Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2024, 02:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc42dbcb9a9be80b9ca1f5c2f58f5b25f8b49b6dad0dac0a55f3f3c16eed0034.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
cc42dbcb9a9be80b9ca1f5c2f58f5b25f8b49b6dad0dac0a55f3f3c16eed0034.exe
-
Size
456KB
-
MD5
99b19db190a700077b66f0fb212ca59f
-
SHA1
b0199d5796e89cec99ac5250e7d738b4a891ad54
-
SHA256
cc42dbcb9a9be80b9ca1f5c2f58f5b25f8b49b6dad0dac0a55f3f3c16eed0034
-
SHA512
23a2f8a595b669ebf0646aea5bcfda29f435ed07e4dea63db4ec532bec053f2c3c5a18b7e367e388ed3143562ca22cd1d08413778d414617df3fdb3f866e28c1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRh:q7Tc2NYHUrAwfMp3CDRh
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/3096-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1744-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/336-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-568-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-657-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-745-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-797-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-1063-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-1791-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4524 xrrrxfx.exe 2308 tbnhnb.exe 2212 jdppv.exe 2912 nttbnb.exe 636 1xxflrx.exe 2984 tnttbh.exe 4156 rxlrfxl.exe 1500 thbbhn.exe 2268 jjvvd.exe 3500 vdddd.exe 4172 lfrrfrf.exe 2928 htbbhb.exe 3760 1pdjp.exe 4580 fffflrx.exe 5024 dvjjd.exe 1452 xlxflrr.exe 3376 pvppv.exe 632 lfffxfx.exe 2508 tthhtb.exe 3260 9ntbht.exe 1496 lrlrflx.exe 5068 dvjjj.exe 2788 nbhtbb.exe 1744 pdvvd.exe 4076 jjpjd.exe 1692 ntbhnt.exe 4468 jdvpj.exe 1872 hbnntb.exe 704 jpjdv.exe 2860 rrlllrr.exe 3608 ttbbbh.exe 4608 1tbhht.exe 4504 frxxxxx.exe 1392 lrrrffr.exe 228 nhtbbh.exe 2188 vdvvp.exe 1972 xffxrxl.exe 4020 7bhntt.exe 1476 jjddv.exe 2920 9rlllrf.exe 2344 hthhhn.exe 4328 pjdpd.exe 4840 lllrxxf.exe 3096 bhnntb.exe 4392 hnbbhh.exe 2308 vpdpd.exe 2324 rxlrxfl.exe 216 3nttbb.exe 5112 vvjpp.exe 1580 llxxxfl.exe 3804 ttbhnt.exe 4648 dvvpj.exe 4848 ppjjp.exe 4872 flxxxfl.exe 1460 nbhhnt.exe 1500 nbtntt.exe 3872 ddvpp.exe 2396 llxrrxx.exe 3112 hhthhn.exe 2096 pvjjd.exe 2332 7dppp.exe 4360 ffllflf.exe 4456 tbhhnn.exe 336 jdppv.exe -
resource yara_rule behavioral2/memory/3096-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/336-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/508-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-745-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-797-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3096 wrote to memory of 4524 3096 cc42dbcb9a9be80b9ca1f5c2f58f5b25f8b49b6dad0dac0a55f3f3c16eed0034.exe 82 PID 3096 wrote to memory of 4524 3096 cc42dbcb9a9be80b9ca1f5c2f58f5b25f8b49b6dad0dac0a55f3f3c16eed0034.exe 82 PID 3096 wrote to memory of 4524 3096 cc42dbcb9a9be80b9ca1f5c2f58f5b25f8b49b6dad0dac0a55f3f3c16eed0034.exe 82 PID 4524 wrote to memory of 2308 4524 xrrrxfx.exe 83 PID 4524 wrote to memory of 2308 4524 xrrrxfx.exe 83 PID 4524 wrote to memory of 2308 4524 xrrrxfx.exe 83 PID 2308 wrote to memory of 2212 2308 tbnhnb.exe 84 PID 2308 wrote to memory of 2212 2308 tbnhnb.exe 84 PID 2308 wrote to memory of 2212 2308 tbnhnb.exe 84 PID 2212 wrote to memory of 2912 2212 jdppv.exe 85 PID 2212 wrote to memory of 2912 2212 jdppv.exe 85 PID 2212 wrote to memory of 2912 2212 jdppv.exe 85 PID 2912 wrote to memory of 636 2912 nttbnb.exe 86 PID 2912 wrote to memory of 636 2912 nttbnb.exe 86 PID 2912 wrote to memory of 636 2912 nttbnb.exe 86 PID 636 wrote to memory of 2984 636 1xxflrx.exe 87 PID 636 wrote to memory of 2984 636 1xxflrx.exe 87 PID 636 wrote to memory of 2984 636 1xxflrx.exe 87 PID 2984 wrote to memory of 4156 2984 tnttbh.exe 88 PID 2984 wrote to memory of 4156 2984 tnttbh.exe 88 PID 2984 wrote to memory of 4156 2984 tnttbh.exe 88 PID 4156 wrote to memory of 1500 4156 rxlrfxl.exe 89 PID 4156 wrote to memory of 1500 4156 rxlrfxl.exe 89 PID 4156 wrote to memory of 1500 4156 rxlrfxl.exe 89 PID 1500 wrote to memory of 2268 1500 thbbhn.exe 90 PID 1500 wrote to memory of 2268 1500 thbbhn.exe 90 PID 1500 wrote to memory of 2268 1500 thbbhn.exe 90 PID 2268 wrote to memory of 3500 2268 jjvvd.exe 91 PID 2268 wrote to memory of 3500 2268 jjvvd.exe 91 PID 2268 wrote to memory of 3500 2268 jjvvd.exe 91 PID 3500 wrote to memory of 4172 3500 vdddd.exe 92 PID 3500 wrote to memory of 4172 3500 vdddd.exe 92 PID 3500 wrote to memory of 4172 3500 vdddd.exe 92 PID 4172 wrote to memory of 2928 4172 lfrrfrf.exe 93 PID 4172 wrote to memory of 2928 4172 lfrrfrf.exe 93 PID 4172 wrote to memory of 2928 4172 lfrrfrf.exe 93 PID 2928 wrote to memory of 3760 2928 htbbhb.exe 94 PID 2928 wrote to memory of 3760 2928 htbbhb.exe 94 PID 2928 wrote to memory of 3760 2928 htbbhb.exe 94 PID 3760 wrote to memory of 4580 3760 1pdjp.exe 95 PID 3760 wrote to memory of 4580 3760 1pdjp.exe 95 PID 3760 wrote to memory of 4580 3760 1pdjp.exe 95 PID 4580 wrote to memory of 5024 4580 fffflrx.exe 96 PID 4580 wrote to memory of 5024 4580 fffflrx.exe 96 PID 4580 wrote to memory of 5024 4580 fffflrx.exe 96 PID 5024 wrote to memory of 1452 5024 dvjjd.exe 97 PID 5024 wrote to memory of 1452 5024 dvjjd.exe 97 PID 5024 wrote to memory of 1452 5024 dvjjd.exe 97 PID 1452 wrote to memory of 3376 1452 xlxflrr.exe 98 PID 1452 wrote to memory of 3376 1452 xlxflrr.exe 98 PID 1452 wrote to memory of 3376 1452 xlxflrr.exe 98 PID 3376 wrote to memory of 632 3376 pvppv.exe 99 PID 3376 wrote to memory of 632 3376 pvppv.exe 99 PID 3376 wrote to memory of 632 3376 pvppv.exe 99 PID 632 wrote to memory of 2508 632 lfffxfx.exe 100 PID 632 wrote to memory of 2508 632 lfffxfx.exe 100 PID 632 wrote to memory of 2508 632 lfffxfx.exe 100 PID 2508 wrote to memory of 3260 2508 tthhtb.exe 101 PID 2508 wrote to memory of 3260 2508 tthhtb.exe 101 PID 2508 wrote to memory of 3260 2508 tthhtb.exe 101 PID 3260 wrote to memory of 1496 3260 9ntbht.exe 102 PID 3260 wrote to memory of 1496 3260 9ntbht.exe 102 PID 3260 wrote to memory of 1496 3260 9ntbht.exe 102 PID 1496 wrote to memory of 5068 1496 lrlrflx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc42dbcb9a9be80b9ca1f5c2f58f5b25f8b49b6dad0dac0a55f3f3c16eed0034.exe"C:\Users\Admin\AppData\Local\Temp\cc42dbcb9a9be80b9ca1f5c2f58f5b25f8b49b6dad0dac0a55f3f3c16eed0034.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\xrrrxfx.exec:\xrrrxfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\tbnhnb.exec:\tbnhnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\jdppv.exec:\jdppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\nttbnb.exec:\nttbnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\1xxflrx.exec:\1xxflrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\tnttbh.exec:\tnttbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\rxlrfxl.exec:\rxlrfxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\thbbhn.exec:\thbbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\jjvvd.exec:\jjvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\vdddd.exec:\vdddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\lfrrfrf.exec:\lfrrfrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\htbbhb.exec:\htbbhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\1pdjp.exec:\1pdjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\fffflrx.exec:\fffflrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\dvjjd.exec:\dvjjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\xlxflrr.exec:\xlxflrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\pvppv.exec:\pvppv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\lfffxfx.exec:\lfffxfx.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\tthhtb.exec:\tthhtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\9ntbht.exec:\9ntbht.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\lrlrflx.exec:\lrlrflx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\dvjjj.exec:\dvjjj.exe23⤵
- Executes dropped EXE
PID:5068 -
\??\c:\nbhtbb.exec:\nbhtbb.exe24⤵
- Executes dropped EXE
PID:2788 -
\??\c:\pdvvd.exec:\pdvvd.exe25⤵
- Executes dropped EXE
PID:1744 -
\??\c:\jjpjd.exec:\jjpjd.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4076 -
\??\c:\ntbhnt.exec:\ntbhnt.exe27⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jdvpj.exec:\jdvpj.exe28⤵
- Executes dropped EXE
PID:4468 -
\??\c:\hbnntb.exec:\hbnntb.exe29⤵
- Executes dropped EXE
PID:1872 -
\??\c:\jpjdv.exec:\jpjdv.exe30⤵
- Executes dropped EXE
PID:704 -
\??\c:\rrlllrr.exec:\rrlllrr.exe31⤵
- Executes dropped EXE
PID:2860 -
\??\c:\ttbbbh.exec:\ttbbbh.exe32⤵
- Executes dropped EXE
PID:3608 -
\??\c:\1tbhht.exec:\1tbhht.exe33⤵
- Executes dropped EXE
PID:4608 -
\??\c:\frxxxxx.exec:\frxxxxx.exe34⤵
- Executes dropped EXE
PID:4504 -
\??\c:\lrrrffr.exec:\lrrrffr.exe35⤵
- Executes dropped EXE
PID:1392 -
\??\c:\nhtbbh.exec:\nhtbbh.exe36⤵
- Executes dropped EXE
PID:228 -
\??\c:\vdvvp.exec:\vdvvp.exe37⤵
- Executes dropped EXE
PID:2188 -
\??\c:\xffxrxl.exec:\xffxrxl.exe38⤵
- Executes dropped EXE
PID:1972 -
\??\c:\7bhntt.exec:\7bhntt.exe39⤵
- Executes dropped EXE
PID:4020 -
\??\c:\jjddv.exec:\jjddv.exe40⤵
- Executes dropped EXE
PID:1476 -
\??\c:\9rlllrf.exec:\9rlllrf.exe41⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hthhhn.exec:\hthhhn.exe42⤵
- Executes dropped EXE
PID:2344 -
\??\c:\pjdpd.exec:\pjdpd.exe43⤵
- Executes dropped EXE
PID:4328 -
\??\c:\lllrxxf.exec:\lllrxxf.exe44⤵
- Executes dropped EXE
PID:4840 -
\??\c:\bhnntb.exec:\bhnntb.exe45⤵
- Executes dropped EXE
PID:3096 -
\??\c:\hnbbhh.exec:\hnbbhh.exe46⤵
- Executes dropped EXE
PID:4392 -
\??\c:\vpdpd.exec:\vpdpd.exe47⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rxlrxfl.exec:\rxlrxfl.exe48⤵
- Executes dropped EXE
PID:2324 -
\??\c:\3nttbb.exec:\3nttbb.exe49⤵
- Executes dropped EXE
PID:216 -
\??\c:\vvjpp.exec:\vvjpp.exe50⤵
- Executes dropped EXE
PID:5112 -
\??\c:\llxxxfl.exec:\llxxxfl.exe51⤵
- Executes dropped EXE
PID:1580 -
\??\c:\ttbhnt.exec:\ttbhnt.exe52⤵
- Executes dropped EXE
PID:3804 -
\??\c:\dvvpj.exec:\dvvpj.exe53⤵
- Executes dropped EXE
PID:4648 -
\??\c:\ppjjp.exec:\ppjjp.exe54⤵
- Executes dropped EXE
PID:4848 -
\??\c:\flxxxfl.exec:\flxxxfl.exe55⤵
- Executes dropped EXE
PID:4872 -
\??\c:\nbhhnt.exec:\nbhhnt.exe56⤵
- Executes dropped EXE
PID:1460 -
\??\c:\nbtntt.exec:\nbtntt.exe57⤵
- Executes dropped EXE
PID:1500 -
\??\c:\ddvpp.exec:\ddvpp.exe58⤵
- Executes dropped EXE
PID:3872 -
\??\c:\llxrrxx.exec:\llxrrxx.exe59⤵
- Executes dropped EXE
PID:2396 -
\??\c:\hhthhn.exec:\hhthhn.exe60⤵
- Executes dropped EXE
PID:3112 -
\??\c:\pvjjd.exec:\pvjjd.exe61⤵
- Executes dropped EXE
PID:2096 -
\??\c:\7dppp.exec:\7dppp.exe62⤵
- Executes dropped EXE
PID:2332 -
\??\c:\ffllflf.exec:\ffllflf.exe63⤵
- Executes dropped EXE
PID:4360 -
\??\c:\tbhhnn.exec:\tbhhnn.exe64⤵
- Executes dropped EXE
PID:4456 -
\??\c:\jdppv.exec:\jdppv.exe65⤵
- Executes dropped EXE
PID:336 -
\??\c:\5xxxfrx.exec:\5xxxfrx.exe66⤵PID:5024
-
\??\c:\1frxllf.exec:\1frxllf.exe67⤵PID:4380
-
\??\c:\vjvdj.exec:\vjvdj.exe68⤵PID:3532
-
\??\c:\9pppv.exec:\9pppv.exe69⤵PID:764
-
\??\c:\fxrrrfr.exec:\fxrrrfr.exe70⤵PID:2392
-
\??\c:\7ntntn.exec:\7ntntn.exe71⤵PID:1164
-
\??\c:\ddjjj.exec:\ddjjj.exe72⤵PID:3452
-
\??\c:\rxlrrxf.exec:\rxlrrxf.exe73⤵PID:4720
-
\??\c:\bbnbhh.exec:\bbnbhh.exe74⤵PID:2828
-
\??\c:\jjvdj.exec:\jjvdj.exe75⤵PID:1448
-
\??\c:\rfllrxf.exec:\rfllrxf.exe76⤵PID:2624
-
\??\c:\nhbhhn.exec:\nhbhhn.exe77⤵PID:1948
-
\??\c:\hhttbh.exec:\hhttbh.exe78⤵PID:1412
-
\??\c:\dvpjj.exec:\dvpjj.exe79⤵PID:4204
-
\??\c:\xxlxxfl.exec:\xxlxxfl.exe80⤵PID:980
-
\??\c:\nnthhb.exec:\nnthhb.exe81⤵PID:2388
-
\??\c:\vvvvj.exec:\vvvvj.exe82⤵PID:1864
-
\??\c:\rllllrr.exec:\rllllrr.exe83⤵PID:1284
-
\??\c:\ffffxlr.exec:\ffffxlr.exe84⤵PID:4068
-
\??\c:\tthnnt.exec:\tthnnt.exe85⤵PID:3672
-
\??\c:\ppvvd.exec:\ppvvd.exe86⤵PID:4152
-
\??\c:\lfllflr.exec:\lfllflr.exe87⤵PID:3056
-
\??\c:\lrrxxfl.exec:\lrrxxfl.exe88⤵PID:4892
-
\??\c:\hthnbh.exec:\hthnbh.exe89⤵PID:3076
-
\??\c:\vjvdd.exec:\vjvdd.exe90⤵PID:1640
-
\??\c:\jjjpv.exec:\jjjpv.exe91⤵PID:1504
-
\??\c:\rflfflf.exec:\rflfflf.exe92⤵PID:3368
-
\??\c:\bhnntb.exec:\bhnntb.exe93⤵PID:3292
-
\??\c:\ddvdv.exec:\ddvdv.exe94⤵PID:4608
-
\??\c:\rxfflrr.exec:\rxfflrr.exe95⤵
- System Location Discovery: System Language Discovery
PID:4348 -
\??\c:\7nbhnt.exec:\7nbhnt.exe96⤵PID:3580
-
\??\c:\bnhhhn.exec:\bnhhhn.exe97⤵PID:3216
-
\??\c:\pvvpv.exec:\pvvpv.exe98⤵PID:3904
-
\??\c:\xxlrflr.exec:\xxlrflr.exe99⤵PID:4896
-
\??\c:\hbtttb.exec:\hbtttb.exe100⤵PID:1972
-
\??\c:\pvpvv.exec:\pvpvv.exe101⤵PID:2772
-
\??\c:\ffxxflr.exec:\ffxxflr.exe102⤵PID:3252
-
\??\c:\bttnbh.exec:\bttnbh.exe103⤵PID:1852
-
\??\c:\vdddj.exec:\vdddj.exe104⤵PID:4332
-
\??\c:\xxrrlrf.exec:\xxrrlrf.exe105⤵PID:3620
-
\??\c:\htntbh.exec:\htntbh.exe106⤵PID:4780
-
\??\c:\ttbbtt.exec:\ttbbtt.exe107⤵PID:3552
-
\??\c:\vpjjj.exec:\vpjjj.exe108⤵PID:624
-
\??\c:\rrffflr.exec:\rrffflr.exe109⤵PID:5060
-
\??\c:\xfllxff.exec:\xfllxff.exe110⤵PID:2896
-
\??\c:\bbhttt.exec:\bbhttt.exe111⤵PID:3840
-
\??\c:\pvvdj.exec:\pvvdj.exe112⤵PID:2212
-
\??\c:\rxxfflr.exec:\rxxfflr.exe113⤵PID:936
-
\??\c:\rfrrrxr.exec:\rfrrrxr.exe114⤵PID:4036
-
\??\c:\nthhtb.exec:\nthhtb.exe115⤵PID:1480
-
\??\c:\jpddj.exec:\jpddj.exe116⤵PID:3804
-
\??\c:\rrxxrxl.exec:\rrxxrxl.exe117⤵PID:2984
-
\??\c:\flrrrxx.exec:\flrrrxx.exe118⤵PID:4848
-
\??\c:\7tnntb.exec:\7tnntb.exe119⤵PID:4872
-
\??\c:\5jvvj.exec:\5jvvj.exe120⤵PID:1844
-
\??\c:\lfrxxff.exec:\lfrxxff.exe121⤵PID:4532
-
\??\c:\bnhhht.exec:\bnhhht.exe122⤵PID:2924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-