Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 19:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3a03493a96952580d1486b20474ea77c4ff9c978c95cad1b024ab2d529ca432c.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
3a03493a96952580d1486b20474ea77c4ff9c978c95cad1b024ab2d529ca432c.exe
-
Size
456KB
-
MD5
e2a2cf56cfcb80df26911a8507bb91e4
-
SHA1
278a45a78451dee93a7a071c222dcd2cc902b084
-
SHA256
3a03493a96952580d1486b20474ea77c4ff9c978c95cad1b024ab2d529ca432c
-
SHA512
ad2bf454c1b4f56ffce5c449497a9db3a4fd02e75fefb01b827c0cbe42329839c033ed931b207817475ebf472feffc9cd0a8ece689c9d88f67f50c5f4dea66a5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRX:q7Tc2NYHUrAwfMp3CDRX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2612-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1428-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1420-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/856-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/836-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2480-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1768-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3792-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1344-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4116-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/312-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2068-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2568-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-720-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-865-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-876-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-875-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-910-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4608 thtnnb.exe 2392 llxxxxx.exe 2856 7bhhnn.exe 1232 bhntnn.exe 3628 fxffxxx.exe 3536 lllllrr.exe 380 9lrxxxr.exe 1428 flxrrrr.exe 1420 pjvvv.exe 2028 lrllxxl.exe 2144 lllxrlx.exe 1052 pvvvp.exe 212 xxllllf.exe 216 djdjd.exe 4700 flrxrrl.exe 2104 fllfxxx.exe 856 ppvvp.exe 3188 9jpvd.exe 1400 btbttt.exe 4688 vjvpj.exe 1844 fxffffx.exe 1872 bnnnnt.exe 4312 hnbnbb.exe 836 vvddd.exe 1356 flrlxxr.exe 2640 3jjjd.exe 4092 pjdvp.exe 956 rrrxxrf.exe 3500 9vvpp.exe 4880 rlxxrxx.exe 3228 rlrlxxr.exe 2408 tbtnbt.exe 2480 llxxffl.exe 2136 tnnttt.exe 4112 jvpjv.exe 5020 lflfxxr.exe 2516 hntnhb.exe 2960 dppjv.exe 4420 rlrlfxl.exe 1772 xrlrfrr.exe 4560 nbnbtt.exe 4468 vdjdd.exe 540 ddjvj.exe 1768 rflffxl.exe 3944 thhhnh.exe 3792 vdjvp.exe 4516 llxfxxl.exe 1296 hbhnhh.exe 1568 nnthbb.exe 1344 pjjvp.exe 3576 3rrlxrl.exe 4404 lfrffxx.exe 2540 btbtbt.exe 3848 dvjpj.exe 4608 xllfxrl.exe 4900 rrfxlff.exe 4116 ntbthb.exe 3048 9dvjv.exe 2536 9rxfxxx.exe 1804 fxffxlf.exe 1192 nbhbhh.exe 3536 nbbttb.exe 3660 dvjdd.exe 3868 xxxrffx.exe -
resource yara_rule behavioral2/memory/2612-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1428-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/856-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/856-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3792-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1344-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4116-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/312-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2568-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-865-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lllflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2612 wrote to memory of 4608 2612 3a03493a96952580d1486b20474ea77c4ff9c978c95cad1b024ab2d529ca432c.exe 83 PID 2612 wrote to memory of 4608 2612 3a03493a96952580d1486b20474ea77c4ff9c978c95cad1b024ab2d529ca432c.exe 83 PID 2612 wrote to memory of 4608 2612 3a03493a96952580d1486b20474ea77c4ff9c978c95cad1b024ab2d529ca432c.exe 83 PID 4608 wrote to memory of 2392 4608 thtnnb.exe 84 PID 4608 wrote to memory of 2392 4608 thtnnb.exe 84 PID 4608 wrote to memory of 2392 4608 thtnnb.exe 84 PID 2392 wrote to memory of 2856 2392 llxxxxx.exe 85 PID 2392 wrote to memory of 2856 2392 llxxxxx.exe 85 PID 2392 wrote to memory of 2856 2392 llxxxxx.exe 85 PID 2856 wrote to memory of 1232 2856 7bhhnn.exe 86 PID 2856 wrote to memory of 1232 2856 7bhhnn.exe 86 PID 2856 wrote to memory of 1232 2856 7bhhnn.exe 86 PID 1232 wrote to memory of 3628 1232 bhntnn.exe 87 PID 1232 wrote to memory of 3628 1232 bhntnn.exe 87 PID 1232 wrote to memory of 3628 1232 bhntnn.exe 87 PID 3628 wrote to memory of 3536 3628 fxffxxx.exe 88 PID 3628 wrote to memory of 3536 3628 fxffxxx.exe 88 PID 3628 wrote to memory of 3536 3628 fxffxxx.exe 88 PID 3536 wrote to memory of 380 3536 lllllrr.exe 89 PID 3536 wrote to memory of 380 3536 lllllrr.exe 89 PID 3536 wrote to memory of 380 3536 lllllrr.exe 89 PID 380 wrote to memory of 1428 380 9lrxxxr.exe 90 PID 380 wrote to memory of 1428 380 9lrxxxr.exe 90 PID 380 wrote to memory of 1428 380 9lrxxxr.exe 90 PID 1428 wrote to memory of 1420 1428 flxrrrr.exe 91 PID 1428 wrote to memory of 1420 1428 flxrrrr.exe 91 PID 1428 wrote to memory of 1420 1428 flxrrrr.exe 91 PID 1420 wrote to memory of 2028 1420 pjvvv.exe 92 PID 1420 wrote to memory of 2028 1420 pjvvv.exe 92 PID 1420 wrote to memory of 2028 1420 pjvvv.exe 92 PID 2028 wrote to memory of 2144 2028 lrllxxl.exe 93 PID 2028 wrote to memory of 2144 2028 lrllxxl.exe 93 PID 2028 wrote to memory of 2144 2028 lrllxxl.exe 93 PID 2144 wrote to memory of 1052 2144 lllxrlx.exe 94 PID 2144 wrote to memory of 1052 2144 lllxrlx.exe 94 PID 2144 wrote to memory of 1052 2144 lllxrlx.exe 94 PID 1052 wrote to memory of 212 1052 pvvvp.exe 95 PID 1052 wrote to memory of 212 1052 pvvvp.exe 95 PID 1052 wrote to memory of 212 1052 pvvvp.exe 95 PID 212 wrote to memory of 216 212 xxllllf.exe 96 PID 212 wrote to memory of 216 212 xxllllf.exe 96 PID 212 wrote to memory of 216 212 xxllllf.exe 96 PID 216 wrote to memory of 4700 216 djdjd.exe 97 PID 216 wrote to memory of 4700 216 djdjd.exe 97 PID 216 wrote to memory of 4700 216 djdjd.exe 97 PID 4700 wrote to memory of 2104 4700 flrxrrl.exe 98 PID 4700 wrote to memory of 2104 4700 flrxrrl.exe 98 PID 4700 wrote to memory of 2104 4700 flrxrrl.exe 98 PID 2104 wrote to memory of 856 2104 fllfxxx.exe 99 PID 2104 wrote to memory of 856 2104 fllfxxx.exe 99 PID 2104 wrote to memory of 856 2104 fllfxxx.exe 99 PID 856 wrote to memory of 3188 856 ppvvp.exe 100 PID 856 wrote to memory of 3188 856 ppvvp.exe 100 PID 856 wrote to memory of 3188 856 ppvvp.exe 100 PID 3188 wrote to memory of 1400 3188 9jpvd.exe 101 PID 3188 wrote to memory of 1400 3188 9jpvd.exe 101 PID 3188 wrote to memory of 1400 3188 9jpvd.exe 101 PID 1400 wrote to memory of 4688 1400 btbttt.exe 102 PID 1400 wrote to memory of 4688 1400 btbttt.exe 102 PID 1400 wrote to memory of 4688 1400 btbttt.exe 102 PID 4688 wrote to memory of 1844 4688 vjvpj.exe 103 PID 4688 wrote to memory of 1844 4688 vjvpj.exe 103 PID 4688 wrote to memory of 1844 4688 vjvpj.exe 103 PID 1844 wrote to memory of 1872 1844 fxffffx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a03493a96952580d1486b20474ea77c4ff9c978c95cad1b024ab2d529ca432c.exe"C:\Users\Admin\AppData\Local\Temp\3a03493a96952580d1486b20474ea77c4ff9c978c95cad1b024ab2d529ca432c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\thtnnb.exec:\thtnnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\llxxxxx.exec:\llxxxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\7bhhnn.exec:\7bhhnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\bhntnn.exec:\bhntnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\fxffxxx.exec:\fxffxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\lllllrr.exec:\lllllrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\9lrxxxr.exec:\9lrxxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\flxrrrr.exec:\flxrrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\pjvvv.exec:\pjvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\lrllxxl.exec:\lrllxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\lllxrlx.exec:\lllxrlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\pvvvp.exec:\pvvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\xxllllf.exec:\xxllllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\djdjd.exec:\djdjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\flrxrrl.exec:\flrxrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\fllfxxx.exec:\fllfxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\ppvvp.exec:\ppvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\9jpvd.exec:\9jpvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\btbttt.exec:\btbttt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\vjvpj.exec:\vjvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\fxffffx.exec:\fxffffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\bnnnnt.exec:\bnnnnt.exe23⤵
- Executes dropped EXE
PID:1872 -
\??\c:\hnbnbb.exec:\hnbnbb.exe24⤵
- Executes dropped EXE
PID:4312 -
\??\c:\vvddd.exec:\vvddd.exe25⤵
- Executes dropped EXE
PID:836 -
\??\c:\flrlxxr.exec:\flrlxxr.exe26⤵
- Executes dropped EXE
PID:1356 -
\??\c:\3jjjd.exec:\3jjjd.exe27⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pjdvp.exec:\pjdvp.exe28⤵
- Executes dropped EXE
PID:4092 -
\??\c:\rrrxxrf.exec:\rrrxxrf.exe29⤵
- Executes dropped EXE
PID:956 -
\??\c:\9vvpp.exec:\9vvpp.exe30⤵
- Executes dropped EXE
PID:3500 -
\??\c:\rlxxrxx.exec:\rlxxrxx.exe31⤵
- Executes dropped EXE
PID:4880 -
\??\c:\rlrlxxr.exec:\rlrlxxr.exe32⤵
- Executes dropped EXE
PID:3228 -
\??\c:\tbtnbt.exec:\tbtnbt.exe33⤵
- Executes dropped EXE
PID:2408 -
\??\c:\llxxffl.exec:\llxxffl.exe34⤵
- Executes dropped EXE
PID:2480 -
\??\c:\tnnttt.exec:\tnnttt.exe35⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jvpjv.exec:\jvpjv.exe36⤵
- Executes dropped EXE
PID:4112 -
\??\c:\lflfxxr.exec:\lflfxxr.exe37⤵
- Executes dropped EXE
PID:5020 -
\??\c:\hntnhb.exec:\hntnhb.exe38⤵
- Executes dropped EXE
PID:2516 -
\??\c:\dppjv.exec:\dppjv.exe39⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rlrlfxl.exec:\rlrlfxl.exe40⤵
- Executes dropped EXE
PID:4420 -
\??\c:\xrlrfrr.exec:\xrlrfrr.exe41⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nbnbtt.exec:\nbnbtt.exe42⤵
- Executes dropped EXE
PID:4560 -
\??\c:\vdjdd.exec:\vdjdd.exe43⤵
- Executes dropped EXE
PID:4468 -
\??\c:\ddjvj.exec:\ddjvj.exe44⤵
- Executes dropped EXE
PID:540 -
\??\c:\rflffxl.exec:\rflffxl.exe45⤵
- Executes dropped EXE
PID:1768 -
\??\c:\thhhnh.exec:\thhhnh.exe46⤵
- Executes dropped EXE
PID:3944 -
\??\c:\vdjvp.exec:\vdjvp.exe47⤵
- Executes dropped EXE
PID:3792 -
\??\c:\llxfxxl.exec:\llxfxxl.exe48⤵
- Executes dropped EXE
PID:4516 -
\??\c:\hbhnhh.exec:\hbhnhh.exe49⤵
- Executes dropped EXE
PID:1296 -
\??\c:\nnthbb.exec:\nnthbb.exe50⤵
- Executes dropped EXE
PID:1568 -
\??\c:\pjjvp.exec:\pjjvp.exe51⤵
- Executes dropped EXE
PID:1344 -
\??\c:\3rrlxrl.exec:\3rrlxrl.exe52⤵
- Executes dropped EXE
PID:3576 -
\??\c:\lfrffxx.exec:\lfrffxx.exe53⤵
- Executes dropped EXE
PID:4404 -
\??\c:\btbtbt.exec:\btbtbt.exe54⤵
- Executes dropped EXE
PID:2540 -
\??\c:\dvjpj.exec:\dvjpj.exe55⤵
- Executes dropped EXE
PID:3848 -
\??\c:\xllfxrl.exec:\xllfxrl.exe56⤵
- Executes dropped EXE
PID:4608 -
\??\c:\rrfxlff.exec:\rrfxlff.exe57⤵
- Executes dropped EXE
PID:4900 -
\??\c:\ntbthb.exec:\ntbthb.exe58⤵
- Executes dropped EXE
PID:4116 -
\??\c:\9dvjv.exec:\9dvjv.exe59⤵
- Executes dropped EXE
PID:3048 -
\??\c:\9rxfxxx.exec:\9rxfxxx.exe60⤵
- Executes dropped EXE
PID:2536 -
\??\c:\fxffxlf.exec:\fxffxlf.exe61⤵
- Executes dropped EXE
PID:1804 -
\??\c:\nbhbhh.exec:\nbhbhh.exe62⤵
- Executes dropped EXE
PID:1192 -
\??\c:\nbbttb.exec:\nbbttb.exe63⤵
- Executes dropped EXE
PID:3536 -
\??\c:\dvjdd.exec:\dvjdd.exe64⤵
- Executes dropped EXE
PID:3660 -
\??\c:\xxxrffx.exec:\xxxrffx.exe65⤵
- Executes dropped EXE
PID:3868 -
\??\c:\nttnnn.exec:\nttnnn.exe66⤵PID:4408
-
\??\c:\jdjdv.exec:\jdjdv.exe67⤵PID:1260
-
\??\c:\rlrlfxl.exec:\rlrlfxl.exe68⤵PID:1684
-
\??\c:\xxllrrr.exec:\xxllrrr.exe69⤵PID:1420
-
\??\c:\dvjdd.exec:\dvjdd.exe70⤵PID:3524
-
\??\c:\dddvp.exec:\dddvp.exe71⤵PID:1876
-
\??\c:\xxxxffr.exec:\xxxxffr.exe72⤵PID:2144
-
\??\c:\rffxrxl.exec:\rffxrxl.exe73⤵PID:220
-
\??\c:\pdjdp.exec:\pdjdp.exe74⤵PID:312
-
\??\c:\llrlfxx.exec:\llrlfxx.exe75⤵PID:4644
-
\??\c:\xflfxlr.exec:\xflfxlr.exe76⤵PID:4720
-
\??\c:\btbbnh.exec:\btbbnh.exe77⤵PID:3472
-
\??\c:\jjpjv.exec:\jjpjv.exe78⤵PID:436
-
\??\c:\xxrfllx.exec:\xxrfllx.exe79⤵PID:4860
-
\??\c:\hntnbt.exec:\hntnbt.exe80⤵PID:856
-
\??\c:\1vvpd.exec:\1vvpd.exe81⤵PID:3528
-
\??\c:\vddpp.exec:\vddpp.exe82⤵PID:3608
-
\??\c:\lllfrlf.exec:\lllfrlf.exe83⤵PID:4548
-
\??\c:\tnbtbb.exec:\tnbtbb.exe84⤵PID:1844
-
\??\c:\pjvjp.exec:\pjvjp.exe85⤵PID:4772
-
\??\c:\vppjd.exec:\vppjd.exe86⤵PID:1488
-
\??\c:\rrrfrlf.exec:\rrrfrlf.exe87⤵PID:4416
-
\??\c:\tbthbn.exec:\tbthbn.exe88⤵PID:4312
-
\??\c:\5ddvj.exec:\5ddvj.exe89⤵PID:2396
-
\??\c:\7lrfrrf.exec:\7lrfrrf.exe90⤵PID:4864
-
\??\c:\rllfrrl.exec:\rllfrrl.exe91⤵PID:4056
-
\??\c:\ntnbtt.exec:\ntnbtt.exe92⤵PID:4268
-
\??\c:\dvddp.exec:\dvddp.exe93⤵PID:4792
-
\??\c:\rffflfx.exec:\rffflfx.exe94⤵PID:464
-
\??\c:\1tthbb.exec:\1tthbb.exe95⤵PID:3396
-
\??\c:\vdppj.exec:\vdppj.exe96⤵PID:320
-
\??\c:\jpvpj.exec:\jpvpj.exe97⤵PID:4824
-
\??\c:\rflxlfx.exec:\rflxlfx.exe98⤵PID:1388
-
\??\c:\bhnhbb.exec:\bhnhbb.exe99⤵PID:2408
-
\??\c:\3djdd.exec:\3djdd.exe100⤵PID:116
-
\??\c:\frxrlfx.exec:\frxrlfx.exe101⤵PID:5064
-
\??\c:\5nnhhh.exec:\5nnhhh.exe102⤵PID:5080
-
\??\c:\7vvjv.exec:\7vvjv.exe103⤵PID:1776
-
\??\c:\ppdvp.exec:\ppdvp.exe104⤵PID:2128
-
\??\c:\lflrxfl.exec:\lflrxfl.exe105⤵PID:2236
-
\??\c:\tbhbbt.exec:\tbhbbt.exe106⤵PID:2976
-
\??\c:\jdjjj.exec:\jdjjj.exe107⤵PID:2076
-
\??\c:\5lrxrrl.exec:\5lrxrrl.exe108⤵PID:3992
-
\??\c:\tnbbbn.exec:\tnbbbn.exe109⤵PID:4820
-
\??\c:\tttttb.exec:\tttttb.exe110⤵PID:1424
-
\??\c:\rrrrllf.exec:\rrrrllf.exe111⤵
- System Location Discovery: System Language Discovery
PID:5104 -
\??\c:\nhtbbt.exec:\nhtbbt.exe112⤵PID:4580
-
\??\c:\hhhhtt.exec:\hhhhtt.exe113⤵PID:3172
-
\??\c:\jjjjd.exec:\jjjjd.exe114⤵PID:4564
-
\??\c:\7xlfxff.exec:\7xlfxff.exe115⤵PID:4516
-
\??\c:\hbhhbt.exec:\hbhhbt.exe116⤵PID:5004
-
\??\c:\7jpjp.exec:\7jpjp.exe117⤵PID:3596
-
\??\c:\1rrfxrr.exec:\1rrfxrr.exe118⤵PID:4396
-
\??\c:\nbhbtt.exec:\nbhbtt.exe119⤵PID:748
-
\??\c:\7pdvv.exec:\7pdvv.exe120⤵PID:2612
-
\??\c:\ddjdj.exec:\ddjdj.exe121⤵PID:2500
-
\??\c:\rlxffll.exec:\rlxffll.exe122⤵PID:2392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-