Analysis
-
max time kernel
150s -
max time network
84s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
18-02-2025 08:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe
-
Size
80KB
-
MD5
f42bdfb526b25e30aa34398337dd8dfb
-
SHA1
38c9e3582e3cf1d352ea222408bae1aeb64ff429
-
SHA256
fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c
-
SHA512
bd68ced0d62e94f347e2561344b535a44a365b262186b6e389b39804b483716132364dad6eb1c32a8dccd4219e55b5d1a4e15a5acfa8c095c660ac046f2fb259
-
SSDEEP
1536:Y41JEOJzOhWlKXXCwsurYKnFNzofrst3ufT/FRxnd:Y49z/lKXXdFvN8Yt3ujFfd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2444-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1508-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/472-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2332-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2812-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2624-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-641-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-720-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-753-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-974-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-991-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-1164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-1398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-1415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3668 ttthbn.exe 2924 jvpjd.exe 1728 1thbnh.exe 1492 htnhbb.exe 2264 pppjv.exe 1520 tbhbnh.exe 3216 ppddv.exe 208 rrlffrl.exe 2652 bntttb.exe 4216 vjdvv.exe 372 xxrlxxr.exe 3516 nhntbt.exe 2252 7pjjd.exe 2172 lffrrlx.exe 816 bbhthh.exe 3320 dpvdv.exe 3748 5rlfxrl.exe 1508 1llxrlx.exe 2588 1tthbt.exe 2796 vvpjd.exe 3612 fffxfxx.exe 4196 bbtnbb.exe 4964 1pjdv.exe 472 frxlrrx.exe 4708 9xfxxrf.exe 1216 bthbhb.exe 4944 1hnhbb.exe 3344 lxxlxrf.exe 4384 7hbnhh.exe 3040 bbbthh.exe 3992 dvpjd.exe 5104 rrxrxxx.exe 1616 5nbthh.exe 3644 vvppj.exe 4704 xfrxxll.exe 3360 fxrrlrr.exe 4364 9nnbtn.exe 2332 3ttnbt.exe 2548 llrlffl.exe 2488 5rfxxrl.exe 3668 bbbbtn.exe 2132 pjdvp.exe 4644 vvdvv.exe 1728 xxrfrlx.exe 3364 7ttnhh.exe 1072 ttnhnn.exe 2108 vdvvj.exe 3988 1xffxxr.exe 4048 frxlfxr.exe 4740 7tbtbt.exe 4180 jdjjd.exe 2176 xrlfxxr.exe 3140 1lfxllx.exe 2812 3nnhbt.exe 924 vvpvp.exe 3180 dvvjd.exe 4116 fffxllx.exe 2168 nnhtnb.exe 4828 9bnhbb.exe 3840 ppvvd.exe 3168 lrlfrlf.exe 2292 9bhbbb.exe 3972 5tnhtt.exe 4056 vpvpv.exe -
resource yara_rule behavioral2/memory/2444-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2252-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1508-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/472-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2332-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2624-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-641-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2444 wrote to memory of 3668 2444 fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe 87 PID 2444 wrote to memory of 3668 2444 fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe 87 PID 2444 wrote to memory of 3668 2444 fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe 87 PID 3668 wrote to memory of 2924 3668 ttthbn.exe 88 PID 3668 wrote to memory of 2924 3668 ttthbn.exe 88 PID 3668 wrote to memory of 2924 3668 ttthbn.exe 88 PID 2924 wrote to memory of 1728 2924 jvpjd.exe 89 PID 2924 wrote to memory of 1728 2924 jvpjd.exe 89 PID 2924 wrote to memory of 1728 2924 jvpjd.exe 89 PID 1728 wrote to memory of 1492 1728 1thbnh.exe 90 PID 1728 wrote to memory of 1492 1728 1thbnh.exe 90 PID 1728 wrote to memory of 1492 1728 1thbnh.exe 90 PID 1492 wrote to memory of 2264 1492 htnhbb.exe 91 PID 1492 wrote to memory of 2264 1492 htnhbb.exe 91 PID 1492 wrote to memory of 2264 1492 htnhbb.exe 91 PID 2264 wrote to memory of 1520 2264 pppjv.exe 92 PID 2264 wrote to memory of 1520 2264 pppjv.exe 92 PID 2264 wrote to memory of 1520 2264 pppjv.exe 92 PID 1520 wrote to memory of 3216 1520 tbhbnh.exe 93 PID 1520 wrote to memory of 3216 1520 tbhbnh.exe 93 PID 1520 wrote to memory of 3216 1520 tbhbnh.exe 93 PID 3216 wrote to memory of 208 3216 ppddv.exe 94 PID 3216 wrote to memory of 208 3216 ppddv.exe 94 PID 3216 wrote to memory of 208 3216 ppddv.exe 94 PID 208 wrote to memory of 2652 208 rrlffrl.exe 95 PID 208 wrote to memory of 2652 208 rrlffrl.exe 95 PID 208 wrote to memory of 2652 208 rrlffrl.exe 95 PID 2652 wrote to memory of 4216 2652 bntttb.exe 96 PID 2652 wrote to memory of 4216 2652 bntttb.exe 96 PID 2652 wrote to memory of 4216 2652 bntttb.exe 96 PID 4216 wrote to memory of 372 4216 vjdvv.exe 97 PID 4216 wrote to memory of 372 4216 vjdvv.exe 97 PID 4216 wrote to memory of 372 4216 vjdvv.exe 97 PID 372 wrote to memory of 3516 372 xxrlxxr.exe 98 PID 372 wrote to memory of 3516 372 xxrlxxr.exe 98 PID 372 wrote to memory of 3516 372 xxrlxxr.exe 98 PID 3516 wrote to memory of 2252 3516 nhntbt.exe 99 PID 3516 wrote to memory of 2252 3516 nhntbt.exe 99 PID 3516 wrote to memory of 2252 3516 nhntbt.exe 99 PID 2252 wrote to memory of 2172 2252 7pjjd.exe 100 PID 2252 wrote to memory of 2172 2252 7pjjd.exe 100 PID 2252 wrote to memory of 2172 2252 7pjjd.exe 100 PID 2172 wrote to memory of 816 2172 lffrrlx.exe 101 PID 2172 wrote to memory of 816 2172 lffrrlx.exe 101 PID 2172 wrote to memory of 816 2172 lffrrlx.exe 101 PID 816 wrote to memory of 3320 816 bbhthh.exe 102 PID 816 wrote to memory of 3320 816 bbhthh.exe 102 PID 816 wrote to memory of 3320 816 bbhthh.exe 102 PID 3320 wrote to memory of 3748 3320 dpvdv.exe 103 PID 3320 wrote to memory of 3748 3320 dpvdv.exe 103 PID 3320 wrote to memory of 3748 3320 dpvdv.exe 103 PID 3748 wrote to memory of 1508 3748 5rlfxrl.exe 104 PID 3748 wrote to memory of 1508 3748 5rlfxrl.exe 104 PID 3748 wrote to memory of 1508 3748 5rlfxrl.exe 104 PID 1508 wrote to memory of 2588 1508 1llxrlx.exe 105 PID 1508 wrote to memory of 2588 1508 1llxrlx.exe 105 PID 1508 wrote to memory of 2588 1508 1llxrlx.exe 105 PID 2588 wrote to memory of 2796 2588 1tthbt.exe 106 PID 2588 wrote to memory of 2796 2588 1tthbt.exe 106 PID 2588 wrote to memory of 2796 2588 1tthbt.exe 106 PID 2796 wrote to memory of 3612 2796 vvpjd.exe 107 PID 2796 wrote to memory of 3612 2796 vvpjd.exe 107 PID 2796 wrote to memory of 3612 2796 vvpjd.exe 107 PID 3612 wrote to memory of 4196 3612 fffxfxx.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe"C:\Users\Admin\AppData\Local\Temp\fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\ttthbn.exec:\ttthbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\jvpjd.exec:\jvpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\1thbnh.exec:\1thbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\htnhbb.exec:\htnhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\pppjv.exec:\pppjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\tbhbnh.exec:\tbhbnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\ppddv.exec:\ppddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\rrlffrl.exec:\rrlffrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\bntttb.exec:\bntttb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vjdvv.exec:\vjdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\xxrlxxr.exec:\xxrlxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\nhntbt.exec:\nhntbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\7pjjd.exec:\7pjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\lffrrlx.exec:\lffrrlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\bbhthh.exec:\bbhthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\dpvdv.exec:\dpvdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\5rlfxrl.exec:\5rlfxrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\1llxrlx.exec:\1llxrlx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\1tthbt.exec:\1tthbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\vvpjd.exec:\vvpjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\fffxfxx.exec:\fffxfxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\bbtnbb.exec:\bbtnbb.exe23⤵
- Executes dropped EXE
PID:4196 -
\??\c:\1pjdv.exec:\1pjdv.exe24⤵
- Executes dropped EXE
PID:4964 -
\??\c:\frxlrrx.exec:\frxlrrx.exe25⤵
- Executes dropped EXE
PID:472 -
\??\c:\9xfxxrf.exec:\9xfxxrf.exe26⤵
- Executes dropped EXE
PID:4708 -
\??\c:\bthbhb.exec:\bthbhb.exe27⤵
- Executes dropped EXE
PID:1216 -
\??\c:\1hnhbb.exec:\1hnhbb.exe28⤵
- Executes dropped EXE
PID:4944 -
\??\c:\lxxlxrf.exec:\lxxlxrf.exe29⤵
- Executes dropped EXE
PID:3344 -
\??\c:\7hbnhh.exec:\7hbnhh.exe30⤵
- Executes dropped EXE
PID:4384 -
\??\c:\bbbthh.exec:\bbbthh.exe31⤵
- Executes dropped EXE
PID:3040 -
\??\c:\dvpjd.exec:\dvpjd.exe32⤵
- Executes dropped EXE
PID:3992 -
\??\c:\rrxrxxx.exec:\rrxrxxx.exe33⤵
- Executes dropped EXE
PID:5104 -
\??\c:\5nbthh.exec:\5nbthh.exe34⤵
- Executes dropped EXE
PID:1616 -
\??\c:\vvppj.exec:\vvppj.exe35⤵
- Executes dropped EXE
PID:3644 -
\??\c:\xfrxxll.exec:\xfrxxll.exe36⤵
- Executes dropped EXE
PID:4704 -
\??\c:\fxrrlrr.exec:\fxrrlrr.exe37⤵
- Executes dropped EXE
PID:3360 -
\??\c:\9nnbtn.exec:\9nnbtn.exe38⤵
- Executes dropped EXE
PID:4364 -
\??\c:\3ttnbt.exec:\3ttnbt.exe39⤵
- Executes dropped EXE
PID:2332 -
\??\c:\llrlffl.exec:\llrlffl.exe40⤵
- Executes dropped EXE
PID:2548 -
\??\c:\5rfxxrl.exec:\5rfxxrl.exe41⤵
- Executes dropped EXE
PID:2488 -
\??\c:\bbbbtn.exec:\bbbbtn.exe42⤵
- Executes dropped EXE
PID:3668 -
\??\c:\pjdvp.exec:\pjdvp.exe43⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vvdvv.exec:\vvdvv.exe44⤵
- Executes dropped EXE
PID:4644 -
\??\c:\xxrfrlx.exec:\xxrfrlx.exe45⤵
- Executes dropped EXE
PID:1728 -
\??\c:\7ttnhh.exec:\7ttnhh.exe46⤵
- Executes dropped EXE
PID:3364 -
\??\c:\ttnhnn.exec:\ttnhnn.exe47⤵
- Executes dropped EXE
PID:1072 -
\??\c:\vdvvj.exec:\vdvvj.exe48⤵
- Executes dropped EXE
PID:2108 -
\??\c:\1xffxxr.exec:\1xffxxr.exe49⤵
- Executes dropped EXE
PID:3988 -
\??\c:\frxlfxr.exec:\frxlfxr.exe50⤵
- Executes dropped EXE
PID:4048 -
\??\c:\7tbtbt.exec:\7tbtbt.exe51⤵
- Executes dropped EXE
PID:4740 -
\??\c:\jdjjd.exec:\jdjjd.exe52⤵
- Executes dropped EXE
PID:4180 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe53⤵
- Executes dropped EXE
PID:2176 -
\??\c:\1lfxllx.exec:\1lfxllx.exe54⤵
- Executes dropped EXE
PID:3140 -
\??\c:\3nnhbt.exec:\3nnhbt.exe55⤵
- Executes dropped EXE
PID:2812 -
\??\c:\vvpvp.exec:\vvpvp.exe56⤵
- Executes dropped EXE
PID:924 -
\??\c:\dvvjd.exec:\dvvjd.exe57⤵
- Executes dropped EXE
PID:3180 -
\??\c:\fffxllx.exec:\fffxllx.exe58⤵
- Executes dropped EXE
PID:4116 -
\??\c:\nnhtnb.exec:\nnhtnb.exe59⤵
- Executes dropped EXE
PID:2168 -
\??\c:\9bnhbb.exec:\9bnhbb.exe60⤵
- Executes dropped EXE
PID:4828 -
\??\c:\ppvvd.exec:\ppvvd.exe61⤵
- Executes dropped EXE
PID:3840 -
\??\c:\lrlfrlf.exec:\lrlfrlf.exe62⤵
- Executes dropped EXE
PID:3168 -
\??\c:\9bhbbb.exec:\9bhbbb.exe63⤵
- Executes dropped EXE
PID:2292 -
\??\c:\5tnhtt.exec:\5tnhtt.exe64⤵
- Executes dropped EXE
PID:3972 -
\??\c:\vpvpv.exec:\vpvpv.exe65⤵
- Executes dropped EXE
PID:4056 -
\??\c:\7rlrrlx.exec:\7rlrrlx.exe66⤵PID:4064
-
\??\c:\3tbttn.exec:\3tbttn.exe67⤵PID:3576
-
\??\c:\nhhbnb.exec:\nhhbnb.exe68⤵PID:708
-
\??\c:\dvvjd.exec:\dvvjd.exe69⤵PID:4884
-
\??\c:\xxlfxrf.exec:\xxlfxrf.exe70⤵PID:1540
-
\??\c:\ffxlfxr.exec:\ffxlfxr.exe71⤵
- System Location Discovery: System Language Discovery
PID:2984 -
\??\c:\nnbtnh.exec:\nnbtnh.exe72⤵PID:2232
-
\??\c:\7vvpp.exec:\7vvpp.exe73⤵PID:3088
-
\??\c:\jvvvp.exec:\jvvvp.exe74⤵PID:4540
-
\??\c:\lfffxxr.exec:\lfffxxr.exe75⤵
- System Location Discovery: System Language Discovery
PID:2856 -
\??\c:\bthhhh.exec:\bthhhh.exe76⤵PID:3976
-
\??\c:\bhtnbt.exec:\bhtnbt.exe77⤵PID:4876
-
\??\c:\jdjvp.exec:\jdjvp.exe78⤵PID:2624
-
\??\c:\3pdpj.exec:\3pdpj.exe79⤵PID:1240
-
\??\c:\llfxlfx.exec:\llfxlfx.exe80⤵PID:4496
-
\??\c:\5hhbnn.exec:\5hhbnn.exe81⤵PID:4384
-
\??\c:\vjpvp.exec:\vjpvp.exe82⤵PID:752
-
\??\c:\3djvp.exec:\3djvp.exe83⤵PID:4788
-
\??\c:\xllffxf.exec:\xllffxf.exe84⤵PID:4556
-
\??\c:\fxxlxxl.exec:\fxxlxxl.exe85⤵PID:4836
-
\??\c:\tbtnbt.exec:\tbtnbt.exe86⤵PID:4956
-
\??\c:\9djjd.exec:\9djjd.exe87⤵PID:456
-
\??\c:\3vpjj.exec:\3vpjj.exe88⤵PID:4784
-
\??\c:\xxxxxrf.exec:\xxxxxrf.exe89⤵PID:4376
-
\??\c:\rxrrfxr.exec:\rxrrfxr.exe90⤵PID:2308
-
\??\c:\httnbt.exec:\httnbt.exe91⤵PID:4536
-
\??\c:\1vppj.exec:\1vppj.exe92⤵PID:4392
-
\??\c:\pdpdj.exec:\pdpdj.exe93⤵PID:1872
-
\??\c:\3xfxrlr.exec:\3xfxrlr.exe94⤵PID:1840
-
\??\c:\lrxrfxl.exec:\lrxrfxl.exe95⤵PID:4292
-
\??\c:\7bbthb.exec:\7bbthb.exe96⤵PID:3232
-
\??\c:\nhnhtb.exec:\nhnhtb.exe97⤵PID:388
-
\??\c:\dvpdv.exec:\dvpdv.exe98⤵PID:5092
-
\??\c:\ffxxrfr.exec:\ffxxrfr.exe99⤵PID:3364
-
\??\c:\fxxfxxr.exec:\fxxfxxr.exe100⤵PID:2264
-
\??\c:\1ttnbn.exec:\1ttnbn.exe101⤵PID:4492
-
\??\c:\5dpjp.exec:\5dpjp.exe102⤵PID:1520
-
\??\c:\1vpjd.exec:\1vpjd.exe103⤵PID:3044
-
\??\c:\llxxfxr.exec:\llxxfxr.exe104⤵PID:4424
-
\??\c:\bbnhbb.exec:\bbnhbb.exe105⤵PID:4728
-
\??\c:\hhhnnh.exec:\hhhnnh.exe106⤵PID:3648
-
\??\c:\vvjdp.exec:\vvjdp.exe107⤵PID:2520
-
\??\c:\ddvjv.exec:\ddvjv.exe108⤵PID:4216
-
\??\c:\7xxxrrl.exec:\7xxxrrl.exe109⤵PID:3204
-
\??\c:\ttbnbt.exec:\ttbnbt.exe110⤵PID:216
-
\??\c:\bthbnh.exec:\bthbnh.exe111⤵PID:844
-
\??\c:\pddvv.exec:\pddvv.exe112⤵PID:2408
-
\??\c:\3ffxrlx.exec:\3ffxrlx.exe113⤵PID:4772
-
\??\c:\ffxrllf.exec:\ffxrllf.exe114⤵PID:4716
-
\??\c:\bntnhh.exec:\bntnhh.exe115⤵PID:3628
-
\??\c:\7vdjj.exec:\7vdjj.exe116⤵PID:1948
-
\??\c:\dvdvj.exec:\dvdvj.exe117⤵PID:1544
-
\??\c:\rlrlrlr.exec:\rlrlrlr.exe118⤵PID:4460
-
\??\c:\nhhhbb.exec:\nhhhbb.exe119⤵PID:3788
-
\??\c:\nnhbtt.exec:\nnhbtt.exe120⤵PID:4428
-
\??\c:\pppjd.exec:\pppjd.exe121⤵PID:2340
-
\??\c:\xxlfxxx.exec:\xxlfxxx.exe122⤵PID:708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-