Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2025, 09:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
502611ffa62de335070d66fd0772b7f4a33ff9d6b3ccca7270753eebd8a13a38.exe
Resource
win7-20240729-en
7 signatures
120 seconds
General
-
Target
502611ffa62de335070d66fd0772b7f4a33ff9d6b3ccca7270753eebd8a13a38.exe
-
Size
454KB
-
MD5
522e437c8aa81aaea975f4c8bbb08dc5
-
SHA1
8607b4fcff4f3c28a0faec18437802e6af25c07a
-
SHA256
502611ffa62de335070d66fd0772b7f4a33ff9d6b3ccca7270753eebd8a13a38
-
SHA512
2a06d4a7df5545c43044d96450206ae298c2a4ffd70b48dbd16595eb677a71ad28c8d4406acfb50f9c05d374d45a1536fd0922af0d1f9f3d54b659d2cd163357
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeM:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1356-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/736-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1768-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2560-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1420-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1336-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1588-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3352-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/668-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-649-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-751-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-788-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 644 httttt.exe 1112 bhntnn.exe 2932 fxlllfx.exe 2208 9hnhnh.exe 4864 xfrfxxx.exe 3324 1nbttt.exe 4632 bttttt.exe 3056 rffxlxr.exe 3588 9frlrrr.exe 2592 pvdvv.exe 2060 xxfxlfx.exe 392 dpddd.exe 2796 xlrrrxf.exe 5016 hhnbnb.exe 2024 vjdvj.exe 4364 1tbtnn.exe 2696 pdpvv.exe 5080 nbhbtb.exe 736 rfrrrxr.exe 440 5flrrxr.exe 4396 lrllrrx.exe 1020 ntnbhb.exe 4176 djdpv.exe 1768 vdppp.exe 4712 jdpvv.exe 2424 bhhhhh.exe 4804 jddpj.exe 2740 xfrlxlf.exe 4944 3ddvv.exe 4732 nhnbhn.exe 1712 jpjpv.exe 228 fllfxrl.exe 1056 1jpjv.exe 3508 9hnnhh.exe 1568 djdvp.exe 2560 hhnhnn.exe 4524 vvvvj.exe 3916 1xxxrrl.exe 1420 3thhbb.exe 1060 jjppd.exe 3912 frrlxxl.exe 2152 bhtbnn.exe 1912 dvjjd.exe 3524 frxxfll.exe 2308 vddvj.exe 1396 vvjdj.exe 4564 1bthbh.exe 1520 pdpjd.exe 4400 lffffxx.exe 3052 tnttnt.exe 1016 jdvvv.exe 5048 llrrrxx.exe 2904 btbhtb.exe 1336 jjvpj.exe 1340 fxllfff.exe 4168 tbhbbb.exe 464 jdjjj.exe 2352 llfllfl.exe 3944 hhnnht.exe 4848 pjjjj.exe 3692 llxrlll.exe 4632 bnttnh.exe 3644 dvpjj.exe 5104 lrrllxr.exe -
resource yara_rule behavioral2/memory/1356-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/736-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1712-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1568-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2560-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1336-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1588-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3352-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/668-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-663-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1356 wrote to memory of 644 1356 502611ffa62de335070d66fd0772b7f4a33ff9d6b3ccca7270753eebd8a13a38.exe 82 PID 1356 wrote to memory of 644 1356 502611ffa62de335070d66fd0772b7f4a33ff9d6b3ccca7270753eebd8a13a38.exe 82 PID 1356 wrote to memory of 644 1356 502611ffa62de335070d66fd0772b7f4a33ff9d6b3ccca7270753eebd8a13a38.exe 82 PID 644 wrote to memory of 1112 644 httttt.exe 83 PID 644 wrote to memory of 1112 644 httttt.exe 83 PID 644 wrote to memory of 1112 644 httttt.exe 83 PID 1112 wrote to memory of 2932 1112 bhntnn.exe 84 PID 1112 wrote to memory of 2932 1112 bhntnn.exe 84 PID 1112 wrote to memory of 2932 1112 bhntnn.exe 84 PID 2932 wrote to memory of 2208 2932 fxlllfx.exe 85 PID 2932 wrote to memory of 2208 2932 fxlllfx.exe 85 PID 2932 wrote to memory of 2208 2932 fxlllfx.exe 85 PID 2208 wrote to memory of 4864 2208 9hnhnh.exe 86 PID 2208 wrote to memory of 4864 2208 9hnhnh.exe 86 PID 2208 wrote to memory of 4864 2208 9hnhnh.exe 86 PID 4864 wrote to memory of 3324 4864 xfrfxxx.exe 87 PID 4864 wrote to memory of 3324 4864 xfrfxxx.exe 87 PID 4864 wrote to memory of 3324 4864 xfrfxxx.exe 87 PID 3324 wrote to memory of 4632 3324 1nbttt.exe 88 PID 3324 wrote to memory of 4632 3324 1nbttt.exe 88 PID 3324 wrote to memory of 4632 3324 1nbttt.exe 88 PID 4632 wrote to memory of 3056 4632 bttttt.exe 89 PID 4632 wrote to memory of 3056 4632 bttttt.exe 89 PID 4632 wrote to memory of 3056 4632 bttttt.exe 89 PID 3056 wrote to memory of 3588 3056 rffxlxr.exe 90 PID 3056 wrote to memory of 3588 3056 rffxlxr.exe 90 PID 3056 wrote to memory of 3588 3056 rffxlxr.exe 90 PID 3588 wrote to memory of 2592 3588 9frlrrr.exe 91 PID 3588 wrote to memory of 2592 3588 9frlrrr.exe 91 PID 3588 wrote to memory of 2592 3588 9frlrrr.exe 91 PID 2592 wrote to memory of 2060 2592 pvdvv.exe 92 PID 2592 wrote to memory of 2060 2592 pvdvv.exe 92 PID 2592 wrote to memory of 2060 2592 pvdvv.exe 92 PID 2060 wrote to memory of 392 2060 xxfxlfx.exe 93 PID 2060 wrote to memory of 392 2060 xxfxlfx.exe 93 PID 2060 wrote to memory of 392 2060 xxfxlfx.exe 93 PID 392 wrote to memory of 2796 392 dpddd.exe 94 PID 392 wrote to memory of 2796 392 dpddd.exe 94 PID 392 wrote to memory of 2796 392 dpddd.exe 94 PID 2796 wrote to memory of 5016 2796 xlrrrxf.exe 95 PID 2796 wrote to memory of 5016 2796 xlrrrxf.exe 95 PID 2796 wrote to memory of 5016 2796 xlrrrxf.exe 95 PID 5016 wrote to memory of 2024 5016 hhnbnb.exe 96 PID 5016 wrote to memory of 2024 5016 hhnbnb.exe 96 PID 5016 wrote to memory of 2024 5016 hhnbnb.exe 96 PID 2024 wrote to memory of 4364 2024 vjdvj.exe 97 PID 2024 wrote to memory of 4364 2024 vjdvj.exe 97 PID 2024 wrote to memory of 4364 2024 vjdvj.exe 97 PID 4364 wrote to memory of 2696 4364 1tbtnn.exe 98 PID 4364 wrote to memory of 2696 4364 1tbtnn.exe 98 PID 4364 wrote to memory of 2696 4364 1tbtnn.exe 98 PID 2696 wrote to memory of 5080 2696 pdpvv.exe 99 PID 2696 wrote to memory of 5080 2696 pdpvv.exe 99 PID 2696 wrote to memory of 5080 2696 pdpvv.exe 99 PID 5080 wrote to memory of 736 5080 nbhbtb.exe 100 PID 5080 wrote to memory of 736 5080 nbhbtb.exe 100 PID 5080 wrote to memory of 736 5080 nbhbtb.exe 100 PID 736 wrote to memory of 440 736 rfrrrxr.exe 101 PID 736 wrote to memory of 440 736 rfrrrxr.exe 101 PID 736 wrote to memory of 440 736 rfrrrxr.exe 101 PID 440 wrote to memory of 4396 440 5flrrxr.exe 102 PID 440 wrote to memory of 4396 440 5flrrxr.exe 102 PID 440 wrote to memory of 4396 440 5flrrxr.exe 102 PID 4396 wrote to memory of 1020 4396 lrllrrx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\502611ffa62de335070d66fd0772b7f4a33ff9d6b3ccca7270753eebd8a13a38.exe"C:\Users\Admin\AppData\Local\Temp\502611ffa62de335070d66fd0772b7f4a33ff9d6b3ccca7270753eebd8a13a38.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\httttt.exec:\httttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\bhntnn.exec:\bhntnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\fxlllfx.exec:\fxlllfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\9hnhnh.exec:\9hnhnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\xfrfxxx.exec:\xfrfxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\1nbttt.exec:\1nbttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\bttttt.exec:\bttttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\rffxlxr.exec:\rffxlxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\9frlrrr.exec:\9frlrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\pvdvv.exec:\pvdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\xxfxlfx.exec:\xxfxlfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\dpddd.exec:\dpddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\xlrrrxf.exec:\xlrrrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\hhnbnb.exec:\hhnbnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\vjdvj.exec:\vjdvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\1tbtnn.exec:\1tbtnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\pdpvv.exec:\pdpvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\nbhbtb.exec:\nbhbtb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\rfrrrxr.exec:\rfrrrxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\5flrrxr.exec:\5flrrxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\lrllrrx.exec:\lrllrrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\ntnbhb.exec:\ntnbhb.exe23⤵
- Executes dropped EXE
PID:1020 -
\??\c:\djdpv.exec:\djdpv.exe24⤵
- Executes dropped EXE
PID:4176 -
\??\c:\vdppp.exec:\vdppp.exe25⤵
- Executes dropped EXE
PID:1768 -
\??\c:\jdpvv.exec:\jdpvv.exe26⤵
- Executes dropped EXE
PID:4712 -
\??\c:\bhhhhh.exec:\bhhhhh.exe27⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jddpj.exec:\jddpj.exe28⤵
- Executes dropped EXE
PID:4804 -
\??\c:\xfrlxlf.exec:\xfrlxlf.exe29⤵
- Executes dropped EXE
PID:2740 -
\??\c:\3ddvv.exec:\3ddvv.exe30⤵
- Executes dropped EXE
PID:4944 -
\??\c:\nhnbhn.exec:\nhnbhn.exe31⤵
- Executes dropped EXE
PID:4732 -
\??\c:\jpjpv.exec:\jpjpv.exe32⤵
- Executes dropped EXE
PID:1712 -
\??\c:\fllfxrl.exec:\fllfxrl.exe33⤵
- Executes dropped EXE
PID:228 -
\??\c:\1jpjv.exec:\1jpjv.exe34⤵
- Executes dropped EXE
PID:1056 -
\??\c:\9hnnhh.exec:\9hnnhh.exe35⤵
- Executes dropped EXE
PID:3508 -
\??\c:\djdvp.exec:\djdvp.exe36⤵
- Executes dropped EXE
PID:1568 -
\??\c:\hhnhnn.exec:\hhnhnn.exe37⤵
- Executes dropped EXE
PID:2560 -
\??\c:\vvvvj.exec:\vvvvj.exe38⤵
- Executes dropped EXE
PID:4524 -
\??\c:\1xxxrrl.exec:\1xxxrrl.exe39⤵
- Executes dropped EXE
PID:3916 -
\??\c:\3thhbb.exec:\3thhbb.exe40⤵
- Executes dropped EXE
PID:1420 -
\??\c:\jjppd.exec:\jjppd.exe41⤵
- Executes dropped EXE
PID:1060 -
\??\c:\frrlxxl.exec:\frrlxxl.exe42⤵
- Executes dropped EXE
PID:3912 -
\??\c:\bhtbnn.exec:\bhtbnn.exe43⤵
- Executes dropped EXE
PID:2152 -
\??\c:\dvjjd.exec:\dvjjd.exe44⤵
- Executes dropped EXE
PID:1912 -
\??\c:\frxxfll.exec:\frxxfll.exe45⤵
- Executes dropped EXE
PID:3524 -
\??\c:\vddvj.exec:\vddvj.exe46⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vvjdj.exec:\vvjdj.exe47⤵
- Executes dropped EXE
PID:1396 -
\??\c:\1bthbh.exec:\1bthbh.exe48⤵
- Executes dropped EXE
PID:4564 -
\??\c:\pdpjd.exec:\pdpjd.exe49⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lffffxx.exec:\lffffxx.exe50⤵
- Executes dropped EXE
PID:4400 -
\??\c:\tnttnt.exec:\tnttnt.exe51⤵
- Executes dropped EXE
PID:3052 -
\??\c:\jdvvv.exec:\jdvvv.exe52⤵
- Executes dropped EXE
PID:1016 -
\??\c:\llrrrxx.exec:\llrrrxx.exe53⤵
- Executes dropped EXE
PID:5048 -
\??\c:\btbhtb.exec:\btbhtb.exe54⤵
- Executes dropped EXE
PID:2904 -
\??\c:\jjvpj.exec:\jjvpj.exe55⤵
- Executes dropped EXE
PID:1336 -
\??\c:\fxllfff.exec:\fxllfff.exe56⤵
- Executes dropped EXE
PID:1340 -
\??\c:\tbhbbb.exec:\tbhbbb.exe57⤵
- Executes dropped EXE
PID:4168 -
\??\c:\jdjjj.exec:\jdjjj.exe58⤵
- Executes dropped EXE
PID:464 -
\??\c:\llfllfl.exec:\llfllfl.exe59⤵
- Executes dropped EXE
PID:2352 -
\??\c:\hhnnht.exec:\hhnnht.exe60⤵
- Executes dropped EXE
PID:3944 -
\??\c:\pjjjj.exec:\pjjjj.exe61⤵
- Executes dropped EXE
PID:4848 -
\??\c:\llxrlll.exec:\llxrlll.exe62⤵
- Executes dropped EXE
PID:3692 -
\??\c:\bnttnh.exec:\bnttnh.exe63⤵
- Executes dropped EXE
PID:4632 -
\??\c:\dvpjj.exec:\dvpjj.exe64⤵
- Executes dropped EXE
PID:3644 -
\??\c:\lrrllxr.exec:\lrrllxr.exe65⤵
- Executes dropped EXE
PID:5104 -
\??\c:\rxfxxff.exec:\rxfxxff.exe66⤵PID:452
-
\??\c:\bnthth.exec:\bnthth.exe67⤵PID:1088
-
\??\c:\jjddv.exec:\jjddv.exe68⤵PID:4152
-
\??\c:\lfrffxr.exec:\lfrffxr.exe69⤵PID:5096
-
\??\c:\bbtntt.exec:\bbtntt.exe70⤵PID:1736
-
\??\c:\vpvvv.exec:\vpvvv.exe71⤵PID:4508
-
\??\c:\bbbbhh.exec:\bbbbhh.exe72⤵PID:2948
-
\??\c:\pvdjd.exec:\pvdjd.exe73⤵PID:4896
-
\??\c:\ffrrrrr.exec:\ffrrrrr.exe74⤵PID:5000
-
\??\c:\hnttbb.exec:\hnttbb.exe75⤵PID:428
-
\??\c:\fxrrrrf.exec:\fxrrrrf.exe76⤵PID:4472
-
\??\c:\bthbbn.exec:\bthbbn.exe77⤵PID:1588
-
\??\c:\jvvpd.exec:\jvvpd.exe78⤵PID:4340
-
\??\c:\lffffrr.exec:\lffffrr.exe79⤵PID:5080
-
\??\c:\nhnntt.exec:\nhnntt.exe80⤵PID:2868
-
\??\c:\pvvpv.exec:\pvvpv.exe81⤵PID:2700
-
\??\c:\llrlxxl.exec:\llrlxxl.exe82⤵PID:5088
-
\??\c:\tnthbb.exec:\tnthbb.exe83⤵PID:4396
-
\??\c:\dppjv.exec:\dppjv.exe84⤵PID:3108
-
\??\c:\rlfrlxx.exec:\rlfrlxx.exe85⤵PID:1716
-
\??\c:\hhhtbb.exec:\hhhtbb.exe86⤵PID:2452
-
\??\c:\1jppd.exec:\1jppd.exe87⤵PID:864
-
\??\c:\jdjvv.exec:\jdjvv.exe88⤵PID:3352
-
\??\c:\llrrxxx.exec:\llrrxxx.exe89⤵PID:3480
-
\??\c:\pvpvp.exec:\pvpvp.exe90⤵PID:3576
-
\??\c:\fffxlfx.exec:\fffxlfx.exe91⤵PID:1116
-
\??\c:\htbttt.exec:\htbttt.exe92⤵PID:4512
-
\??\c:\dvpjd.exec:\dvpjd.exe93⤵PID:3176
-
\??\c:\xrrxfrx.exec:\xrrxfrx.exe94⤵PID:1800
-
\??\c:\thnnnn.exec:\thnnnn.exe95⤵PID:4732
-
\??\c:\vdjjd.exec:\vdjjd.exe96⤵PID:4112
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe97⤵PID:3136
-
\??\c:\htnbnn.exec:\htnbnn.exe98⤵PID:228
-
\??\c:\dpdvd.exec:\dpdvd.exe99⤵PID:1664
-
\??\c:\fflfrfx.exec:\fflfrfx.exe100⤵PID:2508
-
\??\c:\bbbttt.exec:\bbbttt.exe101⤵
- System Location Discovery: System Language Discovery
PID:4928 -
\??\c:\djppp.exec:\djppp.exe102⤵PID:1008
-
\??\c:\rxrrlfx.exec:\rxrrlfx.exe103⤵PID:2464
-
\??\c:\bnbbbh.exec:\bnbbbh.exe104⤵PID:3916
-
\??\c:\pjppj.exec:\pjppj.exe105⤵PID:668
-
\??\c:\lxxrllf.exec:\lxxrllf.exe106⤵PID:412
-
\??\c:\jvpjj.exec:\jvpjj.exe107⤵PID:3304
-
\??\c:\fxxffrr.exec:\fxxffrr.exe108⤵PID:3464
-
\??\c:\7tbhhn.exec:\7tbhhn.exe109⤵PID:216
-
\??\c:\pdvdd.exec:\pdvdd.exe110⤵PID:2296
-
\??\c:\xfllrxf.exec:\xfllrxf.exe111⤵PID:2308
-
\??\c:\nhbthb.exec:\nhbthb.exe112⤵PID:4584
-
\??\c:\pdvpd.exec:\pdvpd.exe113⤵PID:2028
-
\??\c:\xxxllrl.exec:\xxxllrl.exe114⤵PID:4400
-
\??\c:\bhtnbt.exec:\bhtnbt.exe115⤵PID:4388
-
\??\c:\jdddd.exec:\jdddd.exe116⤵PID:1356
-
\??\c:\5ffxxfl.exec:\5ffxxfl.exe117⤵PID:3348
-
\??\c:\hbnnnn.exec:\hbnnnn.exe118⤵PID:2260
-
\??\c:\vdjdd.exec:\vdjdd.exe119⤵PID:4276
-
\??\c:\fxlllll.exec:\fxlllll.exe120⤵PID:4860
-
\??\c:\nbbhtb.exec:\nbbhtb.exe121⤵PID:3648
-
\??\c:\ppjdv.exec:\ppjdv.exe122⤵PID:4272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-