Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 01:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe
-
Size
454KB
-
MD5
a21c7201e63648a542e5110edd865490
-
SHA1
dc859810c352237af5497761e93697a3b8045850
-
SHA256
900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2
-
SHA512
966d33234346a04d2169cff3db3bd47c9d16ee8040a1de1ff825da1111fed707a84a45201a59dda4050925164d4a23b4b0a20d77dec06b32321fb12427aebb4c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbec:q7Tc2NYHUrAwfMp3CDc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1756-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1384-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3160-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/616-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/428-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/660-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1384-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2012-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/708-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2804-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-737-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-852-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-1199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1384 fllffff.exe 1756 ntnnhh.exe 1180 pvdpd.exe 2476 rllflll.exe 2444 1rrrllr.exe 3176 ttnhbt.exe 2064 pvjdv.exe 4032 ddpjv.exe 4492 xxxlfxr.exe 2908 hhhbnh.exe 660 bthbtt.exe 2744 vjjdp.exe 3444 rlfxffx.exe 2660 fflfxrl.exe 380 nbbtnh.exe 2604 1djdp.exe 4104 dvpjv.exe 4928 xxrlxxr.exe 1648 xxfxfff.exe 1596 nthbtn.exe 2616 jjpdp.exe 4868 dppjd.exe 4796 xrxrrrx.exe 2860 7hhbtn.exe 4160 hhbnht.exe 3988 jjvpj.exe 2084 ffrfxrf.exe 3720 ffxlfxl.exe 2360 bnhbhn.exe 3064 vvjvd.exe 4432 3ddvp.exe 4736 lrrlffx.exe 4596 tnntnb.exe 1948 nntnnh.exe 1628 vvvpj.exe 428 llrrrrx.exe 4528 xxfxxxx.exe 4184 thhbtn.exe 2548 ppjvp.exe 1396 lfxrfrf.exe 3260 1htnht.exe 1424 htnbtn.exe 4756 pjvvj.exe 4332 xfflflf.exe 3772 xxlxfff.exe 208 bbtnhh.exe 4372 ddpdv.exe 616 3fxrfxr.exe 1440 xrxxlll.exe 4448 tthbtn.exe 2236 9djdv.exe 3160 xrxrxxf.exe 1384 1bttbh.exe 220 vvvpd.exe 4816 5pjvp.exe 2476 xxlfxxl.exe 2444 nnbnbt.exe 2296 vpvpd.exe 2064 1jvjv.exe 4032 1lxrlll.exe 4088 ttnbnh.exe 3836 3jpdp.exe 632 dvpjd.exe 1360 frlxlfr.exe -
resource yara_rule behavioral2/memory/1384-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1384-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3160-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/616-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/428-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/660-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1384-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2012-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/708-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2804-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-737-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1792 wrote to memory of 1384 1792 900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe 84 PID 1792 wrote to memory of 1384 1792 900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe 84 PID 1792 wrote to memory of 1384 1792 900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe 84 PID 1384 wrote to memory of 1756 1384 fllffff.exe 85 PID 1384 wrote to memory of 1756 1384 fllffff.exe 85 PID 1384 wrote to memory of 1756 1384 fllffff.exe 85 PID 1756 wrote to memory of 1180 1756 ntnnhh.exe 86 PID 1756 wrote to memory of 1180 1756 ntnnhh.exe 86 PID 1756 wrote to memory of 1180 1756 ntnnhh.exe 86 PID 1180 wrote to memory of 2476 1180 pvdpd.exe 87 PID 1180 wrote to memory of 2476 1180 pvdpd.exe 87 PID 1180 wrote to memory of 2476 1180 pvdpd.exe 87 PID 2476 wrote to memory of 2444 2476 rllflll.exe 140 PID 2476 wrote to memory of 2444 2476 rllflll.exe 140 PID 2476 wrote to memory of 2444 2476 rllflll.exe 140 PID 2444 wrote to memory of 3176 2444 1rrrllr.exe 89 PID 2444 wrote to memory of 3176 2444 1rrrllr.exe 89 PID 2444 wrote to memory of 3176 2444 1rrrllr.exe 89 PID 3176 wrote to memory of 2064 3176 ttnhbt.exe 142 PID 3176 wrote to memory of 2064 3176 ttnhbt.exe 142 PID 3176 wrote to memory of 2064 3176 ttnhbt.exe 142 PID 2064 wrote to memory of 4032 2064 pvjdv.exe 91 PID 2064 wrote to memory of 4032 2064 pvjdv.exe 91 PID 2064 wrote to memory of 4032 2064 pvjdv.exe 91 PID 4032 wrote to memory of 4492 4032 ddpjv.exe 92 PID 4032 wrote to memory of 4492 4032 ddpjv.exe 92 PID 4032 wrote to memory of 4492 4032 ddpjv.exe 92 PID 4492 wrote to memory of 2908 4492 xxxlfxr.exe 93 PID 4492 wrote to memory of 2908 4492 xxxlfxr.exe 93 PID 4492 wrote to memory of 2908 4492 xxxlfxr.exe 93 PID 2908 wrote to memory of 660 2908 hhhbnh.exe 94 PID 2908 wrote to memory of 660 2908 hhhbnh.exe 94 PID 2908 wrote to memory of 660 2908 hhhbnh.exe 94 PID 660 wrote to memory of 2744 660 bthbtt.exe 95 PID 660 wrote to memory of 2744 660 bthbtt.exe 95 PID 660 wrote to memory of 2744 660 bthbtt.exe 95 PID 2744 wrote to memory of 3444 2744 vjjdp.exe 96 PID 2744 wrote to memory of 3444 2744 vjjdp.exe 96 PID 2744 wrote to memory of 3444 2744 vjjdp.exe 96 PID 3444 wrote to memory of 2660 3444 rlfxffx.exe 97 PID 3444 wrote to memory of 2660 3444 rlfxffx.exe 97 PID 3444 wrote to memory of 2660 3444 rlfxffx.exe 97 PID 2660 wrote to memory of 380 2660 fflfxrl.exe 98 PID 2660 wrote to memory of 380 2660 fflfxrl.exe 98 PID 2660 wrote to memory of 380 2660 fflfxrl.exe 98 PID 380 wrote to memory of 2604 380 nbbtnh.exe 99 PID 380 wrote to memory of 2604 380 nbbtnh.exe 99 PID 380 wrote to memory of 2604 380 nbbtnh.exe 99 PID 2604 wrote to memory of 4104 2604 1djdp.exe 100 PID 2604 wrote to memory of 4104 2604 1djdp.exe 100 PID 2604 wrote to memory of 4104 2604 1djdp.exe 100 PID 4104 wrote to memory of 4928 4104 dvpjv.exe 101 PID 4104 wrote to memory of 4928 4104 dvpjv.exe 101 PID 4104 wrote to memory of 4928 4104 dvpjv.exe 101 PID 4928 wrote to memory of 1648 4928 xxrlxxr.exe 102 PID 4928 wrote to memory of 1648 4928 xxrlxxr.exe 102 PID 4928 wrote to memory of 1648 4928 xxrlxxr.exe 102 PID 1648 wrote to memory of 1596 1648 xxfxfff.exe 103 PID 1648 wrote to memory of 1596 1648 xxfxfff.exe 103 PID 1648 wrote to memory of 1596 1648 xxfxfff.exe 103 PID 1596 wrote to memory of 2616 1596 nthbtn.exe 104 PID 1596 wrote to memory of 2616 1596 nthbtn.exe 104 PID 1596 wrote to memory of 2616 1596 nthbtn.exe 104 PID 2616 wrote to memory of 4868 2616 jjpdp.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe"C:\Users\Admin\AppData\Local\Temp\900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\fllffff.exec:\fllffff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\ntnnhh.exec:\ntnnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\pvdpd.exec:\pvdpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\rllflll.exec:\rllflll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\1rrrllr.exec:\1rrrllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\ttnhbt.exec:\ttnhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\pvjdv.exec:\pvjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\ddpjv.exec:\ddpjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\xxxlfxr.exec:\xxxlfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\hhhbnh.exec:\hhhbnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\bthbtt.exec:\bthbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\vjjdp.exec:\vjjdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\rlfxffx.exec:\rlfxffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\fflfxrl.exec:\fflfxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\nbbtnh.exec:\nbbtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\1djdp.exec:\1djdp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\dvpjv.exec:\dvpjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\xxrlxxr.exec:\xxrlxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\xxfxfff.exec:\xxfxfff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\nthbtn.exec:\nthbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\jjpdp.exec:\jjpdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\dppjd.exec:\dppjd.exe23⤵
- Executes dropped EXE
PID:4868 -
\??\c:\xrxrrrx.exec:\xrxrrrx.exe24⤵
- Executes dropped EXE
PID:4796 -
\??\c:\7hhbtn.exec:\7hhbtn.exe25⤵
- Executes dropped EXE
PID:2860 -
\??\c:\hhbnht.exec:\hhbnht.exe26⤵
- Executes dropped EXE
PID:4160 -
\??\c:\jjvpj.exec:\jjvpj.exe27⤵
- Executes dropped EXE
PID:3988 -
\??\c:\ffrfxrf.exec:\ffrfxrf.exe28⤵
- Executes dropped EXE
PID:2084 -
\??\c:\ffxlfxl.exec:\ffxlfxl.exe29⤵
- Executes dropped EXE
PID:3720 -
\??\c:\bnhbhn.exec:\bnhbhn.exe30⤵
- Executes dropped EXE
PID:2360 -
\??\c:\vvjvd.exec:\vvjvd.exe31⤵
- Executes dropped EXE
PID:3064 -
\??\c:\3ddvp.exec:\3ddvp.exe32⤵
- Executes dropped EXE
PID:4432 -
\??\c:\lrrlffx.exec:\lrrlffx.exe33⤵
- Executes dropped EXE
PID:4736 -
\??\c:\tnntnb.exec:\tnntnb.exe34⤵
- Executes dropped EXE
PID:4596 -
\??\c:\nntnnh.exec:\nntnnh.exe35⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vvvpj.exec:\vvvpj.exe36⤵
- Executes dropped EXE
PID:1628 -
\??\c:\llrrrrx.exec:\llrrrrx.exe37⤵
- Executes dropped EXE
PID:428 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe38⤵
- Executes dropped EXE
PID:4528 -
\??\c:\thhbtn.exec:\thhbtn.exe39⤵
- Executes dropped EXE
PID:4184 -
\??\c:\ppjvp.exec:\ppjvp.exe40⤵
- Executes dropped EXE
PID:2548 -
\??\c:\lfxrfrf.exec:\lfxrfrf.exe41⤵
- Executes dropped EXE
PID:1396 -
\??\c:\1htnht.exec:\1htnht.exe42⤵
- Executes dropped EXE
PID:3260 -
\??\c:\htnbtn.exec:\htnbtn.exe43⤵
- Executes dropped EXE
PID:1424 -
\??\c:\pjvvj.exec:\pjvvj.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4756 -
\??\c:\xfflflf.exec:\xfflflf.exe45⤵
- Executes dropped EXE
PID:4332 -
\??\c:\xxlxfff.exec:\xxlxfff.exe46⤵
- Executes dropped EXE
PID:3772 -
\??\c:\bbtnhh.exec:\bbtnhh.exe47⤵
- Executes dropped EXE
PID:208 -
\??\c:\ddpdv.exec:\ddpdv.exe48⤵
- Executes dropped EXE
PID:4372 -
\??\c:\3fxrfxr.exec:\3fxrfxr.exe49⤵
- Executes dropped EXE
PID:616 -
\??\c:\xrxxlll.exec:\xrxxlll.exe50⤵
- Executes dropped EXE
PID:1440 -
\??\c:\tthbtn.exec:\tthbtn.exe51⤵
- Executes dropped EXE
PID:4448 -
\??\c:\9djdv.exec:\9djdv.exe52⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xrxrxxf.exec:\xrxrxxf.exe53⤵
- Executes dropped EXE
PID:3160 -
\??\c:\1bttbh.exec:\1bttbh.exe54⤵
- Executes dropped EXE
PID:1384 -
\??\c:\vvvpd.exec:\vvvpd.exe55⤵
- Executes dropped EXE
PID:220 -
\??\c:\5pjvp.exec:\5pjvp.exe56⤵
- Executes dropped EXE
PID:4816 -
\??\c:\xxlfxxl.exec:\xxlfxxl.exe57⤵
- Executes dropped EXE
PID:2476 -
\??\c:\nnbnbt.exec:\nnbnbt.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2444 -
\??\c:\vpvpd.exec:\vpvpd.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2296 -
\??\c:\1jvjv.exec:\1jvjv.exe60⤵
- Executes dropped EXE
PID:2064 -
\??\c:\1lxrlll.exec:\1lxrlll.exe61⤵
- Executes dropped EXE
PID:4032 -
\??\c:\ttnbnh.exec:\ttnbnh.exe62⤵
- Executes dropped EXE
PID:4088 -
\??\c:\3jpdp.exec:\3jpdp.exe63⤵
- Executes dropped EXE
PID:3836 -
\??\c:\dvpjd.exec:\dvpjd.exe64⤵
- Executes dropped EXE
PID:632 -
\??\c:\frlxlfr.exec:\frlxlfr.exe65⤵
- Executes dropped EXE
PID:1360 -
\??\c:\tnnhbt.exec:\tnnhbt.exe66⤵PID:4132
-
\??\c:\jpjjd.exec:\jpjjd.exe67⤵PID:3224
-
\??\c:\jjdpj.exec:\jjdpj.exe68⤵PID:4360
-
\??\c:\fxrlffx.exec:\fxrlffx.exe69⤵PID:4304
-
\??\c:\ththnn.exec:\ththnn.exe70⤵PID:1256
-
\??\c:\vppdp.exec:\vppdp.exe71⤵PID:2260
-
\??\c:\vjvjd.exec:\vjvjd.exe72⤵PID:5076
-
\??\c:\9lxlllf.exec:\9lxlllf.exe73⤵PID:1784
-
\??\c:\tttnnb.exec:\tttnnb.exe74⤵PID:2208
-
\??\c:\3jdvp.exec:\3jdvp.exe75⤵PID:5012
-
\??\c:\llfxrlx.exec:\llfxrlx.exe76⤵PID:3652
-
\??\c:\nnnhtt.exec:\nnnhtt.exe77⤵PID:2788
-
\??\c:\9ppvd.exec:\9ppvd.exe78⤵PID:2708
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe79⤵PID:2360
-
\??\c:\bnttnh.exec:\bnttnh.exe80⤵PID:3648
-
\??\c:\jdjdj.exec:\jdjdj.exe81⤵PID:4432
-
\??\c:\3ffxrlx.exec:\3ffxrlx.exe82⤵PID:2148
-
\??\c:\fffflll.exec:\fffflll.exe83⤵PID:4520
-
\??\c:\tbttnn.exec:\tbttnn.exe84⤵PID:4652
-
\??\c:\vvdvd.exec:\vvdvd.exe85⤵PID:3964
-
\??\c:\flfrfxx.exec:\flfrfxx.exe86⤵PID:4760
-
\??\c:\thnhtt.exec:\thnhtt.exe87⤵
- System Location Discovery: System Language Discovery
PID:1508 -
\??\c:\djjvj.exec:\djjvj.exe88⤵PID:5068
-
\??\c:\rlfxxrl.exec:\rlfxxrl.exe89⤵PID:5100
-
\??\c:\nnhhbn.exec:\nnhhbn.exe90⤵PID:4560
-
\??\c:\hhhnhh.exec:\hhhnhh.exe91⤵PID:1032
-
\??\c:\pvpjd.exec:\pvpjd.exe92⤵PID:904
-
\??\c:\thhhhh.exec:\thhhhh.exe93⤵PID:1940
-
\??\c:\ppdpj.exec:\ppdpj.exe94⤵PID:4332
-
\??\c:\lxfxfff.exec:\lxfxfff.exe95⤵PID:4252
-
\??\c:\flrxrxr.exec:\flrxrxr.exe96⤵PID:1516
-
\??\c:\thbtnn.exec:\thbtnn.exe97⤵PID:3932
-
\??\c:\vjdvp.exec:\vjdvp.exe98⤵PID:4484
-
\??\c:\rlxrfxr.exec:\rlxrfxr.exe99⤵PID:1576
-
\??\c:\9bhbtb.exec:\9bhbtb.exe100⤵PID:4648
-
\??\c:\vvjdj.exec:\vvjdj.exe101⤵PID:2012
-
\??\c:\dvpjd.exec:\dvpjd.exe102⤵PID:4892
-
\??\c:\llrfxrf.exec:\llrfxrf.exe103⤵PID:2388
-
\??\c:\5nnbtn.exec:\5nnbtn.exe104⤵PID:1200
-
\??\c:\ddpjd.exec:\ddpjd.exe105⤵PID:3900
-
\??\c:\3xrlffx.exec:\3xrlffx.exe106⤵PID:3832
-
\??\c:\nhtbnn.exec:\nhtbnn.exe107⤵PID:1788
-
\??\c:\vjjdv.exec:\vjjdv.exe108⤵PID:2444
-
\??\c:\5xrfxrl.exec:\5xrfxrl.exe109⤵
- System Location Discovery: System Language Discovery
PID:4248 -
\??\c:\xllfrlf.exec:\xllfrlf.exe110⤵PID:3452
-
\??\c:\hhnnhb.exec:\hhnnhb.exe111⤵PID:3584
-
\??\c:\ddddv.exec:\ddddv.exe112⤵PID:3024
-
\??\c:\1xrffxl.exec:\1xrffxl.exe113⤵PID:212
-
\??\c:\tnbtnb.exec:\tnbtnb.exe114⤵PID:3836
-
\??\c:\ddvvp.exec:\ddvvp.exe115⤵PID:708
-
\??\c:\xfxxlrl.exec:\xfxxlrl.exe116⤵PID:4720
-
\??\c:\jdvpj.exec:\jdvpj.exe117⤵PID:2804
-
\??\c:\rllffxl.exec:\rllffxl.exe118⤵PID:4132
-
\??\c:\llrlxlx.exec:\llrlxlx.exe119⤵PID:3464
-
\??\c:\bthhbt.exec:\bthhbt.exe120⤵PID:4548
-
\??\c:\vjpdp.exec:\vjpdp.exe121⤵PID:4008
-
\??\c:\frrfxrl.exec:\frrfxrl.exe122⤵PID:1996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-