Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 08:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0133713d9204f84a60a659f38475bacdb7065b044b3761abb7d3454ff525d25aN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
0133713d9204f84a60a659f38475bacdb7065b044b3761abb7d3454ff525d25aN.exe
-
Size
454KB
-
MD5
629defa4bcf66356e793625c7d722560
-
SHA1
9df3013825736b9dd22cbf9a201b5978bcb881d3
-
SHA256
0133713d9204f84a60a659f38475bacdb7065b044b3761abb7d3454ff525d25a
-
SHA512
6bac988a91b5ad56f82276b8872dff0d1b9703f1a60a9896b5056a0f98519ef5f03e6e4de5230c55ba671dd6b71b4909602a8209edcc0e8e9ec4ae147b1f9544
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeF:q7Tc2NYHUrAwfMp3CDF
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3716-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/836-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-773-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-798-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-1001-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-1107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-1132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-1582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5020 hbttth.exe 4420 lfxfrlf.exe 1968 tbtbbt.exe 4520 httnhh.exe 5060 1vpjd.exe 1068 xllfxxr.exe 5008 7tnhtt.exe 3732 5ttthn.exe 4356 nntntn.exe 1552 vdvdp.exe 2892 1djdv.exe 2924 nhhthh.exe 3680 7pdpd.exe 1472 5frfxrl.exe 1700 htnnbh.exe 3620 dvjvv.exe 1588 lflxrll.exe 436 1nnbtn.exe 2244 1fxrllf.exe 2388 3xfxrrl.exe 3980 xxffrrl.exe 4480 5flflrl.exe 2736 xlrlfrl.exe 1444 9lrxrxr.exe 3696 htntnh.exe 5004 dvpjd.exe 8 7jjvp.exe 4364 pvdpd.exe 1096 fllxlfr.exe 3144 3btnhh.exe 4920 7hbttt.exe 2456 1pppj.exe 3244 3pdpd.exe 4824 lrrlllf.exe 3748 hhnhbb.exe 2776 jvvpd.exe 3044 rllrfrl.exe 3364 xxxxfff.exe 1652 1hnhtn.exe 1656 3nnhhn.exe 3444 ddpjj.exe 1252 5fflfll.exe 4872 5ttnhb.exe 116 5nhbnn.exe 2596 3jjdp.exe 3532 7rfxlfx.exe 2300 7fxlxxl.exe 1556 dvdvd.exe 2384 rxrrffx.exe 4320 bnnhhn.exe 1940 nhhhbt.exe 3224 pjjdv.exe 4176 flrlxrr.exe 1504 frrrlfx.exe 3892 3hbttn.exe 4508 jvvpd.exe 532 3ffxxxr.exe 2344 nhhhbb.exe 2372 1vvvv.exe 5080 rflfffx.exe 2672 1hhbth.exe 3340 bbbtnh.exe 5068 vpjdv.exe 1696 3lxrllf.exe -
resource yara_rule behavioral2/memory/3716-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-798-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-820-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-1001-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3716 wrote to memory of 5020 3716 0133713d9204f84a60a659f38475bacdb7065b044b3761abb7d3454ff525d25aN.exe 82 PID 3716 wrote to memory of 5020 3716 0133713d9204f84a60a659f38475bacdb7065b044b3761abb7d3454ff525d25aN.exe 82 PID 3716 wrote to memory of 5020 3716 0133713d9204f84a60a659f38475bacdb7065b044b3761abb7d3454ff525d25aN.exe 82 PID 5020 wrote to memory of 4420 5020 hbttth.exe 83 PID 5020 wrote to memory of 4420 5020 hbttth.exe 83 PID 5020 wrote to memory of 4420 5020 hbttth.exe 83 PID 4420 wrote to memory of 1968 4420 lfxfrlf.exe 84 PID 4420 wrote to memory of 1968 4420 lfxfrlf.exe 84 PID 4420 wrote to memory of 1968 4420 lfxfrlf.exe 84 PID 1968 wrote to memory of 4520 1968 tbtbbt.exe 85 PID 1968 wrote to memory of 4520 1968 tbtbbt.exe 85 PID 1968 wrote to memory of 4520 1968 tbtbbt.exe 85 PID 4520 wrote to memory of 5060 4520 httnhh.exe 86 PID 4520 wrote to memory of 5060 4520 httnhh.exe 86 PID 4520 wrote to memory of 5060 4520 httnhh.exe 86 PID 5060 wrote to memory of 1068 5060 1vpjd.exe 87 PID 5060 wrote to memory of 1068 5060 1vpjd.exe 87 PID 5060 wrote to memory of 1068 5060 1vpjd.exe 87 PID 1068 wrote to memory of 5008 1068 xllfxxr.exe 88 PID 1068 wrote to memory of 5008 1068 xllfxxr.exe 88 PID 1068 wrote to memory of 5008 1068 xllfxxr.exe 88 PID 5008 wrote to memory of 3732 5008 7tnhtt.exe 89 PID 5008 wrote to memory of 3732 5008 7tnhtt.exe 89 PID 5008 wrote to memory of 3732 5008 7tnhtt.exe 89 PID 3732 wrote to memory of 4356 3732 5ttthn.exe 90 PID 3732 wrote to memory of 4356 3732 5ttthn.exe 90 PID 3732 wrote to memory of 4356 3732 5ttthn.exe 90 PID 4356 wrote to memory of 1552 4356 nntntn.exe 91 PID 4356 wrote to memory of 1552 4356 nntntn.exe 91 PID 4356 wrote to memory of 1552 4356 nntntn.exe 91 PID 1552 wrote to memory of 2892 1552 vdvdp.exe 92 PID 1552 wrote to memory of 2892 1552 vdvdp.exe 92 PID 1552 wrote to memory of 2892 1552 vdvdp.exe 92 PID 2892 wrote to memory of 2924 2892 1djdv.exe 93 PID 2892 wrote to memory of 2924 2892 1djdv.exe 93 PID 2892 wrote to memory of 2924 2892 1djdv.exe 93 PID 2924 wrote to memory of 3680 2924 nhhthh.exe 94 PID 2924 wrote to memory of 3680 2924 nhhthh.exe 94 PID 2924 wrote to memory of 3680 2924 nhhthh.exe 94 PID 3680 wrote to memory of 1472 3680 7pdpd.exe 95 PID 3680 wrote to memory of 1472 3680 7pdpd.exe 95 PID 3680 wrote to memory of 1472 3680 7pdpd.exe 95 PID 1472 wrote to memory of 1700 1472 5frfxrl.exe 96 PID 1472 wrote to memory of 1700 1472 5frfxrl.exe 96 PID 1472 wrote to memory of 1700 1472 5frfxrl.exe 96 PID 1700 wrote to memory of 3620 1700 htnnbh.exe 97 PID 1700 wrote to memory of 3620 1700 htnnbh.exe 97 PID 1700 wrote to memory of 3620 1700 htnnbh.exe 97 PID 3620 wrote to memory of 1588 3620 dvjvv.exe 98 PID 3620 wrote to memory of 1588 3620 dvjvv.exe 98 PID 3620 wrote to memory of 1588 3620 dvjvv.exe 98 PID 1588 wrote to memory of 436 1588 lflxrll.exe 99 PID 1588 wrote to memory of 436 1588 lflxrll.exe 99 PID 1588 wrote to memory of 436 1588 lflxrll.exe 99 PID 436 wrote to memory of 2244 436 1nnbtn.exe 100 PID 436 wrote to memory of 2244 436 1nnbtn.exe 100 PID 436 wrote to memory of 2244 436 1nnbtn.exe 100 PID 2244 wrote to memory of 2388 2244 1fxrllf.exe 101 PID 2244 wrote to memory of 2388 2244 1fxrllf.exe 101 PID 2244 wrote to memory of 2388 2244 1fxrllf.exe 101 PID 2388 wrote to memory of 3980 2388 3xfxrrl.exe 102 PID 2388 wrote to memory of 3980 2388 3xfxrrl.exe 102 PID 2388 wrote to memory of 3980 2388 3xfxrrl.exe 102 PID 3980 wrote to memory of 4480 3980 xxffrrl.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0133713d9204f84a60a659f38475bacdb7065b044b3761abb7d3454ff525d25aN.exe"C:\Users\Admin\AppData\Local\Temp\0133713d9204f84a60a659f38475bacdb7065b044b3761abb7d3454ff525d25aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\hbttth.exec:\hbttth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\lfxfrlf.exec:\lfxfrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\tbtbbt.exec:\tbtbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\httnhh.exec:\httnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\1vpjd.exec:\1vpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\xllfxxr.exec:\xllfxxr.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\7tnhtt.exec:\7tnhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\5ttthn.exec:\5ttthn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\nntntn.exec:\nntntn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\vdvdp.exec:\vdvdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\1djdv.exec:\1djdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\nhhthh.exec:\nhhthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\7pdpd.exec:\7pdpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\5frfxrl.exec:\5frfxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\htnnbh.exec:\htnnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\dvjvv.exec:\dvjvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\lflxrll.exec:\lflxrll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\1nnbtn.exec:\1nnbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\1fxrllf.exec:\1fxrllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\3xfxrrl.exec:\3xfxrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\xxffrrl.exec:\xxffrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\5flflrl.exec:\5flflrl.exe23⤵
- Executes dropped EXE
PID:4480 -
\??\c:\xlrlfrl.exec:\xlrlfrl.exe24⤵
- Executes dropped EXE
PID:2736 -
\??\c:\9lrxrxr.exec:\9lrxrxr.exe25⤵
- Executes dropped EXE
PID:1444 -
\??\c:\htntnh.exec:\htntnh.exe26⤵
- Executes dropped EXE
PID:3696 -
\??\c:\dvpjd.exec:\dvpjd.exe27⤵
- Executes dropped EXE
PID:5004 -
\??\c:\7jjvp.exec:\7jjvp.exe28⤵
- Executes dropped EXE
PID:8 -
\??\c:\pvdpd.exec:\pvdpd.exe29⤵
- Executes dropped EXE
PID:4364 -
\??\c:\fllxlfr.exec:\fllxlfr.exe30⤵
- Executes dropped EXE
PID:1096 -
\??\c:\3btnhh.exec:\3btnhh.exe31⤵
- Executes dropped EXE
PID:3144 -
\??\c:\7hbttt.exec:\7hbttt.exe32⤵
- Executes dropped EXE
PID:4920 -
\??\c:\1pppj.exec:\1pppj.exe33⤵
- Executes dropped EXE
PID:2456 -
\??\c:\3pdpd.exec:\3pdpd.exe34⤵
- Executes dropped EXE
PID:3244 -
\??\c:\lrrlllf.exec:\lrrlllf.exe35⤵
- Executes dropped EXE
PID:4824 -
\??\c:\hhnhbb.exec:\hhnhbb.exe36⤵
- Executes dropped EXE
PID:3748 -
\??\c:\jvvpd.exec:\jvvpd.exe37⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rllrfrl.exec:\rllrfrl.exe38⤵
- Executes dropped EXE
PID:3044 -
\??\c:\xxxxfff.exec:\xxxxfff.exe39⤵
- Executes dropped EXE
PID:3364 -
\??\c:\1hnhtn.exec:\1hnhtn.exe40⤵
- Executes dropped EXE
PID:1652 -
\??\c:\3nnhhn.exec:\3nnhhn.exe41⤵
- Executes dropped EXE
PID:1656 -
\??\c:\ddpjj.exec:\ddpjj.exe42⤵
- Executes dropped EXE
PID:3444 -
\??\c:\5fflfll.exec:\5fflfll.exe43⤵
- Executes dropped EXE
PID:1252 -
\??\c:\5ttnhb.exec:\5ttnhb.exe44⤵
- Executes dropped EXE
PID:4872 -
\??\c:\5nhbnn.exec:\5nhbnn.exe45⤵
- Executes dropped EXE
PID:116 -
\??\c:\3jjdp.exec:\3jjdp.exe46⤵
- Executes dropped EXE
PID:2596 -
\??\c:\7rfxlfx.exec:\7rfxlfx.exe47⤵
- Executes dropped EXE
PID:3532 -
\??\c:\7fxlxxl.exec:\7fxlxxl.exe48⤵
- Executes dropped EXE
PID:2300 -
\??\c:\dvdvd.exec:\dvdvd.exe49⤵
- Executes dropped EXE
PID:1556 -
\??\c:\rxrrffx.exec:\rxrrffx.exe50⤵
- Executes dropped EXE
PID:2384 -
\??\c:\bnnhhn.exec:\bnnhhn.exe51⤵
- Executes dropped EXE
PID:4320 -
\??\c:\nhhhbt.exec:\nhhhbt.exe52⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pjjdv.exec:\pjjdv.exe53⤵
- Executes dropped EXE
PID:3224 -
\??\c:\flrlxrr.exec:\flrlxrr.exe54⤵
- Executes dropped EXE
PID:4176 -
\??\c:\frrrlfx.exec:\frrrlfx.exe55⤵
- Executes dropped EXE
PID:1504 -
\??\c:\3hbttn.exec:\3hbttn.exe56⤵
- Executes dropped EXE
PID:3892 -
\??\c:\jvvpd.exec:\jvvpd.exe57⤵
- Executes dropped EXE
PID:4508 -
\??\c:\3ffxxxr.exec:\3ffxxxr.exe58⤵
- Executes dropped EXE
PID:532 -
\??\c:\nhhhbb.exec:\nhhhbb.exe59⤵
- Executes dropped EXE
PID:2344 -
\??\c:\1vvvv.exec:\1vvvv.exe60⤵
- Executes dropped EXE
PID:2372 -
\??\c:\rflfffx.exec:\rflfffx.exe61⤵
- Executes dropped EXE
PID:5080 -
\??\c:\1hhbth.exec:\1hhbth.exe62⤵
- Executes dropped EXE
PID:2672 -
\??\c:\bbbtnh.exec:\bbbtnh.exe63⤵
- Executes dropped EXE
PID:3340 -
\??\c:\vpjdv.exec:\vpjdv.exe64⤵
- Executes dropped EXE
PID:5068 -
\??\c:\3lxrllf.exec:\3lxrllf.exe65⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nbthnn.exec:\nbthnn.exe66⤵PID:4640
-
\??\c:\dvvvj.exec:\dvvvj.exe67⤵PID:4504
-
\??\c:\3ppjj.exec:\3ppjj.exe68⤵PID:1936
-
\??\c:\rllxrlf.exec:\rllxrlf.exe69⤵PID:2376
-
\??\c:\rrfrxxx.exec:\rrfrxxx.exe70⤵PID:4840
-
\??\c:\btbtnn.exec:\btbtnn.exe71⤵PID:3188
-
\??\c:\pjvpv.exec:\pjvpv.exe72⤵PID:4396
-
\??\c:\lxxfrrx.exec:\lxxfrrx.exe73⤵PID:1872
-
\??\c:\hbtnth.exec:\hbtnth.exe74⤵PID:996
-
\??\c:\jjpdv.exec:\jjpdv.exe75⤵PID:2924
-
\??\c:\rlxffxf.exec:\rlxffxf.exe76⤵PID:3752
-
\??\c:\rflxrlf.exec:\rflxrlf.exe77⤵PID:4020
-
\??\c:\9hhhtt.exec:\9hhhtt.exe78⤵PID:4256
-
\??\c:\9vdvd.exec:\9vdvd.exe79⤵PID:2872
-
\??\c:\fxxlfxr.exec:\fxxlfxr.exe80⤵PID:2316
-
\??\c:\fflxrlf.exec:\fflxrlf.exe81⤵PID:3944
-
\??\c:\tnnbtt.exec:\tnnbtt.exe82⤵PID:4532
-
\??\c:\pjdvj.exec:\pjdvj.exe83⤵PID:2136
-
\??\c:\9flrxrx.exec:\9flrxrx.exe84⤵PID:3184
-
\??\c:\rllfxxx.exec:\rllfxxx.exe85⤵PID:1980
-
\??\c:\httnhb.exec:\httnhb.exe86⤵PID:4028
-
\??\c:\pdpjj.exec:\pdpjj.exe87⤵PID:2388
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe88⤵PID:3260
-
\??\c:\htnhbt.exec:\htnhbt.exe89⤵PID:2968
-
\??\c:\bhthnn.exec:\bhthnn.exe90⤵PID:4452
-
\??\c:\vdjdv.exec:\vdjdv.exe91⤵PID:1580
-
\??\c:\llfflxr.exec:\llfflxr.exe92⤵PID:3476
-
\??\c:\nnhhbt.exec:\nnhhbt.exe93⤵PID:764
-
\??\c:\jjjdv.exec:\jjjdv.exe94⤵PID:2204
-
\??\c:\jdpjd.exec:\jdpjd.exe95⤵PID:3236
-
\??\c:\5flrffx.exec:\5flrffx.exe96⤵PID:3648
-
\??\c:\ntbtbb.exec:\ntbtbb.exe97⤵PID:4364
-
\??\c:\jdvvv.exec:\jdvvv.exe98⤵PID:2820
-
\??\c:\fxxrffr.exec:\fxxrffr.exe99⤵PID:3492
-
\??\c:\bttnhb.exec:\bttnhb.exe100⤵PID:1468
-
\??\c:\bnbttt.exec:\bnbttt.exe101⤵PID:448
-
\??\c:\1vdvv.exec:\1vdvv.exe102⤵PID:2572
-
\??\c:\xxlfllr.exec:\xxlfllr.exe103⤵PID:3244
-
\??\c:\9tbthn.exec:\9tbthn.exe104⤵PID:3028
-
\??\c:\5dvpj.exec:\5dvpj.exe105⤵PID:3748
-
\??\c:\frxrlxr.exec:\frxrlxr.exe106⤵PID:2776
-
\??\c:\hbbtnn.exec:\hbbtnn.exe107⤵PID:4336
-
\??\c:\7jvjj.exec:\7jvjj.exe108⤵PID:796
-
\??\c:\5vdpj.exec:\5vdpj.exe109⤵PID:4980
-
\??\c:\lllfxxr.exec:\lllfxxr.exe110⤵PID:3308
-
\??\c:\xxrrlll.exec:\xxrrlll.exe111⤵PID:5092
-
\??\c:\3thtnn.exec:\3thtnn.exe112⤵PID:4228
-
\??\c:\9jpdv.exec:\9jpdv.exe113⤵PID:2036
-
\??\c:\7ffxllf.exec:\7ffxllf.exe114⤵PID:4232
-
\??\c:\llrflfx.exec:\llrflfx.exe115⤵PID:4884
-
\??\c:\thnhtt.exec:\thnhtt.exe116⤵PID:5052
-
\??\c:\1jppj.exec:\1jppj.exe117⤵PID:4576
-
\??\c:\9pvpv.exec:\9pvpv.exe118⤵PID:4240
-
\??\c:\xllfrlf.exec:\xllfrlf.exe119⤵PID:1556
-
\??\c:\bhntnh.exec:\bhntnh.exe120⤵PID:2384
-
\??\c:\3hnhhh.exec:\3hnhhh.exe121⤵PID:4320
-
\??\c:\dvdvp.exec:\dvdvp.exe122⤵PID:4788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-