Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 16:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
94e33468f4d090274c9aa9691e2091144e77090beaff1b8ff4de1df27feee5d9.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
120 seconds
General
-
Target
94e33468f4d090274c9aa9691e2091144e77090beaff1b8ff4de1df27feee5d9.exe
-
Size
454KB
-
MD5
abeadc4604d342f50fdeaeb93ac58779
-
SHA1
793a6a31f2445e043257d4dc0f6f31a23fe385ee
-
SHA256
94e33468f4d090274c9aa9691e2091144e77090beaff1b8ff4de1df27feee5d9
-
SHA512
7524c080e3eacaeb85e46bceda3039973b61211905d48eb22b1008f319e4a225d751ea54e4d32c5fb9f5b364f4254fd4faef86c05953ee7ad67b3a6c5d5ea9b2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeZ:q7Tc2NYHUrAwfMp3CDZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/556-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/852-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1904-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2332-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/768-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-751-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-918-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-1027-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-1139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5028 3vpjd.exe 3176 1hhthn.exe 2708 vpppp.exe 1256 bthhhb.exe 4372 5xflffx.exe 3540 jvjjp.exe 2320 tbhbnh.exe 976 1xrlllf.exe 4216 1dpdp.exe 2688 btnhbt.exe 852 dppdd.exe 3268 7hhbtt.exe 4844 pddvj.exe 1476 flrfrff.exe 2260 9jdpj.exe 1904 rrrlflf.exe 228 1bbttt.exe 1656 pvvpd.exe 2872 vjjdp.exe 1156 tnnhtt.exe 3824 xrffrrl.exe 3208 5hnhnn.exe 2008 vpdjv.exe 4888 xxfxlff.exe 1456 xlfxllf.exe 456 tnnhnn.exe 1404 pjppv.exe 4456 3lrlllf.exe 4944 frrrlfx.exe 4548 httbth.exe 884 jpvdj.exe 1160 lxfflxx.exe 4088 xrlfxrl.exe 2332 xrrfxrf.exe 5016 lrrffxr.exe 1500 bnnnhn.exe 4764 jvdpv.exe 4692 3ththt.exe 4412 djpdj.exe 820 jjjdj.exe 3596 lrrrfrx.exe 3896 9bbthn.exe 3728 dvjvd.exe 4448 5dvpd.exe 2268 xxxffff.exe 1532 thtnnh.exe 5028 vpdjd.exe 112 7flxlll.exe 3968 lfffrrl.exe 1604 bnnthb.exe 4568 jdpvj.exe 3536 9vvpd.exe 740 lfxrllf.exe 3540 bbhbnn.exe 3996 1jdpj.exe 4584 djvpd.exe 4368 1flxfrf.exe 4312 dvdpv.exe 3668 dpjdv.exe 1332 rrlffxx.exe 1704 tbbnht.exe 552 1ddvd.exe 2800 fffxrlf.exe 1824 3tthhn.exe -
resource yara_rule behavioral2/memory/556-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2332-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4252-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/768-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-918-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 556 wrote to memory of 5028 556 94e33468f4d090274c9aa9691e2091144e77090beaff1b8ff4de1df27feee5d9.exe 82 PID 556 wrote to memory of 5028 556 94e33468f4d090274c9aa9691e2091144e77090beaff1b8ff4de1df27feee5d9.exe 82 PID 556 wrote to memory of 5028 556 94e33468f4d090274c9aa9691e2091144e77090beaff1b8ff4de1df27feee5d9.exe 82 PID 5028 wrote to memory of 3176 5028 3vpjd.exe 83 PID 5028 wrote to memory of 3176 5028 3vpjd.exe 83 PID 5028 wrote to memory of 3176 5028 3vpjd.exe 83 PID 3176 wrote to memory of 2708 3176 1hhthn.exe 84 PID 3176 wrote to memory of 2708 3176 1hhthn.exe 84 PID 3176 wrote to memory of 2708 3176 1hhthn.exe 84 PID 2708 wrote to memory of 1256 2708 vpppp.exe 85 PID 2708 wrote to memory of 1256 2708 vpppp.exe 85 PID 2708 wrote to memory of 1256 2708 vpppp.exe 85 PID 1256 wrote to memory of 4372 1256 bthhhb.exe 86 PID 1256 wrote to memory of 4372 1256 bthhhb.exe 86 PID 1256 wrote to memory of 4372 1256 bthhhb.exe 86 PID 4372 wrote to memory of 3540 4372 5xflffx.exe 87 PID 4372 wrote to memory of 3540 4372 5xflffx.exe 87 PID 4372 wrote to memory of 3540 4372 5xflffx.exe 87 PID 3540 wrote to memory of 2320 3540 jvjjp.exe 88 PID 3540 wrote to memory of 2320 3540 jvjjp.exe 88 PID 3540 wrote to memory of 2320 3540 jvjjp.exe 88 PID 2320 wrote to memory of 976 2320 tbhbnh.exe 89 PID 2320 wrote to memory of 976 2320 tbhbnh.exe 89 PID 2320 wrote to memory of 976 2320 tbhbnh.exe 89 PID 976 wrote to memory of 4216 976 1xrlllf.exe 90 PID 976 wrote to memory of 4216 976 1xrlllf.exe 90 PID 976 wrote to memory of 4216 976 1xrlllf.exe 90 PID 4216 wrote to memory of 2688 4216 1dpdp.exe 91 PID 4216 wrote to memory of 2688 4216 1dpdp.exe 91 PID 4216 wrote to memory of 2688 4216 1dpdp.exe 91 PID 2688 wrote to memory of 852 2688 btnhbt.exe 92 PID 2688 wrote to memory of 852 2688 btnhbt.exe 92 PID 2688 wrote to memory of 852 2688 btnhbt.exe 92 PID 852 wrote to memory of 3268 852 dppdd.exe 93 PID 852 wrote to memory of 3268 852 dppdd.exe 93 PID 852 wrote to memory of 3268 852 dppdd.exe 93 PID 3268 wrote to memory of 4844 3268 7hhbtt.exe 94 PID 3268 wrote to memory of 4844 3268 7hhbtt.exe 94 PID 3268 wrote to memory of 4844 3268 7hhbtt.exe 94 PID 4844 wrote to memory of 1476 4844 pddvj.exe 95 PID 4844 wrote to memory of 1476 4844 pddvj.exe 95 PID 4844 wrote to memory of 1476 4844 pddvj.exe 95 PID 1476 wrote to memory of 2260 1476 flrfrff.exe 96 PID 1476 wrote to memory of 2260 1476 flrfrff.exe 96 PID 1476 wrote to memory of 2260 1476 flrfrff.exe 96 PID 2260 wrote to memory of 1904 2260 9jdpj.exe 97 PID 2260 wrote to memory of 1904 2260 9jdpj.exe 97 PID 2260 wrote to memory of 1904 2260 9jdpj.exe 97 PID 1904 wrote to memory of 228 1904 rrrlflf.exe 98 PID 1904 wrote to memory of 228 1904 rrrlflf.exe 98 PID 1904 wrote to memory of 228 1904 rrrlflf.exe 98 PID 228 wrote to memory of 1656 228 1bbttt.exe 99 PID 228 wrote to memory of 1656 228 1bbttt.exe 99 PID 228 wrote to memory of 1656 228 1bbttt.exe 99 PID 1656 wrote to memory of 2872 1656 pvvpd.exe 100 PID 1656 wrote to memory of 2872 1656 pvvpd.exe 100 PID 1656 wrote to memory of 2872 1656 pvvpd.exe 100 PID 2872 wrote to memory of 1156 2872 vjjdp.exe 101 PID 2872 wrote to memory of 1156 2872 vjjdp.exe 101 PID 2872 wrote to memory of 1156 2872 vjjdp.exe 101 PID 1156 wrote to memory of 3824 1156 tnnhtt.exe 102 PID 1156 wrote to memory of 3824 1156 tnnhtt.exe 102 PID 1156 wrote to memory of 3824 1156 tnnhtt.exe 102 PID 3824 wrote to memory of 3208 3824 xrffrrl.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\94e33468f4d090274c9aa9691e2091144e77090beaff1b8ff4de1df27feee5d9.exe"C:\Users\Admin\AppData\Local\Temp\94e33468f4d090274c9aa9691e2091144e77090beaff1b8ff4de1df27feee5d9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\3vpjd.exec:\3vpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\1hhthn.exec:\1hhthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\vpppp.exec:\vpppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\bthhhb.exec:\bthhhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\5xflffx.exec:\5xflffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\jvjjp.exec:\jvjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\tbhbnh.exec:\tbhbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\1xrlllf.exec:\1xrlllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\1dpdp.exec:\1dpdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\btnhbt.exec:\btnhbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\dppdd.exec:\dppdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\7hhbtt.exec:\7hhbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\pddvj.exec:\pddvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\flrfrff.exec:\flrfrff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\9jdpj.exec:\9jdpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\rrrlflf.exec:\rrrlflf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\1bbttt.exec:\1bbttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\pvvpd.exec:\pvvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\vjjdp.exec:\vjjdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\tnnhtt.exec:\tnnhtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\xrffrrl.exec:\xrffrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\5hnhnn.exec:\5hnhnn.exe23⤵
- Executes dropped EXE
PID:3208 -
\??\c:\vpdjv.exec:\vpdjv.exe24⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xxfxlff.exec:\xxfxlff.exe25⤵
- Executes dropped EXE
PID:4888 -
\??\c:\xlfxllf.exec:\xlfxllf.exe26⤵
- Executes dropped EXE
PID:1456 -
\??\c:\tnnhnn.exec:\tnnhnn.exe27⤵
- Executes dropped EXE
PID:456 -
\??\c:\pjppv.exec:\pjppv.exe28⤵
- Executes dropped EXE
PID:1404 -
\??\c:\3lrlllf.exec:\3lrlllf.exe29⤵
- Executes dropped EXE
PID:4456 -
\??\c:\frrrlfx.exec:\frrrlfx.exe30⤵
- Executes dropped EXE
PID:4944 -
\??\c:\httbth.exec:\httbth.exe31⤵
- Executes dropped EXE
PID:4548 -
\??\c:\jpvdj.exec:\jpvdj.exe32⤵
- Executes dropped EXE
PID:884 -
\??\c:\lxfflxx.exec:\lxfflxx.exe33⤵
- Executes dropped EXE
PID:1160 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe34⤵
- Executes dropped EXE
PID:4088 -
\??\c:\xrrfxrf.exec:\xrrfxrf.exe35⤵
- Executes dropped EXE
PID:2332 -
\??\c:\lrrffxr.exec:\lrrffxr.exe36⤵
- Executes dropped EXE
PID:5016 -
\??\c:\bnnnhn.exec:\bnnnhn.exe37⤵
- Executes dropped EXE
PID:1500 -
\??\c:\jvdpv.exec:\jvdpv.exe38⤵
- Executes dropped EXE
PID:4764 -
\??\c:\3ththt.exec:\3ththt.exe39⤵
- Executes dropped EXE
PID:4692 -
\??\c:\djpdj.exec:\djpdj.exe40⤵
- Executes dropped EXE
PID:4412 -
\??\c:\jjjdj.exec:\jjjdj.exe41⤵
- Executes dropped EXE
PID:820 -
\??\c:\lrrrfrx.exec:\lrrrfrx.exe42⤵
- Executes dropped EXE
PID:3596 -
\??\c:\9bbthn.exec:\9bbthn.exe43⤵
- Executes dropped EXE
PID:3896 -
\??\c:\dvjvd.exec:\dvjvd.exe44⤵
- Executes dropped EXE
PID:3728 -
\??\c:\5dvpd.exec:\5dvpd.exe45⤵
- Executes dropped EXE
PID:4448 -
\??\c:\xxxffff.exec:\xxxffff.exe46⤵
- Executes dropped EXE
PID:2268 -
\??\c:\thtnnh.exec:\thtnnh.exe47⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vpdjd.exec:\vpdjd.exe48⤵
- Executes dropped EXE
PID:5028 -
\??\c:\7flxlll.exec:\7flxlll.exe49⤵
- Executes dropped EXE
PID:112 -
\??\c:\lfffrrl.exec:\lfffrrl.exe50⤵
- Executes dropped EXE
PID:3968 -
\??\c:\bnnthb.exec:\bnnthb.exe51⤵
- Executes dropped EXE
PID:1604 -
\??\c:\jdpvj.exec:\jdpvj.exe52⤵
- Executes dropped EXE
PID:4568 -
\??\c:\9vvpd.exec:\9vvpd.exe53⤵
- Executes dropped EXE
PID:3536 -
\??\c:\lfxrllf.exec:\lfxrllf.exe54⤵
- Executes dropped EXE
PID:740 -
\??\c:\bbhbnn.exec:\bbhbnn.exe55⤵
- Executes dropped EXE
PID:3540 -
\??\c:\1jdpj.exec:\1jdpj.exe56⤵
- Executes dropped EXE
PID:3996 -
\??\c:\djvpd.exec:\djvpd.exe57⤵
- Executes dropped EXE
PID:4584 -
\??\c:\1flxfrf.exec:\1flxfrf.exe58⤵
- Executes dropped EXE
PID:4368 -
\??\c:\dvdpv.exec:\dvdpv.exe59⤵
- Executes dropped EXE
PID:4312 -
\??\c:\dpjdv.exec:\dpjdv.exe60⤵
- Executes dropped EXE
PID:3668 -
\??\c:\rrlffxx.exec:\rrlffxx.exe61⤵
- Executes dropped EXE
PID:1332 -
\??\c:\tbbnht.exec:\tbbnht.exe62⤵
- Executes dropped EXE
PID:1704 -
\??\c:\1ddvd.exec:\1ddvd.exe63⤵
- Executes dropped EXE
PID:552 -
\??\c:\fffxrlf.exec:\fffxrlf.exe64⤵
- Executes dropped EXE
PID:2800 -
\??\c:\3tthhn.exec:\3tthhn.exe65⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vvdvj.exec:\vvdvj.exe66⤵PID:4844
-
\??\c:\9lrlrrx.exec:\9lrlrrx.exe67⤵PID:1476
-
\??\c:\thhbnn.exec:\thhbnn.exe68⤵PID:1352
-
\??\c:\pppjv.exec:\pppjv.exe69⤵PID:4252
-
\??\c:\llrlrrl.exec:\llrlrrl.exe70⤵PID:228
-
\??\c:\nbnthh.exec:\nbnthh.exe71⤵PID:4928
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe72⤵PID:2852
-
\??\c:\pddvv.exec:\pddvv.exe73⤵PID:2628
-
\??\c:\rlxfffl.exec:\rlxfffl.exe74⤵PID:3332
-
\??\c:\7bhbtt.exec:\7bhbtt.exe75⤵PID:3096
-
\??\c:\3pppj.exec:\3pppj.exe76⤵PID:2176
-
\??\c:\pvvjp.exec:\pvvjp.exe77⤵PID:2008
-
\??\c:\rrxrllf.exec:\rrxrllf.exe78⤵PID:4920
-
\??\c:\tntnhh.exec:\tntnhh.exe79⤵PID:4888
-
\??\c:\vddvj.exec:\vddvj.exe80⤵PID:1592
-
\??\c:\pddjv.exec:\pddjv.exe81⤵PID:4192
-
\??\c:\xfrlfxr.exec:\xfrlfxr.exe82⤵PID:4860
-
\??\c:\hnnhbb.exec:\hnnhbb.exe83⤵PID:4456
-
\??\c:\dvpdd.exec:\dvpdd.exe84⤵
- System Location Discovery: System Language Discovery
PID:2496 -
\??\c:\vpdjj.exec:\vpdjj.exe85⤵PID:1648
-
\??\c:\lffxrlf.exec:\lffxrlf.exe86⤵PID:4948
-
\??\c:\nbtnbb.exec:\nbtnbb.exe87⤵PID:4672
-
\??\c:\ppddv.exec:\ppddv.exe88⤵PID:3492
-
\??\c:\7xxrrrr.exec:\7xxrrrr.exe89⤵PID:4284
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe90⤵PID:3384
-
\??\c:\ttnbnb.exec:\ttnbnb.exe91⤵PID:8
-
\??\c:\5jdvj.exec:\5jdvj.exe92⤵PID:3340
-
\??\c:\rxxrffr.exec:\rxxrffr.exe93⤵PID:2944
-
\??\c:\nnbtbb.exec:\nnbtbb.exe94⤵PID:3044
-
\??\c:\nhnnhb.exec:\nhnnhb.exe95⤵PID:4012
-
\??\c:\3jddv.exec:\3jddv.exe96⤵PID:2172
-
\??\c:\rllfxxx.exec:\rllfxxx.exe97⤵PID:2296
-
\??\c:\9nttnt.exec:\9nttnt.exe98⤵PID:3056
-
\??\c:\hthnhn.exec:\hthnhn.exe99⤵PID:1816
-
\??\c:\pvvpv.exec:\pvvpv.exe100⤵PID:2728
-
\??\c:\fxffllr.exec:\fxffllr.exe101⤵PID:4436
-
\??\c:\frxlrrf.exec:\frxlrrf.exe102⤵PID:2904
-
\??\c:\bthhnh.exec:\bthhnh.exe103⤵PID:988
-
\??\c:\jdvpj.exec:\jdvpj.exe104⤵PID:2028
-
\??\c:\5ffxxfx.exec:\5ffxxfx.exe105⤵PID:4060
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe106⤵PID:812
-
\??\c:\htttnt.exec:\htttnt.exe107⤵PID:2312
-
\??\c:\jddjd.exec:\jddjd.exe108⤵PID:2368
-
\??\c:\frxrrll.exec:\frxrrll.exe109⤵PID:3660
-
\??\c:\bbnnnh.exec:\bbnnnh.exe110⤵PID:2584
-
\??\c:\bbbtnn.exec:\bbbtnn.exe111⤵PID:412
-
\??\c:\vjjdd.exec:\vjjdd.exe112⤵PID:740
-
\??\c:\3fffrll.exec:\3fffrll.exe113⤵PID:3540
-
\??\c:\3bbbtb.exec:\3bbbtb.exe114⤵PID:3256
-
\??\c:\bttbbh.exec:\bttbbh.exe115⤵PID:4540
-
\??\c:\pdjdp.exec:\pdjdp.exe116⤵PID:5056
-
\??\c:\rrrlffx.exec:\rrrlffx.exe117⤵PID:2632
-
\??\c:\1xrlflf.exec:\1xrlflf.exe118⤵PID:2180
-
\??\c:\nbhbbt.exec:\nbhbbt.exe119⤵PID:3568
-
\??\c:\pdjdd.exec:\pdjdd.exe120⤵PID:216
-
\??\c:\xlrfxrl.exec:\xlrfxrl.exe121⤵PID:3444
-
\??\c:\nhnhhh.exec:\nhnhhh.exe122⤵PID:4256
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-