Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2024 19:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dd2a36405c46bdd1e74d23d2a1970f70N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
dd2a36405c46bdd1e74d23d2a1970f70N.exe
-
Size
410KB
-
MD5
dd2a36405c46bdd1e74d23d2a1970f70
-
SHA1
80c37ad51d47a86938e0fd5a1b3b73a6d5996000
-
SHA256
c45bcb0e936e57cda0ea9fa6eb04448e45ef673a84cf9e3149dc7968eada5bfc
-
SHA512
f7cdacd79d460f64cc4148fe1d872cda67761b91ccf8dec9e16fa7057802b80e168f20501ddf65e32a099d33d703f3a60b3be9e4aa43c318aeaff764deddf601
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAsACF486jJSp1BwciI:Pcm7ImGddXtWrXD486jJq1Bwcn
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4848-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2112-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2100-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3816-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3788-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1100-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-271-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-314-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-348-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-374-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1344-384-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-388-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1228-407-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-414-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-433-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-465-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-484-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-503-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-516-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-536-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-543-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-574-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-635-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-678-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-692-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-791-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-843-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-869-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-1229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-1566-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-1752-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2228 bnhbbt.exe 4832 pjdpv.exe 4136 bhhbnh.exe 2116 djpvj.exe 3924 pvjvd.exe 2112 hnhbtn.exe 2100 xffxrrr.exe 1116 ttbtht.exe 5024 frlxrlf.exe 3456 pjdvp.exe 2524 lxlfrll.exe 512 1nhbtt.exe 3996 jdjdp.exe 4528 5llfxrr.exe 3172 bbnhtb.exe 4328 ttbthb.exe 4252 1llfxrx.exe 4044 hbttbn.exe 60 thnthn.exe 636 lfrfxxx.exe 3880 7dvpj.exe 4032 dvpdp.exe 4204 nhhbnb.exe 1432 djjjd.exe 1440 lxrfrlf.exe 464 vpdvj.exe 1112 rrxxxrr.exe 4876 bbhbtn.exe 5060 ffrffxr.exe 4616 5bbnhb.exe 3568 9ppvj.exe 4312 lrlrlrl.exe 2740 vddvj.exe 4860 fxllrrx.exe 4600 tbhbtt.exe 4892 bhtnbn.exe 640 pvpdv.exe 2328 lllxffr.exe 3816 bhhthb.exe 3572 nhhbtn.exe 2084 jdvpd.exe 2532 rlflrrr.exe 4512 flxllfr.exe 3724 nbnhnh.exe 4172 ppvvj.exe 2436 lxfxrrl.exe 2292 fxrfrrr.exe 3420 tbbnbt.exe 3788 dddjv.exe 4380 jvpdp.exe 2644 fllfxfx.exe 1100 htnhbt.exe 1424 tbthbh.exe 1404 djpjd.exe 2096 lrrlffx.exe 452 xffxrlf.exe 4528 bthbtt.exe 3684 vvdpd.exe 4048 vvdpj.exe 3192 frxflfl.exe 4544 bhhnbt.exe 4708 bnhbtn.exe 2552 flfrxrf.exe 4732 nbtthh.exe -
resource yara_rule behavioral2/memory/4848-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2112-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3788-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1100-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-271-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-303-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-310-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-314-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-341-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-348-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-349-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3876-374-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1344-384-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-388-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1228-407-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1532-414-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-433-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-452-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-465-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-484-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-503-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-516-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-536-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-543-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-574-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-635-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-678-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-692-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-791-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4848 wrote to memory of 2228 4848 dd2a36405c46bdd1e74d23d2a1970f70N.exe 85 PID 4848 wrote to memory of 2228 4848 dd2a36405c46bdd1e74d23d2a1970f70N.exe 85 PID 4848 wrote to memory of 2228 4848 dd2a36405c46bdd1e74d23d2a1970f70N.exe 85 PID 2228 wrote to memory of 4832 2228 bnhbbt.exe 86 PID 2228 wrote to memory of 4832 2228 bnhbbt.exe 86 PID 2228 wrote to memory of 4832 2228 bnhbbt.exe 86 PID 4832 wrote to memory of 4136 4832 pjdpv.exe 87 PID 4832 wrote to memory of 4136 4832 pjdpv.exe 87 PID 4832 wrote to memory of 4136 4832 pjdpv.exe 87 PID 4136 wrote to memory of 2116 4136 bhhbnh.exe 88 PID 4136 wrote to memory of 2116 4136 bhhbnh.exe 88 PID 4136 wrote to memory of 2116 4136 bhhbnh.exe 88 PID 2116 wrote to memory of 3924 2116 djpvj.exe 89 PID 2116 wrote to memory of 3924 2116 djpvj.exe 89 PID 2116 wrote to memory of 3924 2116 djpvj.exe 89 PID 3924 wrote to memory of 2112 3924 pvjvd.exe 90 PID 3924 wrote to memory of 2112 3924 pvjvd.exe 90 PID 3924 wrote to memory of 2112 3924 pvjvd.exe 90 PID 2112 wrote to memory of 2100 2112 hnhbtn.exe 92 PID 2112 wrote to memory of 2100 2112 hnhbtn.exe 92 PID 2112 wrote to memory of 2100 2112 hnhbtn.exe 92 PID 2100 wrote to memory of 1116 2100 xffxrrr.exe 93 PID 2100 wrote to memory of 1116 2100 xffxrrr.exe 93 PID 2100 wrote to memory of 1116 2100 xffxrrr.exe 93 PID 1116 wrote to memory of 5024 1116 ttbtht.exe 95 PID 1116 wrote to memory of 5024 1116 ttbtht.exe 95 PID 1116 wrote to memory of 5024 1116 ttbtht.exe 95 PID 5024 wrote to memory of 3456 5024 frlxrlf.exe 97 PID 5024 wrote to memory of 3456 5024 frlxrlf.exe 97 PID 5024 wrote to memory of 3456 5024 frlxrlf.exe 97 PID 3456 wrote to memory of 2524 3456 pjdvp.exe 98 PID 3456 wrote to memory of 2524 3456 pjdvp.exe 98 PID 3456 wrote to memory of 2524 3456 pjdvp.exe 98 PID 2524 wrote to memory of 512 2524 lxlfrll.exe 99 PID 2524 wrote to memory of 512 2524 lxlfrll.exe 99 PID 2524 wrote to memory of 512 2524 lxlfrll.exe 99 PID 512 wrote to memory of 3996 512 1nhbtt.exe 100 PID 512 wrote to memory of 3996 512 1nhbtt.exe 100 PID 512 wrote to memory of 3996 512 1nhbtt.exe 100 PID 3996 wrote to memory of 4528 3996 jdjdp.exe 101 PID 3996 wrote to memory of 4528 3996 jdjdp.exe 101 PID 3996 wrote to memory of 4528 3996 jdjdp.exe 101 PID 4528 wrote to memory of 3172 4528 5llfxrr.exe 102 PID 4528 wrote to memory of 3172 4528 5llfxrr.exe 102 PID 4528 wrote to memory of 3172 4528 5llfxrr.exe 102 PID 3172 wrote to memory of 4328 3172 bbnhtb.exe 103 PID 3172 wrote to memory of 4328 3172 bbnhtb.exe 103 PID 3172 wrote to memory of 4328 3172 bbnhtb.exe 103 PID 4328 wrote to memory of 4252 4328 ttbthb.exe 104 PID 4328 wrote to memory of 4252 4328 ttbthb.exe 104 PID 4328 wrote to memory of 4252 4328 ttbthb.exe 104 PID 4252 wrote to memory of 4044 4252 1llfxrx.exe 105 PID 4252 wrote to memory of 4044 4252 1llfxrx.exe 105 PID 4252 wrote to memory of 4044 4252 1llfxrx.exe 105 PID 4044 wrote to memory of 60 4044 hbttbn.exe 106 PID 4044 wrote to memory of 60 4044 hbttbn.exe 106 PID 4044 wrote to memory of 60 4044 hbttbn.exe 106 PID 60 wrote to memory of 636 60 thnthn.exe 107 PID 60 wrote to memory of 636 60 thnthn.exe 107 PID 60 wrote to memory of 636 60 thnthn.exe 107 PID 636 wrote to memory of 3880 636 lfrfxxx.exe 108 PID 636 wrote to memory of 3880 636 lfrfxxx.exe 108 PID 636 wrote to memory of 3880 636 lfrfxxx.exe 108 PID 3880 wrote to memory of 4032 3880 7dvpj.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd2a36405c46bdd1e74d23d2a1970f70N.exe"C:\Users\Admin\AppData\Local\Temp\dd2a36405c46bdd1e74d23d2a1970f70N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\bnhbbt.exec:\bnhbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\pjdpv.exec:\pjdpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\bhhbnh.exec:\bhhbnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\djpvj.exec:\djpvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\pvjvd.exec:\pvjvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\hnhbtn.exec:\hnhbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\xffxrrr.exec:\xffxrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\ttbtht.exec:\ttbtht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\frlxrlf.exec:\frlxrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\pjdvp.exec:\pjdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\lxlfrll.exec:\lxlfrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\1nhbtt.exec:\1nhbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\jdjdp.exec:\jdjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\5llfxrr.exec:\5llfxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\bbnhtb.exec:\bbnhtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\ttbthb.exec:\ttbthb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\1llfxrx.exec:\1llfxrx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\hbttbn.exec:\hbttbn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\thnthn.exec:\thnthn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\lfrfxxx.exec:\lfrfxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\7dvpj.exec:\7dvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\dvpdp.exec:\dvpdp.exe23⤵
- Executes dropped EXE
PID:4032 -
\??\c:\nhhbnb.exec:\nhhbnb.exe24⤵
- Executes dropped EXE
PID:4204 -
\??\c:\djjjd.exec:\djjjd.exe25⤵
- Executes dropped EXE
PID:1432 -
\??\c:\lxrfrlf.exec:\lxrfrlf.exe26⤵
- Executes dropped EXE
PID:1440 -
\??\c:\vpdvj.exec:\vpdvj.exe27⤵
- Executes dropped EXE
PID:464 -
\??\c:\rrxxxrr.exec:\rrxxxrr.exe28⤵
- Executes dropped EXE
PID:1112 -
\??\c:\bbhbtn.exec:\bbhbtn.exe29⤵
- Executes dropped EXE
PID:4876 -
\??\c:\ffrffxr.exec:\ffrffxr.exe30⤵
- Executes dropped EXE
PID:5060 -
\??\c:\5bbnhb.exec:\5bbnhb.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4616 -
\??\c:\9ppvj.exec:\9ppvj.exe32⤵
- Executes dropped EXE
PID:3568 -
\??\c:\lrlrlrl.exec:\lrlrlrl.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4312 -
\??\c:\vddvj.exec:\vddvj.exe34⤵
- Executes dropped EXE
PID:2740 -
\??\c:\fxllrrx.exec:\fxllrrx.exe35⤵
- Executes dropped EXE
PID:4860 -
\??\c:\tbhbtt.exec:\tbhbtt.exe36⤵
- Executes dropped EXE
PID:4600 -
\??\c:\bhtnbn.exec:\bhtnbn.exe37⤵
- Executes dropped EXE
PID:4892 -
\??\c:\pvpdv.exec:\pvpdv.exe38⤵
- Executes dropped EXE
PID:640 -
\??\c:\lllxffr.exec:\lllxffr.exe39⤵
- Executes dropped EXE
PID:2328 -
\??\c:\bhhthb.exec:\bhhthb.exe40⤵
- Executes dropped EXE
PID:3816 -
\??\c:\nhhbtn.exec:\nhhbtn.exe41⤵
- Executes dropped EXE
PID:3572 -
\??\c:\jdvpd.exec:\jdvpd.exe42⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rlflrrr.exec:\rlflrrr.exe43⤵
- Executes dropped EXE
PID:2532 -
\??\c:\flxllfr.exec:\flxllfr.exe44⤵
- Executes dropped EXE
PID:4512 -
\??\c:\nbnhnh.exec:\nbnhnh.exe45⤵
- Executes dropped EXE
PID:3724 -
\??\c:\ppvvj.exec:\ppvvj.exe46⤵
- Executes dropped EXE
PID:4172 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe47⤵
- Executes dropped EXE
PID:2436 -
\??\c:\fxrfrrr.exec:\fxrfrrr.exe48⤵
- Executes dropped EXE
PID:2292 -
\??\c:\tbbnbt.exec:\tbbnbt.exe49⤵
- Executes dropped EXE
PID:3420 -
\??\c:\dddjv.exec:\dddjv.exe50⤵
- Executes dropped EXE
PID:3788 -
\??\c:\jvpdp.exec:\jvpdp.exe51⤵
- Executes dropped EXE
PID:4380 -
\??\c:\fllfxfx.exec:\fllfxfx.exe52⤵
- Executes dropped EXE
PID:2644 -
\??\c:\htnhbt.exec:\htnhbt.exe53⤵
- Executes dropped EXE
PID:1100 -
\??\c:\tbthbh.exec:\tbthbh.exe54⤵
- Executes dropped EXE
PID:1424 -
\??\c:\djpjd.exec:\djpjd.exe55⤵
- Executes dropped EXE
PID:1404 -
\??\c:\lrrlffx.exec:\lrrlffx.exe56⤵
- Executes dropped EXE
PID:2096 -
\??\c:\xffxrlf.exec:\xffxrlf.exe57⤵
- Executes dropped EXE
PID:452 -
\??\c:\bthbtt.exec:\bthbtt.exe58⤵
- Executes dropped EXE
PID:4528 -
\??\c:\vvdpd.exec:\vvdpd.exe59⤵
- Executes dropped EXE
PID:3684 -
\??\c:\vvdpj.exec:\vvdpj.exe60⤵
- Executes dropped EXE
PID:4048 -
\??\c:\frxflfl.exec:\frxflfl.exe61⤵
- Executes dropped EXE
PID:3192 -
\??\c:\bhhnbt.exec:\bhhnbt.exe62⤵
- Executes dropped EXE
PID:4544 -
\??\c:\bnhbtn.exec:\bnhbtn.exe63⤵
- Executes dropped EXE
PID:4708 -
\??\c:\flfrxrf.exec:\flfrxrf.exe64⤵
- Executes dropped EXE
PID:2552 -
\??\c:\nbtthh.exec:\nbtthh.exe65⤵
- Executes dropped EXE
PID:4732 -
\??\c:\hhnhhn.exec:\hhnhhn.exe66⤵PID:1472
-
\??\c:\vvvvp.exec:\vvvvp.exe67⤵PID:2572
-
\??\c:\xfrrffx.exec:\xfrrffx.exe68⤵PID:1368
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe69⤵PID:2508
-
\??\c:\bbnnnh.exec:\bbnnnh.exe70⤵PID:4032
-
\??\c:\nbbbtt.exec:\nbbbtt.exe71⤵PID:1816
-
\??\c:\dpvjd.exec:\dpvjd.exe72⤵PID:4204
-
\??\c:\lffxxxr.exec:\lffxxxr.exe73⤵PID:4548
-
\??\c:\rrlxlff.exec:\rrlxlff.exe74⤵PID:4936
-
\??\c:\hnttnn.exec:\hnttnn.exe75⤵PID:1264
-
\??\c:\pvdvj.exec:\pvdvj.exe76⤵PID:1896
-
\??\c:\llrlxxr.exec:\llrlxxr.exe77⤵PID:4940
-
\??\c:\9lfxllf.exec:\9lfxllf.exe78⤵PID:1720
-
\??\c:\hbbbnn.exec:\hbbbnn.exe79⤵PID:3728
-
\??\c:\pddpv.exec:\pddpv.exe80⤵PID:4908
-
\??\c:\xllffxr.exec:\xllffxr.exe81⤵PID:3268
-
\??\c:\rllfxxr.exec:\rllfxxr.exe82⤵PID:3692
-
\??\c:\bttnnh.exec:\bttnnh.exe83⤵PID:456
-
\??\c:\pvvjv.exec:\pvvjv.exe84⤵PID:4680
-
\??\c:\5jjdv.exec:\5jjdv.exe85⤵PID:4476
-
\??\c:\fxfrfxf.exec:\fxfrfxf.exe86⤵PID:2860
-
\??\c:\nnnhhh.exec:\nnnhhh.exe87⤵PID:3840
-
\??\c:\pppjd.exec:\pppjd.exe88⤵PID:3876
-
\??\c:\vdjjj.exec:\vdjjj.exe89⤵PID:4944
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe90⤵PID:3056
-
\??\c:\1ttnhn.exec:\1ttnhn.exe91⤵PID:1344
-
\??\c:\nttnhb.exec:\nttnhb.exe92⤵PID:1104
-
\??\c:\1jjdp.exec:\1jjdp.exe93⤵PID:3112
-
\??\c:\vvjpp.exec:\vvjpp.exe94⤵PID:3924
-
\??\c:\rffxlfx.exec:\rffxlfx.exe95⤵PID:4500
-
\??\c:\htnhhh.exec:\htnhhh.exe96⤵PID:4692
-
\??\c:\vdjdd.exec:\vdjdd.exe97⤵PID:2684
-
\??\c:\pjjjj.exec:\pjjjj.exe98⤵PID:1228
-
\??\c:\1rllffr.exec:\1rllffr.exe99⤵PID:4216
-
\??\c:\hhnhtt.exec:\hhnhtt.exe100⤵PID:1532
-
\??\c:\bnttnh.exec:\bnttnh.exe101⤵PID:2292
-
\??\c:\1jdvp.exec:\1jdvp.exe102⤵PID:2288
-
\??\c:\jjjdv.exec:\jjjdv.exe103⤵PID:3788
-
\??\c:\frlfffl.exec:\frlfffl.exe104⤵PID:3948
-
\??\c:\bhhtht.exec:\bhhtht.exe105⤵PID:2872
-
\??\c:\dpdvj.exec:\dpdvj.exe106⤵PID:4588
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe107⤵PID:2760
-
\??\c:\xxfxrxr.exec:\xxfxrxr.exe108⤵PID:2420
-
\??\c:\5ttnhh.exec:\5ttnhh.exe109⤵PID:3312
-
\??\c:\dvvdv.exec:\dvvdv.exe110⤵PID:2096
-
\??\c:\pdjvj.exec:\pdjvj.exe111⤵PID:4920
-
\??\c:\1fxlfrl.exec:\1fxlfrl.exe112⤵PID:4528
-
\??\c:\nhtntt.exec:\nhtntt.exe113⤵PID:3684
-
\??\c:\dvvpj.exec:\dvvpj.exe114⤵PID:4232
-
\??\c:\vjjdd.exec:\vjjdd.exe115⤵PID:2196
-
\??\c:\xllllfx.exec:\xllllfx.exe116⤵PID:3080
-
\??\c:\tntnhh.exec:\tntnhh.exe117⤵PID:3544
-
\??\c:\jppjd.exec:\jppjd.exe118⤵PID:1368
-
\??\c:\fxxrrxx.exec:\fxxrrxx.exe119⤵PID:432
-
\??\c:\1fxfxlx.exec:\1fxfxlx.exe120⤵PID:228
-
\??\c:\ttbtnh.exec:\ttbtnh.exe121⤵PID:3196
-
\??\c:\jpvpj.exec:\jpvpj.exe122⤵PID:3664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-