Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 03:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b6e1a463968d9b8cfeeb7c7bc58d1b056b5b9c0a034f297b703ec3e77a4978ff.exe
Resource
win7-20240708-en
7 signatures
150 seconds
General
-
Target
b6e1a463968d9b8cfeeb7c7bc58d1b056b5b9c0a034f297b703ec3e77a4978ff.exe
-
Size
454KB
-
MD5
da9bc2d92b719f3bc0ff29731eb3c6e9
-
SHA1
e06cd91f899109e64c6ac0470ce3e77d7d0b73f7
-
SHA256
b6e1a463968d9b8cfeeb7c7bc58d1b056b5b9c0a034f297b703ec3e77a4978ff
-
SHA512
e7aad67c36cbd847d5cf32ac6839020609e97b63aa366e8ff24d90f203b39e0e4f5627ca8d01a7a406e697be51af61ce0607720b26f31a4ebefac1a9a9a40ac1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe2:q7Tc2NYHUrAwfMp3CD2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2012-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1508-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2584-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1184-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/324-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3828-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/616-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1904-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-745-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-830-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-834-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4480 tntnhh.exe 2012 jvvvp.exe 964 rlrlffx.exe 3572 vvvpp.exe 2296 flrrlfx.exe 4804 dvddv.exe 1508 pdddv.exe 4864 lrffllr.exe 4680 jddvp.exe 4380 lfrlfxr.exe 2928 ntthhb.exe 4640 jvjdv.exe 224 rfflrrl.exe 1184 9rrlfxf.exe 5052 9rrlxxl.exe 2944 vjppp.exe 2584 7jpdd.exe 3528 hhbbnt.exe 2904 tnnhhh.exe 5012 rfxrrfx.exe 4084 htbbtn.exe 324 xflfrxr.exe 4720 7nhbnt.exe 1448 7rrlffx.exe 1632 hhnnhn.exe 1700 dvdvp.exe 972 bbhtnh.exe 3828 ffrllrr.exe 3916 hhbtbb.exe 3776 vjpjv.exe 4600 jjvvp.exe 4244 llrlxlf.exe 4156 bhhbbt.exe 3452 vpppp.exe 2660 rffxrxr.exe 616 ntthbt.exe 4904 3vjjd.exe 2908 dvppj.exe 2260 ffxrffl.exe 512 tnnhbb.exe 1548 hhtbtb.exe 2960 3lxfxxx.exe 4268 tnnhbb.exe 4708 7hbbnn.exe 4572 pdjdv.exe 4012 xrrxxxx.exe 2592 bttnhh.exe 4996 dpvpv.exe 2424 lffxffx.exe 400 flxrllf.exe 2604 hhhhhn.exe 4492 vvpjp.exe 1224 llxrlrr.exe 1820 hhtnnt.exe 2012 pjpjj.exe 2184 xlxxrrr.exe 1772 hhhbtt.exe 2932 pvdvd.exe 1020 vvdvd.exe 4104 lflfflf.exe 1996 bntnhh.exe 180 hhtthb.exe 1504 jjvpp.exe 536 frfxrrr.exe -
resource yara_rule behavioral2/memory/2012-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1508-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1184-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2584-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1184-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/324-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3828-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/616-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2604-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-663-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfflrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3640 wrote to memory of 4480 3640 b6e1a463968d9b8cfeeb7c7bc58d1b056b5b9c0a034f297b703ec3e77a4978ff.exe 83 PID 3640 wrote to memory of 4480 3640 b6e1a463968d9b8cfeeb7c7bc58d1b056b5b9c0a034f297b703ec3e77a4978ff.exe 83 PID 3640 wrote to memory of 4480 3640 b6e1a463968d9b8cfeeb7c7bc58d1b056b5b9c0a034f297b703ec3e77a4978ff.exe 83 PID 4480 wrote to memory of 2012 4480 tntnhh.exe 84 PID 4480 wrote to memory of 2012 4480 tntnhh.exe 84 PID 4480 wrote to memory of 2012 4480 tntnhh.exe 84 PID 2012 wrote to memory of 964 2012 jvvvp.exe 85 PID 2012 wrote to memory of 964 2012 jvvvp.exe 85 PID 2012 wrote to memory of 964 2012 jvvvp.exe 85 PID 964 wrote to memory of 3572 964 rlrlffx.exe 86 PID 964 wrote to memory of 3572 964 rlrlffx.exe 86 PID 964 wrote to memory of 3572 964 rlrlffx.exe 86 PID 3572 wrote to memory of 2296 3572 vvvpp.exe 87 PID 3572 wrote to memory of 2296 3572 vvvpp.exe 87 PID 3572 wrote to memory of 2296 3572 vvvpp.exe 87 PID 2296 wrote to memory of 4804 2296 flrrlfx.exe 88 PID 2296 wrote to memory of 4804 2296 flrrlfx.exe 88 PID 2296 wrote to memory of 4804 2296 flrrlfx.exe 88 PID 4804 wrote to memory of 1508 4804 dvddv.exe 89 PID 4804 wrote to memory of 1508 4804 dvddv.exe 89 PID 4804 wrote to memory of 1508 4804 dvddv.exe 89 PID 1508 wrote to memory of 4864 1508 pdddv.exe 90 PID 1508 wrote to memory of 4864 1508 pdddv.exe 90 PID 1508 wrote to memory of 4864 1508 pdddv.exe 90 PID 4864 wrote to memory of 4680 4864 lrffllr.exe 91 PID 4864 wrote to memory of 4680 4864 lrffllr.exe 91 PID 4864 wrote to memory of 4680 4864 lrffllr.exe 91 PID 4680 wrote to memory of 4380 4680 jddvp.exe 92 PID 4680 wrote to memory of 4380 4680 jddvp.exe 92 PID 4680 wrote to memory of 4380 4680 jddvp.exe 92 PID 4380 wrote to memory of 2928 4380 lfrlfxr.exe 93 PID 4380 wrote to memory of 2928 4380 lfrlfxr.exe 93 PID 4380 wrote to memory of 2928 4380 lfrlfxr.exe 93 PID 2928 wrote to memory of 4640 2928 ntthhb.exe 94 PID 2928 wrote to memory of 4640 2928 ntthhb.exe 94 PID 2928 wrote to memory of 4640 2928 ntthhb.exe 94 PID 4640 wrote to memory of 224 4640 jvjdv.exe 95 PID 4640 wrote to memory of 224 4640 jvjdv.exe 95 PID 4640 wrote to memory of 224 4640 jvjdv.exe 95 PID 224 wrote to memory of 1184 224 rfflrrl.exe 96 PID 224 wrote to memory of 1184 224 rfflrrl.exe 96 PID 224 wrote to memory of 1184 224 rfflrrl.exe 96 PID 1184 wrote to memory of 5052 1184 9rrlfxf.exe 97 PID 1184 wrote to memory of 5052 1184 9rrlfxf.exe 97 PID 1184 wrote to memory of 5052 1184 9rrlfxf.exe 97 PID 5052 wrote to memory of 2944 5052 9rrlxxl.exe 98 PID 5052 wrote to memory of 2944 5052 9rrlxxl.exe 98 PID 5052 wrote to memory of 2944 5052 9rrlxxl.exe 98 PID 2944 wrote to memory of 2584 2944 vjppp.exe 99 PID 2944 wrote to memory of 2584 2944 vjppp.exe 99 PID 2944 wrote to memory of 2584 2944 vjppp.exe 99 PID 2584 wrote to memory of 3528 2584 7jpdd.exe 100 PID 2584 wrote to memory of 3528 2584 7jpdd.exe 100 PID 2584 wrote to memory of 3528 2584 7jpdd.exe 100 PID 3528 wrote to memory of 2904 3528 hhbbnt.exe 101 PID 3528 wrote to memory of 2904 3528 hhbbnt.exe 101 PID 3528 wrote to memory of 2904 3528 hhbbnt.exe 101 PID 2904 wrote to memory of 5012 2904 tnnhhh.exe 102 PID 2904 wrote to memory of 5012 2904 tnnhhh.exe 102 PID 2904 wrote to memory of 5012 2904 tnnhhh.exe 102 PID 5012 wrote to memory of 4084 5012 rfxrrfx.exe 103 PID 5012 wrote to memory of 4084 5012 rfxrrfx.exe 103 PID 5012 wrote to memory of 4084 5012 rfxrrfx.exe 103 PID 4084 wrote to memory of 324 4084 htbbtn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6e1a463968d9b8cfeeb7c7bc58d1b056b5b9c0a034f297b703ec3e77a4978ff.exe"C:\Users\Admin\AppData\Local\Temp\b6e1a463968d9b8cfeeb7c7bc58d1b056b5b9c0a034f297b703ec3e77a4978ff.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\tntnhh.exec:\tntnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\jvvvp.exec:\jvvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\rlrlffx.exec:\rlrlffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\vvvpp.exec:\vvvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\flrrlfx.exec:\flrrlfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\dvddv.exec:\dvddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\pdddv.exec:\pdddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\lrffllr.exec:\lrffllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\jddvp.exec:\jddvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\lfrlfxr.exec:\lfrlfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\ntthhb.exec:\ntthhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\jvjdv.exec:\jvjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\rfflrrl.exec:\rfflrrl.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\9rrlfxf.exec:\9rrlfxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\9rrlxxl.exec:\9rrlxxl.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\vjppp.exec:\vjppp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\7jpdd.exec:\7jpdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\hhbbnt.exec:\hhbbnt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\tnnhhh.exec:\tnnhhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\rfxrrfx.exec:\rfxrrfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\htbbtn.exec:\htbbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\xflfrxr.exec:\xflfrxr.exe23⤵
- Executes dropped EXE
PID:324 -
\??\c:\7nhbnt.exec:\7nhbnt.exe24⤵
- Executes dropped EXE
PID:4720 -
\??\c:\7rrlffx.exec:\7rrlffx.exe25⤵
- Executes dropped EXE
PID:1448 -
\??\c:\hhnnhn.exec:\hhnnhn.exe26⤵
- Executes dropped EXE
PID:1632 -
\??\c:\dvdvp.exec:\dvdvp.exe27⤵
- Executes dropped EXE
PID:1700 -
\??\c:\bbhtnh.exec:\bbhtnh.exe28⤵
- Executes dropped EXE
PID:972 -
\??\c:\ffrllrr.exec:\ffrllrr.exe29⤵
- Executes dropped EXE
PID:3828 -
\??\c:\hhbtbb.exec:\hhbtbb.exe30⤵
- Executes dropped EXE
PID:3916 -
\??\c:\vjpjv.exec:\vjpjv.exe31⤵
- Executes dropped EXE
PID:3776 -
\??\c:\jjvvp.exec:\jjvvp.exe32⤵
- Executes dropped EXE
PID:4600 -
\??\c:\llrlxlf.exec:\llrlxlf.exe33⤵
- Executes dropped EXE
PID:4244 -
\??\c:\bhhbbt.exec:\bhhbbt.exe34⤵
- Executes dropped EXE
PID:4156 -
\??\c:\vpppp.exec:\vpppp.exe35⤵
- Executes dropped EXE
PID:3452 -
\??\c:\rffxrxr.exec:\rffxrxr.exe36⤵
- Executes dropped EXE
PID:2660 -
\??\c:\ntthbt.exec:\ntthbt.exe37⤵
- Executes dropped EXE
PID:616 -
\??\c:\3vjjd.exec:\3vjjd.exe38⤵
- Executes dropped EXE
PID:4904 -
\??\c:\dvppj.exec:\dvppj.exe39⤵
- Executes dropped EXE
PID:2908 -
\??\c:\ffxrffl.exec:\ffxrffl.exe40⤵
- Executes dropped EXE
PID:2260 -
\??\c:\tnnhbb.exec:\tnnhbb.exe41⤵
- Executes dropped EXE
PID:512 -
\??\c:\hhtbtb.exec:\hhtbtb.exe42⤵
- Executes dropped EXE
PID:1548 -
\??\c:\3lxfxxx.exec:\3lxfxxx.exe43⤵
- Executes dropped EXE
PID:2960 -
\??\c:\tnnhbb.exec:\tnnhbb.exe44⤵
- Executes dropped EXE
PID:4268 -
\??\c:\7hbbnn.exec:\7hbbnn.exe45⤵
- Executes dropped EXE
PID:4708 -
\??\c:\pdjdv.exec:\pdjdv.exe46⤵
- Executes dropped EXE
PID:4572 -
\??\c:\xrrxxxx.exec:\xrrxxxx.exe47⤵
- Executes dropped EXE
PID:4012 -
\??\c:\bttnhh.exec:\bttnhh.exe48⤵
- Executes dropped EXE
PID:2592 -
\??\c:\dpvpv.exec:\dpvpv.exe49⤵
- Executes dropped EXE
PID:4996 -
\??\c:\lffxffx.exec:\lffxffx.exe50⤵
- Executes dropped EXE
PID:2424 -
\??\c:\flxrllf.exec:\flxrllf.exe51⤵
- Executes dropped EXE
PID:400 -
\??\c:\hhhhhn.exec:\hhhhhn.exe52⤵
- Executes dropped EXE
PID:2604 -
\??\c:\vvpjp.exec:\vvpjp.exe53⤵
- Executes dropped EXE
PID:4492 -
\??\c:\llxrlrr.exec:\llxrlrr.exe54⤵
- Executes dropped EXE
PID:1224 -
\??\c:\hhtnnt.exec:\hhtnnt.exe55⤵
- Executes dropped EXE
PID:1820 -
\??\c:\pjpjj.exec:\pjpjj.exe56⤵
- Executes dropped EXE
PID:2012 -
\??\c:\xlxxrrr.exec:\xlxxrrr.exe57⤵
- Executes dropped EXE
PID:2184 -
\??\c:\hhhbtt.exec:\hhhbtt.exe58⤵
- Executes dropped EXE
PID:1772 -
\??\c:\pvdvd.exec:\pvdvd.exe59⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vvdvd.exec:\vvdvd.exe60⤵
- Executes dropped EXE
PID:1020 -
\??\c:\lflfflf.exec:\lflfflf.exe61⤵
- Executes dropped EXE
PID:4104 -
\??\c:\bntnhh.exec:\bntnhh.exe62⤵
- Executes dropped EXE
PID:1996 -
\??\c:\hhtthb.exec:\hhtthb.exe63⤵
- Executes dropped EXE
PID:180 -
\??\c:\jjvpp.exec:\jjvpp.exe64⤵
- Executes dropped EXE
PID:1504 -
\??\c:\frfxrrr.exec:\frfxrrr.exe65⤵
- Executes dropped EXE
PID:536 -
\??\c:\dpvpj.exec:\dpvpj.exe66⤵PID:3540
-
\??\c:\pvjjp.exec:\pvjjp.exe67⤵PID:3984
-
\??\c:\7xxrlll.exec:\7xxrlll.exe68⤵PID:3160
-
\??\c:\3httbb.exec:\3httbb.exe69⤵PID:4892
-
\??\c:\jppjd.exec:\jppjd.exe70⤵PID:4380
-
\??\c:\frxrfff.exec:\frxrfff.exe71⤵PID:3156
-
\??\c:\nhbtnn.exec:\nhbtnn.exe72⤵PID:2696
-
\??\c:\jdjjj.exec:\jdjjj.exe73⤵PID:2264
-
\??\c:\lrxlffr.exec:\lrxlffr.exe74⤵PID:2224
-
\??\c:\thnhtn.exec:\thnhtn.exe75⤵PID:5052
-
\??\c:\nnnbnn.exec:\nnnbnn.exe76⤵PID:388
-
\??\c:\pdpjv.exec:\pdpjv.exe77⤵PID:1596
-
\??\c:\lxfxfxr.exec:\lxfxfxr.exe78⤵PID:4024
-
\??\c:\htbnhb.exec:\htbnhb.exe79⤵PID:1984
-
\??\c:\jvvvj.exec:\jvvvj.exe80⤵PID:4688
-
\??\c:\rrxrrll.exec:\rrxrrll.exe81⤵PID:2792
-
\??\c:\lfxlllf.exec:\lfxlllf.exe82⤵PID:3464
-
\??\c:\htbbtn.exec:\htbbtn.exe83⤵PID:1628
-
\??\c:\jjddd.exec:\jjddd.exe84⤵PID:2916
-
\??\c:\jppjd.exec:\jppjd.exe85⤵PID:4984
-
\??\c:\flrlffx.exec:\flrlffx.exe86⤵PID:4512
-
\??\c:\btbbtb.exec:\btbbtb.exe87⤵PID:2032
-
\??\c:\dvdvp.exec:\dvdvp.exe88⤵PID:3480
-
\??\c:\rxrlrrr.exec:\rxrlrrr.exe89⤵PID:2020
-
\??\c:\bntnhb.exec:\bntnhb.exe90⤵PID:4852
-
\??\c:\thnhhh.exec:\thnhhh.exe91⤵PID:2936
-
\??\c:\vpvdj.exec:\vpvdj.exe92⤵PID:1700
-
\??\c:\fxfllxx.exec:\fxfllxx.exe93⤵PID:4692
-
\??\c:\7tttnn.exec:\7tttnn.exe94⤵PID:4228
-
\??\c:\djvvd.exec:\djvvd.exe95⤵PID:3988
-
\??\c:\vpdvp.exec:\vpdvp.exe96⤵PID:2760
-
\??\c:\rllfrrf.exec:\rllfrrf.exe97⤵PID:2888
-
\??\c:\tthhbb.exec:\tthhbb.exe98⤵PID:5064
-
\??\c:\pjjdp.exec:\pjjdp.exe99⤵PID:3376
-
\??\c:\xrxxrrx.exec:\xrxxrrx.exe100⤵PID:3224
-
\??\c:\9hnhnh.exec:\9hnhnh.exe101⤵PID:4292
-
\??\c:\vjdvj.exec:\vjdvj.exe102⤵PID:3452
-
\??\c:\rxllrxf.exec:\rxllrxf.exe103⤵PID:2660
-
\??\c:\rrfxrfx.exec:\rrfxrfx.exe104⤵PID:1600
-
\??\c:\bntnhn.exec:\bntnhn.exe105⤵PID:4456
-
\??\c:\jdpjj.exec:\jdpjj.exe106⤵PID:4848
-
\??\c:\fxllfff.exec:\fxllfff.exe107⤵PID:2260
-
\??\c:\5bnttb.exec:\5bnttb.exe108⤵PID:4032
-
\??\c:\bnnhtt.exec:\bnnhtt.exe109⤵PID:3648
-
\??\c:\5pjpd.exec:\5pjpd.exe110⤵PID:2708
-
\??\c:\frrrrxf.exec:\frrrrxf.exe111⤵PID:5084
-
\??\c:\rxxrllf.exec:\rxxrllf.exe112⤵PID:4668
-
\??\c:\tnbnhn.exec:\tnbnhn.exe113⤵PID:2396
-
\??\c:\jjpjj.exec:\jjpjj.exe114⤵PID:1904
-
\??\c:\7rxrrff.exec:\7rxrrff.exe115⤵PID:2008
-
\??\c:\nbnhbb.exec:\nbnhbb.exe116⤵PID:4636
-
\??\c:\5ppjd.exec:\5ppjd.exe117⤵PID:3912
-
\??\c:\vdjvd.exec:\vdjvd.exe118⤵PID:5116
-
\??\c:\frffxrl.exec:\frffxrl.exe119⤵PID:4476
-
\??\c:\9nnhtb.exec:\9nnhtb.exe120⤵PID:4488
-
\??\c:\hbbthh.exec:\hbbthh.exe121⤵PID:4816
-
\??\c:\jjddd.exec:\jjddd.exe122⤵PID:2544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-