Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 20:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1d4f518662926c5ef45ec0741e09588e1534a49017ff27fa6135e2b14a870bef.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
1d4f518662926c5ef45ec0741e09588e1534a49017ff27fa6135e2b14a870bef.exe
-
Size
456KB
-
MD5
7ec19c0612051d0ca8c087d205c1ac32
-
SHA1
710a22d0906be18a8a562a482862729e1e30c96f
-
SHA256
1d4f518662926c5ef45ec0741e09588e1534a49017ff27fa6135e2b14a870bef
-
SHA512
0a84f4e043d71db4ea18038a1db1554f0b0d843499971780b815f2fe1f237687ea8e0ac30c8e29962e407181dfc59d1ce2ed66c8d39c783f4efadb73aea3de43
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbexu:q7Tc2NYHUrAwfMp3CD0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4772-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/592-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1324-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2772-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/516-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-752-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-786-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-1063-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-1127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 592 htntnt.exe 4320 pdpjv.exe 1464 7tnbhn.exe 960 xffxxll.exe 208 ntthth.exe 3956 vdvpj.exe 3748 lfxlxlx.exe 3044 frlfxrl.exe 228 hhhnbn.exe 1076 vjdpd.exe 3864 tnhbht.exe 2436 pjpdd.exe 2152 rfxlrlr.exe 4360 bbbtht.exe 3256 1dvpd.exe 1480 bnhthb.exe 4644 jjjvj.exe 2884 rxxlfrf.exe 3596 btbbnn.exe 3804 pdjjj.exe 3660 tbhbtt.exe 1604 vjpjd.exe 2284 frxfrrr.exe 2012 lxfxrlf.exe 5100 nhtbnb.exe 4200 1ffxxxx.exe 2512 hbthtt.exe 2960 dppdv.exe 4036 lxlxflf.exe 3324 nbthbt.exe 3020 ntbhhn.exe 2508 jjpjp.exe 2752 jvddd.exe 1392 xxlxrll.exe 3212 lrrlflf.exe 1324 1bhtbb.exe 3580 7jdvj.exe 2984 fflfxrr.exe 1448 rfrrfxl.exe 548 hbhtnh.exe 2384 vjjdv.exe 2452 rlxllfr.exe 4504 fxfxlfr.exe 1920 7hhbbh.exe 3500 pvdjv.exe 4356 5xxrllx.exe 3792 1hnbhn.exe 1144 htbtnh.exe 3056 3tbnbt.exe 2364 dpvpd.exe 1532 5btnbn.exe 1484 9vvvp.exe 960 nhhbtn.exe 1860 pjjjd.exe 2772 dvdvv.exe 3240 lxflxfx.exe 3748 jpjdv.exe 3768 flxxxfl.exe 116 frfxlfx.exe 1140 nhbthb.exe 1888 vjpjd.exe 1832 xxfrfll.exe 4920 bnnhhb.exe 32 5vpdp.exe -
resource yara_rule behavioral2/memory/4772-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/592-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2772-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-786-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4772 wrote to memory of 592 4772 1d4f518662926c5ef45ec0741e09588e1534a49017ff27fa6135e2b14a870bef.exe 84 PID 4772 wrote to memory of 592 4772 1d4f518662926c5ef45ec0741e09588e1534a49017ff27fa6135e2b14a870bef.exe 84 PID 4772 wrote to memory of 592 4772 1d4f518662926c5ef45ec0741e09588e1534a49017ff27fa6135e2b14a870bef.exe 84 PID 592 wrote to memory of 4320 592 htntnt.exe 85 PID 592 wrote to memory of 4320 592 htntnt.exe 85 PID 592 wrote to memory of 4320 592 htntnt.exe 85 PID 4320 wrote to memory of 1464 4320 pdpjv.exe 86 PID 4320 wrote to memory of 1464 4320 pdpjv.exe 86 PID 4320 wrote to memory of 1464 4320 pdpjv.exe 86 PID 1464 wrote to memory of 960 1464 7tnbhn.exe 87 PID 1464 wrote to memory of 960 1464 7tnbhn.exe 87 PID 1464 wrote to memory of 960 1464 7tnbhn.exe 87 PID 960 wrote to memory of 208 960 xffxxll.exe 88 PID 960 wrote to memory of 208 960 xffxxll.exe 88 PID 960 wrote to memory of 208 960 xffxxll.exe 88 PID 208 wrote to memory of 3956 208 ntthth.exe 89 PID 208 wrote to memory of 3956 208 ntthth.exe 89 PID 208 wrote to memory of 3956 208 ntthth.exe 89 PID 3956 wrote to memory of 3748 3956 vdvpj.exe 90 PID 3956 wrote to memory of 3748 3956 vdvpj.exe 90 PID 3956 wrote to memory of 3748 3956 vdvpj.exe 90 PID 3748 wrote to memory of 3044 3748 lfxlxlx.exe 91 PID 3748 wrote to memory of 3044 3748 lfxlxlx.exe 91 PID 3748 wrote to memory of 3044 3748 lfxlxlx.exe 91 PID 3044 wrote to memory of 228 3044 frlfxrl.exe 92 PID 3044 wrote to memory of 228 3044 frlfxrl.exe 92 PID 3044 wrote to memory of 228 3044 frlfxrl.exe 92 PID 228 wrote to memory of 1076 228 hhhnbn.exe 93 PID 228 wrote to memory of 1076 228 hhhnbn.exe 93 PID 228 wrote to memory of 1076 228 hhhnbn.exe 93 PID 1076 wrote to memory of 3864 1076 vjdpd.exe 94 PID 1076 wrote to memory of 3864 1076 vjdpd.exe 94 PID 1076 wrote to memory of 3864 1076 vjdpd.exe 94 PID 3864 wrote to memory of 2436 3864 tnhbht.exe 95 PID 3864 wrote to memory of 2436 3864 tnhbht.exe 95 PID 3864 wrote to memory of 2436 3864 tnhbht.exe 95 PID 2436 wrote to memory of 2152 2436 pjpdd.exe 96 PID 2436 wrote to memory of 2152 2436 pjpdd.exe 96 PID 2436 wrote to memory of 2152 2436 pjpdd.exe 96 PID 2152 wrote to memory of 4360 2152 rfxlrlr.exe 97 PID 2152 wrote to memory of 4360 2152 rfxlrlr.exe 97 PID 2152 wrote to memory of 4360 2152 rfxlrlr.exe 97 PID 4360 wrote to memory of 3256 4360 bbbtht.exe 98 PID 4360 wrote to memory of 3256 4360 bbbtht.exe 98 PID 4360 wrote to memory of 3256 4360 bbbtht.exe 98 PID 3256 wrote to memory of 1480 3256 1dvpd.exe 99 PID 3256 wrote to memory of 1480 3256 1dvpd.exe 99 PID 3256 wrote to memory of 1480 3256 1dvpd.exe 99 PID 1480 wrote to memory of 4644 1480 bnhthb.exe 100 PID 1480 wrote to memory of 4644 1480 bnhthb.exe 100 PID 1480 wrote to memory of 4644 1480 bnhthb.exe 100 PID 4644 wrote to memory of 2884 4644 jjjvj.exe 101 PID 4644 wrote to memory of 2884 4644 jjjvj.exe 101 PID 4644 wrote to memory of 2884 4644 jjjvj.exe 101 PID 2884 wrote to memory of 3596 2884 rxxlfrf.exe 102 PID 2884 wrote to memory of 3596 2884 rxxlfrf.exe 102 PID 2884 wrote to memory of 3596 2884 rxxlfrf.exe 102 PID 3596 wrote to memory of 3804 3596 btbbnn.exe 103 PID 3596 wrote to memory of 3804 3596 btbbnn.exe 103 PID 3596 wrote to memory of 3804 3596 btbbnn.exe 103 PID 3804 wrote to memory of 3660 3804 pdjjj.exe 104 PID 3804 wrote to memory of 3660 3804 pdjjj.exe 104 PID 3804 wrote to memory of 3660 3804 pdjjj.exe 104 PID 3660 wrote to memory of 1604 3660 tbhbtt.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d4f518662926c5ef45ec0741e09588e1534a49017ff27fa6135e2b14a870bef.exe"C:\Users\Admin\AppData\Local\Temp\1d4f518662926c5ef45ec0741e09588e1534a49017ff27fa6135e2b14a870bef.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\htntnt.exec:\htntnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\pdpjv.exec:\pdpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\7tnbhn.exec:\7tnbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\xffxxll.exec:\xffxxll.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\ntthth.exec:\ntthth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\vdvpj.exec:\vdvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\lfxlxlx.exec:\lfxlxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\frlfxrl.exec:\frlfxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\hhhnbn.exec:\hhhnbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\vjdpd.exec:\vjdpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\tnhbht.exec:\tnhbht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\pjpdd.exec:\pjpdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\rfxlrlr.exec:\rfxlrlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\bbbtht.exec:\bbbtht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\1dvpd.exec:\1dvpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\bnhthb.exec:\bnhthb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\jjjvj.exec:\jjjvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\rxxlfrf.exec:\rxxlfrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\btbbnn.exec:\btbbnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\pdjjj.exec:\pdjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\tbhbtt.exec:\tbhbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\vjpjd.exec:\vjpjd.exe23⤵
- Executes dropped EXE
PID:1604 -
\??\c:\frxfrrr.exec:\frxfrrr.exe24⤵
- Executes dropped EXE
PID:2284 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe25⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nhtbnb.exec:\nhtbnb.exe26⤵
- Executes dropped EXE
PID:5100 -
\??\c:\1ffxxxx.exec:\1ffxxxx.exe27⤵
- Executes dropped EXE
PID:4200 -
\??\c:\hbthtt.exec:\hbthtt.exe28⤵
- Executes dropped EXE
PID:2512 -
\??\c:\dppdv.exec:\dppdv.exe29⤵
- Executes dropped EXE
PID:2960 -
\??\c:\lxlxflf.exec:\lxlxflf.exe30⤵
- Executes dropped EXE
PID:4036 -
\??\c:\nbthbt.exec:\nbthbt.exe31⤵
- Executes dropped EXE
PID:3324 -
\??\c:\ntbhhn.exec:\ntbhhn.exe32⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jjpjp.exec:\jjpjp.exe33⤵
- Executes dropped EXE
PID:2508 -
\??\c:\jvddd.exec:\jvddd.exe34⤵
- Executes dropped EXE
PID:2752 -
\??\c:\xxlxrll.exec:\xxlxrll.exe35⤵
- Executes dropped EXE
PID:1392 -
\??\c:\lrrlflf.exec:\lrrlflf.exe36⤵
- Executes dropped EXE
PID:3212 -
\??\c:\1bhtbb.exec:\1bhtbb.exe37⤵
- Executes dropped EXE
PID:1324 -
\??\c:\7jdvj.exec:\7jdvj.exe38⤵
- Executes dropped EXE
PID:3580 -
\??\c:\fflfxrr.exec:\fflfxrr.exe39⤵
- Executes dropped EXE
PID:2984 -
\??\c:\rfrrfxl.exec:\rfrrfxl.exe40⤵
- Executes dropped EXE
PID:1448 -
\??\c:\hbhtnh.exec:\hbhtnh.exe41⤵
- Executes dropped EXE
PID:548 -
\??\c:\vjjdv.exec:\vjjdv.exe42⤵
- Executes dropped EXE
PID:2384 -
\??\c:\rlxllfr.exec:\rlxllfr.exe43⤵
- Executes dropped EXE
PID:2452 -
\??\c:\fxfxlfr.exec:\fxfxlfr.exe44⤵
- Executes dropped EXE
PID:4504 -
\??\c:\7hhbbh.exec:\7hhbbh.exe45⤵
- Executes dropped EXE
PID:1920 -
\??\c:\pvdjv.exec:\pvdjv.exe46⤵
- Executes dropped EXE
PID:3500 -
\??\c:\5xxrllx.exec:\5xxrllx.exe47⤵
- Executes dropped EXE
PID:4356 -
\??\c:\1hnbhn.exec:\1hnbhn.exe48⤵
- Executes dropped EXE
PID:3792 -
\??\c:\htbtnh.exec:\htbtnh.exe49⤵
- Executes dropped EXE
PID:1144 -
\??\c:\3tbnbt.exec:\3tbnbt.exe50⤵
- Executes dropped EXE
PID:3056 -
\??\c:\dpvpd.exec:\dpvpd.exe51⤵
- Executes dropped EXE
PID:2364 -
\??\c:\5btnbn.exec:\5btnbn.exe52⤵
- Executes dropped EXE
PID:1532 -
\??\c:\9vvvp.exec:\9vvvp.exe53⤵
- Executes dropped EXE
PID:1484 -
\??\c:\nhhbtn.exec:\nhhbtn.exe54⤵
- Executes dropped EXE
PID:960 -
\??\c:\pjjjd.exec:\pjjjd.exe55⤵
- Executes dropped EXE
PID:1860 -
\??\c:\dvdvv.exec:\dvdvv.exe56⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lxflxfx.exec:\lxflxfx.exe57⤵
- Executes dropped EXE
PID:3240 -
\??\c:\jpjdv.exec:\jpjdv.exe58⤵
- Executes dropped EXE
PID:3748 -
\??\c:\flxxxfl.exec:\flxxxfl.exe59⤵
- Executes dropped EXE
PID:3768 -
\??\c:\frfxlfx.exec:\frfxlfx.exe60⤵
- Executes dropped EXE
PID:116 -
\??\c:\nhbthb.exec:\nhbthb.exe61⤵
- Executes dropped EXE
PID:1140 -
\??\c:\vjpjd.exec:\vjpjd.exe62⤵
- Executes dropped EXE
PID:1888 -
\??\c:\xxfrfll.exec:\xxfrfll.exe63⤵
- Executes dropped EXE
PID:1832 -
\??\c:\bnnhhb.exec:\bnnhhb.exe64⤵
- Executes dropped EXE
PID:4920 -
\??\c:\5vpdp.exec:\5vpdp.exe65⤵
- Executes dropped EXE
PID:32 -
\??\c:\xffxrlf.exec:\xffxrlf.exe66⤵PID:2028
-
\??\c:\9flfxrl.exec:\9flfxrl.exe67⤵PID:3008
-
\??\c:\3nnnbb.exec:\3nnnbb.exe68⤵PID:4500
-
\??\c:\nthtth.exec:\nthtth.exe69⤵PID:396
-
\??\c:\dvdvp.exec:\dvdvp.exe70⤵PID:3928
-
\??\c:\lfxrlfr.exec:\lfxrlfr.exe71⤵PID:4460
-
\??\c:\bntbnh.exec:\bntbnh.exe72⤵PID:3304
-
\??\c:\vjjvj.exec:\vjjvj.exe73⤵PID:5064
-
\??\c:\dvdvp.exec:\dvdvp.exe74⤵PID:4324
-
\??\c:\9xrlrrl.exec:\9xrlrrl.exe75⤵PID:1540
-
\??\c:\hnnhtn.exec:\hnnhtn.exe76⤵PID:1944
-
\??\c:\9vddv.exec:\9vddv.exe77⤵PID:1692
-
\??\c:\3lrxrlx.exec:\3lrxrlx.exe78⤵PID:4344
-
\??\c:\rrrrlxx.exec:\rrrrlxx.exe79⤵PID:2500
-
\??\c:\nhbnnh.exec:\nhbnnh.exe80⤵PID:2284
-
\??\c:\dvpjv.exec:\dvpjv.exe81⤵PID:3896
-
\??\c:\lxrfxxl.exec:\lxrfxxl.exe82⤵PID:2504
-
\??\c:\tnnbtn.exec:\tnnbtn.exe83⤵PID:4120
-
\??\c:\pdpdv.exec:\pdpdv.exe84⤵PID:3992
-
\??\c:\dpvvp.exec:\dpvvp.exe85⤵PID:392
-
\??\c:\1rlllxx.exec:\1rlllxx.exe86⤵PID:2960
-
\??\c:\bntnhn.exec:\bntnhn.exe87⤵PID:2388
-
\??\c:\9dpjp.exec:\9dpjp.exe88⤵PID:5060
-
\??\c:\jpdvp.exec:\jpdvp.exe89⤵PID:4752
-
\??\c:\7rlfffl.exec:\7rlfffl.exe90⤵PID:4568
-
\??\c:\thhbtt.exec:\thhbtt.exe91⤵PID:1756
-
\??\c:\vjjvj.exec:\vjjvj.exe92⤵PID:1504
-
\??\c:\5ddpj.exec:\5ddpj.exe93⤵PID:3140
-
\??\c:\llxrffx.exec:\llxrffx.exe94⤵PID:4064
-
\??\c:\hbtnhh.exec:\hbtnhh.exe95⤵PID:4496
-
\??\c:\hbbttn.exec:\hbbttn.exe96⤵PID:5016
-
\??\c:\dvdvv.exec:\dvdvv.exe97⤵PID:792
-
\??\c:\fxlxrfx.exec:\fxlxrfx.exe98⤵PID:1016
-
\??\c:\lrrrlfx.exec:\lrrrlfx.exe99⤵PID:4560
-
\??\c:\htnnhh.exec:\htnnhh.exe100⤵PID:452
-
\??\c:\vvvpj.exec:\vvvpj.exe101⤵PID:4224
-
\??\c:\llxrfff.exec:\llxrfff.exe102⤵PID:3268
-
\??\c:\rrlfxxx.exec:\rrlfxxx.exe103⤵PID:516
-
\??\c:\hhhthb.exec:\hhhthb.exe104⤵PID:2348
-
\??\c:\jjvpj.exec:\jjvpj.exe105⤵PID:2424
-
\??\c:\rrllllf.exec:\rrllllf.exe106⤵PID:4364
-
\??\c:\3nhbnn.exec:\3nhbnn.exe107⤵PID:4772
-
\??\c:\nbbtbt.exec:\nbbtbt.exe108⤵PID:3720
-
\??\c:\vdjvj.exec:\vdjvj.exe109⤵PID:3972
-
\??\c:\xfrlxrx.exec:\xfrlxrx.exe110⤵PID:916
-
\??\c:\tbhhbb.exec:\tbhhbb.exe111⤵PID:1464
-
\??\c:\bbtnbb.exec:\bbtnbb.exe112⤵PID:1532
-
\??\c:\pjpjv.exec:\pjpjv.exe113⤵PID:4952
-
\??\c:\lflrxfl.exec:\lflrxfl.exe114⤵PID:4904
-
\??\c:\nttnnn.exec:\nttnnn.exe115⤵PID:3052
-
\??\c:\dvjdv.exec:\dvjdv.exe116⤵PID:2428
-
\??\c:\xrxrlff.exec:\xrxrlff.exe117⤵PID:2596
-
\??\c:\nnntbb.exec:\nnntbb.exe118⤵PID:1964
-
\??\c:\bbbttt.exec:\bbbttt.exe119⤵PID:3328
-
\??\c:\vdvpd.exec:\vdvpd.exe120⤵PID:4744
-
\??\c:\xfxrlll.exec:\xfxrlll.exe121⤵PID:3572
-
\??\c:\nntnnh.exec:\nntnnh.exe122⤵PID:1048
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-