Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 02:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a8d10410fa44038a3b506ffd0640a3657df7c216225f9fd5b88cf9e59938a2ab.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
a8d10410fa44038a3b506ffd0640a3657df7c216225f9fd5b88cf9e59938a2ab.exe
-
Size
453KB
-
MD5
e716c5deb71f84b64bccc9f74f26ab32
-
SHA1
b4153d8e4a5b7dd24a549dc55d4a9a1ca951d875
-
SHA256
a8d10410fa44038a3b506ffd0640a3657df7c216225f9fd5b88cf9e59938a2ab
-
SHA512
1318774c6a5179e3f49f8525fd4384cb0bc733af63d5501170569d0581ff32593ce7cb2c2d3dd4e6f7817a52f0c2a60dce65cae4913a2365fa8f836303a60d71
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeL:q7Tc2NYHUrAwfMp3CDL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4560-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4284-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3336-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/516-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1512-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2784-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4208-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/888-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-800-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-901-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-1262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4276 5tnhbt.exe 1460 vvjdv.exe 3968 5flfxfx.exe 4964 thnhbh.exe 4544 hbtnth.exe 4500 rfxfxxr.exe 400 pvvpp.exe 1216 xlrfxrl.exe 4360 9lfrrlf.exe 2692 bnthbn.exe 3452 9lfxrrl.exe 2712 dvvpj.exe 2304 nhbnht.exe 2628 btnnhh.exe 3052 llxfllr.exe 2688 jdpjj.exe 4512 7rxrllf.exe 2400 thbbbt.exe 5104 pvjdv.exe 3168 hbhhbt.exe 1880 lflrflf.exe 4004 hbhhnn.exe 2616 5jvvp.exe 2732 rxrlfff.exe 3640 hbnhnt.exe 4284 pjdvp.exe 4576 rlrffrr.exe 2808 xlrrrrl.exe 1960 ppjdj.exe 4108 dddvp.exe 2108 rlrlflr.exe 1228 tnnbtn.exe 3152 dvdvv.exe 2128 hbnnbt.exe 4316 pddvp.exe 2860 lxxlxrf.exe 4216 flfxxxl.exe 3132 tnnhtt.exe 1628 pdppj.exe 3336 1thnhn.exe 2040 hhhbbb.exe 2852 vpddd.exe 3596 rrfxxxr.exe 3924 frffxfx.exe 2156 9nnhbn.exe 516 vdpvv.exe 4920 xlrlfxr.exe 1512 xrxrrrl.exe 4536 ntnnnh.exe 5004 dvppj.exe 4276 xrrxrfx.exe 2420 tbbbtt.exe 3728 9pppv.exe 3980 lflfrrl.exe 3968 5rlfffx.exe 3468 htbtnh.exe 4184 ddjdv.exe 916 rflfxrl.exe 4732 7ffxrrx.exe 1332 hbttnn.exe 2784 jppjd.exe 4300 djvpj.exe 3528 rxfxrlf.exe 4360 nhhnhb.exe -
resource yara_rule behavioral2/memory/4560-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4284-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3336-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1512-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2784-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4208-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/888-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-800-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-882-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-901-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpvv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4560 wrote to memory of 4276 4560 a8d10410fa44038a3b506ffd0640a3657df7c216225f9fd5b88cf9e59938a2ab.exe 82 PID 4560 wrote to memory of 4276 4560 a8d10410fa44038a3b506ffd0640a3657df7c216225f9fd5b88cf9e59938a2ab.exe 82 PID 4560 wrote to memory of 4276 4560 a8d10410fa44038a3b506ffd0640a3657df7c216225f9fd5b88cf9e59938a2ab.exe 82 PID 4276 wrote to memory of 1460 4276 5tnhbt.exe 83 PID 4276 wrote to memory of 1460 4276 5tnhbt.exe 83 PID 4276 wrote to memory of 1460 4276 5tnhbt.exe 83 PID 1460 wrote to memory of 3968 1460 vvjdv.exe 84 PID 1460 wrote to memory of 3968 1460 vvjdv.exe 84 PID 1460 wrote to memory of 3968 1460 vvjdv.exe 84 PID 3968 wrote to memory of 4964 3968 5flfxfx.exe 85 PID 3968 wrote to memory of 4964 3968 5flfxfx.exe 85 PID 3968 wrote to memory of 4964 3968 5flfxfx.exe 85 PID 4964 wrote to memory of 4544 4964 thnhbh.exe 86 PID 4964 wrote to memory of 4544 4964 thnhbh.exe 86 PID 4964 wrote to memory of 4544 4964 thnhbh.exe 86 PID 4544 wrote to memory of 4500 4544 hbtnth.exe 87 PID 4544 wrote to memory of 4500 4544 hbtnth.exe 87 PID 4544 wrote to memory of 4500 4544 hbtnth.exe 87 PID 4500 wrote to memory of 400 4500 rfxfxxr.exe 88 PID 4500 wrote to memory of 400 4500 rfxfxxr.exe 88 PID 4500 wrote to memory of 400 4500 rfxfxxr.exe 88 PID 400 wrote to memory of 1216 400 pvvpp.exe 89 PID 400 wrote to memory of 1216 400 pvvpp.exe 89 PID 400 wrote to memory of 1216 400 pvvpp.exe 89 PID 1216 wrote to memory of 4360 1216 xlrfxrl.exe 90 PID 1216 wrote to memory of 4360 1216 xlrfxrl.exe 90 PID 1216 wrote to memory of 4360 1216 xlrfxrl.exe 90 PID 4360 wrote to memory of 2692 4360 9lfrrlf.exe 91 PID 4360 wrote to memory of 2692 4360 9lfrrlf.exe 91 PID 4360 wrote to memory of 2692 4360 9lfrrlf.exe 91 PID 2692 wrote to memory of 3452 2692 bnthbn.exe 92 PID 2692 wrote to memory of 3452 2692 bnthbn.exe 92 PID 2692 wrote to memory of 3452 2692 bnthbn.exe 92 PID 3452 wrote to memory of 2712 3452 9lfxrrl.exe 93 PID 3452 wrote to memory of 2712 3452 9lfxrrl.exe 93 PID 3452 wrote to memory of 2712 3452 9lfxrrl.exe 93 PID 2712 wrote to memory of 2304 2712 dvvpj.exe 94 PID 2712 wrote to memory of 2304 2712 dvvpj.exe 94 PID 2712 wrote to memory of 2304 2712 dvvpj.exe 94 PID 2304 wrote to memory of 2628 2304 nhbnht.exe 95 PID 2304 wrote to memory of 2628 2304 nhbnht.exe 95 PID 2304 wrote to memory of 2628 2304 nhbnht.exe 95 PID 2628 wrote to memory of 3052 2628 btnnhh.exe 96 PID 2628 wrote to memory of 3052 2628 btnnhh.exe 96 PID 2628 wrote to memory of 3052 2628 btnnhh.exe 96 PID 3052 wrote to memory of 2688 3052 llxfllr.exe 97 PID 3052 wrote to memory of 2688 3052 llxfllr.exe 97 PID 3052 wrote to memory of 2688 3052 llxfllr.exe 97 PID 2688 wrote to memory of 4512 2688 jdpjj.exe 98 PID 2688 wrote to memory of 4512 2688 jdpjj.exe 98 PID 2688 wrote to memory of 4512 2688 jdpjj.exe 98 PID 4512 wrote to memory of 2400 4512 7rxrllf.exe 99 PID 4512 wrote to memory of 2400 4512 7rxrllf.exe 99 PID 4512 wrote to memory of 2400 4512 7rxrllf.exe 99 PID 2400 wrote to memory of 5104 2400 thbbbt.exe 100 PID 2400 wrote to memory of 5104 2400 thbbbt.exe 100 PID 2400 wrote to memory of 5104 2400 thbbbt.exe 100 PID 5104 wrote to memory of 3168 5104 pvjdv.exe 101 PID 5104 wrote to memory of 3168 5104 pvjdv.exe 101 PID 5104 wrote to memory of 3168 5104 pvjdv.exe 101 PID 3168 wrote to memory of 1880 3168 hbhhbt.exe 102 PID 3168 wrote to memory of 1880 3168 hbhhbt.exe 102 PID 3168 wrote to memory of 1880 3168 hbhhbt.exe 102 PID 1880 wrote to memory of 4004 1880 lflrflf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8d10410fa44038a3b506ffd0640a3657df7c216225f9fd5b88cf9e59938a2ab.exe"C:\Users\Admin\AppData\Local\Temp\a8d10410fa44038a3b506ffd0640a3657df7c216225f9fd5b88cf9e59938a2ab.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\5tnhbt.exec:\5tnhbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\vvjdv.exec:\vvjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\5flfxfx.exec:\5flfxfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\thnhbh.exec:\thnhbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\hbtnth.exec:\hbtnth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\rfxfxxr.exec:\rfxfxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\pvvpp.exec:\pvvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\xlrfxrl.exec:\xlrfxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\9lfrrlf.exec:\9lfrrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\bnthbn.exec:\bnthbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\9lfxrrl.exec:\9lfxrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\dvvpj.exec:\dvvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\nhbnht.exec:\nhbnht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\btnnhh.exec:\btnnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\llxfllr.exec:\llxfllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\jdpjj.exec:\jdpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\7rxrllf.exec:\7rxrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\thbbbt.exec:\thbbbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\pvjdv.exec:\pvjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\hbhhbt.exec:\hbhhbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\lflrflf.exec:\lflrflf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\hbhhnn.exec:\hbhhnn.exe23⤵
- Executes dropped EXE
PID:4004 -
\??\c:\5jvvp.exec:\5jvvp.exe24⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rxrlfff.exec:\rxrlfff.exe25⤵
- Executes dropped EXE
PID:2732 -
\??\c:\hbnhnt.exec:\hbnhnt.exe26⤵
- Executes dropped EXE
PID:3640 -
\??\c:\pjdvp.exec:\pjdvp.exe27⤵
- Executes dropped EXE
PID:4284 -
\??\c:\rlrffrr.exec:\rlrffrr.exe28⤵
- Executes dropped EXE
PID:4576 -
\??\c:\xlrrrrl.exec:\xlrrrrl.exe29⤵
- Executes dropped EXE
PID:2808 -
\??\c:\ppjdj.exec:\ppjdj.exe30⤵
- Executes dropped EXE
PID:1960 -
\??\c:\dddvp.exec:\dddvp.exe31⤵
- Executes dropped EXE
PID:4108 -
\??\c:\rlrlflr.exec:\rlrlflr.exe32⤵
- Executes dropped EXE
PID:2108 -
\??\c:\tnnbtn.exec:\tnnbtn.exe33⤵
- Executes dropped EXE
PID:1228 -
\??\c:\dvdvv.exec:\dvdvv.exe34⤵
- Executes dropped EXE
PID:3152 -
\??\c:\hbnnbt.exec:\hbnnbt.exe35⤵
- Executes dropped EXE
PID:2128 -
\??\c:\pddvp.exec:\pddvp.exe36⤵
- Executes dropped EXE
PID:4316 -
\??\c:\lxxlxrf.exec:\lxxlxrf.exe37⤵
- Executes dropped EXE
PID:2860 -
\??\c:\flfxxxl.exec:\flfxxxl.exe38⤵
- Executes dropped EXE
PID:4216 -
\??\c:\tnnhtt.exec:\tnnhtt.exe39⤵
- Executes dropped EXE
PID:3132 -
\??\c:\pdppj.exec:\pdppj.exe40⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1thnhn.exec:\1thnhn.exe41⤵
- Executes dropped EXE
PID:3336 -
\??\c:\hhhbbb.exec:\hhhbbb.exe42⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vpddd.exec:\vpddd.exe43⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rrfxxxr.exec:\rrfxxxr.exe44⤵
- Executes dropped EXE
PID:3596 -
\??\c:\frffxfx.exec:\frffxfx.exe45⤵
- Executes dropped EXE
PID:3924 -
\??\c:\9nnhbn.exec:\9nnhbn.exe46⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vdpvv.exec:\vdpvv.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:516 -
\??\c:\xlrlfxr.exec:\xlrlfxr.exe48⤵
- Executes dropped EXE
PID:4920 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe49⤵
- Executes dropped EXE
PID:1512 -
\??\c:\ntnnnh.exec:\ntnnnh.exe50⤵
- Executes dropped EXE
PID:4536 -
\??\c:\dvppj.exec:\dvppj.exe51⤵
- Executes dropped EXE
PID:5004 -
\??\c:\xrrxrfx.exec:\xrrxrfx.exe52⤵
- Executes dropped EXE
PID:4276 -
\??\c:\tbbbtt.exec:\tbbbtt.exe53⤵
- Executes dropped EXE
PID:2420 -
\??\c:\9pppv.exec:\9pppv.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3728 -
\??\c:\lflfrrl.exec:\lflfrrl.exe55⤵
- Executes dropped EXE
PID:3980 -
\??\c:\5rlfffx.exec:\5rlfffx.exe56⤵
- Executes dropped EXE
PID:3968 -
\??\c:\htbtnh.exec:\htbtnh.exe57⤵
- Executes dropped EXE
PID:3468 -
\??\c:\ddjdv.exec:\ddjdv.exe58⤵
- Executes dropped EXE
PID:4184 -
\??\c:\rflfxrl.exec:\rflfxrl.exe59⤵
- Executes dropped EXE
PID:916 -
\??\c:\7ffxrrx.exec:\7ffxrrx.exe60⤵
- Executes dropped EXE
PID:4732 -
\??\c:\hbttnn.exec:\hbttnn.exe61⤵
- Executes dropped EXE
PID:1332 -
\??\c:\jppjd.exec:\jppjd.exe62⤵
- Executes dropped EXE
PID:2784 -
\??\c:\djvpj.exec:\djvpj.exe63⤵
- Executes dropped EXE
PID:4300 -
\??\c:\rxfxrlf.exec:\rxfxrlf.exe64⤵
- Executes dropped EXE
PID:3528 -
\??\c:\nhhnhb.exec:\nhhnhb.exe65⤵
- Executes dropped EXE
PID:4360 -
\??\c:\7vvvp.exec:\7vvvp.exe66⤵PID:4820
-
\??\c:\djvpj.exec:\djvpj.exe67⤵PID:352
-
\??\c:\rxxxfxf.exec:\rxxxfxf.exe68⤵PID:2192
-
\??\c:\ttbttt.exec:\ttbttt.exe69⤵PID:2008
-
\??\c:\dvpdv.exec:\dvpdv.exe70⤵PID:5108
-
\??\c:\lflflfl.exec:\lflflfl.exe71⤵PID:4680
-
\??\c:\5ttntn.exec:\5ttntn.exe72⤵PID:4968
-
\??\c:\hbbhhh.exec:\hbbhhh.exe73⤵PID:4704
-
\??\c:\jpdpv.exec:\jpdpv.exe74⤵PID:3040
-
\??\c:\lrxrllf.exec:\lrxrllf.exe75⤵PID:2096
-
\??\c:\btnhbb.exec:\btnhbb.exe76⤵PID:1452
-
\??\c:\jvpjd.exec:\jvpjd.exe77⤵PID:2488
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe78⤵PID:920
-
\??\c:\bbhbbb.exec:\bbhbbb.exe79⤵PID:4208
-
\??\c:\bthhtt.exec:\bthhtt.exe80⤵PID:2632
-
\??\c:\lfrlxrf.exec:\lfrlxrf.exe81⤵PID:1812
-
\??\c:\xflfrrl.exec:\xflfrrl.exe82⤵PID:1880
-
\??\c:\djjvp.exec:\djjvp.exe83⤵PID:4600
-
\??\c:\dpvjd.exec:\dpvjd.exe84⤵PID:2616
-
\??\c:\lxfxlfx.exec:\lxfxlfx.exe85⤵PID:4656
-
\??\c:\bhnhbb.exec:\bhnhbb.exe86⤵PID:832
-
\??\c:\7pjjj.exec:\7pjjj.exe87⤵PID:888
-
\??\c:\rrrfxxr.exec:\rrrfxxr.exe88⤵PID:404
-
\??\c:\tnnthb.exec:\tnnthb.exe89⤵PID:2876
-
\??\c:\9jjvp.exec:\9jjvp.exe90⤵PID:4104
-
\??\c:\jpvjd.exec:\jpvjd.exe91⤵PID:1208
-
\??\c:\lllfxrx.exec:\lllfxrx.exe92⤵PID:2808
-
\??\c:\1bhbnh.exec:\1bhbnh.exe93⤵PID:1776
-
\??\c:\jvvjv.exec:\jvvjv.exe94⤵PID:536
-
\??\c:\5jdpd.exec:\5jdpd.exe95⤵PID:412
-
\??\c:\lfrrxxx.exec:\lfrrxxx.exe96⤵PID:2668
-
\??\c:\tbbnhb.exec:\tbbnhb.exe97⤵PID:2720
-
\??\c:\1djpj.exec:\1djpj.exe98⤵PID:1848
-
\??\c:\rffxfxr.exec:\rffxfxr.exe99⤵PID:4608
-
\??\c:\xrrfxrf.exec:\xrrfxrf.exe100⤵PID:4428
-
\??\c:\1hhbtn.exec:\1hhbtn.exe101⤵PID:740
-
\??\c:\pdjdd.exec:\pdjdd.exe102⤵PID:3184
-
\??\c:\lrrlxrf.exec:\lrrlxrf.exe103⤵PID:952
-
\??\c:\tntnbt.exec:\tntnbt.exe104⤵PID:1060
-
\??\c:\1tbnbb.exec:\1tbnbb.exe105⤵PID:4296
-
\??\c:\ppvpd.exec:\ppvpd.exe106⤵PID:4152
-
\??\c:\rxlxlfr.exec:\rxlxlfr.exe107⤵PID:2220
-
\??\c:\3hnbbb.exec:\3hnbbb.exe108⤵PID:2340
-
\??\c:\tthtnh.exec:\tthtnh.exe109⤵PID:4812
-
\??\c:\1vjdv.exec:\1vjdv.exe110⤵PID:2984
-
\??\c:\9ffrfrf.exec:\9ffrfrf.exe111⤵PID:552
-
\??\c:\5xfxlrl.exec:\5xfxlrl.exe112⤵PID:4996
-
\??\c:\9hhnhh.exec:\9hhnhh.exe113⤵PID:5100
-
\??\c:\1jvjv.exec:\1jvjv.exe114⤵PID:3136
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe115⤵PID:4536
-
\??\c:\1hbttt.exec:\1hbttt.exe116⤵PID:432
-
\??\c:\pdddv.exec:\pdddv.exe117⤵PID:4740
-
\??\c:\3rrrfxf.exec:\3rrrfxf.exe118⤵PID:1544
-
\??\c:\3nbtnn.exec:\3nbtnn.exe119⤵PID:3228
-
\??\c:\btbtbt.exec:\btbtbt.exe120⤵PID:3860
-
\??\c:\jvvjv.exec:\jvvjv.exe121⤵PID:448
-
\??\c:\rrxrllf.exec:\rrxrllf.exe122⤵PID:4964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-