Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 10:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe
Resource
win7-20241023-en
7 signatures
150 seconds
General
-
Target
cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe
-
Size
454KB
-
MD5
6abd8c063831dcdc79203d5e12de4221
-
SHA1
23b9c356decc9114bec5118f93eca4f8cbb4dee5
-
SHA256
cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f
-
SHA512
7c95bc995ee3b3ef80f6e01bc629b37325e7a6ad610cd0864dc10eb8b53055fd71ff3d601f840e56c041cbc6e1a2aa50d679863bbc2d8e6c195aff489e29d3b1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4624-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1744-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2504-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/744-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-675-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-747-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-808-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-908-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-963-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-1055-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-1746-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-1919-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5024 bhtbtt.exe 916 bbbtnt.exe 4804 vpvpp.exe 2752 xxxxffl.exe 1744 fxlfxlf.exe 380 pvpdv.exe 3972 bhntnb.exe 4308 rrxxlxl.exe 4280 pjdvp.exe 4024 xxfffff.exe 1004 ppdvv.exe 1624 lflfxxf.exe 4772 bnbtnt.exe 3688 vvvpj.exe 5112 9xrxrfr.exe 3548 hnnnhn.exe 2032 lxlfxrr.exe 4420 nbhbhh.exe 1504 rxflxlx.exe 3692 dppjd.exe 4828 nthtnh.exe 4840 dppdp.exe 4028 nntnnb.exe 5052 1pdvp.exe 3944 pdjdd.exe 64 9xrlffx.exe 3420 nnbttt.exe 724 lflfxrx.exe 2504 flxrffx.exe 2024 pdjdv.exe 4912 llfffll.exe 4868 nhnbnn.exe 744 xxxrflx.exe 2780 bbnbht.exe 3020 3xxrrxf.exe 1228 hhbthh.exe 1688 ffxllxf.exe 4960 5bbtnt.exe 4896 dvdpj.exe 1736 ffllfll.exe 2464 nhnnhn.exe 2272 ddddv.exe 4408 fxfffrr.exe 4588 btnhbt.exe 1276 1rxxrrr.exe 2700 rrfllll.exe 4128 thnthh.exe 2176 3dddd.exe 3668 9xffrxx.exe 5084 hhhbtt.exe 4076 jjpjd.exe 4620 xrffxxx.exe 3696 llfffff.exe 4624 vjvvd.exe 4372 lfxlxlx.exe 4764 7ntnhb.exe 2060 djvdv.exe 4804 jdjdj.exe 4316 rrflffl.exe 1824 hhnhhb.exe 3164 dpdvv.exe 4768 rlrlllr.exe 2544 hhhhhh.exe 2640 jvvdd.exe -
resource yara_rule behavioral2/memory/4624-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2504-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/744-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2272-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/672-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1536-808-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4624 wrote to memory of 5024 4624 cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe 82 PID 4624 wrote to memory of 5024 4624 cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe 82 PID 4624 wrote to memory of 5024 4624 cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe 82 PID 5024 wrote to memory of 916 5024 bhtbtt.exe 83 PID 5024 wrote to memory of 916 5024 bhtbtt.exe 83 PID 5024 wrote to memory of 916 5024 bhtbtt.exe 83 PID 916 wrote to memory of 4804 916 bbbtnt.exe 84 PID 916 wrote to memory of 4804 916 bbbtnt.exe 84 PID 916 wrote to memory of 4804 916 bbbtnt.exe 84 PID 4804 wrote to memory of 2752 4804 vpvpp.exe 85 PID 4804 wrote to memory of 2752 4804 vpvpp.exe 85 PID 4804 wrote to memory of 2752 4804 vpvpp.exe 85 PID 2752 wrote to memory of 1744 2752 xxxxffl.exe 86 PID 2752 wrote to memory of 1744 2752 xxxxffl.exe 86 PID 2752 wrote to memory of 1744 2752 xxxxffl.exe 86 PID 1744 wrote to memory of 380 1744 fxlfxlf.exe 87 PID 1744 wrote to memory of 380 1744 fxlfxlf.exe 87 PID 1744 wrote to memory of 380 1744 fxlfxlf.exe 87 PID 380 wrote to memory of 3972 380 pvpdv.exe 88 PID 380 wrote to memory of 3972 380 pvpdv.exe 88 PID 380 wrote to memory of 3972 380 pvpdv.exe 88 PID 3972 wrote to memory of 4308 3972 bhntnb.exe 89 PID 3972 wrote to memory of 4308 3972 bhntnb.exe 89 PID 3972 wrote to memory of 4308 3972 bhntnb.exe 89 PID 4308 wrote to memory of 4280 4308 rrxxlxl.exe 90 PID 4308 wrote to memory of 4280 4308 rrxxlxl.exe 90 PID 4308 wrote to memory of 4280 4308 rrxxlxl.exe 90 PID 4280 wrote to memory of 4024 4280 pjdvp.exe 91 PID 4280 wrote to memory of 4024 4280 pjdvp.exe 91 PID 4280 wrote to memory of 4024 4280 pjdvp.exe 91 PID 4024 wrote to memory of 1004 4024 xxfffff.exe 92 PID 4024 wrote to memory of 1004 4024 xxfffff.exe 92 PID 4024 wrote to memory of 1004 4024 xxfffff.exe 92 PID 1004 wrote to memory of 1624 1004 ppdvv.exe 93 PID 1004 wrote to memory of 1624 1004 ppdvv.exe 93 PID 1004 wrote to memory of 1624 1004 ppdvv.exe 93 PID 1624 wrote to memory of 4772 1624 lflfxxf.exe 94 PID 1624 wrote to memory of 4772 1624 lflfxxf.exe 94 PID 1624 wrote to memory of 4772 1624 lflfxxf.exe 94 PID 4772 wrote to memory of 3688 4772 bnbtnt.exe 95 PID 4772 wrote to memory of 3688 4772 bnbtnt.exe 95 PID 4772 wrote to memory of 3688 4772 bnbtnt.exe 95 PID 3688 wrote to memory of 5112 3688 vvvpj.exe 96 PID 3688 wrote to memory of 5112 3688 vvvpj.exe 96 PID 3688 wrote to memory of 5112 3688 vvvpj.exe 96 PID 5112 wrote to memory of 3548 5112 9xrxrfr.exe 97 PID 5112 wrote to memory of 3548 5112 9xrxrfr.exe 97 PID 5112 wrote to memory of 3548 5112 9xrxrfr.exe 97 PID 3548 wrote to memory of 2032 3548 hnnnhn.exe 98 PID 3548 wrote to memory of 2032 3548 hnnnhn.exe 98 PID 3548 wrote to memory of 2032 3548 hnnnhn.exe 98 PID 2032 wrote to memory of 4420 2032 lxlfxrr.exe 99 PID 2032 wrote to memory of 4420 2032 lxlfxrr.exe 99 PID 2032 wrote to memory of 4420 2032 lxlfxrr.exe 99 PID 4420 wrote to memory of 1504 4420 nbhbhh.exe 100 PID 4420 wrote to memory of 1504 4420 nbhbhh.exe 100 PID 4420 wrote to memory of 1504 4420 nbhbhh.exe 100 PID 1504 wrote to memory of 3692 1504 rxflxlx.exe 101 PID 1504 wrote to memory of 3692 1504 rxflxlx.exe 101 PID 1504 wrote to memory of 3692 1504 rxflxlx.exe 101 PID 3692 wrote to memory of 4828 3692 dppjd.exe 102 PID 3692 wrote to memory of 4828 3692 dppjd.exe 102 PID 3692 wrote to memory of 4828 3692 dppjd.exe 102 PID 4828 wrote to memory of 4840 4828 nthtnh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe"C:\Users\Admin\AppData\Local\Temp\cd18b89f15d09381d057f5f6eea546bc4e55bf5be0f7cbd389ccbbcd9908ed2f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\bhtbtt.exec:\bhtbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\bbbtnt.exec:\bbbtnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\vpvpp.exec:\vpvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\xxxxffl.exec:\xxxxffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\fxlfxlf.exec:\fxlfxlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\pvpdv.exec:\pvpdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\bhntnb.exec:\bhntnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\rrxxlxl.exec:\rrxxlxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\pjdvp.exec:\pjdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\xxfffff.exec:\xxfffff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\ppdvv.exec:\ppdvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\lflfxxf.exec:\lflfxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\bnbtnt.exec:\bnbtnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\vvvpj.exec:\vvvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\9xrxrfr.exec:\9xrxrfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\hnnnhn.exec:\hnnnhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\lxlfxrr.exec:\lxlfxrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\nbhbhh.exec:\nbhbhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\rxflxlx.exec:\rxflxlx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\dppjd.exec:\dppjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\nthtnh.exec:\nthtnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\dppdp.exec:\dppdp.exe23⤵
- Executes dropped EXE
PID:4840 -
\??\c:\nntnnb.exec:\nntnnb.exe24⤵
- Executes dropped EXE
PID:4028 -
\??\c:\1pdvp.exec:\1pdvp.exe25⤵
- Executes dropped EXE
PID:5052 -
\??\c:\pdjdd.exec:\pdjdd.exe26⤵
- Executes dropped EXE
PID:3944 -
\??\c:\9xrlffx.exec:\9xrlffx.exe27⤵
- Executes dropped EXE
PID:64 -
\??\c:\nnbttt.exec:\nnbttt.exe28⤵
- Executes dropped EXE
PID:3420 -
\??\c:\lflfxrx.exec:\lflfxrx.exe29⤵
- Executes dropped EXE
PID:724 -
\??\c:\flxrffx.exec:\flxrffx.exe30⤵
- Executes dropped EXE
PID:2504 -
\??\c:\pdjdv.exec:\pdjdv.exe31⤵
- Executes dropped EXE
PID:2024 -
\??\c:\llfffll.exec:\llfffll.exe32⤵
- Executes dropped EXE
PID:4912 -
\??\c:\nhnbnn.exec:\nhnbnn.exe33⤵
- Executes dropped EXE
PID:4868 -
\??\c:\xxxrflx.exec:\xxxrflx.exe34⤵
- Executes dropped EXE
PID:744 -
\??\c:\bbnbht.exec:\bbnbht.exe35⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3xxrrxf.exec:\3xxrrxf.exe36⤵
- Executes dropped EXE
PID:3020 -
\??\c:\hhbthh.exec:\hhbthh.exe37⤵
- Executes dropped EXE
PID:1228 -
\??\c:\ffxllxf.exec:\ffxllxf.exe38⤵
- Executes dropped EXE
PID:1688 -
\??\c:\5bbtnt.exec:\5bbtnt.exe39⤵
- Executes dropped EXE
PID:4960 -
\??\c:\dvdpj.exec:\dvdpj.exe40⤵
- Executes dropped EXE
PID:4896 -
\??\c:\ffllfll.exec:\ffllfll.exe41⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nhnnhn.exec:\nhnnhn.exe42⤵
- Executes dropped EXE
PID:2464 -
\??\c:\ddddv.exec:\ddddv.exe43⤵
- Executes dropped EXE
PID:2272 -
\??\c:\fxfffrr.exec:\fxfffrr.exe44⤵
- Executes dropped EXE
PID:4408 -
\??\c:\btnhbt.exec:\btnhbt.exe45⤵
- Executes dropped EXE
PID:4588 -
\??\c:\1rxxrrr.exec:\1rxxrrr.exe46⤵
- Executes dropped EXE
PID:1276 -
\??\c:\rrfllll.exec:\rrfllll.exe47⤵
- Executes dropped EXE
PID:2700 -
\??\c:\thnthh.exec:\thnthh.exe48⤵
- Executes dropped EXE
PID:4128 -
\??\c:\3dddd.exec:\3dddd.exe49⤵
- Executes dropped EXE
PID:2176 -
\??\c:\9xffrxx.exec:\9xffrxx.exe50⤵
- Executes dropped EXE
PID:3668 -
\??\c:\hhhbtt.exec:\hhhbtt.exe51⤵
- Executes dropped EXE
PID:5084 -
\??\c:\jjpjd.exec:\jjpjd.exe52⤵
- Executes dropped EXE
PID:4076 -
\??\c:\xrffxxx.exec:\xrffxxx.exe53⤵
- Executes dropped EXE
PID:4620 -
\??\c:\llfffff.exec:\llfffff.exe54⤵
- Executes dropped EXE
PID:3696 -
\??\c:\vjvvd.exec:\vjvvd.exe55⤵
- Executes dropped EXE
PID:4624 -
\??\c:\lfxlxlx.exec:\lfxlxlx.exe56⤵
- Executes dropped EXE
PID:4372 -
\??\c:\7ntnhb.exec:\7ntnhb.exe57⤵
- Executes dropped EXE
PID:4764 -
\??\c:\djvdv.exec:\djvdv.exe58⤵
- Executes dropped EXE
PID:2060 -
\??\c:\jdjdj.exec:\jdjdj.exe59⤵
- Executes dropped EXE
PID:4804 -
\??\c:\rrflffl.exec:\rrflffl.exe60⤵
- Executes dropped EXE
PID:4316 -
\??\c:\hhnhhb.exec:\hhnhhb.exe61⤵
- Executes dropped EXE
PID:1824 -
\??\c:\dpdvv.exec:\dpdvv.exe62⤵
- Executes dropped EXE
PID:3164 -
\??\c:\rlrlllr.exec:\rlrlllr.exe63⤵
- Executes dropped EXE
PID:4768 -
\??\c:\hhhhhh.exec:\hhhhhh.exe64⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jvvdd.exec:\jvvdd.exe65⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xlrlffr.exec:\xlrlffr.exe66⤵PID:2580
-
\??\c:\bhhhhh.exec:\bhhhhh.exe67⤵PID:3628
-
\??\c:\jddvj.exec:\jddvj.exe68⤵PID:3896
-
\??\c:\frrrrrl.exec:\frrrrrl.exe69⤵PID:4144
-
\??\c:\hhhbtn.exec:\hhhbtn.exe70⤵PID:1284
-
\??\c:\dvvpp.exec:\dvvpp.exe71⤵PID:2924
-
\??\c:\7pvvv.exec:\7pvvv.exe72⤵PID:2064
-
\??\c:\rlrllff.exec:\rlrllff.exe73⤵PID:1624
-
\??\c:\tnbbbb.exec:\tnbbbb.exe74⤵PID:1028
-
\??\c:\vjpjj.exec:\vjpjj.exe75⤵PID:4832
-
\??\c:\rlrrrrl.exec:\rlrrrrl.exe76⤵PID:4876
-
\??\c:\nnnbnn.exec:\nnnbnn.exe77⤵PID:2564
-
\??\c:\3jppj.exec:\3jppj.exe78⤵PID:3504
-
\??\c:\xrrrrrl.exec:\xrrrrrl.exe79⤵PID:224
-
\??\c:\9rlfxrr.exec:\9rlfxrr.exe80⤵PID:228
-
\??\c:\bhnhbn.exec:\bhnhbn.exe81⤵PID:4564
-
\??\c:\jjdvv.exec:\jjdvv.exe82⤵PID:4420
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe83⤵PID:2868
-
\??\c:\pvvdp.exec:\pvvdp.exe84⤵PID:2808
-
\??\c:\rrxrrfx.exec:\rrxrrfx.exe85⤵PID:1656
-
\??\c:\nhtnbt.exec:\nhtnbt.exe86⤵PID:412
-
\??\c:\dpppj.exec:\dpppj.exe87⤵PID:4840
-
\??\c:\lfffffl.exec:\lfffffl.exe88⤵PID:2816
-
\??\c:\jddvv.exec:\jddvv.exe89⤵PID:408
-
\??\c:\fxflxfx.exec:\fxflxfx.exe90⤵PID:2352
-
\??\c:\hnbtnn.exec:\hnbtnn.exe91⤵PID:2056
-
\??\c:\jdvjv.exec:\jdvjv.exe92⤵PID:4264
-
\??\c:\lfffxxr.exec:\lfffxxr.exe93⤵PID:404
-
\??\c:\tbhhbh.exec:\tbhhbh.exe94⤵PID:3464
-
\??\c:\pjvdp.exec:\pjvdp.exe95⤵PID:1328
-
\??\c:\tbnntn.exec:\tbnntn.exe96⤵PID:1168
-
\??\c:\vpvvp.exec:\vpvvp.exe97⤵PID:3776
-
\??\c:\9lrlffr.exec:\9lrlffr.exe98⤵PID:1172
-
\??\c:\tnnhbb.exec:\tnnhbb.exe99⤵PID:516
-
\??\c:\dvpjj.exec:\dvpjj.exe100⤵PID:3904
-
\??\c:\9lrrlll.exec:\9lrrlll.exe101⤵PID:1248
-
\??\c:\tntbnh.exec:\tntbnh.exe102⤵PID:3468
-
\??\c:\dvvvp.exec:\dvvvp.exe103⤵PID:4268
-
\??\c:\xlxxffx.exec:\xlxxffx.exe104⤵PID:2180
-
\??\c:\7nnnhh.exec:\7nnnhh.exe105⤵PID:4184
-
\??\c:\vpdjd.exec:\vpdjd.exe106⤵PID:2688
-
\??\c:\xxlrrfx.exec:\xxlrrfx.exe107⤵PID:1628
-
\??\c:\nnnnbh.exec:\nnnnbh.exe108⤵PID:2164
-
\??\c:\rllfrrl.exec:\rllfrrl.exe109⤵PID:4848
-
\??\c:\tttbbb.exec:\tttbbb.exe110⤵PID:4508
-
\??\c:\vdpvd.exec:\vdpvd.exe111⤵PID:4692
-
\??\c:\rfrflfl.exec:\rfrflfl.exe112⤵PID:3124
-
\??\c:\nbbtnn.exec:\nbbtnn.exe113⤵PID:3932
-
\??\c:\jdjjj.exec:\jdjjj.exe114⤵PID:1064
-
\??\c:\flxrffr.exec:\flxrffr.exe115⤵PID:4812
-
\??\c:\thnhbb.exec:\thnhbb.exe116⤵PID:460
-
\??\c:\jdjvp.exec:\jdjvp.exe117⤵PID:4128
-
\??\c:\7rrlxfx.exec:\7rrlxfx.exe118⤵PID:1416
-
\??\c:\hbhhnb.exec:\hbhhnb.exe119⤵PID:4900
-
\??\c:\pdjdd.exec:\pdjdd.exe120⤵PID:2092
-
\??\c:\ddjpp.exec:\ddjpp.exe121⤵PID:4388
-
\??\c:\nhbhhb.exec:\nhbhhb.exe122⤵PID:4492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-