Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-01-2025 06:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
59541323c8efdb13556f1e6a72e975ff797e15bc65d68f3e923a122da7066978.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
59541323c8efdb13556f1e6a72e975ff797e15bc65d68f3e923a122da7066978.exe
-
Size
454KB
-
MD5
dfd71456e1da3a0359c4d54ddb8f2fd2
-
SHA1
80cb11e46281acac6e1d13c79cf2c27722f84a64
-
SHA256
59541323c8efdb13556f1e6a72e975ff797e15bc65d68f3e923a122da7066978
-
SHA512
4196833c37abe8aa116b9b8e0ec3e284de1615c569bb45dd4db94b63caa041a4566f1effd422ae01d0994160f09352a7339fdc7050b711a8b7602bb1041ef3b0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbets:q7Tc2NYHUrAwfMp3CDts
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/696-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3828-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/856-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3368-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1324-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/680-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1420-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3380-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/856-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/908-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/992-767-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-807-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-853-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-893-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 964 tnbttt.exe 5012 jvddd.exe 3716 5vvpp.exe 1992 lflrrlf.exe 844 lxlffll.exe 4672 hbntnt.exe 1968 rlrlffx.exe 1220 3nttnn.exe 5084 9rrlfrr.exe 2496 bhtttb.exe 3828 vvvvj.exe 4588 3dpjj.exe 3016 3nnnhn.exe 4796 jdjjj.exe 2992 3nnhtt.exe 632 flrllrl.exe 856 pjvpp.exe 908 ntbnnb.exe 1484 ddvdd.exe 3888 9vddv.exe 3368 ttnhbb.exe 4124 pjdvv.exe 2692 5xxlllf.exe 1324 7jvdv.exe 3632 vdjdv.exe 2420 llllfff.exe 3952 pdjdp.exe 1040 vvjdj.exe 4780 rlrxxxx.exe 2436 1jdvp.exe 4740 flfrxrl.exe 932 7bhhbt.exe 1936 jpvpp.exe 1364 xflfxxx.exe 572 vjvjv.exe 3760 9xfrrrl.exe 1988 htbbtt.exe 4436 pjjdd.exe 4808 lrfxfrx.exe 4408 ffrllfr.exe 1624 1vjdd.exe 3868 rxlffll.exe 4716 frxxrxx.exe 1836 nntnnb.exe 3532 pjvpj.exe 680 lrlxlll.exe 1344 tnnhtn.exe 2872 vppjd.exe 3844 jpjdp.exe 4320 xxxrffr.exe 4480 btbtth.exe 4368 9hbttn.exe 3256 pjjdd.exe 1556 ffrllrl.exe 5112 nhtntt.exe 1532 jdjdv.exe 4488 xrlfrrf.exe 540 7xfrllf.exe 844 bhtnhh.exe 1096 dvddv.exe 4228 xfrllrl.exe 628 ntbhhn.exe 1968 nnbbtt.exe 1220 7djdd.exe -
resource yara_rule behavioral2/memory/696-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3828-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/856-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/680-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3380-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/856-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/908-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/992-767-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-807-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-853-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 696 wrote to memory of 964 696 59541323c8efdb13556f1e6a72e975ff797e15bc65d68f3e923a122da7066978.exe 83 PID 696 wrote to memory of 964 696 59541323c8efdb13556f1e6a72e975ff797e15bc65d68f3e923a122da7066978.exe 83 PID 696 wrote to memory of 964 696 59541323c8efdb13556f1e6a72e975ff797e15bc65d68f3e923a122da7066978.exe 83 PID 964 wrote to memory of 5012 964 tnbttt.exe 84 PID 964 wrote to memory of 5012 964 tnbttt.exe 84 PID 964 wrote to memory of 5012 964 tnbttt.exe 84 PID 5012 wrote to memory of 3716 5012 jvddd.exe 85 PID 5012 wrote to memory of 3716 5012 jvddd.exe 85 PID 5012 wrote to memory of 3716 5012 jvddd.exe 85 PID 3716 wrote to memory of 1992 3716 5vvpp.exe 86 PID 3716 wrote to memory of 1992 3716 5vvpp.exe 86 PID 3716 wrote to memory of 1992 3716 5vvpp.exe 86 PID 1992 wrote to memory of 844 1992 lflrrlf.exe 87 PID 1992 wrote to memory of 844 1992 lflrrlf.exe 87 PID 1992 wrote to memory of 844 1992 lflrrlf.exe 87 PID 844 wrote to memory of 4672 844 lxlffll.exe 88 PID 844 wrote to memory of 4672 844 lxlffll.exe 88 PID 844 wrote to memory of 4672 844 lxlffll.exe 88 PID 4672 wrote to memory of 1968 4672 hbntnt.exe 89 PID 4672 wrote to memory of 1968 4672 hbntnt.exe 89 PID 4672 wrote to memory of 1968 4672 hbntnt.exe 89 PID 1968 wrote to memory of 1220 1968 rlrlffx.exe 90 PID 1968 wrote to memory of 1220 1968 rlrlffx.exe 90 PID 1968 wrote to memory of 1220 1968 rlrlffx.exe 90 PID 1220 wrote to memory of 5084 1220 3nttnn.exe 91 PID 1220 wrote to memory of 5084 1220 3nttnn.exe 91 PID 1220 wrote to memory of 5084 1220 3nttnn.exe 91 PID 5084 wrote to memory of 2496 5084 9rrlfrr.exe 92 PID 5084 wrote to memory of 2496 5084 9rrlfrr.exe 92 PID 5084 wrote to memory of 2496 5084 9rrlfrr.exe 92 PID 2496 wrote to memory of 3828 2496 bhtttb.exe 93 PID 2496 wrote to memory of 3828 2496 bhtttb.exe 93 PID 2496 wrote to memory of 3828 2496 bhtttb.exe 93 PID 3828 wrote to memory of 4588 3828 vvvvj.exe 94 PID 3828 wrote to memory of 4588 3828 vvvvj.exe 94 PID 3828 wrote to memory of 4588 3828 vvvvj.exe 94 PID 4588 wrote to memory of 3016 4588 3dpjj.exe 95 PID 4588 wrote to memory of 3016 4588 3dpjj.exe 95 PID 4588 wrote to memory of 3016 4588 3dpjj.exe 95 PID 3016 wrote to memory of 4796 3016 3nnnhn.exe 96 PID 3016 wrote to memory of 4796 3016 3nnnhn.exe 96 PID 3016 wrote to memory of 4796 3016 3nnnhn.exe 96 PID 4796 wrote to memory of 2992 4796 jdjjj.exe 97 PID 4796 wrote to memory of 2992 4796 jdjjj.exe 97 PID 4796 wrote to memory of 2992 4796 jdjjj.exe 97 PID 2992 wrote to memory of 632 2992 3nnhtt.exe 98 PID 2992 wrote to memory of 632 2992 3nnhtt.exe 98 PID 2992 wrote to memory of 632 2992 3nnhtt.exe 98 PID 632 wrote to memory of 856 632 flrllrl.exe 99 PID 632 wrote to memory of 856 632 flrllrl.exe 99 PID 632 wrote to memory of 856 632 flrllrl.exe 99 PID 856 wrote to memory of 908 856 pjvpp.exe 100 PID 856 wrote to memory of 908 856 pjvpp.exe 100 PID 856 wrote to memory of 908 856 pjvpp.exe 100 PID 908 wrote to memory of 1484 908 ntbnnb.exe 101 PID 908 wrote to memory of 1484 908 ntbnnb.exe 101 PID 908 wrote to memory of 1484 908 ntbnnb.exe 101 PID 1484 wrote to memory of 3888 1484 ddvdd.exe 102 PID 1484 wrote to memory of 3888 1484 ddvdd.exe 102 PID 1484 wrote to memory of 3888 1484 ddvdd.exe 102 PID 3888 wrote to memory of 3368 3888 9vddv.exe 103 PID 3888 wrote to memory of 3368 3888 9vddv.exe 103 PID 3888 wrote to memory of 3368 3888 9vddv.exe 103 PID 3368 wrote to memory of 4124 3368 ttnhbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\59541323c8efdb13556f1e6a72e975ff797e15bc65d68f3e923a122da7066978.exe"C:\Users\Admin\AppData\Local\Temp\59541323c8efdb13556f1e6a72e975ff797e15bc65d68f3e923a122da7066978.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\tnbttt.exec:\tnbttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\jvddd.exec:\jvddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\5vvpp.exec:\5vvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\lflrrlf.exec:\lflrrlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\lxlffll.exec:\lxlffll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\hbntnt.exec:\hbntnt.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\rlrlffx.exec:\rlrlffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\3nttnn.exec:\3nttnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\9rrlfrr.exec:\9rrlfrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\bhtttb.exec:\bhtttb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\vvvvj.exec:\vvvvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\3dpjj.exec:\3dpjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\3nnnhn.exec:\3nnnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\jdjjj.exec:\jdjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\3nnhtt.exec:\3nnhtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\flrllrl.exec:\flrllrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\pjvpp.exec:\pjvpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\ntbnnb.exec:\ntbnnb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\ddvdd.exec:\ddvdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\9vddv.exec:\9vddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\ttnhbb.exec:\ttnhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\pjdvv.exec:\pjdvv.exe23⤵
- Executes dropped EXE
PID:4124 -
\??\c:\5xxlllf.exec:\5xxlllf.exe24⤵
- Executes dropped EXE
PID:2692 -
\??\c:\7jvdv.exec:\7jvdv.exe25⤵
- Executes dropped EXE
PID:1324 -
\??\c:\vdjdv.exec:\vdjdv.exe26⤵
- Executes dropped EXE
PID:3632 -
\??\c:\llllfff.exec:\llllfff.exe27⤵
- Executes dropped EXE
PID:2420 -
\??\c:\pdjdp.exec:\pdjdp.exe28⤵
- Executes dropped EXE
PID:3952 -
\??\c:\vvjdj.exec:\vvjdj.exe29⤵
- Executes dropped EXE
PID:1040 -
\??\c:\rlrxxxx.exec:\rlrxxxx.exe30⤵
- Executes dropped EXE
PID:4780 -
\??\c:\1jdvp.exec:\1jdvp.exe31⤵
- Executes dropped EXE
PID:2436 -
\??\c:\flfrxrl.exec:\flfrxrl.exe32⤵
- Executes dropped EXE
PID:4740 -
\??\c:\7bhhbt.exec:\7bhhbt.exe33⤵
- Executes dropped EXE
PID:932 -
\??\c:\jpvpp.exec:\jpvpp.exe34⤵
- Executes dropped EXE
PID:1936 -
\??\c:\xflfxxx.exec:\xflfxxx.exe35⤵
- Executes dropped EXE
PID:1364 -
\??\c:\vjvjv.exec:\vjvjv.exe36⤵
- Executes dropped EXE
PID:572 -
\??\c:\9xfrrrl.exec:\9xfrrrl.exe37⤵
- Executes dropped EXE
PID:3760 -
\??\c:\htbbtt.exec:\htbbtt.exe38⤵
- Executes dropped EXE
PID:1988 -
\??\c:\pjjdd.exec:\pjjdd.exe39⤵
- Executes dropped EXE
PID:4436 -
\??\c:\lrfxfrx.exec:\lrfxfrx.exe40⤵
- Executes dropped EXE
PID:4808 -
\??\c:\ffrllfr.exec:\ffrllfr.exe41⤵
- Executes dropped EXE
PID:4408 -
\??\c:\1vjdd.exec:\1vjdd.exe42⤵
- Executes dropped EXE
PID:1624 -
\??\c:\rxlffll.exec:\rxlffll.exe43⤵
- Executes dropped EXE
PID:3868 -
\??\c:\frxxrxx.exec:\frxxrxx.exe44⤵
- Executes dropped EXE
PID:4716 -
\??\c:\nntnnb.exec:\nntnnb.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1836 -
\??\c:\pjvpj.exec:\pjvpj.exe46⤵
- Executes dropped EXE
PID:3532 -
\??\c:\lrlxlll.exec:\lrlxlll.exe47⤵
- Executes dropped EXE
PID:680 -
\??\c:\tnnhtn.exec:\tnnhtn.exe48⤵
- Executes dropped EXE
PID:1344 -
\??\c:\vppjd.exec:\vppjd.exe49⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jpjdp.exec:\jpjdp.exe50⤵
- Executes dropped EXE
PID:3844 -
\??\c:\xxxrffr.exec:\xxxrffr.exe51⤵
- Executes dropped EXE
PID:4320 -
\??\c:\btbtth.exec:\btbtth.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4480 -
\??\c:\9hbttn.exec:\9hbttn.exe53⤵
- Executes dropped EXE
PID:4368 -
\??\c:\pjjdd.exec:\pjjdd.exe54⤵
- Executes dropped EXE
PID:3256 -
\??\c:\ffrllrl.exec:\ffrllrl.exe55⤵
- Executes dropped EXE
PID:1556 -
\??\c:\nhtntt.exec:\nhtntt.exe56⤵
- Executes dropped EXE
PID:5112 -
\??\c:\jdjdv.exec:\jdjdv.exe57⤵
- Executes dropped EXE
PID:1532 -
\??\c:\xrlfrrf.exec:\xrlfrrf.exe58⤵
- Executes dropped EXE
PID:4488 -
\??\c:\7xfrllf.exec:\7xfrllf.exe59⤵
- Executes dropped EXE
PID:540 -
\??\c:\bhtnhh.exec:\bhtnhh.exe60⤵
- Executes dropped EXE
PID:844 -
\??\c:\dvddv.exec:\dvddv.exe61⤵
- Executes dropped EXE
PID:1096 -
\??\c:\xfrllrl.exec:\xfrllrl.exe62⤵
- Executes dropped EXE
PID:4228 -
\??\c:\ntbhhn.exec:\ntbhhn.exe63⤵
- Executes dropped EXE
PID:628 -
\??\c:\nnbbtt.exec:\nnbbtt.exe64⤵
- Executes dropped EXE
PID:1968 -
\??\c:\7djdd.exec:\7djdd.exe65⤵
- Executes dropped EXE
PID:1220 -
\??\c:\lrllfff.exec:\lrllfff.exe66⤵PID:5084
-
\??\c:\btbtbt.exec:\btbtbt.exe67⤵PID:1496
-
\??\c:\dvddd.exec:\dvddd.exe68⤵PID:3588
-
\??\c:\3xrrllf.exec:\3xrrllf.exe69⤵PID:3828
-
\??\c:\bttnnn.exec:\bttnnn.exe70⤵PID:4588
-
\??\c:\vpjpd.exec:\vpjpd.exe71⤵PID:2184
-
\??\c:\rlrlxrx.exec:\rlrlxrx.exe72⤵PID:2632
-
\??\c:\nbbtnh.exec:\nbbtnh.exe73⤵PID:1724
-
\??\c:\1pjdv.exec:\1pjdv.exe74⤵PID:3936
-
\??\c:\3flfllr.exec:\3flfllr.exe75⤵PID:4200
-
\??\c:\lflfxxr.exec:\lflfxxr.exe76⤵PID:396
-
\??\c:\hnbtbb.exec:\hnbtbb.exe77⤵PID:1484
-
\??\c:\dvdvv.exec:\dvdvv.exe78⤵PID:5056
-
\??\c:\lxrfxxr.exec:\lxrfxxr.exe79⤵PID:2208
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe80⤵PID:220
-
\??\c:\5ntnnn.exec:\5ntnnn.exe81⤵PID:2736
-
\??\c:\3vdvj.exec:\3vdvj.exe82⤵PID:4192
-
\??\c:\rflfrlf.exec:\rflfrlf.exe83⤵PID:1148
-
\??\c:\hhhbtt.exec:\hhhbtt.exe84⤵PID:3448
-
\??\c:\nhtnhh.exec:\nhtnhh.exe85⤵PID:4352
-
\??\c:\vjvpd.exec:\vjvpd.exe86⤵PID:3944
-
\??\c:\llxrxxf.exec:\llxrxxf.exe87⤵PID:1012
-
\??\c:\9ttnhh.exec:\9ttnhh.exe88⤵PID:4416
-
\??\c:\ttnnhh.exec:\ttnnhh.exe89⤵PID:2828
-
\??\c:\pjjdd.exec:\pjjdd.exe90⤵PID:5116
-
\??\c:\flrfxxr.exec:\flrfxxr.exe91⤵PID:5044
-
\??\c:\ttthhb.exec:\ttthhb.exe92⤵PID:804
-
\??\c:\5tnnhn.exec:\5tnnhn.exe93⤵PID:1064
-
\??\c:\3dddv.exec:\3dddv.exe94⤵PID:4496
-
\??\c:\3xrrlrl.exec:\3xrrlrl.exe95⤵PID:1440
-
\??\c:\tnbbtt.exec:\tnbbtt.exe96⤵PID:3480
-
\??\c:\hbtnhb.exec:\hbtnhb.exe97⤵PID:2444
-
\??\c:\jdjjj.exec:\jdjjj.exe98⤵PID:1372
-
\??\c:\tnbnhh.exec:\tnbnhh.exe99⤵PID:1380
-
\??\c:\5pvpd.exec:\5pvpd.exe100⤵PID:1420
-
\??\c:\ffrlxxx.exec:\ffrlxxx.exe101⤵PID:2860
-
\??\c:\nhhhht.exec:\nhhhht.exe102⤵PID:3380
-
\??\c:\pvjdv.exec:\pvjdv.exe103⤵
- System Location Discovery: System Language Discovery
PID:4696 -
\??\c:\5dvpj.exec:\5dvpj.exe104⤵PID:3868
-
\??\c:\xxxrffx.exec:\xxxrffx.exe105⤵PID:4716
-
\??\c:\bnthbt.exec:\bnthbt.exe106⤵PID:1836
-
\??\c:\jjppd.exec:\jjppd.exe107⤵PID:2988
-
\??\c:\pdjvp.exec:\pdjvp.exe108⤵PID:680
-
\??\c:\xrlrffx.exec:\xrlrffx.exe109⤵PID:1344
-
\??\c:\bbbnhh.exec:\bbbnhh.exe110⤵PID:4172
-
\??\c:\tnnhbb.exec:\tnnhbb.exe111⤵PID:1684
-
\??\c:\djvpj.exec:\djvpj.exe112⤵PID:4312
-
\??\c:\rlrlllf.exec:\rlrlllf.exe113⤵PID:2824
-
\??\c:\9lllffx.exec:\9lllffx.exe114⤵PID:3624
-
\??\c:\3tnhhh.exec:\3tnhhh.exe115⤵PID:4368
-
\??\c:\pddvp.exec:\pddvp.exe116⤵PID:3256
-
\??\c:\rrfxlxx.exec:\rrfxlxx.exe117⤵PID:1556
-
\??\c:\5bbttt.exec:\5bbttt.exe118⤵PID:3716
-
\??\c:\bhtnhh.exec:\bhtnhh.exe119⤵PID:4832
-
\??\c:\ppvpd.exec:\ppvpd.exe120⤵PID:1576
-
\??\c:\llxrffx.exec:\llxrffx.exe121⤵PID:4848
-
\??\c:\rflffxf.exec:\rflffxf.exe122⤵PID:1104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-