Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 01:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe
-
Size
456KB
-
MD5
7c5ae6140ef8bdf10df5bff29e5eaa3d
-
SHA1
5e67f88f4c47fd7f230a393a5ede8bbbdc0b5e6a
-
SHA256
84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683
-
SHA512
d9c85c3aa5bf2c03b0eda75ef9fb2cf1449304c6023b9e24c1e77b1afcc95c7786136ad92a1ece457c855da0accf1a5a093efc4bccfd52a7396f90154f75e27e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1:q7Tc2NYHUrAwfMp3CD1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/548-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3380-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3788-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2092-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1280-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-627-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-690-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-707-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-762-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-927-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-1347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1576 xllllrl.exe 3412 9btnhn.exe 2276 pjjdd.exe 4884 ntnttb.exe 5020 vddvp.exe 2136 1bbbtb.exe 3520 bbnnnn.exe 2796 hnnnhn.exe 3504 jdvdd.exe 3000 nttttt.exe 1416 ppjjd.exe 3108 1xrrrfl.exe 3852 vdvpp.exe 4468 rlrrrrr.exe 4892 7bbbhh.exe 3380 xrxxxxx.exe 1968 7vvvv.exe 4212 xrxrlll.exe 4240 lffllxr.exe 220 rrrrrrr.exe 2552 dvjvv.exe 2352 hbhbtt.exe 4160 jjddv.exe 1436 vpdvp.exe 4296 jpvvv.exe 2256 hbbnbt.exe 1124 7xlllrr.exe 4632 btbnhh.exe 3660 bbttnb.exe 4356 xflxrxx.exe 3788 tntnhh.exe 3740 1pjjd.exe 3756 jjddj.exe 2844 lxxllfx.exe 4060 3bbttb.exe 4616 djjjj.exe 3492 hhttnn.exe 2912 nttnnt.exe 1648 rxfrlll.exe 2620 nntttt.exe 2948 jjjjd.exe 748 5lllrrl.exe 4384 1fxxxfl.exe 3124 tbtnhh.exe 4888 1pjjj.exe 1036 xffffrl.exe 2092 bbhhhn.exe 2576 nbbthb.exe 4372 pdppj.exe 516 xffxxxx.exe 2616 hhhhht.exe 4848 nbnhhb.exe 4868 dpjdv.exe 4292 fxrrrxx.exe 2276 5btttt.exe 880 pppjj.exe 796 fflrrrr.exe 2544 1llrrrl.exe 4572 nhnnhn.exe 2056 pddpd.exe 3860 flrflfr.exe 1636 thnbbb.exe 2796 jjvdv.exe 4168 lllllxx.exe -
resource yara_rule behavioral2/memory/548-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3380-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3788-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2092-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1280-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-927-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 548 wrote to memory of 1576 548 84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe 83 PID 548 wrote to memory of 1576 548 84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe 83 PID 548 wrote to memory of 1576 548 84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe 83 PID 1576 wrote to memory of 3412 1576 xllllrl.exe 84 PID 1576 wrote to memory of 3412 1576 xllllrl.exe 84 PID 1576 wrote to memory of 3412 1576 xllllrl.exe 84 PID 3412 wrote to memory of 2276 3412 9btnhn.exe 85 PID 3412 wrote to memory of 2276 3412 9btnhn.exe 85 PID 3412 wrote to memory of 2276 3412 9btnhn.exe 85 PID 2276 wrote to memory of 4884 2276 pjjdd.exe 86 PID 2276 wrote to memory of 4884 2276 pjjdd.exe 86 PID 2276 wrote to memory of 4884 2276 pjjdd.exe 86 PID 4884 wrote to memory of 5020 4884 ntnttb.exe 87 PID 4884 wrote to memory of 5020 4884 ntnttb.exe 87 PID 4884 wrote to memory of 5020 4884 ntnttb.exe 87 PID 5020 wrote to memory of 2136 5020 vddvp.exe 88 PID 5020 wrote to memory of 2136 5020 vddvp.exe 88 PID 5020 wrote to memory of 2136 5020 vddvp.exe 88 PID 2136 wrote to memory of 3520 2136 1bbbtb.exe 89 PID 2136 wrote to memory of 3520 2136 1bbbtb.exe 89 PID 2136 wrote to memory of 3520 2136 1bbbtb.exe 89 PID 3520 wrote to memory of 2796 3520 bbnnnn.exe 90 PID 3520 wrote to memory of 2796 3520 bbnnnn.exe 90 PID 3520 wrote to memory of 2796 3520 bbnnnn.exe 90 PID 2796 wrote to memory of 3504 2796 hnnnhn.exe 91 PID 2796 wrote to memory of 3504 2796 hnnnhn.exe 91 PID 2796 wrote to memory of 3504 2796 hnnnhn.exe 91 PID 3504 wrote to memory of 3000 3504 jdvdd.exe 92 PID 3504 wrote to memory of 3000 3504 jdvdd.exe 92 PID 3504 wrote to memory of 3000 3504 jdvdd.exe 92 PID 3000 wrote to memory of 1416 3000 nttttt.exe 93 PID 3000 wrote to memory of 1416 3000 nttttt.exe 93 PID 3000 wrote to memory of 1416 3000 nttttt.exe 93 PID 1416 wrote to memory of 3108 1416 ppjjd.exe 94 PID 1416 wrote to memory of 3108 1416 ppjjd.exe 94 PID 1416 wrote to memory of 3108 1416 ppjjd.exe 94 PID 3108 wrote to memory of 3852 3108 1xrrrfl.exe 95 PID 3108 wrote to memory of 3852 3108 1xrrrfl.exe 95 PID 3108 wrote to memory of 3852 3108 1xrrrfl.exe 95 PID 3852 wrote to memory of 4468 3852 vdvpp.exe 96 PID 3852 wrote to memory of 4468 3852 vdvpp.exe 96 PID 3852 wrote to memory of 4468 3852 vdvpp.exe 96 PID 4468 wrote to memory of 4892 4468 rlrrrrr.exe 97 PID 4468 wrote to memory of 4892 4468 rlrrrrr.exe 97 PID 4468 wrote to memory of 4892 4468 rlrrrrr.exe 97 PID 4892 wrote to memory of 3380 4892 7bbbhh.exe 98 PID 4892 wrote to memory of 3380 4892 7bbbhh.exe 98 PID 4892 wrote to memory of 3380 4892 7bbbhh.exe 98 PID 3380 wrote to memory of 1968 3380 xrxxxxx.exe 99 PID 3380 wrote to memory of 1968 3380 xrxxxxx.exe 99 PID 3380 wrote to memory of 1968 3380 xrxxxxx.exe 99 PID 1968 wrote to memory of 4212 1968 7vvvv.exe 100 PID 1968 wrote to memory of 4212 1968 7vvvv.exe 100 PID 1968 wrote to memory of 4212 1968 7vvvv.exe 100 PID 4212 wrote to memory of 4240 4212 xrxrlll.exe 101 PID 4212 wrote to memory of 4240 4212 xrxrlll.exe 101 PID 4212 wrote to memory of 4240 4212 xrxrlll.exe 101 PID 4240 wrote to memory of 220 4240 lffllxr.exe 102 PID 4240 wrote to memory of 220 4240 lffllxr.exe 102 PID 4240 wrote to memory of 220 4240 lffllxr.exe 102 PID 220 wrote to memory of 2552 220 rrrrrrr.exe 103 PID 220 wrote to memory of 2552 220 rrrrrrr.exe 103 PID 220 wrote to memory of 2552 220 rrrrrrr.exe 103 PID 2552 wrote to memory of 2352 2552 dvjvv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe"C:\Users\Admin\AppData\Local\Temp\84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\xllllrl.exec:\xllllrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\9btnhn.exec:\9btnhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\pjjdd.exec:\pjjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\ntnttb.exec:\ntnttb.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\vddvp.exec:\vddvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\1bbbtb.exec:\1bbbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\bbnnnn.exec:\bbnnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\hnnnhn.exec:\hnnnhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\jdvdd.exec:\jdvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\nttttt.exec:\nttttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\ppjjd.exec:\ppjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\1xrrrfl.exec:\1xrrrfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\vdvpp.exec:\vdvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\7bbbhh.exec:\7bbbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\7vvvv.exec:\7vvvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\xrxrlll.exec:\xrxrlll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\lffllxr.exec:\lffllxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\rrrrrrr.exec:\rrrrrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\dvjvv.exec:\dvjvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\hbhbtt.exec:\hbhbtt.exe23⤵
- Executes dropped EXE
PID:2352 -
\??\c:\jjddv.exec:\jjddv.exe24⤵
- Executes dropped EXE
PID:4160 -
\??\c:\vpdvp.exec:\vpdvp.exe25⤵
- Executes dropped EXE
PID:1436 -
\??\c:\jpvvv.exec:\jpvvv.exe26⤵
- Executes dropped EXE
PID:4296 -
\??\c:\hbbnbt.exec:\hbbnbt.exe27⤵
- Executes dropped EXE
PID:2256 -
\??\c:\7xlllrr.exec:\7xlllrr.exe28⤵
- Executes dropped EXE
PID:1124 -
\??\c:\btbnhh.exec:\btbnhh.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4632 -
\??\c:\bbttnb.exec:\bbttnb.exe30⤵
- Executes dropped EXE
PID:3660 -
\??\c:\xflxrxx.exec:\xflxrxx.exe31⤵
- Executes dropped EXE
PID:4356 -
\??\c:\tntnhh.exec:\tntnhh.exe32⤵
- Executes dropped EXE
PID:3788 -
\??\c:\1pjjd.exec:\1pjjd.exe33⤵
- Executes dropped EXE
PID:3740 -
\??\c:\jjddj.exec:\jjddj.exe34⤵
- Executes dropped EXE
PID:3756 -
\??\c:\lxxllfx.exec:\lxxllfx.exe35⤵
- Executes dropped EXE
PID:2844 -
\??\c:\3bbttb.exec:\3bbttb.exe36⤵
- Executes dropped EXE
PID:4060 -
\??\c:\djjjj.exec:\djjjj.exe37⤵
- Executes dropped EXE
PID:4616 -
\??\c:\hhttnn.exec:\hhttnn.exe38⤵
- Executes dropped EXE
PID:3492 -
\??\c:\nttnnt.exec:\nttnnt.exe39⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rxfrlll.exec:\rxfrlll.exe40⤵
- Executes dropped EXE
PID:1648 -
\??\c:\nntttt.exec:\nntttt.exe41⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jjjjd.exec:\jjjjd.exe42⤵
- Executes dropped EXE
PID:2948 -
\??\c:\5lllrrl.exec:\5lllrrl.exe43⤵
- Executes dropped EXE
PID:748 -
\??\c:\1fxxxfl.exec:\1fxxxfl.exe44⤵
- Executes dropped EXE
PID:4384 -
\??\c:\tbtnhh.exec:\tbtnhh.exe45⤵
- Executes dropped EXE
PID:3124 -
\??\c:\1pjjj.exec:\1pjjj.exe46⤵
- Executes dropped EXE
PID:4888 -
\??\c:\xffffrl.exec:\xffffrl.exe47⤵
- Executes dropped EXE
PID:1036 -
\??\c:\bbhhhn.exec:\bbhhhn.exe48⤵
- Executes dropped EXE
PID:2092 -
\??\c:\nbbthb.exec:\nbbthb.exe49⤵
- Executes dropped EXE
PID:2576 -
\??\c:\pdppj.exec:\pdppj.exe50⤵
- Executes dropped EXE
PID:4372 -
\??\c:\xffxxxx.exec:\xffxxxx.exe51⤵
- Executes dropped EXE
PID:516 -
\??\c:\hhhhht.exec:\hhhhht.exe52⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nbnhhb.exec:\nbnhhb.exe53⤵
- Executes dropped EXE
PID:4848 -
\??\c:\dpjdv.exec:\dpjdv.exe54⤵
- Executes dropped EXE
PID:4868 -
\??\c:\fxrrrxx.exec:\fxrrrxx.exe55⤵
- Executes dropped EXE
PID:4292 -
\??\c:\5btttt.exec:\5btttt.exe56⤵
- Executes dropped EXE
PID:2276 -
\??\c:\pppjj.exec:\pppjj.exe57⤵
- Executes dropped EXE
PID:880 -
\??\c:\fflrrrr.exec:\fflrrrr.exe58⤵
- Executes dropped EXE
PID:796 -
\??\c:\1llrrrl.exec:\1llrrrl.exe59⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nhnnhn.exec:\nhnnhn.exe60⤵
- Executes dropped EXE
PID:4572 -
\??\c:\pddpd.exec:\pddpd.exe61⤵
- Executes dropped EXE
PID:2056 -
\??\c:\flrflfr.exec:\flrflfr.exe62⤵
- Executes dropped EXE
PID:3860 -
\??\c:\thnbbb.exec:\thnbbb.exe63⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jjvdv.exec:\jjvdv.exe64⤵
- Executes dropped EXE
PID:2796 -
\??\c:\lllllxx.exec:\lllllxx.exe65⤵
- Executes dropped EXE
PID:4168 -
\??\c:\llxxrrr.exec:\llxxrrr.exe66⤵PID:5088
-
\??\c:\bbnntb.exec:\bbnntb.exe67⤵PID:3000
-
\??\c:\dvdjj.exec:\dvdjj.exe68⤵PID:544
-
\??\c:\3llffrr.exec:\3llffrr.exe69⤵PID:3132
-
\??\c:\ffflrrr.exec:\ffflrrr.exe70⤵PID:5076
-
\??\c:\nbhhhh.exec:\nbhhhh.exe71⤵PID:5000
-
\??\c:\3ddvv.exec:\3ddvv.exe72⤵PID:1260
-
\??\c:\fllllll.exec:\fllllll.exe73⤵PID:1388
-
\??\c:\3bthhn.exec:\3bthhn.exe74⤵PID:3380
-
\??\c:\jpjjj.exec:\jpjjj.exe75⤵PID:4484
-
\??\c:\7rffxlf.exec:\7rffxlf.exe76⤵PID:2464
-
\??\c:\tnttnt.exec:\tnttnt.exe77⤵PID:1588
-
\??\c:\3ddvp.exec:\3ddvp.exe78⤵PID:1280
-
\??\c:\1xlfrxr.exec:\1xlfrxr.exe79⤵PID:848
-
\??\c:\hhnnht.exec:\hhnnht.exe80⤵PID:4252
-
\??\c:\jjjdv.exec:\jjjdv.exe81⤵PID:3344
-
\??\c:\vpdvv.exec:\vpdvv.exe82⤵PID:2312
-
\??\c:\xllllll.exec:\xllllll.exe83⤵PID:3912
-
\??\c:\3hbtnn.exec:\3hbtnn.exe84⤵PID:2428
-
\??\c:\jjpjv.exec:\jjpjv.exe85⤵PID:4516
-
\??\c:\djjjv.exec:\djjjv.exe86⤵PID:384
-
\??\c:\xrrlrrf.exec:\xrrlrrf.exe87⤵PID:4296
-
\??\c:\bhnhnh.exec:\bhnhnh.exe88⤵PID:2256
-
\??\c:\1pjdv.exec:\1pjdv.exe89⤵PID:336
-
\??\c:\rrffxff.exec:\rrffxff.exe90⤵PID:3088
-
\??\c:\9htttt.exec:\9htttt.exe91⤵PID:752
-
\??\c:\1dppd.exec:\1dppd.exe92⤵PID:1032
-
\??\c:\dvvvv.exec:\dvvvv.exe93⤵PID:3384
-
\??\c:\ttthnh.exec:\ttthnh.exe94⤵PID:1608
-
\??\c:\9nbhtn.exec:\9nbhtn.exe95⤵PID:3788
-
\??\c:\vjjjj.exec:\vjjjj.exe96⤵PID:3432
-
\??\c:\llflllf.exec:\llflllf.exe97⤵PID:3732
-
\??\c:\hhttth.exec:\hhttth.exe98⤵PID:1352
-
\??\c:\1jjjd.exec:\1jjjd.exe99⤵PID:3512
-
\??\c:\1vpjd.exec:\1vpjd.exe100⤵
- System Location Discovery: System Language Discovery
PID:4480 -
\??\c:\xxfxrrr.exec:\xxfxrrr.exe101⤵PID:2888
-
\??\c:\thbttb.exec:\thbttb.exe102⤵PID:3476
-
\??\c:\9ddvp.exec:\9ddvp.exe103⤵PID:100
-
\??\c:\fxffxxr.exec:\fxffxxr.exe104⤵PID:1648
-
\??\c:\bhhhhh.exec:\bhhhhh.exe105⤵PID:1632
-
\??\c:\nbbnnh.exec:\nbbnnh.exe106⤵PID:3628
-
\??\c:\jpppd.exec:\jpppd.exe107⤵PID:1000
-
\??\c:\5lffrxr.exec:\5lffrxr.exe108⤵PID:4384
-
\??\c:\bbthtn.exec:\bbthtn.exe109⤵PID:3048
-
\??\c:\pvvvv.exec:\pvvvv.exe110⤵PID:3076
-
\??\c:\dvvvp.exec:\dvvvp.exe111⤵PID:3040
-
\??\c:\9rllffx.exec:\9rllffx.exe112⤵PID:3560
-
\??\c:\9hhbnn.exec:\9hhbnn.exe113⤵PID:4340
-
\??\c:\ddjjj.exec:\ddjjj.exe114⤵PID:4288
-
\??\c:\pjpjj.exec:\pjpjj.exe115⤵PID:4476
-
\??\c:\1rxrllf.exec:\1rxrllf.exe116⤵PID:4092
-
\??\c:\nhhbbb.exec:\nhhbbb.exe117⤵PID:3412
-
\??\c:\vjvvp.exec:\vjvvp.exe118⤵PID:4852
-
\??\c:\dddvp.exec:\dddvp.exe119⤵PID:392
-
\??\c:\fxfrrxl.exec:\fxfrrxl.exe120⤵PID:4884
-
\??\c:\thntbh.exec:\thntbh.exe121⤵PID:4964
-
\??\c:\jjjdv.exec:\jjjdv.exe122⤵PID:448
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-