Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9a5d2a80283f2b5f431b4ea918075424e7caed42fe866903ff24b7b2198fc6f9N.exe
Resource
win7-20241023-en
7 signatures
120 seconds
General
-
Target
9a5d2a80283f2b5f431b4ea918075424e7caed42fe866903ff24b7b2198fc6f9N.exe
-
Size
454KB
-
MD5
4e3224c64103e0b34bbbd4732fd545c0
-
SHA1
925ba74b0c649816b154a7efd3eb2c7374229c94
-
SHA256
9a5d2a80283f2b5f431b4ea918075424e7caed42fe866903ff24b7b2198fc6f9
-
SHA512
0d9462e5e4febc57f344951ce72eed9df8e1a6790993f332b31f18def35bd93b3c13732836a737f3748787577c1fcc32e043f66e3321658ee611f480876ecb1f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeae:q7Tc2NYHUrAwfMp3CDt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/748-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2668-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1420-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/344-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/776-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2748-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2492-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-829-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-827-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-1080-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-1303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3160-1513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4916 bbbttt.exe 3924 hthbtn.exe 4744 vdpjj.exe 2952 lfffffx.exe 2668 nhnnnt.exe 1684 tnnbth.exe 3024 xxlrrlr.exe 1672 jpvvv.exe 1544 jjppv.exe 1420 xffxrrx.exe 3020 lrrlllf.exe 224 nthbbn.exe 4080 btbtnn.exe 3496 tttttb.exe 1664 pvvpj.exe 4144 3frrrrr.exe 344 ntnhbb.exe 3044 thnhhn.exe 5000 vpvvp.exe 4004 nnhhhh.exe 4192 dvdjp.exe 4500 3lfrrxf.exe 3672 5dppp.exe 776 hthhbb.exe 4236 rrrlllf.exe 392 jpvjd.exe 4728 hbhhhh.exe 2748 hhhhhh.exe 2068 rrfrxxl.exe 1688 thhhbh.exe 4868 hntttn.exe 3324 ppppp.exe 1176 nntntt.exe 3964 rxxrlfx.exe 3100 lfrlxrr.exe 3584 bntbhn.exe 1792 bthbhh.exe 2244 5ppvd.exe 2432 flrrxxf.exe 2768 tbtttb.exe 3360 bbtbhn.exe 2672 9dppj.exe 3968 xflffff.exe 4940 hbtnnn.exe 2908 jpvvv.exe 4184 llxxfll.exe 2324 ttttbb.exe 2208 3djjp.exe 1452 fxfxxff.exe 3092 httttt.exe 3156 httttb.exe 2216 1djdv.exe 2960 5xrffff.exe 976 hnhhhn.exe 208 bhbbbn.exe 5044 9dpjj.exe 212 rfrxrlf.exe 3548 nhtntt.exe 3460 ddpjj.exe 3024 rrxxlrl.exe 3304 xlrrrrr.exe 1716 btbthh.exe 1448 vddpp.exe 4636 vdvvp.exe -
resource yara_rule behavioral2/memory/748-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2668-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/344-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/776-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2748-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2492-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-585-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlffx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 748 wrote to memory of 4916 748 9a5d2a80283f2b5f431b4ea918075424e7caed42fe866903ff24b7b2198fc6f9N.exe 83 PID 748 wrote to memory of 4916 748 9a5d2a80283f2b5f431b4ea918075424e7caed42fe866903ff24b7b2198fc6f9N.exe 83 PID 748 wrote to memory of 4916 748 9a5d2a80283f2b5f431b4ea918075424e7caed42fe866903ff24b7b2198fc6f9N.exe 83 PID 4916 wrote to memory of 3924 4916 bbbttt.exe 84 PID 4916 wrote to memory of 3924 4916 bbbttt.exe 84 PID 4916 wrote to memory of 3924 4916 bbbttt.exe 84 PID 3924 wrote to memory of 4744 3924 hthbtn.exe 85 PID 3924 wrote to memory of 4744 3924 hthbtn.exe 85 PID 3924 wrote to memory of 4744 3924 hthbtn.exe 85 PID 4744 wrote to memory of 2952 4744 vdpjj.exe 86 PID 4744 wrote to memory of 2952 4744 vdpjj.exe 86 PID 4744 wrote to memory of 2952 4744 vdpjj.exe 86 PID 2952 wrote to memory of 2668 2952 lfffffx.exe 87 PID 2952 wrote to memory of 2668 2952 lfffffx.exe 87 PID 2952 wrote to memory of 2668 2952 lfffffx.exe 87 PID 2668 wrote to memory of 1684 2668 nhnnnt.exe 88 PID 2668 wrote to memory of 1684 2668 nhnnnt.exe 88 PID 2668 wrote to memory of 1684 2668 nhnnnt.exe 88 PID 1684 wrote to memory of 3024 1684 tnnbth.exe 89 PID 1684 wrote to memory of 3024 1684 tnnbth.exe 89 PID 1684 wrote to memory of 3024 1684 tnnbth.exe 89 PID 3024 wrote to memory of 1672 3024 xxlrrlr.exe 90 PID 3024 wrote to memory of 1672 3024 xxlrrlr.exe 90 PID 3024 wrote to memory of 1672 3024 xxlrrlr.exe 90 PID 1672 wrote to memory of 1544 1672 jpvvv.exe 91 PID 1672 wrote to memory of 1544 1672 jpvvv.exe 91 PID 1672 wrote to memory of 1544 1672 jpvvv.exe 91 PID 1544 wrote to memory of 1420 1544 jjppv.exe 92 PID 1544 wrote to memory of 1420 1544 jjppv.exe 92 PID 1544 wrote to memory of 1420 1544 jjppv.exe 92 PID 1420 wrote to memory of 3020 1420 xffxrrx.exe 93 PID 1420 wrote to memory of 3020 1420 xffxrrx.exe 93 PID 1420 wrote to memory of 3020 1420 xffxrrx.exe 93 PID 3020 wrote to memory of 224 3020 lrrlllf.exe 94 PID 3020 wrote to memory of 224 3020 lrrlllf.exe 94 PID 3020 wrote to memory of 224 3020 lrrlllf.exe 94 PID 224 wrote to memory of 4080 224 nthbbn.exe 95 PID 224 wrote to memory of 4080 224 nthbbn.exe 95 PID 224 wrote to memory of 4080 224 nthbbn.exe 95 PID 4080 wrote to memory of 3496 4080 btbtnn.exe 96 PID 4080 wrote to memory of 3496 4080 btbtnn.exe 96 PID 4080 wrote to memory of 3496 4080 btbtnn.exe 96 PID 3496 wrote to memory of 1664 3496 tttttb.exe 97 PID 3496 wrote to memory of 1664 3496 tttttb.exe 97 PID 3496 wrote to memory of 1664 3496 tttttb.exe 97 PID 1664 wrote to memory of 4144 1664 pvvpj.exe 98 PID 1664 wrote to memory of 4144 1664 pvvpj.exe 98 PID 1664 wrote to memory of 4144 1664 pvvpj.exe 98 PID 4144 wrote to memory of 344 4144 3frrrrr.exe 99 PID 4144 wrote to memory of 344 4144 3frrrrr.exe 99 PID 4144 wrote to memory of 344 4144 3frrrrr.exe 99 PID 344 wrote to memory of 3044 344 ntnhbb.exe 100 PID 344 wrote to memory of 3044 344 ntnhbb.exe 100 PID 344 wrote to memory of 3044 344 ntnhbb.exe 100 PID 3044 wrote to memory of 5000 3044 thnhhn.exe 101 PID 3044 wrote to memory of 5000 3044 thnhhn.exe 101 PID 3044 wrote to memory of 5000 3044 thnhhn.exe 101 PID 5000 wrote to memory of 4004 5000 vpvvp.exe 102 PID 5000 wrote to memory of 4004 5000 vpvvp.exe 102 PID 5000 wrote to memory of 4004 5000 vpvvp.exe 102 PID 4004 wrote to memory of 4192 4004 nnhhhh.exe 103 PID 4004 wrote to memory of 4192 4004 nnhhhh.exe 103 PID 4004 wrote to memory of 4192 4004 nnhhhh.exe 103 PID 4192 wrote to memory of 4500 4192 dvdjp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a5d2a80283f2b5f431b4ea918075424e7caed42fe866903ff24b7b2198fc6f9N.exe"C:\Users\Admin\AppData\Local\Temp\9a5d2a80283f2b5f431b4ea918075424e7caed42fe866903ff24b7b2198fc6f9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\bbbttt.exec:\bbbttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\hthbtn.exec:\hthbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\vdpjj.exec:\vdpjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\lfffffx.exec:\lfffffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\nhnnnt.exec:\nhnnnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\tnnbth.exec:\tnnbth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\xxlrrlr.exec:\xxlrrlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\jpvvv.exec:\jpvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\jjppv.exec:\jjppv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\xffxrrx.exec:\xffxrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\lrrlllf.exec:\lrrlllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\nthbbn.exec:\nthbbn.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\btbtnn.exec:\btbtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\tttttb.exec:\tttttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\pvvpj.exec:\pvvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\3frrrrr.exec:\3frrrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\ntnhbb.exec:\ntnhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\thnhhn.exec:\thnhhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\vpvvp.exec:\vpvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\nnhhhh.exec:\nnhhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\dvdjp.exec:\dvdjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\3lfrrxf.exec:\3lfrrxf.exe23⤵
- Executes dropped EXE
PID:4500 -
\??\c:\5dppp.exec:\5dppp.exe24⤵
- Executes dropped EXE
PID:3672 -
\??\c:\hthhbb.exec:\hthhbb.exe25⤵
- Executes dropped EXE
PID:776 -
\??\c:\rrrlllf.exec:\rrrlllf.exe26⤵
- Executes dropped EXE
PID:4236 -
\??\c:\jpvjd.exec:\jpvjd.exe27⤵
- Executes dropped EXE
PID:392 -
\??\c:\hbhhhh.exec:\hbhhhh.exe28⤵
- Executes dropped EXE
PID:4728 -
\??\c:\hhhhhh.exec:\hhhhhh.exe29⤵
- Executes dropped EXE
PID:2748 -
\??\c:\rrfrxxl.exec:\rrfrxxl.exe30⤵
- Executes dropped EXE
PID:2068 -
\??\c:\thhhbh.exec:\thhhbh.exe31⤵
- Executes dropped EXE
PID:1688 -
\??\c:\hntttn.exec:\hntttn.exe32⤵
- Executes dropped EXE
PID:4868 -
\??\c:\ppppp.exec:\ppppp.exe33⤵
- Executes dropped EXE
PID:3324 -
\??\c:\nntntt.exec:\nntntt.exe34⤵
- Executes dropped EXE
PID:1176 -
\??\c:\rxxrlfx.exec:\rxxrlfx.exe35⤵
- Executes dropped EXE
PID:3964 -
\??\c:\lfrlxrr.exec:\lfrlxrr.exe36⤵
- Executes dropped EXE
PID:3100 -
\??\c:\bntbhn.exec:\bntbhn.exe37⤵
- Executes dropped EXE
PID:3584 -
\??\c:\bthbhh.exec:\bthbhh.exe38⤵
- Executes dropped EXE
PID:1792 -
\??\c:\5ppvd.exec:\5ppvd.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2244 -
\??\c:\flrrxxf.exec:\flrrxxf.exe40⤵
- Executes dropped EXE
PID:2432 -
\??\c:\tbtttb.exec:\tbtttb.exe41⤵
- Executes dropped EXE
PID:2768 -
\??\c:\bbtbhn.exec:\bbtbhn.exe42⤵
- Executes dropped EXE
PID:3360 -
\??\c:\9dppj.exec:\9dppj.exe43⤵
- Executes dropped EXE
PID:2672 -
\??\c:\xflffff.exec:\xflffff.exe44⤵
- Executes dropped EXE
PID:3968 -
\??\c:\hbtnnn.exec:\hbtnnn.exe45⤵
- Executes dropped EXE
PID:4940 -
\??\c:\jpvvv.exec:\jpvvv.exe46⤵
- Executes dropped EXE
PID:2908 -
\??\c:\llxxfll.exec:\llxxfll.exe47⤵
- Executes dropped EXE
PID:4184 -
\??\c:\ttttbb.exec:\ttttbb.exe48⤵
- Executes dropped EXE
PID:2324 -
\??\c:\3djjp.exec:\3djjp.exe49⤵
- Executes dropped EXE
PID:2208 -
\??\c:\fxfxxff.exec:\fxfxxff.exe50⤵
- Executes dropped EXE
PID:1452 -
\??\c:\httttt.exec:\httttt.exe51⤵
- Executes dropped EXE
PID:3092 -
\??\c:\httttb.exec:\httttb.exe52⤵
- Executes dropped EXE
PID:3156 -
\??\c:\1djdv.exec:\1djdv.exe53⤵
- Executes dropped EXE
PID:2216 -
\??\c:\5xrffff.exec:\5xrffff.exe54⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hnhhhn.exec:\hnhhhn.exe55⤵
- Executes dropped EXE
PID:976 -
\??\c:\bhbbbn.exec:\bhbbbn.exe56⤵
- Executes dropped EXE
PID:208 -
\??\c:\9dpjj.exec:\9dpjj.exe57⤵
- Executes dropped EXE
PID:5044 -
\??\c:\rfrxrlf.exec:\rfrxrlf.exe58⤵
- Executes dropped EXE
PID:212 -
\??\c:\nhtntt.exec:\nhtntt.exe59⤵
- Executes dropped EXE
PID:3548 -
\??\c:\ddpjj.exec:\ddpjj.exe60⤵
- Executes dropped EXE
PID:3460 -
\??\c:\rrxxlrl.exec:\rrxxlrl.exe61⤵
- Executes dropped EXE
PID:3024 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe62⤵
- Executes dropped EXE
PID:3304 -
\??\c:\btbthh.exec:\btbthh.exe63⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vddpp.exec:\vddpp.exe64⤵
- Executes dropped EXE
PID:1448 -
\??\c:\vdvvp.exec:\vdvvp.exe65⤵
- Executes dropped EXE
PID:4636 -
\??\c:\rxrlfff.exec:\rxrlfff.exe66⤵PID:5064
-
\??\c:\nthbbn.exec:\nthbbn.exe67⤵PID:3020
-
\??\c:\3djpp.exec:\3djpp.exe68⤵PID:2492
-
\??\c:\vjdvv.exec:\vjdvv.exe69⤵PID:3124
-
\??\c:\rfxlfll.exec:\rfxlfll.exe70⤵PID:604
-
\??\c:\ppjjj.exec:\ppjjj.exe71⤵PID:4764
-
\??\c:\ddvpp.exec:\ddvpp.exe72⤵PID:4284
-
\??\c:\fflxxff.exec:\fflxxff.exe73⤵PID:4528
-
\??\c:\hhhnnt.exec:\hhhnnt.exe74⤵PID:840
-
\??\c:\pjppd.exec:\pjppd.exe75⤵PID:3552
-
\??\c:\xxxxfll.exec:\xxxxfll.exe76⤵PID:4584
-
\??\c:\xlxrrfl.exec:\xlxrrfl.exe77⤵PID:632
-
\??\c:\hhnnnn.exec:\hhnnnn.exe78⤵PID:3652
-
\??\c:\vjjjj.exec:\vjjjj.exe79⤵PID:4912
-
\??\c:\9llxfrr.exec:\9llxfrr.exe80⤵PID:2300
-
\??\c:\1rrrrxx.exec:\1rrrrxx.exe81⤵PID:3828
-
\??\c:\bhhnnn.exec:\bhhnnn.exe82⤵PID:860
-
\??\c:\pvdjj.exec:\pvdjj.exe83⤵PID:2308
-
\??\c:\lffxxfx.exec:\lffxxfx.exe84⤵PID:752
-
\??\c:\rlrllfx.exec:\rlrllfx.exe85⤵PID:1648
-
\??\c:\hhbbbb.exec:\hhbbbb.exe86⤵PID:648
-
\??\c:\djddd.exec:\djddd.exe87⤵PID:1748
-
\??\c:\pjjjj.exec:\pjjjj.exe88⤵PID:1952
-
\??\c:\rrxxlfl.exec:\rrxxlfl.exe89⤵PID:3640
-
\??\c:\9hnnnt.exec:\9hnnnt.exe90⤵PID:832
-
\??\c:\5ttttb.exec:\5ttttb.exe91⤵PID:3956
-
\??\c:\dppjd.exec:\dppjd.exe92⤵
- System Location Discovery: System Language Discovery
PID:2124 -
\??\c:\lrrlffx.exec:\lrrlffx.exe93⤵PID:4976
-
\??\c:\hthhbn.exec:\hthhbn.exe94⤵PID:3504
-
\??\c:\pvjjj.exec:\pvjjj.exe95⤵PID:1688
-
\??\c:\djjpj.exec:\djjpj.exe96⤵PID:4180
-
\??\c:\lrfffll.exec:\lrfffll.exe97⤵PID:1488
-
\??\c:\bnhhbb.exec:\bnhhbb.exe98⤵PID:4264
-
\??\c:\djjjj.exec:\djjjj.exe99⤵PID:444
-
\??\c:\xxrrrrl.exec:\xxrrrrl.exe100⤵PID:1108
-
\??\c:\nttbbn.exec:\nttbbn.exe101⤵PID:924
-
\??\c:\nthhtb.exec:\nthhtb.exe102⤵PID:3584
-
\??\c:\djdvv.exec:\djdvv.exe103⤵PID:1792
-
\??\c:\frxlllf.exec:\frxlllf.exe104⤵PID:1836
-
\??\c:\tbbtbb.exec:\tbbtbb.exe105⤵PID:2432
-
\??\c:\pvdjj.exec:\pvdjj.exe106⤵PID:2892
-
\??\c:\jjpjj.exec:\jjpjj.exe107⤵PID:3360
-
\??\c:\llfxxrr.exec:\llfxxrr.exe108⤵PID:2928
-
\??\c:\tbhnht.exec:\tbhnht.exe109⤵PID:1780
-
\??\c:\dvvvv.exec:\dvvvv.exe110⤵PID:1680
-
\??\c:\9jjjj.exec:\9jjjj.exe111⤵PID:1940
-
\??\c:\xlrrlrr.exec:\xlrrlrr.exe112⤵PID:2328
-
\??\c:\ttttnn.exec:\ttttnn.exe113⤵PID:1808
-
\??\c:\pjpvd.exec:\pjpvd.exe114⤵PID:4196
-
\??\c:\jjpdj.exec:\jjpdj.exe115⤵PID:3984
-
\??\c:\xflfxfx.exec:\xflfxfx.exe116⤵PID:4124
-
\??\c:\1bbbhh.exec:\1bbbhh.exe117⤵PID:3060
-
\??\c:\vvvpj.exec:\vvvpj.exe118⤵PID:600
-
\??\c:\xfrxxxx.exec:\xfrxxxx.exe119⤵PID:5060
-
\??\c:\nntttb.exec:\nntttb.exe120⤵PID:116
-
\??\c:\pvjjp.exec:\pvjjp.exe121⤵PID:2952
-
\??\c:\lrrrxfx.exec:\lrrrxfx.exe122⤵PID:1980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-