Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2024, 21:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe
-
Size
453KB
-
MD5
1bf92ff7b02652b69c83bd1aa97d6702
-
SHA1
43eea7f9d7bd8428fc70ede188a67c00b9a72a50
-
SHA256
37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a
-
SHA512
c8d04dde236e814ac501058f6331a4f875204368e7833a706e8b04d1d2a9eb4ec32a3485e6dbed5dbe537f7e729fdc500f893210d1448884dbcf63248f588b81
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/920-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/996-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1296-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1784-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2376-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3272-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3908-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-661-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-686-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-777-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-1033-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-1199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-1718-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 740 tnnnhh.exe 2676 frfrxrx.exe 4800 httbnh.exe 4892 vvdvp.exe 2200 flfxrrl.exe 3764 pddvp.exe 2892 rllfffr.exe 1180 3ppjd.exe 996 hbhbbb.exe 2872 vvvpj.exe 1232 tnbtnn.exe 3496 jvpjj.exe 1844 9tthbb.exe 4248 rxfxrxr.exe 2400 ntbtnh.exe 4128 jdppv.exe 1788 xrxllll.exe 1296 rrxxrlf.exe 2612 ntbbtn.exe 2396 jpvpj.exe 5088 dvvpj.exe 3680 jppvj.exe 3008 rrxrlrf.exe 4276 dvvpd.exe 4600 1pjdj.exe 4240 3rrflfr.exe 3280 tbtbtn.exe 2992 btthhb.exe 1784 tbtnbt.exe 1616 pjdpj.exe 1848 1bhbbt.exe 3676 btbnnn.exe 1980 rrxrrrx.exe 1592 jvjdd.exe 960 jjjdv.exe 3728 fxlfllr.exe 2832 btttnn.exe 2900 pjdvd.exe 4720 flrllll.exe 2240 tnbthh.exe 2376 vpvvv.exe 4372 lxfffll.exe 2168 vppjd.exe 3028 xllffxx.exe 244 nhhnhb.exe 4852 ddjjp.exe 940 lfxxrlf.exe 3260 lfffxrl.exe 4608 thhhhh.exe 4712 vvddd.exe 2868 xrfrxxx.exe 5036 hnhnhb.exe 4524 hntttn.exe 2200 1vvpp.exe 3872 llrllll.exe 1692 lxfxrrr.exe 2688 hbhhbb.exe 760 vdjjj.exe 4936 xflffff.exe 1564 tnnhhh.exe 2344 tbhbtt.exe 408 pdddp.exe 4640 5lxrrxr.exe 1712 btnhhh.exe -
resource yara_rule behavioral2/memory/920-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/996-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1296-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3272-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3908-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1712-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-686-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xfxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 920 wrote to memory of 740 920 37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe 83 PID 920 wrote to memory of 740 920 37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe 83 PID 920 wrote to memory of 740 920 37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe 83 PID 740 wrote to memory of 2676 740 tnnnhh.exe 84 PID 740 wrote to memory of 2676 740 tnnnhh.exe 84 PID 740 wrote to memory of 2676 740 tnnnhh.exe 84 PID 2676 wrote to memory of 4800 2676 frfrxrx.exe 85 PID 2676 wrote to memory of 4800 2676 frfrxrx.exe 85 PID 2676 wrote to memory of 4800 2676 frfrxrx.exe 85 PID 4800 wrote to memory of 4892 4800 httbnh.exe 86 PID 4800 wrote to memory of 4892 4800 httbnh.exe 86 PID 4800 wrote to memory of 4892 4800 httbnh.exe 86 PID 4892 wrote to memory of 2200 4892 vvdvp.exe 87 PID 4892 wrote to memory of 2200 4892 vvdvp.exe 87 PID 4892 wrote to memory of 2200 4892 vvdvp.exe 87 PID 2200 wrote to memory of 3764 2200 flfxrrl.exe 88 PID 2200 wrote to memory of 3764 2200 flfxrrl.exe 88 PID 2200 wrote to memory of 3764 2200 flfxrrl.exe 88 PID 3764 wrote to memory of 2892 3764 pddvp.exe 89 PID 3764 wrote to memory of 2892 3764 pddvp.exe 89 PID 3764 wrote to memory of 2892 3764 pddvp.exe 89 PID 2892 wrote to memory of 1180 2892 rllfffr.exe 90 PID 2892 wrote to memory of 1180 2892 rllfffr.exe 90 PID 2892 wrote to memory of 1180 2892 rllfffr.exe 90 PID 1180 wrote to memory of 996 1180 3ppjd.exe 91 PID 1180 wrote to memory of 996 1180 3ppjd.exe 91 PID 1180 wrote to memory of 996 1180 3ppjd.exe 91 PID 996 wrote to memory of 2872 996 hbhbbb.exe 92 PID 996 wrote to memory of 2872 996 hbhbbb.exe 92 PID 996 wrote to memory of 2872 996 hbhbbb.exe 92 PID 2872 wrote to memory of 1232 2872 vvvpj.exe 93 PID 2872 wrote to memory of 1232 2872 vvvpj.exe 93 PID 2872 wrote to memory of 1232 2872 vvvpj.exe 93 PID 1232 wrote to memory of 3496 1232 tnbtnn.exe 94 PID 1232 wrote to memory of 3496 1232 tnbtnn.exe 94 PID 1232 wrote to memory of 3496 1232 tnbtnn.exe 94 PID 3496 wrote to memory of 1844 3496 jvpjj.exe 95 PID 3496 wrote to memory of 1844 3496 jvpjj.exe 95 PID 3496 wrote to memory of 1844 3496 jvpjj.exe 95 PID 1844 wrote to memory of 4248 1844 9tthbb.exe 96 PID 1844 wrote to memory of 4248 1844 9tthbb.exe 96 PID 1844 wrote to memory of 4248 1844 9tthbb.exe 96 PID 4248 wrote to memory of 2400 4248 rxfxrxr.exe 97 PID 4248 wrote to memory of 2400 4248 rxfxrxr.exe 97 PID 4248 wrote to memory of 2400 4248 rxfxrxr.exe 97 PID 2400 wrote to memory of 4128 2400 ntbtnh.exe 98 PID 2400 wrote to memory of 4128 2400 ntbtnh.exe 98 PID 2400 wrote to memory of 4128 2400 ntbtnh.exe 98 PID 4128 wrote to memory of 1788 4128 jdppv.exe 99 PID 4128 wrote to memory of 1788 4128 jdppv.exe 99 PID 4128 wrote to memory of 1788 4128 jdppv.exe 99 PID 1788 wrote to memory of 1296 1788 xrxllll.exe 100 PID 1788 wrote to memory of 1296 1788 xrxllll.exe 100 PID 1788 wrote to memory of 1296 1788 xrxllll.exe 100 PID 1296 wrote to memory of 2612 1296 rrxxrlf.exe 101 PID 1296 wrote to memory of 2612 1296 rrxxrlf.exe 101 PID 1296 wrote to memory of 2612 1296 rrxxrlf.exe 101 PID 2612 wrote to memory of 2396 2612 ntbbtn.exe 102 PID 2612 wrote to memory of 2396 2612 ntbbtn.exe 102 PID 2612 wrote to memory of 2396 2612 ntbbtn.exe 102 PID 2396 wrote to memory of 5088 2396 jpvpj.exe 103 PID 2396 wrote to memory of 5088 2396 jpvpj.exe 103 PID 2396 wrote to memory of 5088 2396 jpvpj.exe 103 PID 5088 wrote to memory of 3680 5088 dvvpj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe"C:\Users\Admin\AppData\Local\Temp\37c005ca98f6ba1e84c6487c9a7d6c206ede6656219cdc9d420adcd989a9569a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\tnnnhh.exec:\tnnnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\frfrxrx.exec:\frfrxrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\httbnh.exec:\httbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\vvdvp.exec:\vvdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\flfxrrl.exec:\flfxrrl.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\pddvp.exec:\pddvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\rllfffr.exec:\rllfffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\3ppjd.exec:\3ppjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\hbhbbb.exec:\hbhbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\vvvpj.exec:\vvvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\tnbtnn.exec:\tnbtnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\jvpjj.exec:\jvpjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\9tthbb.exec:\9tthbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\rxfxrxr.exec:\rxfxrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\ntbtnh.exec:\ntbtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\jdppv.exec:\jdppv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\xrxllll.exec:\xrxllll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\rrxxrlf.exec:\rrxxrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\ntbbtn.exec:\ntbbtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\jpvpj.exec:\jpvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\dvvpj.exec:\dvvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\jppvj.exec:\jppvj.exe23⤵
- Executes dropped EXE
PID:3680 -
\??\c:\rrxrlrf.exec:\rrxrlrf.exe24⤵
- Executes dropped EXE
PID:3008 -
\??\c:\dvvpd.exec:\dvvpd.exe25⤵
- Executes dropped EXE
PID:4276 -
\??\c:\1pjdj.exec:\1pjdj.exe26⤵
- Executes dropped EXE
PID:4600 -
\??\c:\3rrflfr.exec:\3rrflfr.exe27⤵
- Executes dropped EXE
PID:4240 -
\??\c:\tbtbtn.exec:\tbtbtn.exe28⤵
- Executes dropped EXE
PID:3280 -
\??\c:\btthhb.exec:\btthhb.exe29⤵
- Executes dropped EXE
PID:2992 -
\??\c:\tbtnbt.exec:\tbtnbt.exe30⤵
- Executes dropped EXE
PID:1784 -
\??\c:\pjdpj.exec:\pjdpj.exe31⤵
- Executes dropped EXE
PID:1616 -
\??\c:\1bhbbt.exec:\1bhbbt.exe32⤵
- Executes dropped EXE
PID:1848 -
\??\c:\btbnnn.exec:\btbnnn.exe33⤵
- Executes dropped EXE
PID:3676 -
\??\c:\rrxrrrx.exec:\rrxrrrx.exe34⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jvjdd.exec:\jvjdd.exe35⤵
- Executes dropped EXE
PID:1592 -
\??\c:\jjjdv.exec:\jjjdv.exe36⤵
- Executes dropped EXE
PID:960 -
\??\c:\fxlfllr.exec:\fxlfllr.exe37⤵
- Executes dropped EXE
PID:3728 -
\??\c:\btttnn.exec:\btttnn.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\pjdvd.exec:\pjdvd.exe39⤵
- Executes dropped EXE
PID:2900 -
\??\c:\flrllll.exec:\flrllll.exe40⤵
- Executes dropped EXE
PID:4720 -
\??\c:\tnbthh.exec:\tnbthh.exe41⤵
- Executes dropped EXE
PID:2240 -
\??\c:\vpvvv.exec:\vpvvv.exe42⤵
- Executes dropped EXE
PID:2376 -
\??\c:\lxfffll.exec:\lxfffll.exe43⤵
- Executes dropped EXE
PID:4372 -
\??\c:\vppjd.exec:\vppjd.exe44⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xllffxx.exec:\xllffxx.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3028 -
\??\c:\nhhnhb.exec:\nhhnhb.exe46⤵
- Executes dropped EXE
PID:244 -
\??\c:\tntbtn.exec:\tntbtn.exe47⤵PID:4404
-
\??\c:\ddjjp.exec:\ddjjp.exe48⤵
- Executes dropped EXE
PID:4852 -
\??\c:\lfxxrlf.exec:\lfxxrlf.exe49⤵
- Executes dropped EXE
PID:940 -
\??\c:\lfffxrl.exec:\lfffxrl.exe50⤵
- Executes dropped EXE
PID:3260 -
\??\c:\thhhhh.exec:\thhhhh.exe51⤵
- Executes dropped EXE
PID:4608 -
\??\c:\vvddd.exec:\vvddd.exe52⤵
- Executes dropped EXE
PID:4712 -
\??\c:\xrfrxxx.exec:\xrfrxxx.exe53⤵
- Executes dropped EXE
PID:2868 -
\??\c:\hnhnhb.exec:\hnhnhb.exe54⤵
- Executes dropped EXE
PID:5036 -
\??\c:\hntttn.exec:\hntttn.exe55⤵
- Executes dropped EXE
PID:4524 -
\??\c:\1vvpp.exec:\1vvpp.exe56⤵
- Executes dropped EXE
PID:2200 -
\??\c:\llrllll.exec:\llrllll.exe57⤵
- Executes dropped EXE
PID:3872 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe58⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hbhhbb.exec:\hbhhbb.exe59⤵
- Executes dropped EXE
PID:2688 -
\??\c:\vdjjj.exec:\vdjjj.exe60⤵
- Executes dropped EXE
PID:760 -
\??\c:\xflffff.exec:\xflffff.exe61⤵
- Executes dropped EXE
PID:4936 -
\??\c:\tnnhhh.exec:\tnnhhh.exe62⤵
- Executes dropped EXE
PID:1564 -
\??\c:\tbhbtt.exec:\tbhbtt.exe63⤵
- Executes dropped EXE
PID:2344 -
\??\c:\pdddp.exec:\pdddp.exe64⤵
- Executes dropped EXE
PID:408 -
\??\c:\5lxrrxr.exec:\5lxrrxr.exe65⤵
- Executes dropped EXE
PID:4640 -
\??\c:\btnhhh.exec:\btnhhh.exe66⤵
- Executes dropped EXE
PID:1712 -
\??\c:\ddpjj.exec:\ddpjj.exe67⤵PID:3968
-
\??\c:\pvpjd.exec:\pvpjd.exe68⤵PID:3800
-
\??\c:\xrxxxfl.exec:\xrxxxfl.exe69⤵PID:4652
-
\??\c:\tttnnb.exec:\tttnnb.exe70⤵PID:2400
-
\??\c:\jjpjd.exec:\jjpjd.exe71⤵PID:3192
-
\??\c:\rrrlfxx.exec:\rrrlfxx.exe72⤵PID:4496
-
\??\c:\nttnhh.exec:\nttnhh.exe73⤵PID:4644
-
\??\c:\jjjdp.exec:\jjjdp.exe74⤵PID:1788
-
\??\c:\7jpjd.exec:\7jpjd.exe75⤵PID:4504
-
\??\c:\lffxrrf.exec:\lffxrrf.exe76⤵PID:3516
-
\??\c:\thhhbt.exec:\thhhbt.exe77⤵PID:2396
-
\??\c:\jddvp.exec:\jddvp.exe78⤵PID:1096
-
\??\c:\lxrlfff.exec:\lxrlfff.exe79⤵PID:872
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe80⤵PID:3120
-
\??\c:\nhhbbb.exec:\nhhbbb.exe81⤵PID:4236
-
\??\c:\vjpvp.exec:\vjpvp.exe82⤵PID:4320
-
\??\c:\9xxfrrf.exec:\9xxfrrf.exe83⤵PID:1816
-
\??\c:\7tbntt.exec:\7tbntt.exe84⤵PID:1840
-
\??\c:\jvddd.exec:\jvddd.exe85⤵PID:4000
-
\??\c:\jdddp.exec:\jdddp.exe86⤵PID:4268
-
\??\c:\lfffxll.exec:\lfffxll.exe87⤵PID:4632
-
\??\c:\bhnhbt.exec:\bhnhbt.exe88⤵PID:2652
-
\??\c:\pdppj.exec:\pdppj.exe89⤵PID:1308
-
\??\c:\dvjdj.exec:\dvjdj.exe90⤵PID:1008
-
\??\c:\5ffxxxr.exec:\5ffxxxr.exe91⤵PID:1876
-
\??\c:\ttbbtn.exec:\ttbbtn.exe92⤵PID:392
-
\??\c:\vpppj.exec:\vpppj.exe93⤵PID:1848
-
\??\c:\ffrrxxf.exec:\ffrrxxf.exe94⤵PID:5052
-
\??\c:\htnnht.exec:\htnnht.exe95⤵PID:1544
-
\??\c:\bhnhbt.exec:\bhnhbt.exe96⤵PID:2712
-
\??\c:\1pvjv.exec:\1pvjv.exe97⤵PID:2620
-
\??\c:\fxxlfxr.exec:\fxxlfxr.exe98⤵PID:4380
-
\??\c:\bhnhbb.exec:\bhnhbb.exe99⤵PID:3272
-
\??\c:\pdvpd.exec:\pdvpd.exe100⤵PID:3212
-
\??\c:\lfxrfxl.exec:\lfxrfxl.exe101⤵PID:4068
-
\??\c:\bnbnht.exec:\bnbnht.exe102⤵PID:5016
-
\??\c:\hhnhhb.exec:\hhnhhb.exe103⤵PID:2828
-
\??\c:\pjpjd.exec:\pjpjd.exe104⤵
- System Location Discovery: System Language Discovery
PID:5040 -
\??\c:\3llfrrr.exec:\3llfrrr.exe105⤵PID:3012
-
\??\c:\rrfxrrl.exec:\rrfxrrl.exe106⤵PID:3116
-
\??\c:\9nhnhh.exec:\9nhnhh.exe107⤵PID:4692
-
\??\c:\1vppj.exec:\1vppj.exe108⤵PID:1724
-
\??\c:\flrrffx.exec:\flrrffx.exe109⤵
- System Location Discovery: System Language Discovery
PID:828 -
\??\c:\tbnhbb.exec:\tbnhbb.exe110⤵PID:2936
-
\??\c:\hbbtnt.exec:\hbbtnt.exe111⤵PID:2676
-
\??\c:\vvdpj.exec:\vvdpj.exe112⤵PID:3704
-
\??\c:\9rflxlf.exec:\9rflxlf.exe113⤵PID:1068
-
\??\c:\tnbttt.exec:\tnbttt.exe114⤵PID:3908
-
\??\c:\bttnhh.exec:\bttnhh.exe115⤵PID:2868
-
\??\c:\djpjd.exec:\djpjd.exe116⤵PID:4536
-
\??\c:\lrxxrrl.exec:\lrxxrrl.exe117⤵PID:1856
-
\??\c:\bttnnn.exec:\bttnnn.exe118⤵PID:320
-
\??\c:\nnnnnt.exec:\nnnnnt.exe119⤵PID:1636
-
\??\c:\pvvvp.exec:\pvvvp.exe120⤵PID:2528
-
\??\c:\3lflfxl.exec:\3lflfxl.exe121⤵PID:2688
-
\??\c:\9ntnhh.exec:\9ntnhh.exe122⤵PID:760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-