Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 03:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c5f1a42519efbb482ea4f7e5e5735a4329c448e5c6428827987cefc8d626b4ac.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
c5f1a42519efbb482ea4f7e5e5735a4329c448e5c6428827987cefc8d626b4ac.exe
-
Size
456KB
-
MD5
ef57657e36a02b78ecc11f73d7e6d425
-
SHA1
03a2dec8fb08b08e93aa039ee2219acd0dde2d5f
-
SHA256
c5f1a42519efbb482ea4f7e5e5735a4329c448e5c6428827987cefc8d626b4ac
-
SHA512
d8700a3429551d42208ff99fe98672650a53292675295208b211a9263bc6563ff8b5f5fd23d50cca2d376fc5630f1650ceb0362a1bed4722ad8cd495b8053edc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRX:q7Tc2NYHUrAwfMp3CDRX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1268-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/324-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/460-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3288-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/664-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1296-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3288-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-706-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-845-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-1015-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-1724-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 452 hbhbtt.exe 4068 1vvvv.exe 4872 rrxxxrr.exe 3512 rffxrrl.exe 324 thhnbb.exe 4832 rxffffl.exe 1744 rxlflrx.exe 460 jddvp.exe 2440 flrrrrx.exe 2724 3ppjd.exe 3288 thhbtt.exe 4616 lxfxrlf.exe 3224 bbhnnt.exe 2800 nhnnhh.exe 1620 7pvpp.exe 5108 9rxrrrl.exe 4696 jjpvp.exe 3136 lrlfffx.exe 2920 3djdd.exe 1196 btttnn.exe 2820 jvdvv.exe 4508 3dddv.exe 664 xflrrxx.exe 1012 nthtnb.exe 1180 9jjjj.exe 2856 bthhnn.exe 3064 1jjjd.exe 2760 7lxrxxf.exe 3660 hnttnn.exe 3408 7nhbhn.exe 2088 nhhbtb.exe 3696 jddjd.exe 2404 ntbnhn.exe 1992 ddjjj.exe 1376 fflrxxl.exe 2380 vpddj.exe 3068 xrrrlll.exe 4660 bhnnnn.exe 4516 vpjvj.exe 4500 jdpjj.exe 4564 flfxrrr.exe 3260 bhnhhh.exe 3420 fxllfll.exe 4088 htbbtt.exe 228 thbbhh.exe 2200 jdjpj.exe 1732 5lrllxx.exe 3512 tnnhnn.exe 1296 bnbtnn.exe 4880 vvjdj.exe 4864 rxrrllf.exe 3692 rxlfxrl.exe 4800 nnhnhh.exe 2796 jdppv.exe 1696 7rrrrxx.exe 1828 bhnnhn.exe 4044 jdvpj.exe 3272 lffffxx.exe 2440 thhhhh.exe 3472 vdpdd.exe 2452 fxffxxx.exe 3288 nhhhbb.exe 5004 jvddv.exe 404 9jppj.exe -
resource yara_rule behavioral2/memory/1268-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/324-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/460-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3288-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/664-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1296-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3288-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-706-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1268 wrote to memory of 452 1268 c5f1a42519efbb482ea4f7e5e5735a4329c448e5c6428827987cefc8d626b4ac.exe 83 PID 1268 wrote to memory of 452 1268 c5f1a42519efbb482ea4f7e5e5735a4329c448e5c6428827987cefc8d626b4ac.exe 83 PID 1268 wrote to memory of 452 1268 c5f1a42519efbb482ea4f7e5e5735a4329c448e5c6428827987cefc8d626b4ac.exe 83 PID 452 wrote to memory of 4068 452 hbhbtt.exe 84 PID 452 wrote to memory of 4068 452 hbhbtt.exe 84 PID 452 wrote to memory of 4068 452 hbhbtt.exe 84 PID 4068 wrote to memory of 4872 4068 1vvvv.exe 85 PID 4068 wrote to memory of 4872 4068 1vvvv.exe 85 PID 4068 wrote to memory of 4872 4068 1vvvv.exe 85 PID 4872 wrote to memory of 3512 4872 rrxxxrr.exe 86 PID 4872 wrote to memory of 3512 4872 rrxxxrr.exe 86 PID 4872 wrote to memory of 3512 4872 rrxxxrr.exe 86 PID 3512 wrote to memory of 324 3512 rffxrrl.exe 87 PID 3512 wrote to memory of 324 3512 rffxrrl.exe 87 PID 3512 wrote to memory of 324 3512 rffxrrl.exe 87 PID 324 wrote to memory of 4832 324 thhnbb.exe 88 PID 324 wrote to memory of 4832 324 thhnbb.exe 88 PID 324 wrote to memory of 4832 324 thhnbb.exe 88 PID 4832 wrote to memory of 1744 4832 rxffffl.exe 89 PID 4832 wrote to memory of 1744 4832 rxffffl.exe 89 PID 4832 wrote to memory of 1744 4832 rxffffl.exe 89 PID 1744 wrote to memory of 460 1744 rxlflrx.exe 90 PID 1744 wrote to memory of 460 1744 rxlflrx.exe 90 PID 1744 wrote to memory of 460 1744 rxlflrx.exe 90 PID 460 wrote to memory of 2440 460 jddvp.exe 91 PID 460 wrote to memory of 2440 460 jddvp.exe 91 PID 460 wrote to memory of 2440 460 jddvp.exe 91 PID 2440 wrote to memory of 2724 2440 flrrrrx.exe 92 PID 2440 wrote to memory of 2724 2440 flrrrrx.exe 92 PID 2440 wrote to memory of 2724 2440 flrrrrx.exe 92 PID 2724 wrote to memory of 3288 2724 3ppjd.exe 93 PID 2724 wrote to memory of 3288 2724 3ppjd.exe 93 PID 2724 wrote to memory of 3288 2724 3ppjd.exe 93 PID 3288 wrote to memory of 4616 3288 thhbtt.exe 94 PID 3288 wrote to memory of 4616 3288 thhbtt.exe 94 PID 3288 wrote to memory of 4616 3288 thhbtt.exe 94 PID 4616 wrote to memory of 3224 4616 lxfxrlf.exe 95 PID 4616 wrote to memory of 3224 4616 lxfxrlf.exe 95 PID 4616 wrote to memory of 3224 4616 lxfxrlf.exe 95 PID 3224 wrote to memory of 2800 3224 bbhnnt.exe 96 PID 3224 wrote to memory of 2800 3224 bbhnnt.exe 96 PID 3224 wrote to memory of 2800 3224 bbhnnt.exe 96 PID 2800 wrote to memory of 1620 2800 nhnnhh.exe 97 PID 2800 wrote to memory of 1620 2800 nhnnhh.exe 97 PID 2800 wrote to memory of 1620 2800 nhnnhh.exe 97 PID 1620 wrote to memory of 5108 1620 7pvpp.exe 98 PID 1620 wrote to memory of 5108 1620 7pvpp.exe 98 PID 1620 wrote to memory of 5108 1620 7pvpp.exe 98 PID 5108 wrote to memory of 4696 5108 9rxrrrl.exe 99 PID 5108 wrote to memory of 4696 5108 9rxrrrl.exe 99 PID 5108 wrote to memory of 4696 5108 9rxrrrl.exe 99 PID 4696 wrote to memory of 3136 4696 jjpvp.exe 100 PID 4696 wrote to memory of 3136 4696 jjpvp.exe 100 PID 4696 wrote to memory of 3136 4696 jjpvp.exe 100 PID 3136 wrote to memory of 2920 3136 lrlfffx.exe 101 PID 3136 wrote to memory of 2920 3136 lrlfffx.exe 101 PID 3136 wrote to memory of 2920 3136 lrlfffx.exe 101 PID 2920 wrote to memory of 1196 2920 3djdd.exe 102 PID 2920 wrote to memory of 1196 2920 3djdd.exe 102 PID 2920 wrote to memory of 1196 2920 3djdd.exe 102 PID 1196 wrote to memory of 2820 1196 btttnn.exe 103 PID 1196 wrote to memory of 2820 1196 btttnn.exe 103 PID 1196 wrote to memory of 2820 1196 btttnn.exe 103 PID 2820 wrote to memory of 4508 2820 jvdvv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5f1a42519efbb482ea4f7e5e5735a4329c448e5c6428827987cefc8d626b4ac.exe"C:\Users\Admin\AppData\Local\Temp\c5f1a42519efbb482ea4f7e5e5735a4329c448e5c6428827987cefc8d626b4ac.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\hbhbtt.exec:\hbhbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\1vvvv.exec:\1vvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\rrxxxrr.exec:\rrxxxrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\rffxrrl.exec:\rffxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\thhnbb.exec:\thhnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\rxffffl.exec:\rxffffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\rxlflrx.exec:\rxlflrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\jddvp.exec:\jddvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
\??\c:\flrrrrx.exec:\flrrrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\3ppjd.exec:\3ppjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\thhbtt.exec:\thhbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\bbhnnt.exec:\bbhnnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\nhnnhh.exec:\nhnnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\7pvpp.exec:\7pvpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\9rxrrrl.exec:\9rxrrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\jjpvp.exec:\jjpvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\lrlfffx.exec:\lrlfffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\3djdd.exec:\3djdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\btttnn.exec:\btttnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\jvdvv.exec:\jvdvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\3dddv.exec:\3dddv.exe23⤵
- Executes dropped EXE
PID:4508 -
\??\c:\xflrrxx.exec:\xflrrxx.exe24⤵
- Executes dropped EXE
PID:664 -
\??\c:\nthtnb.exec:\nthtnb.exe25⤵
- Executes dropped EXE
PID:1012 -
\??\c:\9jjjj.exec:\9jjjj.exe26⤵
- Executes dropped EXE
PID:1180 -
\??\c:\bthhnn.exec:\bthhnn.exe27⤵
- Executes dropped EXE
PID:2856 -
\??\c:\1jjjd.exec:\1jjjd.exe28⤵
- Executes dropped EXE
PID:3064 -
\??\c:\7lxrxxf.exec:\7lxrxxf.exe29⤵
- Executes dropped EXE
PID:2760 -
\??\c:\hnttnn.exec:\hnttnn.exe30⤵
- Executes dropped EXE
PID:3660 -
\??\c:\7nhbhn.exec:\7nhbhn.exe31⤵
- Executes dropped EXE
PID:3408 -
\??\c:\nhhbtb.exec:\nhhbtb.exe32⤵
- Executes dropped EXE
PID:2088 -
\??\c:\jddjd.exec:\jddjd.exe33⤵
- Executes dropped EXE
PID:3696 -
\??\c:\ntbnhn.exec:\ntbnhn.exe34⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ddjjj.exec:\ddjjj.exe35⤵
- Executes dropped EXE
PID:1992 -
\??\c:\fflrxxl.exec:\fflrxxl.exe36⤵
- Executes dropped EXE
PID:1376 -
\??\c:\vpddj.exec:\vpddj.exe37⤵
- Executes dropped EXE
PID:2380 -
\??\c:\xrrrlll.exec:\xrrrlll.exe38⤵
- Executes dropped EXE
PID:3068 -
\??\c:\bhnnnn.exec:\bhnnnn.exe39⤵
- Executes dropped EXE
PID:4660 -
\??\c:\vpjvj.exec:\vpjvj.exe40⤵
- Executes dropped EXE
PID:4516 -
\??\c:\jdpjj.exec:\jdpjj.exe41⤵
- Executes dropped EXE
PID:4500 -
\??\c:\flfxrrr.exec:\flfxrrr.exe42⤵
- Executes dropped EXE
PID:4564 -
\??\c:\bhnhhh.exec:\bhnhhh.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3260 -
\??\c:\fxllfll.exec:\fxllfll.exe44⤵
- Executes dropped EXE
PID:3420 -
\??\c:\htbbtt.exec:\htbbtt.exe45⤵
- Executes dropped EXE
PID:4088 -
\??\c:\thbbhh.exec:\thbbhh.exe46⤵
- Executes dropped EXE
PID:228 -
\??\c:\jdjpj.exec:\jdjpj.exe47⤵
- Executes dropped EXE
PID:2200 -
\??\c:\5lrllxx.exec:\5lrllxx.exe48⤵
- Executes dropped EXE
PID:1732 -
\??\c:\tnnhnn.exec:\tnnhnn.exe49⤵
- Executes dropped EXE
PID:3512 -
\??\c:\bnbtnn.exec:\bnbtnn.exe50⤵
- Executes dropped EXE
PID:1296 -
\??\c:\vvjdj.exec:\vvjdj.exe51⤵
- Executes dropped EXE
PID:4880 -
\??\c:\rxrrllf.exec:\rxrrllf.exe52⤵
- Executes dropped EXE
PID:4864 -
\??\c:\rxlfxrl.exec:\rxlfxrl.exe53⤵
- Executes dropped EXE
PID:3692 -
\??\c:\nnhnhh.exec:\nnhnhh.exe54⤵
- Executes dropped EXE
PID:4800 -
\??\c:\jdppv.exec:\jdppv.exe55⤵
- Executes dropped EXE
PID:2796 -
\??\c:\7rrrrxx.exec:\7rrrrxx.exe56⤵
- Executes dropped EXE
PID:1696 -
\??\c:\bhnnhn.exec:\bhnnhn.exe57⤵
- Executes dropped EXE
PID:1828 -
\??\c:\jdvpj.exec:\jdvpj.exe58⤵
- Executes dropped EXE
PID:4044 -
\??\c:\lffffxx.exec:\lffffxx.exe59⤵
- Executes dropped EXE
PID:3272 -
\??\c:\thhhhh.exec:\thhhhh.exe60⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vdpdd.exec:\vdpdd.exe61⤵
- Executes dropped EXE
PID:3472 -
\??\c:\fxffxxx.exec:\fxffxxx.exe62⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nhhhbb.exec:\nhhhbb.exe63⤵
- Executes dropped EXE
PID:3288 -
\??\c:\jvddv.exec:\jvddv.exe64⤵
- Executes dropped EXE
PID:5004 -
\??\c:\9jppj.exec:\9jppj.exe65⤵
- Executes dropped EXE
PID:404 -
\??\c:\llxxxff.exec:\llxxxff.exe66⤵PID:1740
-
\??\c:\nhttnt.exec:\nhttnt.exe67⤵PID:1212
-
\??\c:\ppjpj.exec:\ppjpj.exe68⤵PID:4148
-
\??\c:\djvvd.exec:\djvvd.exe69⤵PID:3300
-
\??\c:\rlrlfff.exec:\rlrlfff.exe70⤵PID:4948
-
\??\c:\nthbbb.exec:\nthbbb.exe71⤵PID:4524
-
\??\c:\dpvpj.exec:\dpvpj.exe72⤵PID:5000
-
\??\c:\djvpp.exec:\djvpp.exe73⤵PID:1092
-
\??\c:\rxrxxfr.exec:\rxrxxfr.exe74⤵PID:3988
-
\??\c:\nhhhbb.exec:\nhhhbb.exe75⤵PID:1472
-
\??\c:\jdjjd.exec:\jdjjd.exe76⤵PID:2288
-
\??\c:\xrffflf.exec:\xrffflf.exe77⤵PID:2768
-
\??\c:\1hbbbb.exec:\1hbbbb.exe78⤵PID:2396
-
\??\c:\vjpjd.exec:\vjpjd.exe79⤵PID:464
-
\??\c:\xrxflrr.exec:\xrxflrr.exe80⤵PID:3760
-
\??\c:\xxfrrff.exec:\xxfrrff.exe81⤵PID:4380
-
\??\c:\nhnttt.exec:\nhnttt.exe82⤵PID:3960
-
\??\c:\3pppp.exec:\3pppp.exe83⤵PID:2132
-
\??\c:\pdjdd.exec:\pdjdd.exe84⤵PID:3284
-
\??\c:\rlrrrxr.exec:\rlrrrxr.exe85⤵PID:2344
-
\??\c:\tnbbbh.exec:\tnbbbh.exe86⤵PID:4884
-
\??\c:\vvdvv.exec:\vvdvv.exe87⤵PID:2760
-
\??\c:\lfllflf.exec:\lfllflf.exe88⤵PID:2556
-
\??\c:\hthhhh.exec:\hthhhh.exe89⤵PID:4316
-
\??\c:\jvvpp.exec:\jvvpp.exe90⤵PID:4452
-
\??\c:\frlxxlf.exec:\frlxxlf.exe91⤵PID:4572
-
\??\c:\hhbhbt.exec:\hhbhbt.exe92⤵PID:4224
-
\??\c:\3vpjd.exec:\3vpjd.exe93⤵PID:808
-
\??\c:\lrlfrrx.exec:\lrlfrrx.exe94⤵PID:544
-
\??\c:\htttnn.exec:\htttnn.exe95⤵PID:448
-
\??\c:\tnbbtn.exec:\tnbbtn.exe96⤵PID:3608
-
\??\c:\3pvvv.exec:\3pvvv.exe97⤵PID:3228
-
\??\c:\lxllffx.exec:\lxllffx.exe98⤵PID:2612
-
\??\c:\ntnbtt.exec:\ntnbtt.exe99⤵PID:3564
-
\??\c:\5ddjd.exec:\5ddjd.exe100⤵PID:4360
-
\??\c:\vpvpp.exec:\vpvpp.exe101⤵PID:4368
-
\??\c:\rxrrrxx.exec:\rxrrrxx.exe102⤵PID:1268
-
\??\c:\bnhttt.exec:\bnhttt.exe103⤵PID:4500
-
\??\c:\1ppjp.exec:\1ppjp.exe104⤵PID:4836
-
\??\c:\dvddv.exec:\dvddv.exe105⤵PID:1968
-
\??\c:\1ffxrxr.exec:\1ffxrxr.exe106⤵PID:884
-
\??\c:\nhnntt.exec:\nhnntt.exe107⤵PID:4236
-
\??\c:\jjjjp.exec:\jjjjp.exe108⤵PID:3688
-
\??\c:\1fflfrl.exec:\1fflfrl.exe109⤵PID:4332
-
\??\c:\3lrllll.exec:\3lrllll.exe110⤵PID:1512
-
\??\c:\bbnnhn.exec:\bbnnhn.exe111⤵PID:3096
-
\??\c:\ppjdd.exec:\ppjdd.exe112⤵PID:3112
-
\??\c:\5lffxfx.exec:\5lffxfx.exe113⤵PID:3104
-
\??\c:\tttnnn.exec:\tttnnn.exe114⤵PID:4832
-
\??\c:\pdpjj.exec:\pdpjj.exe115⤵PID:3692
-
\??\c:\rlrlffx.exec:\rlrlffx.exe116⤵PID:2840
-
\??\c:\5thbtt.exec:\5thbtt.exe117⤵PID:4920
-
\??\c:\ttnnbb.exec:\ttnnbb.exe118⤵PID:760
-
\??\c:\rxrflfl.exec:\rxrflfl.exe119⤵PID:1392
-
\??\c:\flfrfxr.exec:\flfrfxr.exe120⤵PID:4824
-
\??\c:\3bnhbh.exec:\3bnhbh.exe121⤵PID:1784
-
\??\c:\5vdvp.exec:\5vdvp.exe122⤵PID:1672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-