Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2025, 09:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
de3888e25f809880cac3302540b917e5e699abf0127dd3d14cd5fa4a244fc21f.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
de3888e25f809880cac3302540b917e5e699abf0127dd3d14cd5fa4a244fc21f.exe
-
Size
456KB
-
MD5
cdc6457dd7f5b2ee8e961aa4046a7236
-
SHA1
39bbdb62797f69d831506fd38ce3ea3ad07ccec8
-
SHA256
de3888e25f809880cac3302540b917e5e699abf0127dd3d14cd5fa4a244fc21f
-
SHA512
5b1f5c66b3671e11990edf1d3ee16c5e779361fc098c1bbd93098cc69a31c1a74a5a9600bc2d1fa943c7b2de16f9cd4b83c2940ffd70de0e7d8be4bb7a70e523
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeu:q7Tc2NYHUrAwfMp3CDu
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4908-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2712-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3752-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/988-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4608-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/668-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2332-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-707-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2072-850-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-917-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-921-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2704-953-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-1743-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1992 htbbbn.exe 668 pdddd.exe 3624 xlfxrrr.exe 3404 hhnnbb.exe 1920 jjjjd.exe 4108 djvpj.exe 2460 rlfxrrr.exe 2844 nhbhtt.exe 2872 1pdvp.exe 2984 rlffffx.exe 2628 1tttnt.exe 2004 1ppjd.exe 4608 llrllff.exe 3200 tbbthb.exe 4972 vvdvd.exe 5104 xrxxxxx.exe 4892 btttnn.exe 4268 pvjdv.exe 2560 jvddj.exe 4076 xllrfxl.exe 3116 httttb.exe 4020 1nbthh.exe 4212 1vvjd.exe 988 5rlrllf.exe 1528 lllfxxr.exe 3752 hhnhnn.exe 4844 vvdvj.exe 4704 vpdjd.exe 2732 xfrrffr.exe 4280 hhhbtt.exe 1768 hnhbtn.exe 740 jddvp.exe 3596 9fxrllx.exe 2972 frrfxrx.exe 3952 nnnhht.exe 2240 9vvpd.exe 2712 pdvjj.exe 3536 9xlfxxr.exe 3096 bnnhhh.exe 4336 bbnbhh.exe 3044 vdvjv.exe 1612 rlxflrx.exe 3464 bbbbtn.exe 4388 thtnbn.exe 2824 dvpvj.exe 3576 lxlfrrl.exe 3828 bbhbtt.exe 1904 ttnnhh.exe 2372 djddv.exe 3232 rxfxffl.exe 4636 7flffrl.exe 3556 bhbtnh.exe 2500 dvvjd.exe 2424 hthnbn.exe 4420 bhhhbb.exe 2336 jjdvp.exe 4456 lllfffl.exe 2096 lffxrxr.exe 4536 3thbtt.exe 2144 ddvvp.exe 3732 dddvp.exe 116 rflxxrl.exe 2332 btbttn.exe 4580 5dppj.exe -
resource yara_rule behavioral2/memory/4908-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2712-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/988-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4608-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/668-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2332-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2072-850-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-917-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-921-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-940-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2704-953-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4908 wrote to memory of 1992 4908 de3888e25f809880cac3302540b917e5e699abf0127dd3d14cd5fa4a244fc21f.exe 83 PID 4908 wrote to memory of 1992 4908 de3888e25f809880cac3302540b917e5e699abf0127dd3d14cd5fa4a244fc21f.exe 83 PID 4908 wrote to memory of 1992 4908 de3888e25f809880cac3302540b917e5e699abf0127dd3d14cd5fa4a244fc21f.exe 83 PID 1992 wrote to memory of 668 1992 htbbbn.exe 84 PID 1992 wrote to memory of 668 1992 htbbbn.exe 84 PID 1992 wrote to memory of 668 1992 htbbbn.exe 84 PID 668 wrote to memory of 3624 668 pdddd.exe 85 PID 668 wrote to memory of 3624 668 pdddd.exe 85 PID 668 wrote to memory of 3624 668 pdddd.exe 85 PID 3624 wrote to memory of 3404 3624 xlfxrrr.exe 86 PID 3624 wrote to memory of 3404 3624 xlfxrrr.exe 86 PID 3624 wrote to memory of 3404 3624 xlfxrrr.exe 86 PID 3404 wrote to memory of 1920 3404 hhnnbb.exe 87 PID 3404 wrote to memory of 1920 3404 hhnnbb.exe 87 PID 3404 wrote to memory of 1920 3404 hhnnbb.exe 87 PID 1920 wrote to memory of 4108 1920 jjjjd.exe 88 PID 1920 wrote to memory of 4108 1920 jjjjd.exe 88 PID 1920 wrote to memory of 4108 1920 jjjjd.exe 88 PID 4108 wrote to memory of 2460 4108 djvpj.exe 89 PID 4108 wrote to memory of 2460 4108 djvpj.exe 89 PID 4108 wrote to memory of 2460 4108 djvpj.exe 89 PID 2460 wrote to memory of 2844 2460 rlfxrrr.exe 90 PID 2460 wrote to memory of 2844 2460 rlfxrrr.exe 90 PID 2460 wrote to memory of 2844 2460 rlfxrrr.exe 90 PID 2844 wrote to memory of 2872 2844 nhbhtt.exe 91 PID 2844 wrote to memory of 2872 2844 nhbhtt.exe 91 PID 2844 wrote to memory of 2872 2844 nhbhtt.exe 91 PID 2872 wrote to memory of 2984 2872 1pdvp.exe 92 PID 2872 wrote to memory of 2984 2872 1pdvp.exe 92 PID 2872 wrote to memory of 2984 2872 1pdvp.exe 92 PID 2984 wrote to memory of 2628 2984 rlffffx.exe 93 PID 2984 wrote to memory of 2628 2984 rlffffx.exe 93 PID 2984 wrote to memory of 2628 2984 rlffffx.exe 93 PID 2628 wrote to memory of 2004 2628 1tttnt.exe 153 PID 2628 wrote to memory of 2004 2628 1tttnt.exe 153 PID 2628 wrote to memory of 2004 2628 1tttnt.exe 153 PID 2004 wrote to memory of 4608 2004 1ppjd.exe 95 PID 2004 wrote to memory of 4608 2004 1ppjd.exe 95 PID 2004 wrote to memory of 4608 2004 1ppjd.exe 95 PID 4608 wrote to memory of 3200 4608 llrllff.exe 96 PID 4608 wrote to memory of 3200 4608 llrllff.exe 96 PID 4608 wrote to memory of 3200 4608 llrllff.exe 96 PID 3200 wrote to memory of 4972 3200 tbbthb.exe 97 PID 3200 wrote to memory of 4972 3200 tbbthb.exe 97 PID 3200 wrote to memory of 4972 3200 tbbthb.exe 97 PID 4972 wrote to memory of 5104 4972 vvdvd.exe 98 PID 4972 wrote to memory of 5104 4972 vvdvd.exe 98 PID 4972 wrote to memory of 5104 4972 vvdvd.exe 98 PID 5104 wrote to memory of 4892 5104 xrxxxxx.exe 99 PID 5104 wrote to memory of 4892 5104 xrxxxxx.exe 99 PID 5104 wrote to memory of 4892 5104 xrxxxxx.exe 99 PID 4892 wrote to memory of 4268 4892 btttnn.exe 100 PID 4892 wrote to memory of 4268 4892 btttnn.exe 100 PID 4892 wrote to memory of 4268 4892 btttnn.exe 100 PID 4268 wrote to memory of 2560 4268 pvjdv.exe 101 PID 4268 wrote to memory of 2560 4268 pvjdv.exe 101 PID 4268 wrote to memory of 2560 4268 pvjdv.exe 101 PID 2560 wrote to memory of 4076 2560 jvddj.exe 102 PID 2560 wrote to memory of 4076 2560 jvddj.exe 102 PID 2560 wrote to memory of 4076 2560 jvddj.exe 102 PID 4076 wrote to memory of 3116 4076 xllrfxl.exe 103 PID 4076 wrote to memory of 3116 4076 xllrfxl.exe 103 PID 4076 wrote to memory of 3116 4076 xllrfxl.exe 103 PID 3116 wrote to memory of 4020 3116 httttb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\de3888e25f809880cac3302540b917e5e699abf0127dd3d14cd5fa4a244fc21f.exe"C:\Users\Admin\AppData\Local\Temp\de3888e25f809880cac3302540b917e5e699abf0127dd3d14cd5fa4a244fc21f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\htbbbn.exec:\htbbbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\pdddd.exec:\pdddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\xlfxrrr.exec:\xlfxrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\hhnnbb.exec:\hhnnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\jjjjd.exec:\jjjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\djvpj.exec:\djvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\rlfxrrr.exec:\rlfxrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\nhbhtt.exec:\nhbhtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\1pdvp.exec:\1pdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\rlffffx.exec:\rlffffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\1tttnt.exec:\1tttnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\1ppjd.exec:\1ppjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\llrllff.exec:\llrllff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\tbbthb.exec:\tbbthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\vvdvd.exec:\vvdvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\btttnn.exec:\btttnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\pvjdv.exec:\pvjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\jvddj.exec:\jvddj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\xllrfxl.exec:\xllrfxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\httttb.exec:\httttb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\1nbthh.exec:\1nbthh.exe23⤵
- Executes dropped EXE
PID:4020 -
\??\c:\1vvjd.exec:\1vvjd.exe24⤵
- Executes dropped EXE
PID:4212 -
\??\c:\5rlrllf.exec:\5rlrllf.exe25⤵
- Executes dropped EXE
PID:988 -
\??\c:\lllfxxr.exec:\lllfxxr.exe26⤵
- Executes dropped EXE
PID:1528 -
\??\c:\hhnhnn.exec:\hhnhnn.exe27⤵
- Executes dropped EXE
PID:3752 -
\??\c:\vvdvj.exec:\vvdvj.exe28⤵
- Executes dropped EXE
PID:4844 -
\??\c:\vpdjd.exec:\vpdjd.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4704 -
\??\c:\xfrrffr.exec:\xfrrffr.exe30⤵
- Executes dropped EXE
PID:2732 -
\??\c:\hhhbtt.exec:\hhhbtt.exe31⤵
- Executes dropped EXE
PID:4280 -
\??\c:\hnhbtn.exec:\hnhbtn.exe32⤵
- Executes dropped EXE
PID:1768 -
\??\c:\jddvp.exec:\jddvp.exe33⤵
- Executes dropped EXE
PID:740 -
\??\c:\9fxrllx.exec:\9fxrllx.exe34⤵
- Executes dropped EXE
PID:3596 -
\??\c:\frrfxrx.exec:\frrfxrx.exe35⤵
- Executes dropped EXE
PID:2972 -
\??\c:\nnnhht.exec:\nnnhht.exe36⤵
- Executes dropped EXE
PID:3952 -
\??\c:\9vvpd.exec:\9vvpd.exe37⤵
- Executes dropped EXE
PID:2240 -
\??\c:\pdvjj.exec:\pdvjj.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\9xlfxxr.exec:\9xlfxxr.exe39⤵
- Executes dropped EXE
PID:3536 -
\??\c:\bnnhhh.exec:\bnnhhh.exe40⤵
- Executes dropped EXE
PID:3096 -
\??\c:\bbnbhh.exec:\bbnbhh.exe41⤵
- Executes dropped EXE
PID:4336 -
\??\c:\vdvjv.exec:\vdvjv.exe42⤵
- Executes dropped EXE
PID:3044 -
\??\c:\rlxflrx.exec:\rlxflrx.exe43⤵
- Executes dropped EXE
PID:1612 -
\??\c:\bbbbtn.exec:\bbbbtn.exe44⤵
- Executes dropped EXE
PID:3464 -
\??\c:\thtnbn.exec:\thtnbn.exe45⤵
- Executes dropped EXE
PID:4388 -
\??\c:\dvpvj.exec:\dvpvj.exe46⤵
- Executes dropped EXE
PID:2824 -
\??\c:\lxlfrrl.exec:\lxlfrrl.exe47⤵
- Executes dropped EXE
PID:3576 -
\??\c:\bbhbtt.exec:\bbhbtt.exe48⤵
- Executes dropped EXE
PID:3828 -
\??\c:\ttnnhh.exec:\ttnnhh.exe49⤵
- Executes dropped EXE
PID:1904 -
\??\c:\djddv.exec:\djddv.exe50⤵
- Executes dropped EXE
PID:2372 -
\??\c:\rxfxffl.exec:\rxfxffl.exe51⤵
- Executes dropped EXE
PID:3232 -
\??\c:\7flffrl.exec:\7flffrl.exe52⤵
- Executes dropped EXE
PID:4636 -
\??\c:\bhbtnh.exec:\bhbtnh.exe53⤵
- Executes dropped EXE
PID:3556 -
\??\c:\dvvjd.exec:\dvvjd.exe54⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hthnbn.exec:\hthnbn.exe55⤵
- Executes dropped EXE
PID:2424 -
\??\c:\bhhhbb.exec:\bhhhbb.exe56⤵
- Executes dropped EXE
PID:4420 -
\??\c:\jjdvp.exec:\jjdvp.exe57⤵
- Executes dropped EXE
PID:2336 -
\??\c:\lllfffl.exec:\lllfffl.exe58⤵
- Executes dropped EXE
PID:4456 -
\??\c:\lffxrxr.exec:\lffxrxr.exe59⤵
- Executes dropped EXE
PID:2096 -
\??\c:\3thbtt.exec:\3thbtt.exe60⤵
- Executes dropped EXE
PID:4536 -
\??\c:\ddvvp.exec:\ddvvp.exe61⤵
- Executes dropped EXE
PID:2144 -
\??\c:\dddvp.exec:\dddvp.exe62⤵
- Executes dropped EXE
PID:3732 -
\??\c:\rflxxrl.exec:\rflxxrl.exe63⤵
- Executes dropped EXE
PID:116 -
\??\c:\btbttn.exec:\btbttn.exe64⤵
- Executes dropped EXE
PID:2332 -
\??\c:\5dppj.exec:\5dppj.exe65⤵
- Executes dropped EXE
PID:4580 -
\??\c:\7xxxxfx.exec:\7xxxxfx.exe66⤵PID:1168
-
\??\c:\hhbhht.exec:\hhbhht.exe67⤵
- System Location Discovery: System Language Discovery
PID:556 -
\??\c:\nnhhnn.exec:\nnhhnn.exe68⤵PID:644
-
\??\c:\jdddd.exec:\jdddd.exe69⤵PID:4048
-
\??\c:\llfxrrf.exec:\llfxrrf.exe70⤵PID:4424
-
\??\c:\httnhh.exec:\httnhh.exe71⤵PID:4820
-
\??\c:\rxfrlxx.exec:\rxfrlxx.exe72⤵
- System Location Discovery: System Language Discovery
PID:2004 -
\??\c:\tnnnhb.exec:\tnnnhb.exe73⤵PID:3172
-
\??\c:\ffxrlff.exec:\ffxrlff.exe74⤵PID:100
-
\??\c:\1hbttt.exec:\1hbttt.exe75⤵PID:3248
-
\??\c:\pjpjj.exec:\pjpjj.exe76⤵PID:3156
-
\??\c:\flrllfl.exec:\flrllfl.exe77⤵PID:3460
-
\??\c:\tnbhtn.exec:\tnbhtn.exe78⤵PID:4728
-
\??\c:\bhbtht.exec:\bhbtht.exe79⤵PID:3452
-
\??\c:\vvpjj.exec:\vvpjj.exe80⤵PID:5096
-
\??\c:\ffxrllf.exec:\ffxrllf.exe81⤵PID:4500
-
\??\c:\thhhhh.exec:\thhhhh.exe82⤵PID:4284
-
\??\c:\jpvvj.exec:\jpvvj.exe83⤵PID:3424
-
\??\c:\flfxrlf.exec:\flfxrlf.exe84⤵PID:4012
-
\??\c:\nthbtt.exec:\nthbtt.exe85⤵PID:1812
-
\??\c:\jvvpj.exec:\jvvpj.exe86⤵PID:1472
-
\??\c:\rxxrrrl.exec:\rxxrrrl.exe87⤵PID:956
-
\??\c:\5vjjd.exec:\5vjjd.exe88⤵PID:736
-
\??\c:\1tnttt.exec:\1tnttt.exe89⤵PID:4976
-
\??\c:\9pppj.exec:\9pppj.exe90⤵PID:2484
-
\??\c:\xffxxxx.exec:\xffxxxx.exe91⤵PID:904
-
\??\c:\vvdvd.exec:\vvdvd.exe92⤵PID:3596
-
\??\c:\fllfffx.exec:\fllfffx.exe93⤵PID:1384
-
\??\c:\jjddv.exec:\jjddv.exe94⤵PID:2572
-
\??\c:\9lffxxx.exec:\9lffxxx.exe95⤵PID:4596
-
\??\c:\rlrlllf.exec:\rlrlllf.exe96⤵PID:3856
-
\??\c:\jjpjj.exec:\jjpjj.exe97⤵PID:1676
-
\??\c:\1ffxxxr.exec:\1ffxxxr.exe98⤵PID:2596
-
\??\c:\nbhbtt.exec:\nbhbtt.exe99⤵PID:4340
-
\??\c:\3vdpd.exec:\3vdpd.exe100⤵PID:4796
-
\??\c:\lrxrrrr.exec:\lrxrrrr.exe101⤵PID:3016
-
\??\c:\nhbtnn.exec:\nhbtnn.exe102⤵PID:2848
-
\??\c:\1bhbhh.exec:\1bhbhh.exe103⤵PID:1656
-
\??\c:\fxfxllx.exec:\fxfxllx.exe104⤵PID:432
-
\??\c:\3ttnbb.exec:\3ttnbb.exe105⤵PID:3684
-
\??\c:\xfxfffl.exec:\xfxfffl.exe106⤵PID:4544
-
\??\c:\hnnhbb.exec:\hnnhbb.exe107⤵PID:3716
-
\??\c:\pvdvv.exec:\pvdvv.exe108⤵PID:1648
-
\??\c:\flllrfl.exec:\flllrfl.exe109⤵PID:2760
-
\??\c:\vvdpd.exec:\vvdpd.exe110⤵PID:3708
-
\??\c:\7djdv.exec:\7djdv.exe111⤵PID:2304
-
\??\c:\nnnnhh.exec:\nnnnhh.exe112⤵PID:544
-
\??\c:\pddjd.exec:\pddjd.exe113⤵PID:456
-
\??\c:\llrrrlf.exec:\llrrrlf.exe114⤵PID:3252
-
\??\c:\ttbnbn.exec:\ttbnbn.exe115⤵PID:1164
-
\??\c:\3vpjj.exec:\3vpjj.exe116⤵PID:4908
-
\??\c:\xxrlffx.exec:\xxrlffx.exe117⤵PID:4524
-
\??\c:\xllfffx.exec:\xllfffx.exe118⤵PID:2072
-
\??\c:\nbbnnh.exec:\nbbnnh.exe119⤵PID:1212
-
\??\c:\dvddd.exec:\dvddd.exe120⤵PID:1988
-
\??\c:\lflfxxr.exec:\lflfxxr.exe121⤵PID:224
-
\??\c:\tthhtt.exec:\tthhtt.exe122⤵PID:1048
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-