Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2025, 20:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4f424d75b1b06dd5760eca96ca0fbd926ca936f8d0fa9b17175f23cdffff685b.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
4f424d75b1b06dd5760eca96ca0fbd926ca936f8d0fa9b17175f23cdffff685b.exe
-
Size
459KB
-
MD5
51032db7aee08ad84b3dc18d6000f85d
-
SHA1
f3ed9d44261d966e08e2992b93252c1b8ab20a76
-
SHA256
4f424d75b1b06dd5760eca96ca0fbd926ca936f8d0fa9b17175f23cdffff685b
-
SHA512
bb779beacd693e48ad3197670ec8a82362b14c33459340c0a45f548f2040a453dae1cb0078da48f5347dc06588038457685d8c9012cd4e204de4ad01a0d63e1b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbes:q7Tc2NYHUrAwfMp3CDs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2152-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2704-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3352-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1316-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2672-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/600-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2672-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/824-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/700-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/856-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2812-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1784-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2784-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1392-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-683-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-739-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-780-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-857-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2152 bbtnnt.exe 1932 c248404.exe 2704 6648288.exe 3108 8226626.exe 3680 6248866.exe 3588 lxfxxxr.exe 3352 66844.exe 2564 pvpjj.exe 4980 62482.exe 4192 2026660.exe 4724 02260.exe 3764 q64260.exe 4524 4226600.exe 2756 tnnhhn.exe 1732 bttnhn.exe 1316 3dvpd.exe 1708 hhbnbt.exe 1792 8604826.exe 2264 hntnnn.exe 4352 606662.exe 5004 xllrxfl.exe 3756 7btnbn.exe 1980 4686606.exe 4404 626426.exe 2672 2642048.exe 1156 pvpdv.exe 1240 vvvpd.exe 632 ntnbnb.exe 4540 7tthhb.exe 4376 3lrfrfr.exe 2208 2668204.exe 3516 httnnb.exe 1952 w44204.exe 3808 frfrfxr.exe 4652 1vvpd.exe 4560 6822604.exe 3488 4222606.exe 4792 bhhthb.exe 216 u020484.exe 3596 xflfxrr.exe 3588 xxfrffr.exe 600 088640.exe 756 s8088.exe 4256 86222.exe 4084 jvvjd.exe 1628 rrrfrfr.exe 4980 jvvpd.exe 2856 c286426.exe 1920 08260.exe 3268 3vjpj.exe 3944 448282.exe 2468 284826.exe 2756 pjpdp.exe 1732 8804262.exe 3892 xxxrlfx.exe 1316 hnnbtb.exe 1520 jvdvj.exe 232 4242206.exe 3888 pvdpd.exe 4272 0206482.exe 1868 w82608.exe 2264 7xrflfr.exe 1576 pdjvp.exe 3940 80642.exe -
resource yara_rule behavioral2/memory/2152-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2704-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3352-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1316-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2672-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/600-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2672-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/824-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/700-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/856-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1392-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-498-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w44204.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00642.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0828864.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40208.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6620400.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 460808.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2152 1968 4f424d75b1b06dd5760eca96ca0fbd926ca936f8d0fa9b17175f23cdffff685b.exe 87 PID 1968 wrote to memory of 2152 1968 4f424d75b1b06dd5760eca96ca0fbd926ca936f8d0fa9b17175f23cdffff685b.exe 87 PID 1968 wrote to memory of 2152 1968 4f424d75b1b06dd5760eca96ca0fbd926ca936f8d0fa9b17175f23cdffff685b.exe 87 PID 2152 wrote to memory of 1932 2152 bbtnnt.exe 88 PID 2152 wrote to memory of 1932 2152 bbtnnt.exe 88 PID 2152 wrote to memory of 1932 2152 bbtnnt.exe 88 PID 1932 wrote to memory of 2704 1932 c248404.exe 89 PID 1932 wrote to memory of 2704 1932 c248404.exe 89 PID 1932 wrote to memory of 2704 1932 c248404.exe 89 PID 2704 wrote to memory of 3108 2704 6648288.exe 90 PID 2704 wrote to memory of 3108 2704 6648288.exe 90 PID 2704 wrote to memory of 3108 2704 6648288.exe 90 PID 3108 wrote to memory of 3680 3108 8226626.exe 91 PID 3108 wrote to memory of 3680 3108 8226626.exe 91 PID 3108 wrote to memory of 3680 3108 8226626.exe 91 PID 3680 wrote to memory of 3588 3680 6248866.exe 92 PID 3680 wrote to memory of 3588 3680 6248866.exe 92 PID 3680 wrote to memory of 3588 3680 6248866.exe 92 PID 3588 wrote to memory of 3352 3588 lxfxxxr.exe 93 PID 3588 wrote to memory of 3352 3588 lxfxxxr.exe 93 PID 3588 wrote to memory of 3352 3588 lxfxxxr.exe 93 PID 3352 wrote to memory of 2564 3352 66844.exe 94 PID 3352 wrote to memory of 2564 3352 66844.exe 94 PID 3352 wrote to memory of 2564 3352 66844.exe 94 PID 2564 wrote to memory of 4980 2564 pvpjj.exe 95 PID 2564 wrote to memory of 4980 2564 pvpjj.exe 95 PID 2564 wrote to memory of 4980 2564 pvpjj.exe 95 PID 4980 wrote to memory of 4192 4980 62482.exe 97 PID 4980 wrote to memory of 4192 4980 62482.exe 97 PID 4980 wrote to memory of 4192 4980 62482.exe 97 PID 4192 wrote to memory of 4724 4192 2026660.exe 99 PID 4192 wrote to memory of 4724 4192 2026660.exe 99 PID 4192 wrote to memory of 4724 4192 2026660.exe 99 PID 4724 wrote to memory of 3764 4724 02260.exe 100 PID 4724 wrote to memory of 3764 4724 02260.exe 100 PID 4724 wrote to memory of 3764 4724 02260.exe 100 PID 3764 wrote to memory of 4524 3764 q64260.exe 101 PID 3764 wrote to memory of 4524 3764 q64260.exe 101 PID 3764 wrote to memory of 4524 3764 q64260.exe 101 PID 4524 wrote to memory of 2756 4524 4226600.exe 102 PID 4524 wrote to memory of 2756 4524 4226600.exe 102 PID 4524 wrote to memory of 2756 4524 4226600.exe 102 PID 2756 wrote to memory of 1732 2756 tnnhhn.exe 103 PID 2756 wrote to memory of 1732 2756 tnnhhn.exe 103 PID 2756 wrote to memory of 1732 2756 tnnhhn.exe 103 PID 1732 wrote to memory of 1316 1732 bttnhn.exe 104 PID 1732 wrote to memory of 1316 1732 bttnhn.exe 104 PID 1732 wrote to memory of 1316 1732 bttnhn.exe 104 PID 1316 wrote to memory of 1708 1316 3dvpd.exe 106 PID 1316 wrote to memory of 1708 1316 3dvpd.exe 106 PID 1316 wrote to memory of 1708 1316 3dvpd.exe 106 PID 1708 wrote to memory of 1792 1708 hhbnbt.exe 107 PID 1708 wrote to memory of 1792 1708 hhbnbt.exe 107 PID 1708 wrote to memory of 1792 1708 hhbnbt.exe 107 PID 1792 wrote to memory of 2264 1792 8604826.exe 108 PID 1792 wrote to memory of 2264 1792 8604826.exe 108 PID 1792 wrote to memory of 2264 1792 8604826.exe 108 PID 2264 wrote to memory of 4352 2264 hntnnn.exe 109 PID 2264 wrote to memory of 4352 2264 hntnnn.exe 109 PID 2264 wrote to memory of 4352 2264 hntnnn.exe 109 PID 4352 wrote to memory of 5004 4352 606662.exe 110 PID 4352 wrote to memory of 5004 4352 606662.exe 110 PID 4352 wrote to memory of 5004 4352 606662.exe 110 PID 5004 wrote to memory of 3756 5004 xllrxfl.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f424d75b1b06dd5760eca96ca0fbd926ca936f8d0fa9b17175f23cdffff685b.exe"C:\Users\Admin\AppData\Local\Temp\4f424d75b1b06dd5760eca96ca0fbd926ca936f8d0fa9b17175f23cdffff685b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\bbtnnt.exec:\bbtnnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\c248404.exec:\c248404.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\6648288.exec:\6648288.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\8226626.exec:\8226626.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\6248866.exec:\6248866.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\lxfxxxr.exec:\lxfxxxr.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\66844.exec:\66844.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\pvpjj.exec:\pvpjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\62482.exec:\62482.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\2026660.exec:\2026660.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\02260.exec:\02260.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\q64260.exec:\q64260.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\4226600.exec:\4226600.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\tnnhhn.exec:\tnnhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\bttnhn.exec:\bttnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\3dvpd.exec:\3dvpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\hhbnbt.exec:\hhbnbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\8604826.exec:\8604826.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\hntnnn.exec:\hntnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\606662.exec:\606662.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\xllrxfl.exec:\xllrxfl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\7btnbn.exec:\7btnbn.exe23⤵
- Executes dropped EXE
PID:3756 -
\??\c:\4686606.exec:\4686606.exe24⤵
- Executes dropped EXE
PID:1980 -
\??\c:\626426.exec:\626426.exe25⤵
- Executes dropped EXE
PID:4404 -
\??\c:\2642048.exec:\2642048.exe26⤵
- Executes dropped EXE
PID:2672 -
\??\c:\pvpdv.exec:\pvpdv.exe27⤵
- Executes dropped EXE
PID:1156 -
\??\c:\vvvpd.exec:\vvvpd.exe28⤵
- Executes dropped EXE
PID:1240 -
\??\c:\ntnbnb.exec:\ntnbnb.exe29⤵
- Executes dropped EXE
PID:632 -
\??\c:\7tthhb.exec:\7tthhb.exe30⤵
- Executes dropped EXE
PID:4540 -
\??\c:\3lrfrfr.exec:\3lrfrfr.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4376 -
\??\c:\2668204.exec:\2668204.exe32⤵
- Executes dropped EXE
PID:2208 -
\??\c:\httnnb.exec:\httnnb.exe33⤵
- Executes dropped EXE
PID:3516 -
\??\c:\w44204.exec:\w44204.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1952 -
\??\c:\frfrfxr.exec:\frfrfxr.exe35⤵
- Executes dropped EXE
PID:3808 -
\??\c:\1vvpd.exec:\1vvpd.exe36⤵
- Executes dropped EXE
PID:4652 -
\??\c:\6822604.exec:\6822604.exe37⤵
- Executes dropped EXE
PID:4560 -
\??\c:\4222606.exec:\4222606.exe38⤵
- Executes dropped EXE
PID:3488 -
\??\c:\bhhthb.exec:\bhhthb.exe39⤵
- Executes dropped EXE
PID:4792 -
\??\c:\u020484.exec:\u020484.exe40⤵
- Executes dropped EXE
PID:216 -
\??\c:\xflfxrr.exec:\xflfxrr.exe41⤵
- Executes dropped EXE
PID:3596 -
\??\c:\xxfrffr.exec:\xxfrffr.exe42⤵
- Executes dropped EXE
PID:3588 -
\??\c:\088640.exec:\088640.exe43⤵
- Executes dropped EXE
PID:600 -
\??\c:\s8088.exec:\s8088.exe44⤵
- Executes dropped EXE
PID:756 -
\??\c:\86222.exec:\86222.exe45⤵
- Executes dropped EXE
PID:4256 -
\??\c:\jvvjd.exec:\jvvjd.exe46⤵
- Executes dropped EXE
PID:4084 -
\??\c:\rrrfrfr.exec:\rrrfrfr.exe47⤵
- Executes dropped EXE
PID:1628 -
\??\c:\jvvpd.exec:\jvvpd.exe48⤵
- Executes dropped EXE
PID:4980 -
\??\c:\c286426.exec:\c286426.exe49⤵
- Executes dropped EXE
PID:2856 -
\??\c:\08260.exec:\08260.exe50⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3vjpj.exec:\3vjpj.exe51⤵
- Executes dropped EXE
PID:3268 -
\??\c:\448282.exec:\448282.exe52⤵
- Executes dropped EXE
PID:3944 -
\??\c:\284826.exec:\284826.exe53⤵
- Executes dropped EXE
PID:2468 -
\??\c:\pjpdp.exec:\pjpdp.exe54⤵
- Executes dropped EXE
PID:2756 -
\??\c:\8804262.exec:\8804262.exe55⤵
- Executes dropped EXE
PID:1732 -
\??\c:\xxxrlfx.exec:\xxxrlfx.exe56⤵
- Executes dropped EXE
PID:3892 -
\??\c:\hnnbtb.exec:\hnnbtb.exe57⤵
- Executes dropped EXE
PID:1316 -
\??\c:\jvdvj.exec:\jvdvj.exe58⤵
- Executes dropped EXE
PID:1520 -
\??\c:\4242206.exec:\4242206.exe59⤵
- Executes dropped EXE
PID:232 -
\??\c:\pvdpd.exec:\pvdpd.exe60⤵
- Executes dropped EXE
PID:3888 -
\??\c:\0206482.exec:\0206482.exe61⤵
- Executes dropped EXE
PID:4272 -
\??\c:\w82608.exec:\w82608.exe62⤵
- Executes dropped EXE
PID:1868 -
\??\c:\7xrflfr.exec:\7xrflfr.exe63⤵
- Executes dropped EXE
PID:2264 -
\??\c:\pdjvp.exec:\pdjvp.exe64⤵
- Executes dropped EXE
PID:1576 -
\??\c:\80642.exec:\80642.exe65⤵
- Executes dropped EXE
PID:3940 -
\??\c:\a2420.exec:\a2420.exe66⤵PID:1716
-
\??\c:\46882.exec:\46882.exe67⤵PID:3120
-
\??\c:\064248.exec:\064248.exe68⤵PID:1980
-
\??\c:\pjjvp.exec:\pjjvp.exe69⤵PID:4916
-
\??\c:\xxfxlrl.exec:\xxfxlrl.exe70⤵PID:2752
-
\??\c:\vpjdp.exec:\vpjdp.exe71⤵PID:2672
-
\??\c:\48420.exec:\48420.exe72⤵PID:5016
-
\??\c:\djjvj.exec:\djjvj.exe73⤵PID:5048
-
\??\c:\frxllfx.exec:\frxllfx.exe74⤵PID:2600
-
\??\c:\pjvpd.exec:\pjvpd.exe75⤵PID:824
-
\??\c:\8664482.exec:\8664482.exe76⤵PID:3824
-
\??\c:\nhbbnt.exec:\nhbbnt.exe77⤵PID:4552
-
\??\c:\46248.exec:\46248.exe78⤵PID:5100
-
\??\c:\djjdd.exec:\djjdd.exe79⤵PID:1392
-
\??\c:\xlfxrrx.exec:\xlfxrrx.exe80⤵PID:3364
-
\??\c:\vjdpj.exec:\vjdpj.exe81⤵PID:1952
-
\??\c:\u620826.exec:\u620826.exe82⤵PID:1340
-
\??\c:\640448.exec:\640448.exe83⤵PID:700
-
\??\c:\7lfrfxr.exec:\7lfrfxr.exe84⤵PID:2604
-
\??\c:\0860482.exec:\0860482.exe85⤵PID:1480
-
\??\c:\402266.exec:\402266.exe86⤵PID:856
-
\??\c:\nhhtnh.exec:\nhhtnh.exe87⤵PID:1976
-
\??\c:\btnbnn.exec:\btnbnn.exe88⤵PID:4528
-
\??\c:\pjpjd.exec:\pjpjd.exe89⤵PID:4256
-
\??\c:\m4486.exec:\m4486.exe90⤵PID:1224
-
\??\c:\200448.exec:\200448.exe91⤵PID:3080
-
\??\c:\1dpjp.exec:\1dpjp.exe92⤵PID:2812
-
\??\c:\frxfxll.exec:\frxfxll.exe93⤵PID:4724
-
\??\c:\62826.exec:\62826.exe94⤵PID:4576
-
\??\c:\7xfxfff.exec:\7xfxfff.exe95⤵PID:3040
-
\??\c:\062266.exec:\062266.exe96⤵PID:2296
-
\??\c:\a8620.exec:\a8620.exe97⤵PID:1064
-
\??\c:\jjpvp.exec:\jjpvp.exe98⤵PID:2088
-
\??\c:\244822.exec:\244822.exe99⤵PID:1812
-
\??\c:\608644.exec:\608644.exe100⤵PID:4780
-
\??\c:\djddv.exec:\djddv.exe101⤵PID:4984
-
\??\c:\60266.exec:\60266.exe102⤵PID:1784
-
\??\c:\4826228.exec:\4826228.exe103⤵PID:2784
-
\??\c:\820000.exec:\820000.exe104⤵PID:4900
-
\??\c:\9jjdv.exec:\9jjdv.exe105⤵PID:4956
-
\??\c:\lrfxrrl.exec:\lrfxrrl.exe106⤵PID:4636
-
\??\c:\pvdvv.exec:\pvdvv.exe107⤵PID:3020
-
\??\c:\rrxrllx.exec:\rrxrllx.exe108⤵PID:3940
-
\??\c:\608028.exec:\608028.exe109⤵PID:4856
-
\??\c:\446404.exec:\446404.exe110⤵PID:3420
-
\??\c:\48688.exec:\48688.exe111⤵PID:4352
-
\??\c:\bnttbt.exec:\bnttbt.exe112⤵PID:2752
-
\??\c:\240660.exec:\240660.exe113⤵PID:2720
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe114⤵PID:4600
-
\??\c:\bnbttt.exec:\bnbttt.exe115⤵PID:1664
-
\??\c:\g6426.exec:\g6426.exe116⤵PID:1104
-
\??\c:\dvdvv.exec:\dvdvv.exe117⤵PID:5112
-
\??\c:\c026444.exec:\c026444.exe118⤵PID:2304
-
\??\c:\6206060.exec:\6206060.exe119⤵PID:4552
-
\??\c:\lrfxxxr.exec:\lrfxxxr.exe120⤵PID:5100
-
\??\c:\nbhthb.exec:\nbhthb.exe121⤵PID:1392
-
\??\c:\8260448.exec:\8260448.exe122⤵PID:3660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-