Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2024, 20:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
23342650f890cb44811530777913f749504f6c4007c1fcb4e8ea06d53ac1023d.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
23342650f890cb44811530777913f749504f6c4007c1fcb4e8ea06d53ac1023d.exe
-
Size
454KB
-
MD5
22d677bacb60344e879fb9042b9a1313
-
SHA1
07bec762950b9ca0804d7cf7d20f725f3923a436
-
SHA256
23342650f890cb44811530777913f749504f6c4007c1fcb4e8ea06d53ac1023d
-
SHA512
9b58f207c77287de40569fd9425dc0ada962bcf3c96b5327a1ad185c308f3772c2b73e949d10b5e78679555fc3934cb2718e32e6d6d57bd866f57dbfad931206
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2848-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1732-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1428-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3352-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/796-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/892-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1264-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-764-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-798-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-874-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-1146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-1211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1308 9xfxfxf.exe 4380 btnnhh.exe 3732 vvjjp.exe 2540 ddvvv.exe 2288 3fllfll.exe 4996 hhtntn.exe 4780 7tbbbb.exe 3772 xxfffff.exe 3524 7hhbbn.exe 3944 tbhbtb.exe 2280 hbbttt.exe 3320 pjjvv.exe 3980 ddddd.exe 116 5fxrlll.exe 3404 tttntt.exe 540 lrlfxxf.exe 2004 ttthhh.exe 5112 nttnhh.exe 2200 flxxrrr.exe 2336 nbnnhh.exe 4416 pvddv.exe 4524 llrfxxx.exe 4908 ppddd.exe 408 hbhbbb.exe 4824 7ppdd.exe 4828 fxxrlll.exe 4968 frrffxr.exe 1732 9ffrrrl.exe 2596 hthbtt.exe 3296 5djjj.exe 2380 9nhbtb.exe 1264 tbnnnt.exe 1888 vvvvp.exe 2016 rlllfll.exe 3904 lxlfxfr.exe 2188 pjvvp.exe 4332 xllffxr.exe 2676 tntttb.exe 1664 pvjvj.exe 2428 3xfrflf.exe 4764 jvvpd.exe 4060 xxlxrlf.exe 2120 btnbhb.exe 2544 rfxfrrx.exe 1428 nbnhhh.exe 2420 7xrlfrr.exe 5036 dppdv.exe 4012 frrlffx.exe 2548 nbhhtt.exe 4876 dvjjp.exe 4724 3xffxfx.exe 3952 xllxrrl.exe 224 hhnnnn.exe 4384 jdjdv.exe 4304 9lrlxrl.exe 1336 nbbtnn.exe 4348 dvdvv.exe 3352 pjvdd.exe 3216 xrfxfll.exe 3600 bttnhb.exe 4964 pvvpj.exe 4780 xlrlrrl.exe 796 3flfrlx.exe 4864 bnttnn.exe -
resource yara_rule behavioral2/memory/2848-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1732-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1428-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3352-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/796-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/892-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1264-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-764-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllflrx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2848 wrote to memory of 1308 2848 23342650f890cb44811530777913f749504f6c4007c1fcb4e8ea06d53ac1023d.exe 83 PID 2848 wrote to memory of 1308 2848 23342650f890cb44811530777913f749504f6c4007c1fcb4e8ea06d53ac1023d.exe 83 PID 2848 wrote to memory of 1308 2848 23342650f890cb44811530777913f749504f6c4007c1fcb4e8ea06d53ac1023d.exe 83 PID 1308 wrote to memory of 4380 1308 9xfxfxf.exe 84 PID 1308 wrote to memory of 4380 1308 9xfxfxf.exe 84 PID 1308 wrote to memory of 4380 1308 9xfxfxf.exe 84 PID 4380 wrote to memory of 3732 4380 btnnhh.exe 85 PID 4380 wrote to memory of 3732 4380 btnnhh.exe 85 PID 4380 wrote to memory of 3732 4380 btnnhh.exe 85 PID 3732 wrote to memory of 2540 3732 vvjjp.exe 86 PID 3732 wrote to memory of 2540 3732 vvjjp.exe 86 PID 3732 wrote to memory of 2540 3732 vvjjp.exe 86 PID 2540 wrote to memory of 2288 2540 ddvvv.exe 87 PID 2540 wrote to memory of 2288 2540 ddvvv.exe 87 PID 2540 wrote to memory of 2288 2540 ddvvv.exe 87 PID 2288 wrote to memory of 4996 2288 3fllfll.exe 88 PID 2288 wrote to memory of 4996 2288 3fllfll.exe 88 PID 2288 wrote to memory of 4996 2288 3fllfll.exe 88 PID 4996 wrote to memory of 4780 4996 hhtntn.exe 89 PID 4996 wrote to memory of 4780 4996 hhtntn.exe 89 PID 4996 wrote to memory of 4780 4996 hhtntn.exe 89 PID 4780 wrote to memory of 3772 4780 7tbbbb.exe 90 PID 4780 wrote to memory of 3772 4780 7tbbbb.exe 90 PID 4780 wrote to memory of 3772 4780 7tbbbb.exe 90 PID 3772 wrote to memory of 3524 3772 xxfffff.exe 91 PID 3772 wrote to memory of 3524 3772 xxfffff.exe 91 PID 3772 wrote to memory of 3524 3772 xxfffff.exe 91 PID 3524 wrote to memory of 3944 3524 7hhbbn.exe 92 PID 3524 wrote to memory of 3944 3524 7hhbbn.exe 92 PID 3524 wrote to memory of 3944 3524 7hhbbn.exe 92 PID 3944 wrote to memory of 2280 3944 tbhbtb.exe 93 PID 3944 wrote to memory of 2280 3944 tbhbtb.exe 93 PID 3944 wrote to memory of 2280 3944 tbhbtb.exe 93 PID 2280 wrote to memory of 3320 2280 hbbttt.exe 94 PID 2280 wrote to memory of 3320 2280 hbbttt.exe 94 PID 2280 wrote to memory of 3320 2280 hbbttt.exe 94 PID 3320 wrote to memory of 3980 3320 pjjvv.exe 95 PID 3320 wrote to memory of 3980 3320 pjjvv.exe 95 PID 3320 wrote to memory of 3980 3320 pjjvv.exe 95 PID 3980 wrote to memory of 116 3980 ddddd.exe 96 PID 3980 wrote to memory of 116 3980 ddddd.exe 96 PID 3980 wrote to memory of 116 3980 ddddd.exe 96 PID 116 wrote to memory of 3404 116 5fxrlll.exe 97 PID 116 wrote to memory of 3404 116 5fxrlll.exe 97 PID 116 wrote to memory of 3404 116 5fxrlll.exe 97 PID 3404 wrote to memory of 540 3404 tttntt.exe 98 PID 3404 wrote to memory of 540 3404 tttntt.exe 98 PID 3404 wrote to memory of 540 3404 tttntt.exe 98 PID 540 wrote to memory of 2004 540 lrlfxxf.exe 99 PID 540 wrote to memory of 2004 540 lrlfxxf.exe 99 PID 540 wrote to memory of 2004 540 lrlfxxf.exe 99 PID 2004 wrote to memory of 5112 2004 ttthhh.exe 100 PID 2004 wrote to memory of 5112 2004 ttthhh.exe 100 PID 2004 wrote to memory of 5112 2004 ttthhh.exe 100 PID 5112 wrote to memory of 2200 5112 nttnhh.exe 101 PID 5112 wrote to memory of 2200 5112 nttnhh.exe 101 PID 5112 wrote to memory of 2200 5112 nttnhh.exe 101 PID 2200 wrote to memory of 2336 2200 flxxrrr.exe 102 PID 2200 wrote to memory of 2336 2200 flxxrrr.exe 102 PID 2200 wrote to memory of 2336 2200 flxxrrr.exe 102 PID 2336 wrote to memory of 4416 2336 nbnnhh.exe 103 PID 2336 wrote to memory of 4416 2336 nbnnhh.exe 103 PID 2336 wrote to memory of 4416 2336 nbnnhh.exe 103 PID 4416 wrote to memory of 4524 4416 pvddv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\23342650f890cb44811530777913f749504f6c4007c1fcb4e8ea06d53ac1023d.exe"C:\Users\Admin\AppData\Local\Temp\23342650f890cb44811530777913f749504f6c4007c1fcb4e8ea06d53ac1023d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\9xfxfxf.exec:\9xfxfxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\btnnhh.exec:\btnnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\vvjjp.exec:\vvjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\ddvvv.exec:\ddvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\3fllfll.exec:\3fllfll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\hhtntn.exec:\hhtntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\7tbbbb.exec:\7tbbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\xxfffff.exec:\xxfffff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\7hhbbn.exec:\7hhbbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\tbhbtb.exec:\tbhbtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\hbbttt.exec:\hbbttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\pjjvv.exec:\pjjvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\ddddd.exec:\ddddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\5fxrlll.exec:\5fxrlll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\tttntt.exec:\tttntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\lrlfxxf.exec:\lrlfxxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\ttthhh.exec:\ttthhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\nttnhh.exec:\nttnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\flxxrrr.exec:\flxxrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\nbnnhh.exec:\nbnnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\pvddv.exec:\pvddv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\llrfxxx.exec:\llrfxxx.exe23⤵
- Executes dropped EXE
PID:4524 -
\??\c:\ppddd.exec:\ppddd.exe24⤵
- Executes dropped EXE
PID:4908 -
\??\c:\hbhbbb.exec:\hbhbbb.exe25⤵
- Executes dropped EXE
PID:408 -
\??\c:\7ppdd.exec:\7ppdd.exe26⤵
- Executes dropped EXE
PID:4824 -
\??\c:\fxxrlll.exec:\fxxrlll.exe27⤵
- Executes dropped EXE
PID:4828 -
\??\c:\frrffxr.exec:\frrffxr.exe28⤵
- Executes dropped EXE
PID:4968 -
\??\c:\9ffrrrl.exec:\9ffrrrl.exe29⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hthbtt.exec:\hthbtt.exe30⤵
- Executes dropped EXE
PID:2596 -
\??\c:\5djjj.exec:\5djjj.exe31⤵
- Executes dropped EXE
PID:3296 -
\??\c:\9nhbtb.exec:\9nhbtb.exe32⤵
- Executes dropped EXE
PID:2380 -
\??\c:\tbnnnt.exec:\tbnnnt.exe33⤵
- Executes dropped EXE
PID:1264 -
\??\c:\vvvvp.exec:\vvvvp.exe34⤵
- Executes dropped EXE
PID:1888 -
\??\c:\rlllfll.exec:\rlllfll.exe35⤵
- Executes dropped EXE
PID:2016 -
\??\c:\lxlfxfr.exec:\lxlfxfr.exe36⤵
- Executes dropped EXE
PID:3904 -
\??\c:\pjvvp.exec:\pjvvp.exe37⤵
- Executes dropped EXE
PID:2188 -
\??\c:\xllffxr.exec:\xllffxr.exe38⤵
- Executes dropped EXE
PID:4332 -
\??\c:\tntttb.exec:\tntttb.exe39⤵
- Executes dropped EXE
PID:2676 -
\??\c:\pvjvj.exec:\pvjvj.exe40⤵
- Executes dropped EXE
PID:1664 -
\??\c:\3xfrflf.exec:\3xfrflf.exe41⤵
- Executes dropped EXE
PID:2428 -
\??\c:\jvvpd.exec:\jvvpd.exe42⤵
- Executes dropped EXE
PID:4764 -
\??\c:\xxlxrlf.exec:\xxlxrlf.exe43⤵
- Executes dropped EXE
PID:4060 -
\??\c:\btnbhb.exec:\btnbhb.exe44⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rfxfrrx.exec:\rfxfrrx.exe45⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nbnhhh.exec:\nbnhhh.exe46⤵
- Executes dropped EXE
PID:1428 -
\??\c:\7xrlfrr.exec:\7xrlfrr.exe47⤵
- Executes dropped EXE
PID:2420 -
\??\c:\dppdv.exec:\dppdv.exe48⤵
- Executes dropped EXE
PID:5036 -
\??\c:\frrlffx.exec:\frrlffx.exe49⤵
- Executes dropped EXE
PID:4012 -
\??\c:\nbhhtt.exec:\nbhhtt.exe50⤵
- Executes dropped EXE
PID:2548 -
\??\c:\dvjjp.exec:\dvjjp.exe51⤵
- Executes dropped EXE
PID:4876 -
\??\c:\3xffxfx.exec:\3xffxfx.exe52⤵
- Executes dropped EXE
PID:4724 -
\??\c:\xllxrrl.exec:\xllxrrl.exe53⤵
- Executes dropped EXE
PID:3952 -
\??\c:\hhnnnn.exec:\hhnnnn.exe54⤵
- Executes dropped EXE
PID:224 -
\??\c:\jdjdv.exec:\jdjdv.exe55⤵
- Executes dropped EXE
PID:4384 -
\??\c:\9lrlxrl.exec:\9lrlxrl.exe56⤵
- Executes dropped EXE
PID:4304 -
\??\c:\nbbtnn.exec:\nbbtnn.exe57⤵
- Executes dropped EXE
PID:1336 -
\??\c:\dvdvv.exec:\dvdvv.exe58⤵
- Executes dropped EXE
PID:4348 -
\??\c:\pjvdd.exec:\pjvdd.exe59⤵
- Executes dropped EXE
PID:3352 -
\??\c:\xrfxfll.exec:\xrfxfll.exe60⤵
- Executes dropped EXE
PID:3216 -
\??\c:\bttnhb.exec:\bttnhb.exe61⤵
- Executes dropped EXE
PID:3600 -
\??\c:\pvvpj.exec:\pvvpj.exe62⤵
- Executes dropped EXE
PID:4964 -
\??\c:\xlrlrrl.exec:\xlrlrrl.exe63⤵
- Executes dropped EXE
PID:4780 -
\??\c:\3flfrlx.exec:\3flfrlx.exe64⤵
- Executes dropped EXE
PID:796 -
\??\c:\bnttnn.exec:\bnttnn.exe65⤵
- Executes dropped EXE
PID:4864 -
\??\c:\7pddj.exec:\7pddj.exe66⤵PID:3484
-
\??\c:\9xrlrrl.exec:\9xrlrrl.exe67⤵PID:2824
-
\??\c:\thhbtt.exec:\thhbtt.exe68⤵PID:4040
-
\??\c:\hnthtt.exec:\hnthtt.exe69⤵PID:4376
-
\??\c:\3vvpv.exec:\3vvpv.exe70⤵PID:4840
-
\??\c:\lfffxrl.exec:\lfffxrl.exe71⤵PID:1360
-
\??\c:\3bttnn.exec:\3bttnn.exe72⤵PID:2404
-
\??\c:\5djjd.exec:\5djjd.exe73⤵PID:3492
-
\??\c:\jddpv.exec:\jddpv.exe74⤵PID:5112
-
\??\c:\fxllfff.exec:\fxllfff.exe75⤵PID:2200
-
\??\c:\ttbtnn.exec:\ttbtnn.exe76⤵PID:2496
-
\??\c:\jdjjv.exec:\jdjjv.exe77⤵PID:4668
-
\??\c:\lfllffx.exec:\lfllffx.exe78⤵PID:3592
-
\??\c:\nbnnbt.exec:\nbnnbt.exe79⤵PID:2700
-
\??\c:\vppjv.exec:\vppjv.exe80⤵PID:4788
-
\??\c:\9dvjv.exec:\9dvjv.exe81⤵PID:2508
-
\??\c:\lxrrfff.exec:\lxrrfff.exe82⤵PID:2008
-
\??\c:\tbtnhb.exec:\tbtnhb.exe83⤵PID:3292
-
\??\c:\1jddv.exec:\1jddv.exe84⤵PID:3212
-
\??\c:\fxllllr.exec:\fxllllr.exe85⤵PID:1388
-
\??\c:\rlrllff.exec:\rlrllff.exe86⤵PID:4700
-
\??\c:\btbbtt.exec:\btbbtt.exe87⤵PID:4532
-
\??\c:\ddpvj.exec:\ddpvj.exe88⤵PID:4624
-
\??\c:\rxrfllr.exec:\rxrfllr.exe89⤵PID:3228
-
\??\c:\5bhbbb.exec:\5bhbbb.exe90⤵PID:424
-
\??\c:\bbhnbn.exec:\bbhnbn.exe91⤵
- System Location Discovery: System Language Discovery
PID:4232 -
\??\c:\pdjvj.exec:\pdjvj.exe92⤵PID:4140
-
\??\c:\lflllfr.exec:\lflllfr.exe93⤵PID:2044
-
\??\c:\rllxrlf.exec:\rllxrlf.exe94⤵PID:2268
-
\??\c:\nbhbhh.exec:\nbhbhh.exe95⤵PID:1868
-
\??\c:\vpjdj.exec:\vpjdj.exe96⤵PID:1076
-
\??\c:\llrrxlf.exec:\llrrxlf.exe97⤵PID:1752
-
\??\c:\fxffxxx.exec:\fxffxxx.exe98⤵PID:4312
-
\??\c:\bbhbnh.exec:\bbhbnh.exe99⤵PID:4512
-
\??\c:\pjdvj.exec:\pjdvj.exe100⤵
- System Location Discovery: System Language Discovery
PID:4460 -
\??\c:\flrlxrl.exec:\flrlxrl.exe101⤵PID:2272
-
\??\c:\nhnnhh.exec:\nhnnhh.exe102⤵PID:2428
-
\??\c:\dvvpj.exec:\dvvpj.exe103⤵PID:2080
-
\??\c:\fflfxxr.exec:\fflfxxr.exe104⤵PID:3196
-
\??\c:\hbnhhh.exec:\hbnhhh.exe105⤵PID:3104
-
\??\c:\nhhbbb.exec:\nhhbbb.exe106⤵PID:1728
-
\??\c:\vjdpj.exec:\vjdpj.exe107⤵PID:1476
-
\??\c:\7rlfrlf.exec:\7rlfrlf.exe108⤵PID:3856
-
\??\c:\rlllxrf.exec:\rlllxrf.exe109⤵PID:2420
-
\??\c:\9nnnhb.exec:\9nnnhb.exe110⤵PID:4740
-
\??\c:\vpjvj.exec:\vpjvj.exe111⤵PID:4012
-
\??\c:\ffxlflx.exec:\ffxlflx.exe112⤵PID:428
-
\??\c:\rllfxxr.exec:\rllfxxr.exe113⤵PID:4876
-
\??\c:\ntbthh.exec:\ntbthh.exe114⤵PID:4724
-
\??\c:\vppjj.exec:\vppjj.exe115⤵PID:3952
-
\??\c:\frrfrrf.exec:\frrfrrf.exe116⤵PID:224
-
\??\c:\5lfxllf.exec:\5lfxllf.exe117⤵PID:232
-
\??\c:\hhnhbb.exec:\hhnhbb.exe118⤵PID:4152
-
\??\c:\7pjdp.exec:\7pjdp.exe119⤵PID:1336
-
\??\c:\rfrfxrl.exec:\rfrfxrl.exe120⤵PID:2856
-
\??\c:\xlxrlll.exec:\xlxrlll.exe121⤵PID:3116
-
\??\c:\hhhbbn.exec:\hhhbbn.exe122⤵PID:892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-