdcb23fab9c80ceca53ad879630159ec9c9386e4e69acbda99e5355629e51
-
SHA512
eaab9f75dce5cf924748dd3e5a908272adddd1db731b8ff67e9f227df233dc5feadfb642807ffc7900b23b7b9081d90940419d40c7f359b88046bb2fe31d9a41
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeY:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4212-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1344-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/460-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3848-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/804-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1344-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-745-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1852-836-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-1518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4380 7hhbtn.exe 3212 frfxxrr.exe 4080 5btbtn.exe 444 ddjdp.exe 2220 fllrxrl.exe 2508 ddjvp.exe 4148 rxxrffr.exe 3068 ntthhb.exe 1056 pjjdv.exe 1544 fllfxrl.exe 4088 thhbbt.exe 3912 bbbbtt.exe 2952 hbtbbt.exe 1808 hhbhnt.exe 4016 5jdvp.exe 5084 dpvvj.exe 4512 jdpjj.exe 3808 nnbnhb.exe 4496 7dvpd.exe 2020 pddvp.exe 1232 lxxrrrl.exe 4568 lfffxlf.exe 1200 bnnhtt.exe 4036 ttbnhb.exe 2964 1pjpj.exe 3640 rxfxxrr.exe 1344 7lffrrr.exe 4648 vjpdv.exe 4780 xrrlfxr.exe 5100 thtttn.exe 2784 rlrrrrr.exe 1520 vjjjj.exe 2744 xxfxllf.exe 3076 hnbnhb.exe 3560 pjvjj.exe 2192 9jdvj.exe 2444 rrrfxrx.exe 4020 nhhhbb.exe 2600 9jjdj.exe 2248 lfxflfx.exe 60 hbbnhh.exe 3196 dppjd.exe 5108 xrrlffx.exe 3724 ntbtnn.exe 4892 vpjjd.exe 1128 vpvpj.exe 836 rlllfxr.exe 1800 7tbthb.exe 3136 hbtnhb.exe 2520 pjpvv.exe 532 frrrlfx.exe 4304 5xffxrl.exe 3616 tntttt.exe 4356 jvvjd.exe 4380 xlxxlll.exe 4344 lllxrlr.exe 3576 bthhbb.exe 4044 jjpjv.exe 3748 xrfxxrx.exe 1940 nbbnbt.exe 4404 ddpjd.exe 460 fffxllf.exe 3848 xxrrffr.exe 552 htbtnh.exe -
resource yara_rule behavioral2/memory/4212-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1344-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/460-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3848-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/804-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1344-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-642-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4212 wrote to memory of 4380 4212 071cdcb23fab9c80ceca53ad879630159ec9c9386e4e69acbda99e5355629e51.exe 82 PID 4212 wrote to memory of 4380 4212 071cdcb23fab9c80ceca53ad879630159ec9c9386e4e69acbda99e5355629e51.exe 82 PID 4212 wrote to memory of 4380 4212 071cdcb23fab9c80ceca53ad879630159ec9c9386e4e69acbda99e5355629e51.exe 82 PID 4380 wrote to memory of 3212 4380 7hhbtn.exe 83 PID 4380 wrote to memory of 3212 4380 7hhbtn.exe 83 PID 4380 wrote to memory of 3212 4380 7hhbtn.exe 83 PID 3212 wrote to memory of 4080 3212 frfxxrr.exe 84 PID 3212 wrote to memory of 4080 3212 frfxxrr.exe 84 PID 3212 wrote to memory of 4080 3212 frfxxrr.exe 84 PID 4080 wrote to memory of 444 4080 5btbtn.exe 85 PID 4080 wrote to memory of 444 4080 5btbtn.exe 85 PID 4080 wrote to memory of 444 4080 5btbtn.exe 85 PID 444 wrote to memory of 2220 444 ddjdp.exe 86 PID 444 wrote to memory of 2220 444 ddjdp.exe 86 PID 444 wrote to memory of 2220 444 ddjdp.exe 86 PID 2220 wrote to memory of 2508 2220 fllrxrl.exe 87 PID 2220 wrote to memory of 2508 2220 fllrxrl.exe 87 PID 2220 wrote to memory of 2508 2220 fllrxrl.exe 87 PID 2508 wrote to memory of 4148 2508 ddjvp.exe 88 PID 2508 wrote to memory of 4148 2508 ddjvp.exe 88 PID 2508 wrote to memory of 4148 2508 ddjvp.exe 88 PID 4148 wrote to memory of 3068 4148 rxxrffr.exe 89 PID 4148 wrote to memory of 3068 4148 rxxrffr.exe 89 PID 4148 wrote to memory of 3068 4148 rxxrffr.exe 89 PID 3068 wrote to memory of 1056 3068 ntthhb.exe 90 PID 3068 wrote to memory of 1056 3068 ntthhb.exe 90 PID 3068 wrote to memory of 1056 3068 ntthhb.exe 90 PID 1056 wrote to memory of 1544 1056 pjjdv.exe 91 PID 1056 wrote to memory of 1544 1056 pjjdv.exe 91 PID 1056 wrote to memory of 1544 1056 pjjdv.exe 91 PID 1544 wrote to memory of 4088 1544 fllfxrl.exe 92 PID 1544 wrote to memory of 4088 1544 fllfxrl.exe 92 PID 1544 wrote to memory of 4088 1544 fllfxrl.exe 92 PID 4088 wrote to memory of 3912 4088 thhbbt.exe 93 PID 4088 wrote to memory of 3912 4088 thhbbt.exe 93 PID 4088 wrote to memory of 3912 4088 thhbbt.exe 93 PID 3912 wrote to memory of 2952 3912 bbbbtt.exe 94 PID 3912 wrote to memory of 2952 3912 bbbbtt.exe 94 PID 3912 wrote to memory of 2952 3912 bbbbtt.exe 94 PID 2952 wrote to memory of 1808 2952 hbtbbt.exe 95 PID 2952 wrote to memory of 1808 2952 hbtbbt.exe 95 PID 2952 wrote to memory of 1808 2952 hbtbbt.exe 95 PID 1808 wrote to memory of 4016 1808 hhbhnt.exe 96 PID 1808 wrote to memory of 4016 1808 hhbhnt.exe 96 PID 1808 wrote to memory of 4016 1808 hhbhnt.exe 96 PID 4016 wrote to memory of 5084 4016 5jdvp.exe 97 PID 4016 wrote to memory of 5084 4016 5jdvp.exe 97 PID 4016 wrote to memory of 5084 4016 5jdvp.exe 97 PID 5084 wrote to memory of 4512 5084 dpvvj.exe 98 PID 5084 wrote to memory of 4512 5084 dpvvj.exe 98 PID 5084 wrote to memory of 4512 5084 dpvvj.exe 98 PID 4512 wrote to memory of 3808 4512 jdpjj.exe 99 PID 4512 wrote to memory of 3808 4512 jdpjj.exe 99 PID 4512 wrote to memory of 3808 4512 jdpjj.exe 99 PID 3808 wrote to memory of 4496 3808 nnbnhb.exe 100 PID 3808 wrote to memory of 4496 3808 nnbnhb.exe 100 PID 3808 wrote to memory of 4496 3808 nnbnhb.exe 100 PID 4496 wrote to memory of 2020 4496 7dvpd.exe 101 PID 4496 wrote to memory of 2020 4496 7dvpd.exe 101 PID 4496 wrote to memory of 2020 4496 7dvpd.exe 101 PID 2020 wrote to memory of 1232 2020 pddvp.exe 102 PID 2020 wrote to memory of 1232 2020 pddvp.exe 102 PID 2020 wrote to memory of 1232 2020 pddvp.exe 102 PID 1232 wrote to memory of 4568 1232 lxxrrrl.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\071cdcb23fab9c80ceca53ad879630159ec9c9386e4e69acbda99e5355629e51.exe"C:\Users\Admin\AppData\Local\Temp\071cdcb23fab9c80ceca53ad879630159ec9c9386e4e69acbda99e5355629e51.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\7hhbtn.exec:\7hhbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\frfxxrr.exec:\frfxxrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\5btbtn.exec:\5btbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\ddjdp.exec:\ddjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\fllrxrl.exec:\fllrxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\ddjvp.exec:\ddjvp.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\rxxrffr.exec:\rxxrffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\ntthhb.exec:\ntthhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\pjjdv.exec:\pjjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\fllfxrl.exec:\fllfxrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\thhbbt.exec:\thhbbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\bbbbtt.exec:\bbbbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\hbtbbt.exec:\hbtbbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\hhbhnt.exec:\hhbhnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\5jdvp.exec:\5jdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\dpvvj.exec:\dpvvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\jdpjj.exec:\jdpjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\nnbnhb.exec:\nnbnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\7dvpd.exec:\7dvpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\pddvp.exec:\pddvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\lxxrrrl.exec:\lxxrrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\lfffxlf.exec:\lfffxlf.exe23⤵
- Executes dropped EXE
PID:4568 -
\??\c:\bnnhtt.exec:\bnnhtt.exe24⤵
- Executes dropped EXE
PID:1200 -
\??\c:\ttbnhb.exec:\ttbnhb.exe25⤵
- Executes dropped EXE
PID:4036 -
\??\c:\1pjpj.exec:\1pjpj.exe26⤵
- Executes dropped EXE
PID:2964 -
\??\c:\rxfxxrr.exec:\rxfxxrr.exe27⤵
- Executes dropped EXE
PID:3640 -
\??\c:\7lffrrr.exec:\7lffrrr.exe28⤵
- Executes dropped EXE
PID:1344 -
\??\c:\vjpdv.exec:\vjpdv.exe29⤵
- Executes dropped EXE
PID:4648 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe30⤵
- Executes dropped EXE
PID:4780 -
\??\c:\thtttn.exec:\thtttn.exe31⤵
- Executes dropped EXE
PID:5100 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe32⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vjjjj.exec:\vjjjj.exe33⤵
- Executes dropped EXE
PID:1520 -
\??\c:\xxfxllf.exec:\xxfxllf.exe34⤵
- Executes dropped EXE
PID:2744 -
\??\c:\hnbnhb.exec:\hnbnhb.exe35⤵
- Executes dropped EXE
PID:3076 -
\??\c:\pjvjj.exec:\pjvjj.exe36⤵
- Executes dropped EXE
PID:3560 -
\??\c:\9jdvj.exec:\9jdvj.exe37⤵
- Executes dropped EXE
PID:2192 -
\??\c:\rrrfxrx.exec:\rrrfxrx.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2444 -
\??\c:\nhhhbb.exec:\nhhhbb.exe39⤵
- Executes dropped EXE
PID:4020 -
\??\c:\9jjdj.exec:\9jjdj.exe40⤵
- Executes dropped EXE
PID:2600 -
\??\c:\lfxflfx.exec:\lfxflfx.exe41⤵
- Executes dropped EXE
PID:2248 -
\??\c:\hbbnhh.exec:\hbbnhh.exe42⤵
- Executes dropped EXE
PID:60 -
\??\c:\dppjd.exec:\dppjd.exe43⤵
- Executes dropped EXE
PID:3196 -
\??\c:\xrrlffx.exec:\xrrlffx.exe44⤵
- Executes dropped EXE
PID:5108 -
\??\c:\ntbtnn.exec:\ntbtnn.exe45⤵
- Executes dropped EXE
PID:3724 -
\??\c:\vpjjd.exec:\vpjjd.exe46⤵
- Executes dropped EXE
PID:4892 -
\??\c:\vpvpj.exec:\vpvpj.exe47⤵
- Executes dropped EXE
PID:1128 -
\??\c:\rlllfxr.exec:\rlllfxr.exe48⤵
- Executes dropped EXE
PID:836 -
\??\c:\7tbthb.exec:\7tbthb.exe49⤵
- Executes dropped EXE
PID:1800 -
\??\c:\hbtnhb.exec:\hbtnhb.exe50⤵
- Executes dropped EXE
PID:3136 -
\??\c:\pjpvv.exec:\pjpvv.exe51⤵
- Executes dropped EXE
PID:2520 -
\??\c:\frrrlfx.exec:\frrrlfx.exe52⤵
- Executes dropped EXE
PID:532 -
\??\c:\5xffxrl.exec:\5xffxrl.exe53⤵
- Executes dropped EXE
PID:4304 -
\??\c:\tntttt.exec:\tntttt.exe54⤵
- Executes dropped EXE
PID:3616 -
\??\c:\jvvjd.exec:\jvvjd.exe55⤵
- Executes dropped EXE
PID:4356 -
\??\c:\xlxxlll.exec:\xlxxlll.exe56⤵
- Executes dropped EXE
PID:4380 -
\??\c:\lllxrlr.exec:\lllxrlr.exe57⤵
- Executes dropped EXE
PID:4344 -
\??\c:\bthhbb.exec:\bthhbb.exe58⤵
- Executes dropped EXE
PID:3576 -
\??\c:\jjpjv.exec:\jjpjv.exe59⤵
- Executes dropped EXE
PID:4044 -
\??\c:\xrfxxrx.exec:\xrfxxrx.exe60⤵
- Executes dropped EXE
PID:3748 -
\??\c:\nbbnbt.exec:\nbbnbt.exe61⤵
- Executes dropped EXE
PID:1940 -
\??\c:\ddpjd.exec:\ddpjd.exe62⤵
- Executes dropped EXE
PID:4404 -
\??\c:\fffxllf.exec:\fffxllf.exe63⤵
- Executes dropped EXE
PID:460 -
\??\c:\xxrrffr.exec:\xxrrffr.exe64⤵
- Executes dropped EXE
PID:3848 -
\??\c:\htbtnh.exec:\htbtnh.exe65⤵
- Executes dropped EXE
PID:552 -
\??\c:\dvdpj.exec:\dvdpj.exe66⤵PID:1056
-
\??\c:\xllxrxl.exec:\xllxrxl.exe67⤵PID:1396
-
\??\c:\1xlrfxl.exec:\1xlrfxl.exe68⤵PID:1836
-
\??\c:\httbnh.exec:\httbnh.exe69⤵PID:1544
-
\??\c:\1bbnbt.exec:\1bbnbt.exe70⤵PID:1400
-
\??\c:\dpvjj.exec:\dpvjj.exe71⤵PID:4144
-
\??\c:\fxrflff.exec:\fxrflff.exe72⤵PID:1728
-
\??\c:\nhbtnh.exec:\nhbtnh.exe73⤵PID:2152
-
\??\c:\vjpdp.exec:\vjpdp.exe74⤵PID:2332
-
\??\c:\pdjvp.exec:\pdjvp.exe75⤵PID:636
-
\??\c:\xlfrfxl.exec:\xlfrfxl.exe76⤵PID:4972
-
\??\c:\bttnhb.exec:\bttnhb.exe77⤵PID:4016
-
\??\c:\ddvjp.exec:\ddvjp.exe78⤵PID:4396
-
\??\c:\flrfxrl.exec:\flrfxrl.exe79⤵PID:3676
-
\??\c:\bbhbnn.exec:\bbhbnn.exe80⤵PID:3256
-
\??\c:\vvvvp.exec:\vvvvp.exe81⤵PID:4496
-
\??\c:\jvdpd.exec:\jvdpd.exe82⤵PID:5072
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe83⤵PID:2068
-
\??\c:\1tnbhb.exec:\1tnbhb.exe84⤵PID:4072
-
\??\c:\hnnhbt.exec:\hnnhbt.exe85⤵PID:2956
-
\??\c:\dvvjd.exec:\dvvjd.exe86⤵PID:2244
-
\??\c:\lffxlfx.exec:\lffxlfx.exe87⤵PID:3040
-
\??\c:\9btnhh.exec:\9btnhh.exe88⤵PID:1200
-
\??\c:\nhhbtt.exec:\nhhbtt.exe89⤵PID:436
-
\??\c:\pjdpj.exec:\pjdpj.exe90⤵PID:3544
-
\??\c:\xrfxrll.exec:\xrfxrll.exe91⤵PID:2964
-
\??\c:\fxrllrr.exec:\fxrllrr.exe92⤵PID:3060
-
\??\c:\bnttnh.exec:\bnttnh.exe93⤵PID:4452
-
\??\c:\pdjdv.exec:\pdjdv.exe94⤵PID:4024
-
\??\c:\7llfxxx.exec:\7llfxxx.exe95⤵PID:5008
-
\??\c:\htnnhn.exec:\htnnhn.exe96⤵PID:208
-
\??\c:\3vvpj.exec:\3vvpj.exe97⤵PID:32
-
\??\c:\rffxrlf.exec:\rffxrlf.exe98⤵PID:4040
-
\??\c:\llrlllf.exec:\llrlllf.exe99⤵PID:3612
-
\??\c:\tnhhbt.exec:\tnhhbt.exe100⤵PID:1520
-
\??\c:\ppjdv.exec:\ppjdv.exe101⤵PID:4744
-
\??\c:\pvdvj.exec:\pvdvj.exe102⤵PID:2308
-
\??\c:\lflrflf.exec:\lflrflf.exe103⤵PID:4612
-
\??\c:\1hbbtt.exec:\1hbbtt.exe104⤵PID:4992
-
\??\c:\vpvjj.exec:\vpvjj.exe105⤵PID:2444
-
\??\c:\dpvdv.exec:\dpvdv.exe106⤵PID:5024
-
\??\c:\llrlxxr.exec:\llrlxxr.exe107⤵PID:2300
-
\??\c:\bthbhb.exec:\bthbhb.exe108⤵PID:2992
-
\??\c:\pddpj.exec:\pddpj.exe109⤵PID:628
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe110⤵PID:1824
-
\??\c:\rxlxrfx.exec:\rxlxrfx.exe111⤵PID:3232
-
\??\c:\bttnhh.exec:\bttnhh.exe112⤵PID:964
-
\??\c:\hhhbtt.exec:\hhhbtt.exe113⤵PID:1804
-
\??\c:\pdpjv.exec:\pdpjv.exe114⤵PID:3520
-
\??\c:\lflfllx.exec:\lflfllx.exe115⤵PID:588
-
\??\c:\btbnbt.exec:\btbnbt.exe116⤵PID:1560
-
\??\c:\nttnhb.exec:\nttnhb.exe117⤵PID:4564
-
\??\c:\vpddj.exec:\vpddj.exe118⤵PID:3392
-
\??\c:\frrlffx.exec:\frrlffx.exe119⤵PID:1968
-
\??\c:\rxffxxx.exec:\rxffxxx.exe120⤵PID:4368
-
\??\c:\btthbb.exec:\btthbb.exe121⤵PID:4756
-
\??\c:\vdpjp.exec:\vdpjp.exe122⤵PID:2340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-