Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2024, 23:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
64870b7daea9873cdb8281a650af11fff44adcde6a9864ec0f505b03e7f39baf.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
64870b7daea9873cdb8281a650af11fff44adcde6a9864ec0f505b03e7f39baf.exe
-
Size
456KB
-
MD5
99d046cbd785d917471eb8f6f1f4e18c
-
SHA1
22e2d8872ce3d5192ac673567a5f891a8f96ea2c
-
SHA256
64870b7daea9873cdb8281a650af11fff44adcde6a9864ec0f505b03e7f39baf
-
SHA512
ef83ba875ff938845990d996ea98960d7d403231c81a3b465040489af5ed47836c1e71f7edfb376b09ad05cd6641c03094a5f659f549e062112bcd1e1bb7268b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRy:q7Tc2NYHUrAwfMp3CDRy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4928-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3272-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/952-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/852-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1248-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-704-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-796-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-1005-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1236-1144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-1567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-1610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3144 btbbtn.exe 3432 3ppjd.exe 4460 ntbthb.exe 2200 3dvpj.exe 3272 xrlxrlf.exe 4652 htbnhh.exe 3688 3nbthh.exe 3516 xrllfxf.exe 4916 vpjpd.exe 4788 btnnbb.exe 2776 jvdvp.exe 1200 5fxxxxx.exe 1624 hbbtnn.exe 1388 bbnthn.exe 212 rrrfxrf.exe 2160 tbnhhh.exe 4984 rfllfxr.exe 2080 nthtnh.exe 116 vjdpv.exe 1308 xlfrxlx.exe 3448 5tnhbb.exe 876 flxxfxr.exe 456 rfxfrlr.exe 4084 btbtbb.exe 2008 ntnnhb.exe 4232 9dvpj.exe 2304 dddpd.exe 1128 hntnht.exe 1064 3vvpd.exe 4092 bhnhbt.exe 4992 vvpjp.exe 4008 flxlfxr.exe 952 vdvvj.exe 636 lxxrrrr.exe 3284 hthbbt.exe 3024 vppdv.exe 1496 flrlrlx.exe 2032 bttnnh.exe 1048 vdjdp.exe 2660 lllfxxx.exe 3352 bnbttn.exe 4268 ddvpp.exe 1716 lfrlxxr.exe 3488 nhtntt.exe 3560 9bhbtn.exe 1812 7pdjd.exe 924 xxllfxr.exe 2424 9hhhbh.exe 3076 7dvjv.exe 5084 lflxrrl.exe 4524 btthth.exe 4816 jddvp.exe 4392 rxlxrlf.exe 2236 7tnhbt.exe 3932 jdvpj.exe 4568 1jdvj.exe 4868 9fxrffx.exe 1880 9bhbth.exe 4072 vjdvd.exe 3068 xrfrlrl.exe 216 bhhbth.exe 3272 dvjdd.exe 3348 rlxxlrf.exe 4976 9djvp.exe -
resource yara_rule behavioral2/memory/4928-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3272-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1388-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/952-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1248-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-953-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-1005-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4928 wrote to memory of 3144 4928 64870b7daea9873cdb8281a650af11fff44adcde6a9864ec0f505b03e7f39baf.exe 82 PID 4928 wrote to memory of 3144 4928 64870b7daea9873cdb8281a650af11fff44adcde6a9864ec0f505b03e7f39baf.exe 82 PID 4928 wrote to memory of 3144 4928 64870b7daea9873cdb8281a650af11fff44adcde6a9864ec0f505b03e7f39baf.exe 82 PID 3144 wrote to memory of 3432 3144 btbbtn.exe 83 PID 3144 wrote to memory of 3432 3144 btbbtn.exe 83 PID 3144 wrote to memory of 3432 3144 btbbtn.exe 83 PID 3432 wrote to memory of 4460 3432 3ppjd.exe 84 PID 3432 wrote to memory of 4460 3432 3ppjd.exe 84 PID 3432 wrote to memory of 4460 3432 3ppjd.exe 84 PID 4460 wrote to memory of 2200 4460 ntbthb.exe 85 PID 4460 wrote to memory of 2200 4460 ntbthb.exe 85 PID 4460 wrote to memory of 2200 4460 ntbthb.exe 85 PID 2200 wrote to memory of 3272 2200 3dvpj.exe 86 PID 2200 wrote to memory of 3272 2200 3dvpj.exe 86 PID 2200 wrote to memory of 3272 2200 3dvpj.exe 86 PID 3272 wrote to memory of 4652 3272 xrlxrlf.exe 87 PID 3272 wrote to memory of 4652 3272 xrlxrlf.exe 87 PID 3272 wrote to memory of 4652 3272 xrlxrlf.exe 87 PID 4652 wrote to memory of 3688 4652 htbnhh.exe 88 PID 4652 wrote to memory of 3688 4652 htbnhh.exe 88 PID 4652 wrote to memory of 3688 4652 htbnhh.exe 88 PID 3688 wrote to memory of 3516 3688 3nbthh.exe 89 PID 3688 wrote to memory of 3516 3688 3nbthh.exe 89 PID 3688 wrote to memory of 3516 3688 3nbthh.exe 89 PID 3516 wrote to memory of 4916 3516 xrllfxf.exe 90 PID 3516 wrote to memory of 4916 3516 xrllfxf.exe 90 PID 3516 wrote to memory of 4916 3516 xrllfxf.exe 90 PID 4916 wrote to memory of 4788 4916 vpjpd.exe 91 PID 4916 wrote to memory of 4788 4916 vpjpd.exe 91 PID 4916 wrote to memory of 4788 4916 vpjpd.exe 91 PID 4788 wrote to memory of 2776 4788 btnnbb.exe 92 PID 4788 wrote to memory of 2776 4788 btnnbb.exe 92 PID 4788 wrote to memory of 2776 4788 btnnbb.exe 92 PID 2776 wrote to memory of 1200 2776 jvdvp.exe 93 PID 2776 wrote to memory of 1200 2776 jvdvp.exe 93 PID 2776 wrote to memory of 1200 2776 jvdvp.exe 93 PID 1200 wrote to memory of 1624 1200 5fxxxxx.exe 94 PID 1200 wrote to memory of 1624 1200 5fxxxxx.exe 94 PID 1200 wrote to memory of 1624 1200 5fxxxxx.exe 94 PID 1624 wrote to memory of 1388 1624 hbbtnn.exe 95 PID 1624 wrote to memory of 1388 1624 hbbtnn.exe 95 PID 1624 wrote to memory of 1388 1624 hbbtnn.exe 95 PID 1388 wrote to memory of 212 1388 bbnthn.exe 96 PID 1388 wrote to memory of 212 1388 bbnthn.exe 96 PID 1388 wrote to memory of 212 1388 bbnthn.exe 96 PID 212 wrote to memory of 2160 212 rrrfxrf.exe 97 PID 212 wrote to memory of 2160 212 rrrfxrf.exe 97 PID 212 wrote to memory of 2160 212 rrrfxrf.exe 97 PID 2160 wrote to memory of 4984 2160 tbnhhh.exe 98 PID 2160 wrote to memory of 4984 2160 tbnhhh.exe 98 PID 2160 wrote to memory of 4984 2160 tbnhhh.exe 98 PID 4984 wrote to memory of 2080 4984 rfllfxr.exe 99 PID 4984 wrote to memory of 2080 4984 rfllfxr.exe 99 PID 4984 wrote to memory of 2080 4984 rfllfxr.exe 99 PID 2080 wrote to memory of 116 2080 nthtnh.exe 100 PID 2080 wrote to memory of 116 2080 nthtnh.exe 100 PID 2080 wrote to memory of 116 2080 nthtnh.exe 100 PID 116 wrote to memory of 1308 116 vjdpv.exe 101 PID 116 wrote to memory of 1308 116 vjdpv.exe 101 PID 116 wrote to memory of 1308 116 vjdpv.exe 101 PID 1308 wrote to memory of 3448 1308 xlfrxlx.exe 102 PID 1308 wrote to memory of 3448 1308 xlfrxlx.exe 102 PID 1308 wrote to memory of 3448 1308 xlfrxlx.exe 102 PID 3448 wrote to memory of 876 3448 5tnhbb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\64870b7daea9873cdb8281a650af11fff44adcde6a9864ec0f505b03e7f39baf.exe"C:\Users\Admin\AppData\Local\Temp\64870b7daea9873cdb8281a650af11fff44adcde6a9864ec0f505b03e7f39baf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\btbbtn.exec:\btbbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\3ppjd.exec:\3ppjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\ntbthb.exec:\ntbthb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\3dvpj.exec:\3dvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\xrlxrlf.exec:\xrlxrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\htbnhh.exec:\htbnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\3nbthh.exec:\3nbthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\xrllfxf.exec:\xrllfxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\vpjpd.exec:\vpjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\btnnbb.exec:\btnnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\jvdvp.exec:\jvdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\5fxxxxx.exec:\5fxxxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\hbbtnn.exec:\hbbtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\bbnthn.exec:\bbnthn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\rrrfxrf.exec:\rrrfxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\tbnhhh.exec:\tbnhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\rfllfxr.exec:\rfllfxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\nthtnh.exec:\nthtnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\vjdpv.exec:\vjdpv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\xlfrxlx.exec:\xlfrxlx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\5tnhbb.exec:\5tnhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\flxxfxr.exec:\flxxfxr.exe23⤵
- Executes dropped EXE
PID:876 -
\??\c:\rfxfrlr.exec:\rfxfrlr.exe24⤵
- Executes dropped EXE
PID:456 -
\??\c:\btbtbb.exec:\btbtbb.exe25⤵
- Executes dropped EXE
PID:4084 -
\??\c:\ntnnhb.exec:\ntnnhb.exe26⤵
- Executes dropped EXE
PID:2008 -
\??\c:\9dvpj.exec:\9dvpj.exe27⤵
- Executes dropped EXE
PID:4232 -
\??\c:\dddpd.exec:\dddpd.exe28⤵
- Executes dropped EXE
PID:2304 -
\??\c:\hntnht.exec:\hntnht.exe29⤵
- Executes dropped EXE
PID:1128 -
\??\c:\3vvpd.exec:\3vvpd.exe30⤵
- Executes dropped EXE
PID:1064 -
\??\c:\bhnhbt.exec:\bhnhbt.exe31⤵
- Executes dropped EXE
PID:4092 -
\??\c:\vvpjp.exec:\vvpjp.exe32⤵
- Executes dropped EXE
PID:4992 -
\??\c:\flxlfxr.exec:\flxlfxr.exe33⤵
- Executes dropped EXE
PID:4008 -
\??\c:\vdvvj.exec:\vdvvj.exe34⤵
- Executes dropped EXE
PID:952 -
\??\c:\lxxrrrr.exec:\lxxrrrr.exe35⤵
- Executes dropped EXE
PID:636 -
\??\c:\hthbbt.exec:\hthbbt.exe36⤵
- Executes dropped EXE
PID:3284 -
\??\c:\vppdv.exec:\vppdv.exe37⤵
- Executes dropped EXE
PID:3024 -
\??\c:\flrlrlx.exec:\flrlrlx.exe38⤵
- Executes dropped EXE
PID:1496 -
\??\c:\bttnnh.exec:\bttnnh.exe39⤵
- Executes dropped EXE
PID:2032 -
\??\c:\vdjdp.exec:\vdjdp.exe40⤵
- Executes dropped EXE
PID:1048 -
\??\c:\lllfxxx.exec:\lllfxxx.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\bnbttn.exec:\bnbttn.exe42⤵
- Executes dropped EXE
PID:3352 -
\??\c:\ddvpp.exec:\ddvpp.exe43⤵
- Executes dropped EXE
PID:4268 -
\??\c:\lfrlxxr.exec:\lfrlxxr.exe44⤵
- Executes dropped EXE
PID:1716 -
\??\c:\nhtntt.exec:\nhtntt.exe45⤵
- Executes dropped EXE
PID:3488 -
\??\c:\9bhbtn.exec:\9bhbtn.exe46⤵
- Executes dropped EXE
PID:3560 -
\??\c:\7pdjd.exec:\7pdjd.exe47⤵
- Executes dropped EXE
PID:1812 -
\??\c:\xxllfxr.exec:\xxllfxr.exe48⤵
- Executes dropped EXE
PID:924 -
\??\c:\9hhhbh.exec:\9hhhbh.exe49⤵
- Executes dropped EXE
PID:2424 -
\??\c:\7dvjv.exec:\7dvjv.exe50⤵
- Executes dropped EXE
PID:3076 -
\??\c:\lflxrrl.exec:\lflxrrl.exe51⤵
- Executes dropped EXE
PID:5084 -
\??\c:\btthth.exec:\btthth.exe52⤵
- Executes dropped EXE
PID:4524 -
\??\c:\jddvp.exec:\jddvp.exe53⤵
- Executes dropped EXE
PID:4816 -
\??\c:\rxlxrlf.exec:\rxlxrlf.exe54⤵
- Executes dropped EXE
PID:4392 -
\??\c:\7tnhbt.exec:\7tnhbt.exe55⤵
- Executes dropped EXE
PID:2236 -
\??\c:\jdvpj.exec:\jdvpj.exe56⤵
- Executes dropped EXE
PID:3932 -
\??\c:\1jdvj.exec:\1jdvj.exe57⤵
- Executes dropped EXE
PID:4568 -
\??\c:\9fxrffx.exec:\9fxrffx.exe58⤵
- Executes dropped EXE
PID:4868 -
\??\c:\9bhbth.exec:\9bhbth.exe59⤵
- Executes dropped EXE
PID:1880 -
\??\c:\vjdvd.exec:\vjdvd.exe60⤵
- Executes dropped EXE
PID:4072 -
\??\c:\xrfrlrl.exec:\xrfrlrl.exe61⤵
- Executes dropped EXE
PID:3068 -
\??\c:\bhhbth.exec:\bhhbth.exe62⤵
- Executes dropped EXE
PID:216 -
\??\c:\dvjdd.exec:\dvjdd.exe63⤵
- Executes dropped EXE
PID:3272 -
\??\c:\rlxxlrf.exec:\rlxxlrf.exe64⤵
- Executes dropped EXE
PID:3348 -
\??\c:\9djvp.exec:\9djvp.exe65⤵
- Executes dropped EXE
PID:4976 -
\??\c:\vpvjd.exec:\vpvjd.exe66⤵PID:908
-
\??\c:\xxfxllf.exec:\xxfxllf.exe67⤵PID:1848
-
\??\c:\thttnn.exec:\thttnn.exe68⤵PID:852
-
\??\c:\pvdpv.exec:\pvdpv.exe69⤵PID:2956
-
\??\c:\xxxxlrl.exec:\xxxxlrl.exe70⤵PID:4384
-
\??\c:\hbhhhb.exec:\hbhhhb.exe71⤵PID:3580
-
\??\c:\ppdjp.exec:\ppdjp.exe72⤵PID:1228
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe73⤵PID:4320
-
\??\c:\fflxrfx.exec:\fflxrfx.exe74⤵PID:1360
-
\??\c:\9hbnhb.exec:\9hbnhb.exe75⤵PID:1984
-
\??\c:\5vdvd.exec:\5vdvd.exe76⤵PID:3676
-
\??\c:\rlrfxxr.exec:\rlrfxxr.exe77⤵PID:4520
-
\??\c:\hbbbtt.exec:\hbbbtt.exe78⤵PID:4964
-
\??\c:\vdjjd.exec:\vdjjd.exe79⤵PID:2184
-
\??\c:\jvvvv.exec:\jvvvv.exe80⤵PID:2112
-
\??\c:\lxfrllf.exec:\lxfrllf.exe81⤵PID:1976
-
\??\c:\nbntnn.exec:\nbntnn.exe82⤵PID:3944
-
\??\c:\vjppp.exec:\vjppp.exe83⤵PID:1272
-
\??\c:\rflfxxr.exec:\rflfxxr.exe84⤵PID:4000
-
\??\c:\nhnntn.exec:\nhnntn.exe85⤵PID:2264
-
\??\c:\3nnhbb.exec:\3nnhbb.exe86⤵PID:3080
-
\??\c:\jdjdj.exec:\jdjdj.exe87⤵PID:876
-
\??\c:\vvpjd.exec:\vvpjd.exe88⤵PID:2752
-
\??\c:\7lllrxr.exec:\7lllrxr.exe89⤵PID:3016
-
\??\c:\hhbhhn.exec:\hhbhhn.exe90⤵PID:5024
-
\??\c:\hnbhbh.exec:\hnbhbh.exe91⤵PID:4592
-
\??\c:\pvvpp.exec:\pvvpp.exe92⤵PID:2952
-
\??\c:\xfxrlll.exec:\xfxrlll.exe93⤵PID:3424
-
\??\c:\ttbthb.exec:\ttbthb.exe94⤵PID:4348
-
\??\c:\vdddv.exec:\vdddv.exe95⤵PID:1128
-
\??\c:\vddvv.exec:\vddvv.exe96⤵PID:2924
-
\??\c:\xrfxffl.exec:\xrfxffl.exe97⤵PID:1572
-
\??\c:\thnhbb.exec:\thnhbb.exe98⤵PID:5032
-
\??\c:\vdpdv.exec:\vdpdv.exe99⤵PID:4992
-
\??\c:\vjjdd.exec:\vjjdd.exe100⤵PID:3568
-
\??\c:\1xxxrxr.exec:\1xxxrxr.exe101⤵PID:748
-
\??\c:\btbhbb.exec:\btbhbb.exe102⤵PID:3380
-
\??\c:\pdjdv.exec:\pdjdv.exe103⤵PID:2712
-
\??\c:\lrxxxrl.exec:\lrxxxrl.exe104⤵PID:2220
-
\??\c:\lllrlrl.exec:\lllrlrl.exe105⤵PID:3296
-
\??\c:\hnbbnh.exec:\hnbbnh.exe106⤵PID:5020
-
\??\c:\djjpv.exec:\djjpv.exe107⤵PID:1116
-
\??\c:\rxfxllx.exec:\rxfxllx.exe108⤵PID:4356
-
\??\c:\nnhhbb.exec:\nnhhbb.exe109⤵PID:4944
-
\??\c:\jpvjv.exec:\jpvjv.exe110⤵PID:2632
-
\??\c:\ddjdv.exec:\ddjdv.exe111⤵PID:1620
-
\??\c:\rxxlrrl.exec:\rxxlrrl.exe112⤵PID:1368
-
\??\c:\bnttnn.exec:\bnttnn.exe113⤵PID:3488
-
\??\c:\hthtnh.exec:\hthtnh.exe114⤵PID:2348
-
\??\c:\dvvpj.exec:\dvvpj.exe115⤵PID:1812
-
\??\c:\flrlrrx.exec:\flrlrrx.exe116⤵PID:4668
-
\??\c:\thhtnh.exec:\thhtnh.exe117⤵PID:1152
-
\??\c:\9bbnnh.exec:\9bbnnh.exe118⤵PID:3076
-
\??\c:\9jjjd.exec:\9jjjd.exe119⤵PID:4696
-
\??\c:\vpppv.exec:\vpppv.exe120⤵PID:4524
-
\??\c:\rrxflrf.exec:\rrxflrf.exe121⤵PID:2308
-
\??\c:\btthbt.exec:\btthbt.exe122⤵PID:3592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-