Analysis
-
max time kernel
120s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/08/2024, 01:20
Behavioral task
behavioral1
Sample
2c75f5b0b73da8378aa2025737180fc0N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
2c75f5b0b73da8378aa2025737180fc0N.exe
-
Size
337KB
-
MD5
2c75f5b0b73da8378aa2025737180fc0
-
SHA1
5c7e9c9e5e6d0036e15298a5abcb532b4377206d
-
SHA256
d1f3338e6c605c28ff1594bc274846623e6a62c0333cfa68441456ad872992dc
-
SHA512
463d80669ce93d90857acfc1246f27141165fab3fc92a14c7194dfcad686fcbc5510ba604c457938813a2068a9211f606173fe92dd7be1a31b33eeccb133cf3d
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1i/K:x4wFHoS3eFaKHpv/VycgE8oK
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/5012-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1044-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4752-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2972-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/960-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3168-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3084-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3512-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1932-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2488-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3528-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1496-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1124-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3440-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3440-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1920-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5008-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1344-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1076-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2636-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2124-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1632-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1280-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2532-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4760-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4516-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5008-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4620-477-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-492-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4440-502-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1276-509-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3092-523-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1860-533-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2092-543-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1792-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4380-560-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4708-568-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2904-632-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-667-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1708-1114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-1290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4872 3fxrxrx.exe 1044 3flfrrl.exe 5024 hhhbnn.exe 4000 pdvpj.exe 1992 jdppd.exe 2276 7rfxlff.exe 4692 5btnnh.exe 4752 bhnbtn.exe 100 nthhbh.exe 2872 lxxrlfr.exe 2972 pjpjd.exe 4356 xxxlfxl.exe 960 hhhhht.exe 3168 xlrlxrf.exe 3400 pdddv.exe 3084 dvdvv.exe 5084 xxfxrlf.exe 3512 bnttbt.exe 1932 vpvpp.exe 4528 rrfrflx.exe 2132 bntnbt.exe 2488 jjpdv.exe 1196 9hhthh.exe 448 7djdv.exe 3528 xxxrfxx.exe 4876 5hhbtn.exe 1188 rlrlrrx.exe 1496 1tnhbt.exe 1800 vjvpp.exe 4224 1btnhb.exe 4540 ddvjd.exe 4952 xrrrfxl.exe 4456 dvdvj.exe 4332 llrfxrl.exe 1708 hbbtht.exe 2376 5nnhtt.exe 1124 7djdp.exe 3440 1xrllrl.exe 1252 hhnhbt.exe 4316 vjppd.exe 5064 3flfllf.exe 4964 bhbhhh.exe 5092 9nttht.exe 1920 pvjdj.exe 1044 fflfrlx.exe 5008 tbhbtn.exe 4888 9jvpj.exe 4460 3pjdp.exe 4052 ffxrlff.exe 3868 rfffrlf.exe 1344 htbtbb.exe 4244 vpjpv.exe 4724 lfrlrrx.exe 1300 5bbthb.exe 2212 bhnhhh.exe 1076 pdjdp.exe 2636 rxrrxfl.exe 328 nbhtnn.exe 3064 1rllxlf.exe 2124 bnnnnn.exe 992 5djvj.exe 1784 pvpdp.exe 3384 ffrlflf.exe 3180 tntnbt.exe -
resource yara_rule behavioral2/memory/5012-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233fa-3.dat upx behavioral2/memory/5012-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4872-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002345d-12.dat upx behavioral2/memory/4872-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023460-16.dat upx behavioral2/memory/5024-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1044-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023462-30.dat upx behavioral2/memory/4000-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023461-23.dat upx behavioral2/files/0x0007000000023463-35.dat upx behavioral2/memory/2276-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023464-41.dat upx behavioral2/files/0x0007000000023465-45.dat upx behavioral2/memory/4752-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023466-51.dat upx behavioral2/memory/4752-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023468-57.dat upx behavioral2/files/0x0007000000023469-62.dat upx behavioral2/memory/2972-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346a-69.dat upx behavioral2/memory/2972-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4356-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346b-75.dat upx behavioral2/memory/960-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000001e554-82.dat upx behavioral2/memory/3168-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002345e-87.dat upx behavioral2/memory/3168-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346c-94.dat upx behavioral2/files/0x000700000002346d-100.dat upx behavioral2/memory/3084-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346e-105.dat upx behavioral2/memory/3512-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3400-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5084-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346f-114.dat upx behavioral2/memory/1932-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023470-118.dat upx behavioral2/files/0x0007000000023472-128.dat upx behavioral2/files/0x0007000000023471-124.dat upx behavioral2/files/0x0007000000023473-133.dat upx behavioral2/memory/2488-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023474-139.dat upx behavioral2/files/0x0007000000023475-144.dat upx behavioral2/files/0x0007000000023476-149.dat upx behavioral2/memory/3528-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023477-155.dat upx behavioral2/memory/4876-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0003000000022aa9-162.dat upx behavioral2/memory/1496-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023479-167.dat upx behavioral2/memory/1800-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002347a-173.dat upx behavioral2/memory/4224-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002347b-178.dat upx behavioral2/files/0x000700000002347c-184.dat upx behavioral2/memory/4540-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4952-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4456-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2376-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1124-209-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5012 wrote to memory of 4872 5012 2c75f5b0b73da8378aa2025737180fc0N.exe 83 PID 5012 wrote to memory of 4872 5012 2c75f5b0b73da8378aa2025737180fc0N.exe 83 PID 5012 wrote to memory of 4872 5012 2c75f5b0b73da8378aa2025737180fc0N.exe 83 PID 4872 wrote to memory of 1044 4872 3fxrxrx.exe 85 PID 4872 wrote to memory of 1044 4872 3fxrxrx.exe 85 PID 4872 wrote to memory of 1044 4872 3fxrxrx.exe 85 PID 1044 wrote to memory of 5024 1044 3flfrrl.exe 86 PID 1044 wrote to memory of 5024 1044 3flfrrl.exe 86 PID 1044 wrote to memory of 5024 1044 3flfrrl.exe 86 PID 5024 wrote to memory of 4000 5024 hhhbnn.exe 87 PID 5024 wrote to memory of 4000 5024 hhhbnn.exe 87 PID 5024 wrote to memory of 4000 5024 hhhbnn.exe 87 PID 4000 wrote to memory of 1992 4000 pdvpj.exe 88 PID 4000 wrote to memory of 1992 4000 pdvpj.exe 88 PID 4000 wrote to memory of 1992 4000 pdvpj.exe 88 PID 1992 wrote to memory of 2276 1992 jdppd.exe 89 PID 1992 wrote to memory of 2276 1992 jdppd.exe 89 PID 1992 wrote to memory of 2276 1992 jdppd.exe 89 PID 2276 wrote to memory of 4692 2276 7rfxlff.exe 90 PID 2276 wrote to memory of 4692 2276 7rfxlff.exe 90 PID 2276 wrote to memory of 4692 2276 7rfxlff.exe 90 PID 4692 wrote to memory of 4752 4692 5btnnh.exe 91 PID 4692 wrote to memory of 4752 4692 5btnnh.exe 91 PID 4692 wrote to memory of 4752 4692 5btnnh.exe 91 PID 4752 wrote to memory of 100 4752 bhnbtn.exe 92 PID 4752 wrote to memory of 100 4752 bhnbtn.exe 92 PID 4752 wrote to memory of 100 4752 bhnbtn.exe 92 PID 100 wrote to memory of 2872 100 nthhbh.exe 93 PID 100 wrote to memory of 2872 100 nthhbh.exe 93 PID 100 wrote to memory of 2872 100 nthhbh.exe 93 PID 2872 wrote to memory of 2972 2872 lxxrlfr.exe 94 PID 2872 wrote to memory of 2972 2872 lxxrlfr.exe 94 PID 2872 wrote to memory of 2972 2872 lxxrlfr.exe 94 PID 2972 wrote to memory of 4356 2972 pjpjd.exe 95 PID 2972 wrote to memory of 4356 2972 pjpjd.exe 95 PID 2972 wrote to memory of 4356 2972 pjpjd.exe 95 PID 4356 wrote to memory of 960 4356 xxxlfxl.exe 96 PID 4356 wrote to memory of 960 4356 xxxlfxl.exe 96 PID 4356 wrote to memory of 960 4356 xxxlfxl.exe 96 PID 960 wrote to memory of 3168 960 hhhhht.exe 97 PID 960 wrote to memory of 3168 960 hhhhht.exe 97 PID 960 wrote to memory of 3168 960 hhhhht.exe 97 PID 3168 wrote to memory of 3400 3168 xlrlxrf.exe 98 PID 3168 wrote to memory of 3400 3168 xlrlxrf.exe 98 PID 3168 wrote to memory of 3400 3168 xlrlxrf.exe 98 PID 3400 wrote to memory of 3084 3400 pdddv.exe 99 PID 3400 wrote to memory of 3084 3400 pdddv.exe 99 PID 3400 wrote to memory of 3084 3400 pdddv.exe 99 PID 3084 wrote to memory of 5084 3084 dvdvv.exe 100 PID 3084 wrote to memory of 5084 3084 dvdvv.exe 100 PID 3084 wrote to memory of 5084 3084 dvdvv.exe 100 PID 5084 wrote to memory of 3512 5084 xxfxrlf.exe 101 PID 5084 wrote to memory of 3512 5084 xxfxrlf.exe 101 PID 5084 wrote to memory of 3512 5084 xxfxrlf.exe 101 PID 3512 wrote to memory of 1932 3512 bnttbt.exe 102 PID 3512 wrote to memory of 1932 3512 bnttbt.exe 102 PID 3512 wrote to memory of 1932 3512 bnttbt.exe 102 PID 1932 wrote to memory of 4528 1932 vpvpp.exe 103 PID 1932 wrote to memory of 4528 1932 vpvpp.exe 103 PID 1932 wrote to memory of 4528 1932 vpvpp.exe 103 PID 4528 wrote to memory of 2132 4528 rrfrflx.exe 104 PID 4528 wrote to memory of 2132 4528 rrfrflx.exe 104 PID 4528 wrote to memory of 2132 4528 rrfrflx.exe 104 PID 2132 wrote to memory of 2488 2132 bntnbt.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c75f5b0b73da8378aa2025737180fc0N.exe"C:\Users\Admin\AppData\Local\Temp\2c75f5b0b73da8378aa2025737180fc0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\3fxrxrx.exec:\3fxrxrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\3flfrrl.exec:\3flfrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\hhhbnn.exec:\hhhbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\pdvpj.exec:\pdvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\jdppd.exec:\jdppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\7rfxlff.exec:\7rfxlff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\5btnnh.exec:\5btnnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\bhnbtn.exec:\bhnbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\nthhbh.exec:\nthhbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\lxxrlfr.exec:\lxxrlfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\pjpjd.exec:\pjpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\xxxlfxl.exec:\xxxlfxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\hhhhht.exec:\hhhhht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\xlrlxrf.exec:\xlrlxrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\pdddv.exec:\pdddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\dvdvv.exec:\dvdvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\xxfxrlf.exec:\xxfxrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\bnttbt.exec:\bnttbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\vpvpp.exec:\vpvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\rrfrflx.exec:\rrfrflx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\bntnbt.exec:\bntnbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\jjpdv.exec:\jjpdv.exe23⤵
- Executes dropped EXE
PID:2488 -
\??\c:\9hhthh.exec:\9hhthh.exe24⤵
- Executes dropped EXE
PID:1196 -
\??\c:\7djdv.exec:\7djdv.exe25⤵
- Executes dropped EXE
PID:448 -
\??\c:\xxxrfxx.exec:\xxxrfxx.exe26⤵
- Executes dropped EXE
PID:3528 -
\??\c:\5hhbtn.exec:\5hhbtn.exe27⤵
- Executes dropped EXE
PID:4876 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe28⤵
- Executes dropped EXE
PID:1188 -
\??\c:\1tnhbt.exec:\1tnhbt.exe29⤵
- Executes dropped EXE
PID:1496 -
\??\c:\vjvpp.exec:\vjvpp.exe30⤵
- Executes dropped EXE
PID:1800 -
\??\c:\1btnhb.exec:\1btnhb.exe31⤵
- Executes dropped EXE
PID:4224 -
\??\c:\ddvjd.exec:\ddvjd.exe32⤵
- Executes dropped EXE
PID:4540 -
\??\c:\xrrrfxl.exec:\xrrrfxl.exe33⤵
- Executes dropped EXE
PID:4952 -
\??\c:\dvdvj.exec:\dvdvj.exe34⤵
- Executes dropped EXE
PID:4456 -
\??\c:\llrfxrl.exec:\llrfxrl.exe35⤵
- Executes dropped EXE
PID:4332 -
\??\c:\hbbtht.exec:\hbbtht.exe36⤵
- Executes dropped EXE
PID:1708 -
\??\c:\5nnhtt.exec:\5nnhtt.exe37⤵
- Executes dropped EXE
PID:2376 -
\??\c:\7djdp.exec:\7djdp.exe38⤵
- Executes dropped EXE
PID:1124 -
\??\c:\1xrllrl.exec:\1xrllrl.exe39⤵
- Executes dropped EXE
PID:3440 -
\??\c:\hhnhbt.exec:\hhnhbt.exe40⤵
- Executes dropped EXE
PID:1252 -
\??\c:\vjppd.exec:\vjppd.exe41⤵
- Executes dropped EXE
PID:4316 -
\??\c:\3flfllf.exec:\3flfllf.exe42⤵
- Executes dropped EXE
PID:5064 -
\??\c:\bhbhhh.exec:\bhbhhh.exe43⤵
- Executes dropped EXE
PID:4964 -
\??\c:\9nttht.exec:\9nttht.exe44⤵
- Executes dropped EXE
PID:5092 -
\??\c:\pvjdj.exec:\pvjdj.exe45⤵
- Executes dropped EXE
PID:1920 -
\??\c:\fflfrlx.exec:\fflfrlx.exe46⤵
- Executes dropped EXE
PID:1044 -
\??\c:\tbhbtn.exec:\tbhbtn.exe47⤵
- Executes dropped EXE
PID:5008 -
\??\c:\9jvpj.exec:\9jvpj.exe48⤵
- Executes dropped EXE
PID:4888 -
\??\c:\3pjdp.exec:\3pjdp.exe49⤵
- Executes dropped EXE
PID:4460 -
\??\c:\ffxrlff.exec:\ffxrlff.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4052 -
\??\c:\rfffrlf.exec:\rfffrlf.exe51⤵
- Executes dropped EXE
PID:3868 -
\??\c:\htbtbb.exec:\htbtbb.exe52⤵
- Executes dropped EXE
PID:1344 -
\??\c:\vpjpv.exec:\vpjpv.exe53⤵
- Executes dropped EXE
PID:4244 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe54⤵
- Executes dropped EXE
PID:4724 -
\??\c:\5bbthb.exec:\5bbthb.exe55⤵
- Executes dropped EXE
PID:1300 -
\??\c:\bhnhhh.exec:\bhnhhh.exe56⤵
- Executes dropped EXE
PID:2212 -
\??\c:\pdjdp.exec:\pdjdp.exe57⤵
- Executes dropped EXE
PID:1076 -
\??\c:\rxrrxfl.exec:\rxrrxfl.exe58⤵
- Executes dropped EXE
PID:2636 -
\??\c:\nbhtnn.exec:\nbhtnn.exe59⤵
- Executes dropped EXE
PID:328 -
\??\c:\1rllxlf.exec:\1rllxlf.exe60⤵
- Executes dropped EXE
PID:3064 -
\??\c:\bnnnnn.exec:\bnnnnn.exe61⤵
- Executes dropped EXE
PID:2124 -
\??\c:\5djvj.exec:\5djvj.exe62⤵
- Executes dropped EXE
PID:992 -
\??\c:\pvpdp.exec:\pvpdp.exe63⤵
- Executes dropped EXE
PID:1784 -
\??\c:\ffrlflf.exec:\ffrlflf.exe64⤵
- Executes dropped EXE
PID:3384 -
\??\c:\tntnbt.exec:\tntnbt.exe65⤵
- Executes dropped EXE
PID:3180 -
\??\c:\vpvvj.exec:\vpvvj.exe66⤵PID:3420
-
\??\c:\9ffxllf.exec:\9ffxllf.exe67⤵PID:4668
-
\??\c:\lffllfr.exec:\lffllfr.exe68⤵PID:1632
-
\??\c:\hhhbtt.exec:\hhhbtt.exe69⤵PID:1280
-
\??\c:\vjpjd.exec:\vjpjd.exe70⤵PID:3260
-
\??\c:\llrlxrl.exec:\llrlxrl.exe71⤵PID:1232
-
\??\c:\fxxlflf.exec:\fxxlflf.exe72⤵PID:5044
-
\??\c:\tnnhbt.exec:\tnnhbt.exe73⤵PID:1368
-
\??\c:\dvdvp.exec:\dvdvp.exe74⤵PID:1196
-
\??\c:\xxfrlxr.exec:\xxfrlxr.exe75⤵PID:1684
-
\??\c:\frrlxrl.exec:\frrlxrl.exe76⤵PID:3280
-
\??\c:\htbtnn.exec:\htbtnn.exe77⤵PID:3528
-
\??\c:\vdjdd.exec:\vdjdd.exe78⤵PID:2800
-
\??\c:\rlxrffx.exec:\rlxrffx.exe79⤵PID:2532
-
\??\c:\htnbnh.exec:\htnbnh.exe80⤵PID:1036
-
\??\c:\jvddv.exec:\jvddv.exe81⤵PID:1328
-
\??\c:\vdjvd.exec:\vdjvd.exe82⤵PID:1960
-
\??\c:\rllfxrr.exec:\rllfxrr.exe83⤵PID:396
-
\??\c:\3tbbbb.exec:\3tbbbb.exe84⤵PID:4860
-
\??\c:\bntnhn.exec:\bntnhn.exe85⤵PID:2368
-
\??\c:\jdpjv.exec:\jdpjv.exe86⤵PID:3508
-
\??\c:\pvdvj.exec:\pvdvj.exe87⤵PID:2228
-
\??\c:\fxfxlfx.exec:\fxfxlfx.exe88⤵PID:4760
-
\??\c:\tnhntt.exec:\tnhntt.exe89⤵PID:4516
-
\??\c:\nbhbhb.exec:\nbhbhb.exe90⤵PID:2676
-
\??\c:\vjdvp.exec:\vjdvp.exe91⤵PID:3544
-
\??\c:\jddvv.exec:\jddvv.exe92⤵PID:4836
-
\??\c:\xlrffxf.exec:\xlrffxf.exe93⤵PID:4328
-
\??\c:\tnbbtn.exec:\tnbbtn.exe94⤵PID:1540
-
\??\c:\bbhttt.exec:\bbhttt.exe95⤵PID:1012
-
\??\c:\vdvpd.exec:\vdvpd.exe96⤵PID:5064
-
\??\c:\dppjv.exec:\dppjv.exe97⤵PID:808
-
\??\c:\5xrlxxr.exec:\5xrlxxr.exe98⤵PID:3248
-
\??\c:\nhhbbh.exec:\nhhbbh.exe99⤵PID:2200
-
\??\c:\dddvj.exec:\dddvj.exe100⤵PID:3880
-
\??\c:\pvvvp.exec:\pvvvp.exe101⤵PID:3236
-
\??\c:\xlrrrxx.exec:\xlrrrxx.exe102⤵PID:5008
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe103⤵PID:548
-
\??\c:\thhbtn.exec:\thhbtn.exe104⤵PID:1964
-
\??\c:\9vdvv.exec:\9vdvv.exe105⤵PID:2848
-
\??\c:\3xxrrrl.exec:\3xxrrrl.exe106⤵PID:4692
-
\??\c:\rxrrffx.exec:\rxrrffx.exe107⤵PID:4604
-
\??\c:\nhtnnn.exec:\nhtnnn.exe108⤵PID:4244
-
\??\c:\ppjjd.exec:\ppjjd.exe109⤵PID:4724
-
\??\c:\jjpjd.exec:\jjpjd.exe110⤵PID:1300
-
\??\c:\xrxfrrf.exec:\xrxfrrf.exe111⤵PID:2212
-
\??\c:\7nnbnn.exec:\7nnbnn.exe112⤵PID:1076
-
\??\c:\jvvjv.exec:\jvvjv.exe113⤵PID:5080
-
\??\c:\dvdvv.exec:\dvdvv.exe114⤵PID:400
-
\??\c:\fxxlfxr.exec:\fxxlfxr.exe115⤵PID:1528
-
\??\c:\thhbtn.exec:\thhbtn.exe116⤵PID:5072
-
\??\c:\5ntnnh.exec:\5ntnnh.exe117⤵PID:368
-
\??\c:\ppjdp.exec:\ppjdp.exe118⤵PID:4620
-
\??\c:\lfxlfff.exec:\lfxlfff.exe119⤵PID:4552
-
\??\c:\bhnbtt.exec:\bhnbtt.exe120⤵PID:5108
-
\??\c:\5pddp.exec:\5pddp.exe121⤵PID:1576
-
\??\c:\5pdvp.exec:\5pdvp.exe122⤵PID:4716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-