Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 02:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9a37341b9cc6e5645fb8cd303be2bed92e3d8bd8e6fd20e7fe44e04941046cf0.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
9a37341b9cc6e5645fb8cd303be2bed92e3d8bd8e6fd20e7fe44e04941046cf0.exe
-
Size
453KB
-
MD5
da7357f566fd1212dec4f1ed125473e7
-
SHA1
a6d78770e3915ae2e4dff9cca217ecce68250310
-
SHA256
9a37341b9cc6e5645fb8cd303be2bed92e3d8bd8e6fd20e7fe44e04941046cf0
-
SHA512
e1018237cec738e7c3d67cf183f889c3cf4184be587f5694b016b4567cc8b103a5e6f3d48baef8f1c8bc4dc2450f23c6e38788fb4fc82bcdbe04650310ea5fbe
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1068-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1324-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3028-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/892-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2836-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/244-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-733-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-752-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-768-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-844-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-1043-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1068 lxfxxxr.exe 3580 btthbb.exe 1552 3rxrlrr.exe 2676 hhbnnh.exe 812 vpvvj.exe 1768 5ppdp.exe 976 rfffxxx.exe 540 jdjdv.exe 1972 xlxxrll.exe 3796 hhhbhb.exe 2292 lrxlrff.exe 868 ttbtnn.exe 4632 pjvvv.exe 400 tbhbtn.exe 632 1pvdj.exe 920 ttnhbn.exe 748 dvjvj.exe 2900 llrlfxf.exe 4424 hntntt.exe 1324 btnhhh.exe 2344 vpvpp.exe 2840 rlrxrlf.exe 2876 hhhtnh.exe 1588 pjvvp.exe 3424 lrffxrr.exe 1100 7hhhbb.exe 1688 jjjjp.exe 4416 pppjj.exe 4840 1flfxxr.exe 644 hbnnnt.exe 2308 3pvpj.exe 4568 ddpjj.exe 4460 xrxrlxr.exe 4796 bthbnb.exe 3052 hthbtb.exe 388 ddddv.exe 1576 frrrrrl.exe 2064 tnbttt.exe 1484 hhbbbt.exe 232 1llxrlf.exe 5072 nhnhtn.exe 4520 djjjd.exe 3892 pjpjd.exe 1520 fxxxrll.exe 5108 9bhbbb.exe 4868 vddpj.exe 1032 rllfxxr.exe 1380 thnnhh.exe 4812 dpvjd.exe 3028 5jjjp.exe 336 9nnnhh.exe 1696 dvpjj.exe 976 xlfxxfx.exe 540 bnbtnn.exe 5056 vdjdp.exe 3648 lxffxff.exe 2924 btbtnn.exe 1488 jppjp.exe 3568 rflrrfl.exe 4436 btthbb.exe 4820 jjpdp.exe 1048 frxllfl.exe 3276 lllfxxr.exe 2192 tthbhh.exe -
resource yara_rule behavioral2/memory/1068-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1100-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3028-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/892-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/244-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/988-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-733-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-752-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4000 wrote to memory of 1068 4000 9a37341b9cc6e5645fb8cd303be2bed92e3d8bd8e6fd20e7fe44e04941046cf0.exe 82 PID 4000 wrote to memory of 1068 4000 9a37341b9cc6e5645fb8cd303be2bed92e3d8bd8e6fd20e7fe44e04941046cf0.exe 82 PID 4000 wrote to memory of 1068 4000 9a37341b9cc6e5645fb8cd303be2bed92e3d8bd8e6fd20e7fe44e04941046cf0.exe 82 PID 1068 wrote to memory of 3580 1068 lxfxxxr.exe 83 PID 1068 wrote to memory of 3580 1068 lxfxxxr.exe 83 PID 1068 wrote to memory of 3580 1068 lxfxxxr.exe 83 PID 3580 wrote to memory of 1552 3580 btthbb.exe 84 PID 3580 wrote to memory of 1552 3580 btthbb.exe 84 PID 3580 wrote to memory of 1552 3580 btthbb.exe 84 PID 1552 wrote to memory of 2676 1552 3rxrlrr.exe 85 PID 1552 wrote to memory of 2676 1552 3rxrlrr.exe 85 PID 1552 wrote to memory of 2676 1552 3rxrlrr.exe 85 PID 2676 wrote to memory of 812 2676 hhbnnh.exe 86 PID 2676 wrote to memory of 812 2676 hhbnnh.exe 86 PID 2676 wrote to memory of 812 2676 hhbnnh.exe 86 PID 812 wrote to memory of 1768 812 vpvvj.exe 87 PID 812 wrote to memory of 1768 812 vpvvj.exe 87 PID 812 wrote to memory of 1768 812 vpvvj.exe 87 PID 1768 wrote to memory of 976 1768 5ppdp.exe 88 PID 1768 wrote to memory of 976 1768 5ppdp.exe 88 PID 1768 wrote to memory of 976 1768 5ppdp.exe 88 PID 976 wrote to memory of 540 976 rfffxxx.exe 89 PID 976 wrote to memory of 540 976 rfffxxx.exe 89 PID 976 wrote to memory of 540 976 rfffxxx.exe 89 PID 540 wrote to memory of 1972 540 jdjdv.exe 90 PID 540 wrote to memory of 1972 540 jdjdv.exe 90 PID 540 wrote to memory of 1972 540 jdjdv.exe 90 PID 1972 wrote to memory of 3796 1972 xlxxrll.exe 91 PID 1972 wrote to memory of 3796 1972 xlxxrll.exe 91 PID 1972 wrote to memory of 3796 1972 xlxxrll.exe 91 PID 3796 wrote to memory of 2292 3796 hhhbhb.exe 92 PID 3796 wrote to memory of 2292 3796 hhhbhb.exe 92 PID 3796 wrote to memory of 2292 3796 hhhbhb.exe 92 PID 2292 wrote to memory of 868 2292 lrxlrff.exe 93 PID 2292 wrote to memory of 868 2292 lrxlrff.exe 93 PID 2292 wrote to memory of 868 2292 lrxlrff.exe 93 PID 868 wrote to memory of 4632 868 ttbtnn.exe 94 PID 868 wrote to memory of 4632 868 ttbtnn.exe 94 PID 868 wrote to memory of 4632 868 ttbtnn.exe 94 PID 4632 wrote to memory of 400 4632 pjvvv.exe 95 PID 4632 wrote to memory of 400 4632 pjvvv.exe 95 PID 4632 wrote to memory of 400 4632 pjvvv.exe 95 PID 400 wrote to memory of 632 400 tbhbtn.exe 96 PID 400 wrote to memory of 632 400 tbhbtn.exe 96 PID 400 wrote to memory of 632 400 tbhbtn.exe 96 PID 632 wrote to memory of 920 632 1pvdj.exe 97 PID 632 wrote to memory of 920 632 1pvdj.exe 97 PID 632 wrote to memory of 920 632 1pvdj.exe 97 PID 920 wrote to memory of 748 920 ttnhbn.exe 98 PID 920 wrote to memory of 748 920 ttnhbn.exe 98 PID 920 wrote to memory of 748 920 ttnhbn.exe 98 PID 748 wrote to memory of 2900 748 dvjvj.exe 99 PID 748 wrote to memory of 2900 748 dvjvj.exe 99 PID 748 wrote to memory of 2900 748 dvjvj.exe 99 PID 2900 wrote to memory of 4424 2900 llrlfxf.exe 100 PID 2900 wrote to memory of 4424 2900 llrlfxf.exe 100 PID 2900 wrote to memory of 4424 2900 llrlfxf.exe 100 PID 4424 wrote to memory of 1324 4424 hntntt.exe 101 PID 4424 wrote to memory of 1324 4424 hntntt.exe 101 PID 4424 wrote to memory of 1324 4424 hntntt.exe 101 PID 1324 wrote to memory of 2344 1324 btnhhh.exe 102 PID 1324 wrote to memory of 2344 1324 btnhhh.exe 102 PID 1324 wrote to memory of 2344 1324 btnhhh.exe 102 PID 2344 wrote to memory of 2840 2344 vpvpp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a37341b9cc6e5645fb8cd303be2bed92e3d8bd8e6fd20e7fe44e04941046cf0.exe"C:\Users\Admin\AppData\Local\Temp\9a37341b9cc6e5645fb8cd303be2bed92e3d8bd8e6fd20e7fe44e04941046cf0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\lxfxxxr.exec:\lxfxxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\btthbb.exec:\btthbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\3rxrlrr.exec:\3rxrlrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\hhbnnh.exec:\hhbnnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\vpvvj.exec:\vpvvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\5ppdp.exec:\5ppdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\rfffxxx.exec:\rfffxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\jdjdv.exec:\jdjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\xlxxrll.exec:\xlxxrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\hhhbhb.exec:\hhhbhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\lrxlrff.exec:\lrxlrff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\ttbtnn.exec:\ttbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\pjvvv.exec:\pjvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\tbhbtn.exec:\tbhbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\1pvdj.exec:\1pvdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\ttnhbn.exec:\ttnhbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\dvjvj.exec:\dvjvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\llrlfxf.exec:\llrlfxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\hntntt.exec:\hntntt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\btnhhh.exec:\btnhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\vpvpp.exec:\vpvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\rlrxrlf.exec:\rlrxrlf.exe23⤵
- Executes dropped EXE
PID:2840 -
\??\c:\hhhtnh.exec:\hhhtnh.exe24⤵
- Executes dropped EXE
PID:2876 -
\??\c:\pjvvp.exec:\pjvvp.exe25⤵
- Executes dropped EXE
PID:1588 -
\??\c:\lrffxrr.exec:\lrffxrr.exe26⤵
- Executes dropped EXE
PID:3424 -
\??\c:\7hhhbb.exec:\7hhhbb.exe27⤵
- Executes dropped EXE
PID:1100 -
\??\c:\jjjjp.exec:\jjjjp.exe28⤵
- Executes dropped EXE
PID:1688 -
\??\c:\pppjj.exec:\pppjj.exe29⤵
- Executes dropped EXE
PID:4416 -
\??\c:\1flfxxr.exec:\1flfxxr.exe30⤵
- Executes dropped EXE
PID:4840 -
\??\c:\hbnnnt.exec:\hbnnnt.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:644 -
\??\c:\3pvpj.exec:\3pvpj.exe32⤵
- Executes dropped EXE
PID:2308 -
\??\c:\ddpjj.exec:\ddpjj.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4568 -
\??\c:\xrxrlxr.exec:\xrxrlxr.exe34⤵
- Executes dropped EXE
PID:4460 -
\??\c:\bthbnb.exec:\bthbnb.exe35⤵
- Executes dropped EXE
PID:4796 -
\??\c:\hthbtb.exec:\hthbtb.exe36⤵
- Executes dropped EXE
PID:3052 -
\??\c:\ddddv.exec:\ddddv.exe37⤵
- Executes dropped EXE
PID:388 -
\??\c:\frrrrrl.exec:\frrrrrl.exe38⤵
- Executes dropped EXE
PID:1576 -
\??\c:\tnbttt.exec:\tnbttt.exe39⤵
- Executes dropped EXE
PID:2064 -
\??\c:\hhbbbt.exec:\hhbbbt.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1484 -
\??\c:\1llxrlf.exec:\1llxrlf.exe41⤵
- Executes dropped EXE
PID:232 -
\??\c:\nhnhtn.exec:\nhnhtn.exe42⤵
- Executes dropped EXE
PID:5072 -
\??\c:\djjjd.exec:\djjjd.exe43⤵
- Executes dropped EXE
PID:4520 -
\??\c:\pjpjd.exec:\pjpjd.exe44⤵
- Executes dropped EXE
PID:3892 -
\??\c:\fxxxrll.exec:\fxxxrll.exe45⤵
- Executes dropped EXE
PID:1520 -
\??\c:\9bhbbb.exec:\9bhbbb.exe46⤵
- Executes dropped EXE
PID:5108 -
\??\c:\vddpj.exec:\vddpj.exe47⤵
- Executes dropped EXE
PID:4868 -
\??\c:\rllfxxr.exec:\rllfxxr.exe48⤵
- Executes dropped EXE
PID:1032 -
\??\c:\thnnhh.exec:\thnnhh.exe49⤵
- Executes dropped EXE
PID:1380 -
\??\c:\dpvjd.exec:\dpvjd.exe50⤵
- Executes dropped EXE
PID:4812 -
\??\c:\5jjjp.exec:\5jjjp.exe51⤵
- Executes dropped EXE
PID:3028 -
\??\c:\9nnnhh.exec:\9nnnhh.exe52⤵
- Executes dropped EXE
PID:336 -
\??\c:\dvpjj.exec:\dvpjj.exe53⤵
- Executes dropped EXE
PID:1696 -
\??\c:\xlfxxfx.exec:\xlfxxfx.exe54⤵
- Executes dropped EXE
PID:976 -
\??\c:\bnbtnn.exec:\bnbtnn.exe55⤵
- Executes dropped EXE
PID:540 -
\??\c:\vdjdp.exec:\vdjdp.exe56⤵
- Executes dropped EXE
PID:5056 -
\??\c:\lxffxff.exec:\lxffxff.exe57⤵
- Executes dropped EXE
PID:3648 -
\??\c:\btbtnn.exec:\btbtnn.exe58⤵
- Executes dropped EXE
PID:2924 -
\??\c:\jppjp.exec:\jppjp.exe59⤵
- Executes dropped EXE
PID:1488 -
\??\c:\rflrrfl.exec:\rflrrfl.exe60⤵
- Executes dropped EXE
PID:3568 -
\??\c:\btthbb.exec:\btthbb.exe61⤵
- Executes dropped EXE
PID:4436 -
\??\c:\jjpdp.exec:\jjpdp.exe62⤵
- Executes dropped EXE
PID:4820 -
\??\c:\frxllfl.exec:\frxllfl.exe63⤵
- Executes dropped EXE
PID:1048 -
\??\c:\lllfxxr.exec:\lllfxxr.exe64⤵
- Executes dropped EXE
PID:3276 -
\??\c:\tthbhh.exec:\tthbhh.exe65⤵
- Executes dropped EXE
PID:2192 -
\??\c:\pvdvv.exec:\pvdvv.exe66⤵PID:4256
-
\??\c:\xrxxlll.exec:\xrxxlll.exe67⤵PID:1396
-
\??\c:\nhhnhh.exec:\nhhnhh.exe68⤵PID:4852
-
\??\c:\vjvpj.exec:\vjvpj.exe69⤵PID:4468
-
\??\c:\frxrllf.exec:\frxrllf.exe70⤵PID:4816
-
\??\c:\xxxxrrl.exec:\xxxxrrl.exe71⤵PID:780
-
\??\c:\tbbtnn.exec:\tbbtnn.exe72⤵PID:4176
-
\??\c:\jdvpp.exec:\jdvpp.exe73⤵PID:1960
-
\??\c:\flfxxrr.exec:\flfxxrr.exe74⤵PID:2932
-
\??\c:\xrrlffx.exec:\xrrlffx.exe75⤵PID:2876
-
\??\c:\nnthbb.exec:\nnthbb.exe76⤵PID:1588
-
\??\c:\pdppp.exec:\pdppp.exe77⤵PID:4132
-
\??\c:\hbbbhh.exec:\hbbbhh.exe78⤵
- System Location Discovery: System Language Discovery
PID:3424 -
\??\c:\9hbntn.exec:\9hbntn.exe79⤵PID:892
-
\??\c:\1jvpv.exec:\1jvpv.exe80⤵PID:988
-
\??\c:\7rxlflf.exec:\7rxlflf.exe81⤵PID:2652
-
\??\c:\7hnnhh.exec:\7hnnhh.exe82⤵PID:4840
-
\??\c:\djjdv.exec:\djjdv.exe83⤵PID:644
-
\??\c:\rlfrxrx.exec:\rlfrxrx.exe84⤵PID:3508
-
\??\c:\xxlxrlf.exec:\xxlxrlf.exe85⤵PID:1924
-
\??\c:\tnhbtt.exec:\tnhbtt.exe86⤵PID:2484
-
\??\c:\pjddv.exec:\pjddv.exe87⤵PID:640
-
\??\c:\7nthht.exec:\7nthht.exe88⤵PID:3972
-
\??\c:\3vjvv.exec:\3vjvv.exe89⤵PID:4796
-
\??\c:\dvvpd.exec:\dvvpd.exe90⤵PID:1992
-
\??\c:\xfxflrl.exec:\xfxflrl.exe91⤵PID:3260
-
\??\c:\htbttt.exec:\htbttt.exe92⤵PID:2156
-
\??\c:\pppjd.exec:\pppjd.exe93⤵PID:3736
-
\??\c:\vppjj.exec:\vppjj.exe94⤵PID:1112
-
\??\c:\rxrllfx.exec:\rxrllfx.exe95⤵PID:1764
-
\??\c:\hbnhhb.exec:\hbnhhb.exe96⤵PID:1484
-
\??\c:\vvpjj.exec:\vvpjj.exe97⤵PID:1180
-
\??\c:\3xfxxxx.exec:\3xfxxxx.exe98⤵PID:1128
-
\??\c:\frlrllf.exec:\frlrllf.exe99⤵PID:2392
-
\??\c:\thbtnh.exec:\thbtnh.exe100⤵PID:2836
-
\??\c:\vjvvv.exec:\vjvvv.exe101⤵PID:1628
-
\??\c:\lxfxrll.exec:\lxfxrll.exe102⤵PID:4640
-
\??\c:\fxxrlll.exec:\fxxrlll.exe103⤵PID:4340
-
\??\c:\nbhbtt.exec:\nbhbtt.exe104⤵PID:1520
-
\??\c:\jjdvj.exec:\jjdvj.exe105⤵PID:3312
-
\??\c:\lflffxx.exec:\lflffxx.exe106⤵PID:4600
-
\??\c:\9nnttt.exec:\9nnttt.exe107⤵PID:3280
-
\??\c:\tttnnt.exec:\tttnnt.exe108⤵PID:2448
-
\??\c:\pjjjj.exec:\pjjjj.exe109⤵PID:4920
-
\??\c:\fxxxrff.exec:\fxxxrff.exe110⤵PID:3912
-
\??\c:\7nnhtt.exec:\7nnhtt.exe111⤵PID:1768
-
\??\c:\ppvpj.exec:\ppvpj.exe112⤵PID:2772
-
\??\c:\dvvdv.exec:\dvvdv.exe113⤵PID:2460
-
\??\c:\1lrlffx.exec:\1lrlffx.exe114⤵PID:4156
-
\??\c:\tntnhb.exec:\tntnhb.exe115⤵PID:3092
-
\??\c:\jpvpp.exec:\jpvpp.exe116⤵PID:1188
-
\??\c:\jdjdj.exec:\jdjdj.exe117⤵PID:1972
-
\??\c:\llxrfxl.exec:\llxrfxl.exe118⤵PID:4064
-
\??\c:\ntnhhn.exec:\ntnhhn.exe119⤵PID:4332
-
\??\c:\tnnnnn.exec:\tnnnnn.exe120⤵PID:4032
-
\??\c:\dpvpp.exec:\dpvpp.exe121⤵PID:4800
-
\??\c:\xrfxrlx.exec:\xrfxrlx.exe122⤵PID:1364
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-