Analysis
-
max time kernel
120s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 15:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
90de930629e91d0cd04069d7d1038799483b81fc2c7969852938c67cf671806aN.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
90de930629e91d0cd04069d7d1038799483b81fc2c7969852938c67cf671806aN.exe
-
Size
453KB
-
MD5
70cef72baffbc3256eeaf172b22ac290
-
SHA1
653d957c90dd47aa28cdf6af35705de5c71cc6f6
-
SHA256
90de930629e91d0cd04069d7d1038799483b81fc2c7969852938c67cf671806a
-
SHA512
893ee7f91ee9e6f8f069b95d25c0c0de8f69d80c836126a81da4f9d92ee44830a1559dafbf02d7ceb3ccd9ab6ac2877ea3024856c45c39ba8f60c57d910e6234
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbef:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4640-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3420-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3368-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-705-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-1021-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-1037-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-1066-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-1076-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-1119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-1671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3260 fflrrxf.exe 4640 tbtntt.exe 1628 vpvjj.exe 4028 lxllrxx.exe 3324 flxrrxx.exe 4680 thnnnn.exe 1564 bbhnnt.exe 1252 ddjjj.exe 4364 hhntbt.exe 4400 xxffxxx.exe 1428 pjvdd.exe 3420 xflxfxf.exe 2024 tnhhhn.exe 220 vjddd.exe 2548 jdddd.exe 2076 ddpvv.exe 3256 3bttnt.exe 4324 vpvvv.exe 4184 nnnnnn.exe 4496 ntthbh.exe 3728 pjddd.exe 2016 xxxxxll.exe 4432 7bhhnt.exe 2648 vvpjj.exe 4944 vvvvv.exe 4176 rrxxxxx.exe 1636 jdjjd.exe 2804 rlxxxxx.exe 1556 bbbbtb.exe 3404 bnbbtt.exe 3368 pjpjd.exe 2004 nhttnn.exe 3832 bbnttt.exe 5068 xrxfflr.exe 3192 tbhhhn.exe 4416 pjjdv.exe 3280 fflllrx.exe 5060 nnhnnt.exe 3588 9dddj.exe 632 ppddj.exe 3848 bhttbh.exe 4444 ffrxlxf.exe 3956 7ttbth.exe 4656 hhttth.exe 1576 xxxflrx.exe 1720 hnttbb.exe 4640 1pvvv.exe 396 rllffll.exe 1628 hhntnn.exe 1404 vvjjj.exe 4028 xxrrxxf.exe 508 rxxxfll.exe 968 ddjdp.exe 3060 ffrrllx.exe 1992 ntbnbb.exe 3348 vvpjj.exe 3896 rxffxfl.exe 3004 fxfffll.exe 1564 btbbbb.exe 724 ddjjd.exe 4832 xffllrl.exe 1112 rlllffr.exe 2276 hbhhhh.exe 4300 nhtbbn.exe -
resource yara_rule behavioral2/memory/4640-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-1021-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-1037-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-1066-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-1076-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-1119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-1183-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4556 wrote to memory of 3260 4556 90de930629e91d0cd04069d7d1038799483b81fc2c7969852938c67cf671806aN.exe 82 PID 4556 wrote to memory of 3260 4556 90de930629e91d0cd04069d7d1038799483b81fc2c7969852938c67cf671806aN.exe 82 PID 4556 wrote to memory of 3260 4556 90de930629e91d0cd04069d7d1038799483b81fc2c7969852938c67cf671806aN.exe 82 PID 3260 wrote to memory of 4640 3260 fflrrxf.exe 83 PID 3260 wrote to memory of 4640 3260 fflrrxf.exe 83 PID 3260 wrote to memory of 4640 3260 fflrrxf.exe 83 PID 4640 wrote to memory of 1628 4640 tbtntt.exe 84 PID 4640 wrote to memory of 1628 4640 tbtntt.exe 84 PID 4640 wrote to memory of 1628 4640 tbtntt.exe 84 PID 1628 wrote to memory of 4028 1628 vpvjj.exe 85 PID 1628 wrote to memory of 4028 1628 vpvjj.exe 85 PID 1628 wrote to memory of 4028 1628 vpvjj.exe 85 PID 4028 wrote to memory of 3324 4028 lxllrxx.exe 86 PID 4028 wrote to memory of 3324 4028 lxllrxx.exe 86 PID 4028 wrote to memory of 3324 4028 lxllrxx.exe 86 PID 3324 wrote to memory of 4680 3324 flxrrxx.exe 87 PID 3324 wrote to memory of 4680 3324 flxrrxx.exe 87 PID 3324 wrote to memory of 4680 3324 flxrrxx.exe 87 PID 4680 wrote to memory of 1564 4680 thnnnn.exe 88 PID 4680 wrote to memory of 1564 4680 thnnnn.exe 88 PID 4680 wrote to memory of 1564 4680 thnnnn.exe 88 PID 1564 wrote to memory of 1252 1564 bbhnnt.exe 89 PID 1564 wrote to memory of 1252 1564 bbhnnt.exe 89 PID 1564 wrote to memory of 1252 1564 bbhnnt.exe 89 PID 1252 wrote to memory of 4364 1252 ddjjj.exe 90 PID 1252 wrote to memory of 4364 1252 ddjjj.exe 90 PID 1252 wrote to memory of 4364 1252 ddjjj.exe 90 PID 4364 wrote to memory of 4400 4364 hhntbt.exe 91 PID 4364 wrote to memory of 4400 4364 hhntbt.exe 91 PID 4364 wrote to memory of 4400 4364 hhntbt.exe 91 PID 4400 wrote to memory of 1428 4400 xxffxxx.exe 92 PID 4400 wrote to memory of 1428 4400 xxffxxx.exe 92 PID 4400 wrote to memory of 1428 4400 xxffxxx.exe 92 PID 1428 wrote to memory of 3420 1428 pjvdd.exe 93 PID 1428 wrote to memory of 3420 1428 pjvdd.exe 93 PID 1428 wrote to memory of 3420 1428 pjvdd.exe 93 PID 3420 wrote to memory of 2024 3420 xflxfxf.exe 94 PID 3420 wrote to memory of 2024 3420 xflxfxf.exe 94 PID 3420 wrote to memory of 2024 3420 xflxfxf.exe 94 PID 2024 wrote to memory of 220 2024 tnhhhn.exe 95 PID 2024 wrote to memory of 220 2024 tnhhhn.exe 95 PID 2024 wrote to memory of 220 2024 tnhhhn.exe 95 PID 220 wrote to memory of 2548 220 vjddd.exe 96 PID 220 wrote to memory of 2548 220 vjddd.exe 96 PID 220 wrote to memory of 2548 220 vjddd.exe 96 PID 2548 wrote to memory of 2076 2548 jdddd.exe 97 PID 2548 wrote to memory of 2076 2548 jdddd.exe 97 PID 2548 wrote to memory of 2076 2548 jdddd.exe 97 PID 2076 wrote to memory of 3256 2076 ddpvv.exe 98 PID 2076 wrote to memory of 3256 2076 ddpvv.exe 98 PID 2076 wrote to memory of 3256 2076 ddpvv.exe 98 PID 3256 wrote to memory of 4324 3256 3bttnt.exe 99 PID 3256 wrote to memory of 4324 3256 3bttnt.exe 99 PID 3256 wrote to memory of 4324 3256 3bttnt.exe 99 PID 4324 wrote to memory of 4184 4324 vpvvv.exe 100 PID 4324 wrote to memory of 4184 4324 vpvvv.exe 100 PID 4324 wrote to memory of 4184 4324 vpvvv.exe 100 PID 4184 wrote to memory of 4496 4184 nnnnnn.exe 101 PID 4184 wrote to memory of 4496 4184 nnnnnn.exe 101 PID 4184 wrote to memory of 4496 4184 nnnnnn.exe 101 PID 4496 wrote to memory of 3728 4496 ntthbh.exe 102 PID 4496 wrote to memory of 3728 4496 ntthbh.exe 102 PID 4496 wrote to memory of 3728 4496 ntthbh.exe 102 PID 3728 wrote to memory of 2016 3728 pjddd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\90de930629e91d0cd04069d7d1038799483b81fc2c7969852938c67cf671806aN.exe"C:\Users\Admin\AppData\Local\Temp\90de930629e91d0cd04069d7d1038799483b81fc2c7969852938c67cf671806aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\fflrrxf.exec:\fflrrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\tbtntt.exec:\tbtntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\vpvjj.exec:\vpvjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\lxllrxx.exec:\lxllrxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\flxrrxx.exec:\flxrrxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\thnnnn.exec:\thnnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\bbhnnt.exec:\bbhnnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\ddjjj.exec:\ddjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\hhntbt.exec:\hhntbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\xxffxxx.exec:\xxffxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\pjvdd.exec:\pjvdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\xflxfxf.exec:\xflxfxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\tnhhhn.exec:\tnhhhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\vjddd.exec:\vjddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\jdddd.exec:\jdddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\ddpvv.exec:\ddpvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\3bttnt.exec:\3bttnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\vpvvv.exec:\vpvvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\nnnnnn.exec:\nnnnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\ntthbh.exec:\ntthbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\pjddd.exec:\pjddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\xxxxxll.exec:\xxxxxll.exe23⤵
- Executes dropped EXE
PID:2016 -
\??\c:\7bhhnt.exec:\7bhhnt.exe24⤵
- Executes dropped EXE
PID:4432 -
\??\c:\vvpjj.exec:\vvpjj.exe25⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vvvvv.exec:\vvvvv.exe26⤵
- Executes dropped EXE
PID:4944 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe27⤵
- Executes dropped EXE
PID:4176 -
\??\c:\jdjjd.exec:\jdjjd.exe28⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe29⤵
- Executes dropped EXE
PID:2804 -
\??\c:\bbbbtb.exec:\bbbbtb.exe30⤵
- Executes dropped EXE
PID:1556 -
\??\c:\bnbbtt.exec:\bnbbtt.exe31⤵
- Executes dropped EXE
PID:3404 -
\??\c:\pjpjd.exec:\pjpjd.exe32⤵
- Executes dropped EXE
PID:3368 -
\??\c:\nhttnn.exec:\nhttnn.exe33⤵
- Executes dropped EXE
PID:2004 -
\??\c:\bbnttt.exec:\bbnttt.exe34⤵
- Executes dropped EXE
PID:3832 -
\??\c:\xrxfflr.exec:\xrxfflr.exe35⤵
- Executes dropped EXE
PID:5068 -
\??\c:\tbhhhn.exec:\tbhhhn.exe36⤵
- Executes dropped EXE
PID:3192 -
\??\c:\pjjdv.exec:\pjjdv.exe37⤵
- Executes dropped EXE
PID:4416 -
\??\c:\fflllrx.exec:\fflllrx.exe38⤵
- Executes dropped EXE
PID:3280 -
\??\c:\nnhnnt.exec:\nnhnnt.exe39⤵
- Executes dropped EXE
PID:5060 -
\??\c:\9dddj.exec:\9dddj.exe40⤵
- Executes dropped EXE
PID:3588 -
\??\c:\ppddj.exec:\ppddj.exe41⤵
- Executes dropped EXE
PID:632 -
\??\c:\bhttbh.exec:\bhttbh.exe42⤵
- Executes dropped EXE
PID:3848 -
\??\c:\ffrxlxf.exec:\ffrxlxf.exe43⤵
- Executes dropped EXE
PID:4444 -
\??\c:\7ttbth.exec:\7ttbth.exe44⤵
- Executes dropped EXE
PID:3956 -
\??\c:\hhttth.exec:\hhttth.exe45⤵
- Executes dropped EXE
PID:4656 -
\??\c:\xxxflrx.exec:\xxxflrx.exe46⤵
- Executes dropped EXE
PID:1576 -
\??\c:\hnttbb.exec:\hnttbb.exe47⤵
- Executes dropped EXE
PID:1720 -
\??\c:\1pvvv.exec:\1pvvv.exe48⤵
- Executes dropped EXE
PID:4640 -
\??\c:\rllffll.exec:\rllffll.exe49⤵
- Executes dropped EXE
PID:396 -
\??\c:\hhntnn.exec:\hhntnn.exe50⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vvjjj.exec:\vvjjj.exe51⤵
- Executes dropped EXE
PID:1404 -
\??\c:\xxrrxxf.exec:\xxrrxxf.exe52⤵
- Executes dropped EXE
PID:4028 -
\??\c:\rxxxfll.exec:\rxxxfll.exe53⤵
- Executes dropped EXE
PID:508 -
\??\c:\ddjdp.exec:\ddjdp.exe54⤵
- Executes dropped EXE
PID:968 -
\??\c:\ffrrllx.exec:\ffrrllx.exe55⤵
- Executes dropped EXE
PID:3060 -
\??\c:\ntbnbb.exec:\ntbnbb.exe56⤵
- Executes dropped EXE
PID:1992 -
\??\c:\vvpjj.exec:\vvpjj.exe57⤵
- Executes dropped EXE
PID:3348 -
\??\c:\rxffxfl.exec:\rxffxfl.exe58⤵
- Executes dropped EXE
PID:3896 -
\??\c:\fxfffll.exec:\fxfffll.exe59⤵
- Executes dropped EXE
PID:3004 -
\??\c:\btbbbb.exec:\btbbbb.exe60⤵
- Executes dropped EXE
PID:1564 -
\??\c:\ddjjd.exec:\ddjjd.exe61⤵
- Executes dropped EXE
PID:724 -
\??\c:\xffllrl.exec:\xffllrl.exe62⤵
- Executes dropped EXE
PID:4832 -
\??\c:\rlllffr.exec:\rlllffr.exe63⤵
- Executes dropped EXE
PID:1112 -
\??\c:\hbhhhh.exec:\hbhhhh.exe64⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nhtbbn.exec:\nhtbbn.exe65⤵
- Executes dropped EXE
PID:4300 -
\??\c:\pdpdd.exec:\pdpdd.exe66⤵PID:4604
-
\??\c:\rrxflrx.exec:\rrxflrx.exe67⤵PID:1016
-
\??\c:\tnbbbh.exec:\tnbbbh.exe68⤵PID:3604
-
\??\c:\jdppv.exec:\jdppv.exe69⤵PID:3012
-
\??\c:\9fffxxf.exec:\9fffxxf.exe70⤵PID:3216
-
\??\c:\bnbhnt.exec:\bnbhnt.exe71⤵PID:3668
-
\??\c:\dvjjp.exec:\dvjjp.exe72⤵PID:3512
-
\??\c:\hnbntb.exec:\hnbntb.exe73⤵PID:536
-
\??\c:\3vdvv.exec:\3vdvv.exe74⤵PID:1132
-
\??\c:\3lffrxx.exec:\3lffrxx.exe75⤵PID:1944
-
\??\c:\nhttbh.exec:\nhttbh.exe76⤵PID:3596
-
\??\c:\pppvv.exec:\pppvv.exe77⤵PID:2000
-
\??\c:\1lllrxf.exec:\1lllrxf.exe78⤵PID:748
-
\??\c:\3fllllr.exec:\3fllllr.exe79⤵PID:552
-
\??\c:\ppvdd.exec:\ppvdd.exe80⤵PID:1812
-
\??\c:\xrllrxx.exec:\xrllrxx.exe81⤵PID:4496
-
\??\c:\nntnnb.exec:\nntnnb.exe82⤵PID:1680
-
\??\c:\vpvvv.exec:\vpvvv.exe83⤵PID:5044
-
\??\c:\3vvvp.exec:\3vvvp.exe84⤵PID:2280
-
\??\c:\lxllrff.exec:\lxllrff.exe85⤵PID:4912
-
\??\c:\tbbbtb.exec:\tbbbtb.exe86⤵PID:4988
-
\??\c:\jdjjd.exec:\jdjjd.exe87⤵PID:2648
-
\??\c:\xfrrlrr.exec:\xfrrlrr.exe88⤵PID:4276
-
\??\c:\rrfrrxx.exec:\rrfrrxx.exe89⤵PID:4072
-
\??\c:\tnhhhh.exec:\tnhhhh.exe90⤵PID:860
-
\??\c:\ppvjd.exec:\ppvjd.exe91⤵PID:4904
-
\??\c:\lrllrrr.exec:\lrllrrr.exe92⤵PID:4292
-
\??\c:\lrflxfl.exec:\lrflxfl.exe93⤵PID:4828
-
\??\c:\bhbhhn.exec:\bhbhhn.exe94⤵PID:1848
-
\??\c:\ddddj.exec:\ddddj.exe95⤵PID:3844
-
\??\c:\5lrlllr.exec:\5lrlllr.exe96⤵PID:1588
-
\??\c:\hnnnnt.exec:\hnnnnt.exe97⤵
- System Location Discovery: System Language Discovery
PID:4404 -
\??\c:\pdppp.exec:\pdppp.exe98⤵PID:3224
-
\??\c:\rlfflrf.exec:\rlfflrf.exe99⤵PID:4936
-
\??\c:\5thhnb.exec:\5thhnb.exe100⤵PID:1320
-
\??\c:\djppj.exec:\djppj.exe101⤵PID:4412
-
\??\c:\5pjjp.exec:\5pjjp.exe102⤵PID:3520
-
\??\c:\lrfflrx.exec:\lrfflrx.exe103⤵PID:3192
-
\??\c:\nnhthn.exec:\nnhthn.exe104⤵PID:3288
-
\??\c:\djjjp.exec:\djjjp.exe105⤵PID:2592
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe106⤵PID:1836
-
\??\c:\bhbbhn.exec:\bhbbhn.exe107⤵PID:2192
-
\??\c:\jpddd.exec:\jpddd.exe108⤵PID:4880
-
\??\c:\xxrxxfl.exec:\xxrxxfl.exe109⤵PID:4464
-
\??\c:\nhhhhn.exec:\nhhhhn.exe110⤵PID:1364
-
\??\c:\tthhhh.exec:\tthhhh.exe111⤵PID:3568
-
\??\c:\vjppj.exec:\vjppj.exe112⤵PID:3372
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe113⤵PID:828
-
\??\c:\nhnnnt.exec:\nhnnnt.exe114⤵PID:2428
-
\??\c:\dvdvv.exec:\dvdvv.exe115⤵PID:2752
-
\??\c:\7vjjj.exec:\7vjjj.exe116⤵PID:1480
-
\??\c:\rfrllff.exec:\rfrllff.exe117⤵PID:1164
-
\??\c:\tbnnnn.exec:\tbnnnn.exe118⤵PID:3800
-
\??\c:\bbtbnt.exec:\bbtbnt.exe119⤵PID:4232
-
\??\c:\vdjdv.exec:\vdjdv.exe120⤵PID:1708
-
\??\c:\rrlllll.exec:\rrlllll.exe121⤵PID:380
-
\??\c:\bthhnb.exec:\bthhnb.exe122⤵PID:1776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-