Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 09:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe
-
Size
454KB
-
MD5
028354d76bfca5b4d8452fd7dad45001
-
SHA1
7f5a15adf340040e323df9c4e43360861f3c5200
-
SHA256
b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d
-
SHA512
ce6edfa4d27a6dc8a054b093bb97afceb40da0b01913efff223e5305094cc920f4ec3f9b807eb1458c5c417b01965e7043385aaac8a3b827440dfd2314a2ffa1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4384-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1512-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/952-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1212-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1276-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2492-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-692-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-711-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-1154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-1523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3500 tbbhbh.exe 4452 5tbtnt.exe 3280 jjpjj.exe 3600 jdpjd.exe 3412 ttbtnn.exe 116 lllrrxr.exe 2740 thnnhn.exe 4568 tbntnt.exe 1040 vdppj.exe 1532 jdddv.exe 2616 ttbnnn.exe 3296 rflllll.exe 4124 ddddv.exe 3016 xrrfrxl.exe 3556 tbnntb.exe 3744 jjjpv.exe 1968 fxfrllf.exe 2952 pjdvv.exe 1512 ntnnnn.exe 548 vvvdv.exe 5108 ffxxxxr.exe 4136 vpddv.exe 3488 nhhhnn.exe 2584 ppdpd.exe 952 xxfffff.exe 4720 bbnnhn.exe 1212 5pdjd.exe 1276 lrlrrxx.exe 4884 rflllfl.exe 3284 1xxrllf.exe 3748 ffrllxx.exe 3936 pjppj.exe 4940 hhbbtn.exe 4740 nbthbt.exe 1064 pvpvp.exe 4368 9flxxll.exe 5056 hbhbtt.exe 5068 ppdvj.exe 1696 llllllf.exe 2704 1tbtbb.exe 1616 vdddd.exe 4384 rxxlflf.exe 2760 tntnhh.exe 4452 9vvpp.exe 3544 flfllll.exe 4604 tbnnbh.exe 2204 pvddd.exe 864 lllllll.exe 1624 hnttnb.exe 5100 7xrrrxr.exe 5000 xxxfxfx.exe 2404 nnttnt.exe 4568 3dpvj.exe 516 frllllf.exe 1040 fxllfff.exe 3716 hbhbbb.exe 556 pvvdd.exe 1720 9xxxxxx.exe 2076 hhhhhh.exe 1932 djjdp.exe 1592 rxrlllf.exe 4752 5xrrrlf.exe 1376 hbtttt.exe 3040 dddjj.exe -
resource yara_rule behavioral2/memory/4384-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1512-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/952-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1212-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1276-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2492-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-711-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4384 wrote to memory of 3500 4384 b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe 83 PID 4384 wrote to memory of 3500 4384 b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe 83 PID 4384 wrote to memory of 3500 4384 b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe 83 PID 3500 wrote to memory of 4452 3500 tbbhbh.exe 84 PID 3500 wrote to memory of 4452 3500 tbbhbh.exe 84 PID 3500 wrote to memory of 4452 3500 tbbhbh.exe 84 PID 4452 wrote to memory of 3280 4452 5tbtnt.exe 85 PID 4452 wrote to memory of 3280 4452 5tbtnt.exe 85 PID 4452 wrote to memory of 3280 4452 5tbtnt.exe 85 PID 3280 wrote to memory of 3600 3280 jjpjj.exe 86 PID 3280 wrote to memory of 3600 3280 jjpjj.exe 86 PID 3280 wrote to memory of 3600 3280 jjpjj.exe 86 PID 3600 wrote to memory of 3412 3600 jdpjd.exe 87 PID 3600 wrote to memory of 3412 3600 jdpjd.exe 87 PID 3600 wrote to memory of 3412 3600 jdpjd.exe 87 PID 3412 wrote to memory of 116 3412 ttbtnn.exe 88 PID 3412 wrote to memory of 116 3412 ttbtnn.exe 88 PID 3412 wrote to memory of 116 3412 ttbtnn.exe 88 PID 116 wrote to memory of 2740 116 lllrrxr.exe 89 PID 116 wrote to memory of 2740 116 lllrrxr.exe 89 PID 116 wrote to memory of 2740 116 lllrrxr.exe 89 PID 2740 wrote to memory of 4568 2740 thnnhn.exe 90 PID 2740 wrote to memory of 4568 2740 thnnhn.exe 90 PID 2740 wrote to memory of 4568 2740 thnnhn.exe 90 PID 4568 wrote to memory of 1040 4568 tbntnt.exe 91 PID 4568 wrote to memory of 1040 4568 tbntnt.exe 91 PID 4568 wrote to memory of 1040 4568 tbntnt.exe 91 PID 1040 wrote to memory of 1532 1040 vdppj.exe 92 PID 1040 wrote to memory of 1532 1040 vdppj.exe 92 PID 1040 wrote to memory of 1532 1040 vdppj.exe 92 PID 1532 wrote to memory of 2616 1532 jdddv.exe 93 PID 1532 wrote to memory of 2616 1532 jdddv.exe 93 PID 1532 wrote to memory of 2616 1532 jdddv.exe 93 PID 2616 wrote to memory of 3296 2616 ttbnnn.exe 94 PID 2616 wrote to memory of 3296 2616 ttbnnn.exe 94 PID 2616 wrote to memory of 3296 2616 ttbnnn.exe 94 PID 3296 wrote to memory of 4124 3296 rflllll.exe 95 PID 3296 wrote to memory of 4124 3296 rflllll.exe 95 PID 3296 wrote to memory of 4124 3296 rflllll.exe 95 PID 4124 wrote to memory of 3016 4124 ddddv.exe 96 PID 4124 wrote to memory of 3016 4124 ddddv.exe 96 PID 4124 wrote to memory of 3016 4124 ddddv.exe 96 PID 3016 wrote to memory of 3556 3016 xrrfrxl.exe 97 PID 3016 wrote to memory of 3556 3016 xrrfrxl.exe 97 PID 3016 wrote to memory of 3556 3016 xrrfrxl.exe 97 PID 3556 wrote to memory of 3744 3556 tbnntb.exe 98 PID 3556 wrote to memory of 3744 3556 tbnntb.exe 98 PID 3556 wrote to memory of 3744 3556 tbnntb.exe 98 PID 3744 wrote to memory of 1968 3744 jjjpv.exe 99 PID 3744 wrote to memory of 1968 3744 jjjpv.exe 99 PID 3744 wrote to memory of 1968 3744 jjjpv.exe 99 PID 1968 wrote to memory of 2952 1968 fxfrllf.exe 100 PID 1968 wrote to memory of 2952 1968 fxfrllf.exe 100 PID 1968 wrote to memory of 2952 1968 fxfrllf.exe 100 PID 2952 wrote to memory of 1512 2952 pjdvv.exe 101 PID 2952 wrote to memory of 1512 2952 pjdvv.exe 101 PID 2952 wrote to memory of 1512 2952 pjdvv.exe 101 PID 1512 wrote to memory of 548 1512 ntnnnn.exe 102 PID 1512 wrote to memory of 548 1512 ntnnnn.exe 102 PID 1512 wrote to memory of 548 1512 ntnnnn.exe 102 PID 548 wrote to memory of 5108 548 vvvdv.exe 103 PID 548 wrote to memory of 5108 548 vvvdv.exe 103 PID 548 wrote to memory of 5108 548 vvvdv.exe 103 PID 5108 wrote to memory of 4136 5108 ffxxxxr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe"C:\Users\Admin\AppData\Local\Temp\b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\tbbhbh.exec:\tbbhbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\5tbtnt.exec:\5tbtnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\jjpjj.exec:\jjpjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\jdpjd.exec:\jdpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\ttbtnn.exec:\ttbtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\lllrrxr.exec:\lllrrxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\thnnhn.exec:\thnnhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\tbntnt.exec:\tbntnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\vdppj.exec:\vdppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\jdddv.exec:\jdddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\ttbnnn.exec:\ttbnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\rflllll.exec:\rflllll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\ddddv.exec:\ddddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\xrrfrxl.exec:\xrrfrxl.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\tbnntb.exec:\tbnntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\jjjpv.exec:\jjjpv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\fxfrllf.exec:\fxfrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\pjdvv.exec:\pjdvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\ntnnnn.exec:\ntnnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\vvvdv.exec:\vvvdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\ffxxxxr.exec:\ffxxxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\vpddv.exec:\vpddv.exe23⤵
- Executes dropped EXE
PID:4136 -
\??\c:\nhhhnn.exec:\nhhhnn.exe24⤵
- Executes dropped EXE
PID:3488 -
\??\c:\ppdpd.exec:\ppdpd.exe25⤵
- Executes dropped EXE
PID:2584 -
\??\c:\xxfffff.exec:\xxfffff.exe26⤵
- Executes dropped EXE
PID:952 -
\??\c:\bbnnhn.exec:\bbnnhn.exe27⤵
- Executes dropped EXE
PID:4720 -
\??\c:\5pdjd.exec:\5pdjd.exe28⤵
- Executes dropped EXE
PID:1212 -
\??\c:\lrlrrxx.exec:\lrlrrxx.exe29⤵
- Executes dropped EXE
PID:1276 -
\??\c:\rflllfl.exec:\rflllfl.exe30⤵
- Executes dropped EXE
PID:4884 -
\??\c:\1xxrllf.exec:\1xxrllf.exe31⤵
- Executes dropped EXE
PID:3284 -
\??\c:\ffrllxx.exec:\ffrllxx.exe32⤵
- Executes dropped EXE
PID:3748 -
\??\c:\pjppj.exec:\pjppj.exe33⤵
- Executes dropped EXE
PID:3936 -
\??\c:\hhbbtn.exec:\hhbbtn.exe34⤵
- Executes dropped EXE
PID:4940 -
\??\c:\nbthbt.exec:\nbthbt.exe35⤵
- Executes dropped EXE
PID:4740 -
\??\c:\pvpvp.exec:\pvpvp.exe36⤵
- Executes dropped EXE
PID:1064 -
\??\c:\9flxxll.exec:\9flxxll.exe37⤵
- Executes dropped EXE
PID:4368 -
\??\c:\hbhbtt.exec:\hbhbtt.exe38⤵
- Executes dropped EXE
PID:5056 -
\??\c:\ppdvj.exec:\ppdvj.exe39⤵
- Executes dropped EXE
PID:5068 -
\??\c:\llllllf.exec:\llllllf.exe40⤵
- Executes dropped EXE
PID:1696 -
\??\c:\1tbtbb.exec:\1tbtbb.exe41⤵
- Executes dropped EXE
PID:2704 -
\??\c:\vdddd.exec:\vdddd.exe42⤵
- Executes dropped EXE
PID:1616 -
\??\c:\rxxlflf.exec:\rxxlflf.exe43⤵
- Executes dropped EXE
PID:4384 -
\??\c:\tntnhh.exec:\tntnhh.exe44⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9vvpp.exec:\9vvpp.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4452 -
\??\c:\flfllll.exec:\flfllll.exe46⤵
- Executes dropped EXE
PID:3544 -
\??\c:\tbnnbh.exec:\tbnnbh.exe47⤵
- Executes dropped EXE
PID:4604 -
\??\c:\pvddd.exec:\pvddd.exe48⤵
- Executes dropped EXE
PID:2204 -
\??\c:\lllllll.exec:\lllllll.exe49⤵
- Executes dropped EXE
PID:864 -
\??\c:\hnttnb.exec:\hnttnb.exe50⤵
- Executes dropped EXE
PID:1624 -
\??\c:\7xrrrxr.exec:\7xrrrxr.exe51⤵
- Executes dropped EXE
PID:5100 -
\??\c:\xxxfxfx.exec:\xxxfxfx.exe52⤵
- Executes dropped EXE
PID:5000 -
\??\c:\nnttnt.exec:\nnttnt.exe53⤵
- Executes dropped EXE
PID:2404 -
\??\c:\3dpvj.exec:\3dpvj.exe54⤵
- Executes dropped EXE
PID:4568 -
\??\c:\frllllf.exec:\frllllf.exe55⤵
- Executes dropped EXE
PID:516 -
\??\c:\fxllfff.exec:\fxllfff.exe56⤵
- Executes dropped EXE
PID:1040 -
\??\c:\hbhbbb.exec:\hbhbbb.exe57⤵
- Executes dropped EXE
PID:3716 -
\??\c:\pvvdd.exec:\pvvdd.exe58⤵
- Executes dropped EXE
PID:556 -
\??\c:\9xxxxxx.exec:\9xxxxxx.exe59⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hhhhhh.exec:\hhhhhh.exe60⤵
- Executes dropped EXE
PID:2076 -
\??\c:\djjdp.exec:\djjdp.exe61⤵
- Executes dropped EXE
PID:1932 -
\??\c:\rxrlllf.exec:\rxrlllf.exe62⤵
- Executes dropped EXE
PID:1592 -
\??\c:\5xrrrlf.exec:\5xrrrlf.exe63⤵
- Executes dropped EXE
PID:4752 -
\??\c:\hbtttt.exec:\hbtttt.exe64⤵
- Executes dropped EXE
PID:1376 -
\??\c:\dddjj.exec:\dddjj.exe65⤵
- Executes dropped EXE
PID:3040 -
\??\c:\lxxxxxx.exec:\lxxxxxx.exe66⤵PID:4824
-
\??\c:\5nnttb.exec:\5nnttb.exe67⤵PID:4432
-
\??\c:\dpppp.exec:\dpppp.exe68⤵PID:3684
-
\??\c:\rlfflrf.exec:\rlfflrf.exe69⤵PID:1632
-
\??\c:\nbbntt.exec:\nbbntt.exe70⤵PID:3364
-
\??\c:\jjvvj.exec:\jjvvj.exe71⤵PID:1860
-
\??\c:\frxflrf.exec:\frxflrf.exe72⤵PID:1820
-
\??\c:\7thhnt.exec:\7thhnt.exe73⤵PID:1472
-
\??\c:\jjjjj.exec:\jjjjj.exe74⤵PID:1792
-
\??\c:\xxrfrrl.exec:\xxrfrrl.exe75⤵PID:2224
-
\??\c:\rrxrllx.exec:\rrxrllx.exe76⤵PID:4052
-
\??\c:\bnbhhn.exec:\bnbhhn.exe77⤵PID:1048
-
\??\c:\ppddd.exec:\ppddd.exe78⤵PID:1660
-
\??\c:\lrlllll.exec:\lrlllll.exe79⤵PID:1276
-
\??\c:\bnnbtt.exec:\bnnbtt.exe80⤵PID:4904
-
\??\c:\vjjvp.exec:\vjjvp.exe81⤵PID:3856
-
\??\c:\flrlllf.exec:\flrlllf.exe82⤵PID:5088
-
\??\c:\thhhbh.exec:\thhhbh.exe83⤵PID:4796
-
\??\c:\3ppvp.exec:\3ppvp.exe84⤵PID:3748
-
\??\c:\xllrrxx.exec:\xllrrxx.exe85⤵PID:3936
-
\??\c:\tntnbh.exec:\tntnbh.exe86⤵PID:1324
-
\??\c:\1nbbnn.exec:\1nbbnn.exe87⤵PID:2920
-
\??\c:\djjdp.exec:\djjdp.exe88⤵PID:1252
-
\??\c:\rfxxxff.exec:\rfxxxff.exe89⤵PID:4732
-
\??\c:\lrlrrfx.exec:\lrlrrfx.exe90⤵PID:1952
-
\??\c:\nhhnnn.exec:\nhhnnn.exe91⤵PID:4444
-
\??\c:\vvvvv.exec:\vvvvv.exe92⤵PID:1776
-
\??\c:\frxfllf.exec:\frxfllf.exe93⤵PID:1760
-
\??\c:\nhnnnh.exec:\nhnnnh.exe94⤵PID:4340
-
\??\c:\hhnnnn.exec:\hhnnnn.exe95⤵PID:4608
-
\??\c:\3vjvv.exec:\3vjvv.exe96⤵PID:2424
-
\??\c:\7xxffxx.exec:\7xxffxx.exe97⤵PID:1676
-
\??\c:\bbbbbh.exec:\bbbbbh.exe98⤵PID:2036
-
\??\c:\jvdvv.exec:\jvdvv.exe99⤵PID:2488
-
\??\c:\pdvvd.exec:\pdvvd.exe100⤵PID:4364
-
\??\c:\xrxxxff.exec:\xrxxxff.exe101⤵PID:4788
-
\??\c:\nttnbh.exec:\nttnbh.exe102⤵PID:3620
-
\??\c:\dvvvv.exec:\dvvvv.exe103⤵PID:3544
-
\??\c:\rrrlffx.exec:\rrrlffx.exe104⤵PID:4604
-
\??\c:\xxfllrx.exec:\xxfllrx.exe105⤵PID:2884
-
\??\c:\bbnhtb.exec:\bbnhtb.exe106⤵PID:2204
-
\??\c:\vpjjj.exec:\vpjjj.exe107⤵PID:864
-
\??\c:\flrflfl.exec:\flrflfl.exe108⤵PID:4672
-
\??\c:\hntttb.exec:\hntttb.exe109⤵PID:2492
-
\??\c:\bhhhhn.exec:\bhhhhn.exe110⤵PID:2228
-
\??\c:\rrlxxxx.exec:\rrlxxxx.exe111⤵PID:2240
-
\??\c:\hbthth.exec:\hbthth.exe112⤵PID:4292
-
\??\c:\tbbhhb.exec:\tbbhhb.exe113⤵PID:2284
-
\??\c:\dvddv.exec:\dvddv.exe114⤵PID:628
-
\??\c:\llfxxff.exec:\llfxxff.exe115⤵PID:1588
-
\??\c:\hnnttn.exec:\hnnttn.exe116⤵PID:2616
-
\??\c:\ddddd.exec:\ddddd.exe117⤵PID:4080
-
\??\c:\xxrxfll.exec:\xxrxfll.exe118⤵PID:972
-
\??\c:\htttnh.exec:\htttnh.exe119⤵PID:3048
-
\??\c:\hbbnnn.exec:\hbbnnn.exe120⤵PID:2496
-
\??\c:\jvddv.exec:\jvddv.exe121⤵PID:1044
-
\??\c:\fllfllf.exec:\fllfllf.exe122⤵PID:4060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-