Analysis
-
max time kernel
120s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08-09-2024 03:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b148b9e5aab63e764124beb7975de030N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
b148b9e5aab63e764124beb7975de030N.exe
-
Size
353KB
-
MD5
b148b9e5aab63e764124beb7975de030
-
SHA1
6acf6c0dbd6fae52230fe6ca737d29a409753b00
-
SHA256
f02111c40e43dec576105338dc53b560aa7aa89a6b31fa8405b15f47766dab7f
-
SHA512
70c97cd17697d8ba1609e8f9150d246d552b78fd6fdc863032e7fa797d50a0f15cf40726e3fff4654597486d42ebdb936bde663d81f37cff31c1dcfd054a7907
-
SSDEEP
6144:4cm7ImGddXvJuzyy/SfVFKpU/sien7NuOpo0HmtDKe0wKyKqiOfm8RCfDK4TrHHF:+7TcBuGy/Sa+/sie0OpncKe/KFBOfmz9
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3032-11-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3692-6-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2256-17-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4924-23-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1964-31-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1824-30-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1544-42-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4408-49-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3724-48-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1932-56-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1468-65-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3020-67-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2460-82-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2240-93-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3548-99-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3112-111-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3352-118-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4140-139-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4488-143-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3044-149-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/816-156-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1264-166-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4812-175-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1944-174-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3084-183-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4420-189-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2896-195-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/552-199-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4544-203-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1920-210-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4708-215-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3476-222-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3032-227-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1232-232-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2940-236-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4408-258-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/568-262-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4296-279-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3540-283-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/400-293-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/644-306-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2652-319-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4432-323-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2912-330-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4488-343-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/468-368-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2580-388-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2284-395-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2832-402-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5068-433-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3512-462-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4472-472-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4212-485-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3820-489-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3696-499-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2244-506-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2648-531-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4412-574-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3704-605-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1360-645-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3776-673-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2504-829-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3400-1021-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3032 hbtnbt.exe 2256 vpjdp.exe 4924 btttnh.exe 1964 lfrlrrf.exe 1824 nnhbhh.exe 1544 tntnnn.exe 3724 ppjjj.exe 4408 vvjpv.exe 1932 fxfxxfl.exe 1468 nthbhn.exe 3020 pddvd.exe 984 frxlfxr.exe 2460 dppjd.exe 3704 ffffxrr.exe 2240 ttnnnn.exe 3548 3lxrrrr.exe 2588 1thhhh.exe 3112 jdvvd.exe 4100 xfrrlfx.exe 3352 ntnbbt.exe 5060 dppvj.exe 4044 xllxxxr.exe 2052 9bntnt.exe 4140 xfxrffx.exe 4488 5tbbtb.exe 3044 9bhhbb.exe 816 tntbtt.exe 1264 vdvvv.exe 1944 rrlfffx.exe 4812 ntntnt.exe 3084 djjjp.exe 4420 bntnhh.exe 3608 jdvpj.exe 2896 ppppv.exe 552 lffrllf.exe 4544 hhnhtt.exe 1672 pppvv.exe 1920 lrlfxxr.exe 1308 5nbhnt.exe 4708 3bnhnn.exe 3476 3xxrrfl.exe 3032 xllxrlf.exe 1232 btbthb.exe 2940 9djjd.exe 4204 ffffflr.exe 656 lfrlfff.exe 2348 vpddv.exe 3668 lfrlxrx.exe 1496 rfrlfxr.exe 2040 hthbbb.exe 4408 1pddp.exe 568 jvppj.exe 4392 rrfxrlf.exe 1468 1hnnhh.exe 1684 vpvpp.exe 4104 5fxxflr.exe 4296 1bttnt.exe 3540 htbbhh.exe 2280 fflffxf.exe 772 7lrrlll.exe 400 7hnnhn.exe 3512 vvvpp.exe 4660 lxfrfrx.exe 920 tbhhhb.exe -
resource yara_rule behavioral2/memory/3032-11-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3692-6-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2256-17-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4924-23-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1964-31-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1824-30-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1544-36-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1544-42-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4408-49-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3724-48-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1932-56-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1468-65-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3020-67-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2460-82-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2240-93-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3548-99-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3112-111-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3352-118-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4140-139-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4488-143-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3044-149-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/816-156-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1264-166-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4812-175-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1944-174-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3084-183-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4420-189-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2896-195-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/552-199-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4544-203-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1920-210-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4708-215-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3476-222-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3032-227-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1232-232-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2940-236-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4408-258-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/568-262-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1684-268-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4296-279-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3540-283-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/400-293-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/644-306-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2652-319-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4432-323-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2912-330-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4488-343-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/468-368-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2580-384-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2580-388-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2284-395-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2832-402-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5068-433-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3512-462-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4472-472-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4212-485-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3820-489-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3696-499-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2244-506-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2648-531-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4412-574-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3704-605-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1360-645-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3776-673-0x0000000000400000-0x000000000042D000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxlllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ffxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3btnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnntn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3692 wrote to memory of 3032 3692 b148b9e5aab63e764124beb7975de030N.exe 85 PID 3692 wrote to memory of 3032 3692 b148b9e5aab63e764124beb7975de030N.exe 85 PID 3692 wrote to memory of 3032 3692 b148b9e5aab63e764124beb7975de030N.exe 85 PID 3032 wrote to memory of 2256 3032 hbtnbt.exe 86 PID 3032 wrote to memory of 2256 3032 hbtnbt.exe 86 PID 3032 wrote to memory of 2256 3032 hbtnbt.exe 86 PID 2256 wrote to memory of 4924 2256 vpjdp.exe 87 PID 2256 wrote to memory of 4924 2256 vpjdp.exe 87 PID 2256 wrote to memory of 4924 2256 vpjdp.exe 87 PID 4924 wrote to memory of 1964 4924 btttnh.exe 88 PID 4924 wrote to memory of 1964 4924 btttnh.exe 88 PID 4924 wrote to memory of 1964 4924 btttnh.exe 88 PID 1964 wrote to memory of 1824 1964 lfrlrrf.exe 89 PID 1964 wrote to memory of 1824 1964 lfrlrrf.exe 89 PID 1964 wrote to memory of 1824 1964 lfrlrrf.exe 89 PID 1824 wrote to memory of 1544 1824 nnhbhh.exe 90 PID 1824 wrote to memory of 1544 1824 nnhbhh.exe 90 PID 1824 wrote to memory of 1544 1824 nnhbhh.exe 90 PID 1544 wrote to memory of 3724 1544 tntnnn.exe 91 PID 1544 wrote to memory of 3724 1544 tntnnn.exe 91 PID 1544 wrote to memory of 3724 1544 tntnnn.exe 91 PID 3724 wrote to memory of 4408 3724 ppjjj.exe 93 PID 3724 wrote to memory of 4408 3724 ppjjj.exe 93 PID 3724 wrote to memory of 4408 3724 ppjjj.exe 93 PID 4408 wrote to memory of 1932 4408 vvjpv.exe 94 PID 4408 wrote to memory of 1932 4408 vvjpv.exe 94 PID 4408 wrote to memory of 1932 4408 vvjpv.exe 94 PID 1932 wrote to memory of 1468 1932 fxfxxfl.exe 96 PID 1932 wrote to memory of 1468 1932 fxfxxfl.exe 96 PID 1932 wrote to memory of 1468 1932 fxfxxfl.exe 96 PID 1468 wrote to memory of 3020 1468 nthbhn.exe 97 PID 1468 wrote to memory of 3020 1468 nthbhn.exe 97 PID 1468 wrote to memory of 3020 1468 nthbhn.exe 97 PID 3020 wrote to memory of 984 3020 pddvd.exe 98 PID 3020 wrote to memory of 984 3020 pddvd.exe 98 PID 3020 wrote to memory of 984 3020 pddvd.exe 98 PID 984 wrote to memory of 2460 984 frxlfxr.exe 99 PID 984 wrote to memory of 2460 984 frxlfxr.exe 99 PID 984 wrote to memory of 2460 984 frxlfxr.exe 99 PID 2460 wrote to memory of 3704 2460 dppjd.exe 100 PID 2460 wrote to memory of 3704 2460 dppjd.exe 100 PID 2460 wrote to memory of 3704 2460 dppjd.exe 100 PID 3704 wrote to memory of 2240 3704 ffffxrr.exe 102 PID 3704 wrote to memory of 2240 3704 ffffxrr.exe 102 PID 3704 wrote to memory of 2240 3704 ffffxrr.exe 102 PID 2240 wrote to memory of 3548 2240 ttnnnn.exe 103 PID 2240 wrote to memory of 3548 2240 ttnnnn.exe 103 PID 2240 wrote to memory of 3548 2240 ttnnnn.exe 103 PID 3548 wrote to memory of 2588 3548 3lxrrrr.exe 104 PID 3548 wrote to memory of 2588 3548 3lxrrrr.exe 104 PID 3548 wrote to memory of 2588 3548 3lxrrrr.exe 104 PID 2588 wrote to memory of 3112 2588 1thhhh.exe 105 PID 2588 wrote to memory of 3112 2588 1thhhh.exe 105 PID 2588 wrote to memory of 3112 2588 1thhhh.exe 105 PID 3112 wrote to memory of 4100 3112 jdvvd.exe 106 PID 3112 wrote to memory of 4100 3112 jdvvd.exe 106 PID 3112 wrote to memory of 4100 3112 jdvvd.exe 106 PID 4100 wrote to memory of 3352 4100 xfrrlfx.exe 107 PID 4100 wrote to memory of 3352 4100 xfrrlfx.exe 107 PID 4100 wrote to memory of 3352 4100 xfrrlfx.exe 107 PID 3352 wrote to memory of 5060 3352 ntnbbt.exe 108 PID 3352 wrote to memory of 5060 3352 ntnbbt.exe 108 PID 3352 wrote to memory of 5060 3352 ntnbbt.exe 108 PID 5060 wrote to memory of 4044 5060 dppvj.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\b148b9e5aab63e764124beb7975de030N.exe"C:\Users\Admin\AppData\Local\Temp\b148b9e5aab63e764124beb7975de030N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\hbtnbt.exec:\hbtnbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\vpjdp.exec:\vpjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\btttnh.exec:\btttnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\lfrlrrf.exec:\lfrlrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\nnhbhh.exec:\nnhbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\tntnnn.exec:\tntnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\ppjjj.exec:\ppjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\vvjpv.exec:\vvjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\fxfxxfl.exec:\fxfxxfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\nthbhn.exec:\nthbhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\pddvd.exec:\pddvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\frxlfxr.exec:\frxlfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\dppjd.exec:\dppjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\ffffxrr.exec:\ffffxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\ttnnnn.exec:\ttnnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\3lxrrrr.exec:\3lxrrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\1thhhh.exec:\1thhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\jdvvd.exec:\jdvvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\xfrrlfx.exec:\xfrrlfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\ntnbbt.exec:\ntnbbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\dppvj.exec:\dppvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\xllxxxr.exec:\xllxxxr.exe23⤵
- Executes dropped EXE
PID:4044 -
\??\c:\9bntnt.exec:\9bntnt.exe24⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xfxrffx.exec:\xfxrffx.exe25⤵
- Executes dropped EXE
PID:4140 -
\??\c:\5tbbtb.exec:\5tbbtb.exe26⤵
- Executes dropped EXE
PID:4488 -
\??\c:\9bhhbb.exec:\9bhhbb.exe27⤵
- Executes dropped EXE
PID:3044 -
\??\c:\tntbtt.exec:\tntbtt.exe28⤵
- Executes dropped EXE
PID:816 -
\??\c:\vdvvv.exec:\vdvvv.exe29⤵
- Executes dropped EXE
PID:1264 -
\??\c:\rrlfffx.exec:\rrlfffx.exe30⤵
- Executes dropped EXE
PID:1944 -
\??\c:\ntntnt.exec:\ntntnt.exe31⤵
- Executes dropped EXE
PID:4812 -
\??\c:\djjjp.exec:\djjjp.exe32⤵
- Executes dropped EXE
PID:3084 -
\??\c:\bntnhh.exec:\bntnhh.exe33⤵
- Executes dropped EXE
PID:4420 -
\??\c:\jdvpj.exec:\jdvpj.exe34⤵
- Executes dropped EXE
PID:3608 -
\??\c:\ppppv.exec:\ppppv.exe35⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lffrllf.exec:\lffrllf.exe36⤵
- Executes dropped EXE
PID:552 -
\??\c:\hhnhtt.exec:\hhnhtt.exe37⤵
- Executes dropped EXE
PID:4544 -
\??\c:\pppvv.exec:\pppvv.exe38⤵
- Executes dropped EXE
PID:1672 -
\??\c:\lrlfxxr.exec:\lrlfxxr.exe39⤵
- Executes dropped EXE
PID:1920 -
\??\c:\5nbhnt.exec:\5nbhnt.exe40⤵
- Executes dropped EXE
PID:1308 -
\??\c:\3bnhnn.exec:\3bnhnn.exe41⤵
- Executes dropped EXE
PID:4708 -
\??\c:\7djdv.exec:\7djdv.exe42⤵PID:4396
-
\??\c:\3xxrrfl.exec:\3xxrrfl.exe43⤵
- Executes dropped EXE
PID:3476 -
\??\c:\xllxrlf.exec:\xllxrlf.exe44⤵
- Executes dropped EXE
PID:3032 -
\??\c:\btbthb.exec:\btbthb.exe45⤵
- Executes dropped EXE
PID:1232 -
\??\c:\9djjd.exec:\9djjd.exe46⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ffffflr.exec:\ffffflr.exe47⤵
- Executes dropped EXE
PID:4204 -
\??\c:\lfrlfff.exec:\lfrlfff.exe48⤵
- Executes dropped EXE
PID:656 -
\??\c:\vpddv.exec:\vpddv.exe49⤵
- Executes dropped EXE
PID:2348 -
\??\c:\lfrlxrx.exec:\lfrlxrx.exe50⤵
- Executes dropped EXE
PID:3668 -
\??\c:\rfrlfxr.exec:\rfrlfxr.exe51⤵
- Executes dropped EXE
PID:1496 -
\??\c:\hthbbb.exec:\hthbbb.exe52⤵
- Executes dropped EXE
PID:2040 -
\??\c:\1pddp.exec:\1pddp.exe53⤵
- Executes dropped EXE
PID:4408 -
\??\c:\jvppj.exec:\jvppj.exe54⤵
- Executes dropped EXE
PID:568 -
\??\c:\rrfxrlf.exec:\rrfxrlf.exe55⤵
- Executes dropped EXE
PID:4392 -
\??\c:\1hnnhh.exec:\1hnnhh.exe56⤵
- Executes dropped EXE
PID:1468 -
\??\c:\vpvpp.exec:\vpvpp.exe57⤵
- Executes dropped EXE
PID:1684 -
\??\c:\5fxxflr.exec:\5fxxflr.exe58⤵
- Executes dropped EXE
PID:4104 -
\??\c:\1bttnt.exec:\1bttnt.exe59⤵
- Executes dropped EXE
PID:4296 -
\??\c:\htbbhh.exec:\htbbhh.exe60⤵
- Executes dropped EXE
PID:3540 -
\??\c:\fflffxf.exec:\fflffxf.exe61⤵
- Executes dropped EXE
PID:2280 -
\??\c:\7lrrlll.exec:\7lrrlll.exe62⤵
- Executes dropped EXE
PID:772 -
\??\c:\7hnnhn.exec:\7hnnhn.exe63⤵
- Executes dropped EXE
PID:400 -
\??\c:\vvvpp.exec:\vvvpp.exe64⤵
- Executes dropped EXE
PID:3512 -
\??\c:\lxfrfrx.exec:\lxfrfrx.exe65⤵
- Executes dropped EXE
PID:4660 -
\??\c:\tbhhhb.exec:\tbhhhb.exe66⤵
- Executes dropped EXE
PID:920 -
\??\c:\thbbhh.exec:\thbbhh.exe67⤵PID:644
-
\??\c:\dvppv.exec:\dvppv.exe68⤵PID:2572
-
\??\c:\rxlfxfx.exec:\rxlfxfx.exe69⤵PID:4736
-
\??\c:\tbnhbh.exec:\tbnhbh.exe70⤵PID:3344
-
\??\c:\jpvvv.exec:\jpvvv.exe71⤵PID:2652
-
\??\c:\fxxxlll.exec:\fxxxlll.exe72⤵PID:4432
-
\??\c:\5hbbhn.exec:\5hbbhn.exe73⤵PID:2232
-
\??\c:\1thbhh.exec:\1thbhh.exe74⤵PID:2912
-
\??\c:\7vvvp.exec:\7vvvp.exe75⤵PID:4712
-
\??\c:\9flfxxr.exec:\9flfxxr.exe76⤵PID:4008
-
\??\c:\nhtnth.exec:\nhtnth.exe77⤵PID:4064
-
\??\c:\vvjdd.exec:\vvjdd.exe78⤵PID:4488
-
\??\c:\ppddj.exec:\ppddj.exe79⤵PID:760
-
\??\c:\ffrlffl.exec:\ffrlffl.exe80⤵PID:1080
-
\??\c:\bbnnhh.exec:\bbnnhh.exe81⤵PID:1700
-
\??\c:\hbntbn.exec:\hbntbn.exe82⤵PID:1372
-
\??\c:\3jppv.exec:\3jppv.exe83⤵PID:3216
-
\??\c:\ppvpj.exec:\ppvpj.exe84⤵PID:4968
-
\??\c:\lfxrflf.exec:\lfxrflf.exe85⤵PID:2688
-
\??\c:\bnnhbt.exec:\bnnhbt.exe86⤵PID:468
-
\??\c:\bnhbtt.exec:\bnhbtt.exe87⤵PID:3608
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe88⤵PID:3132
-
\??\c:\5rxxrxr.exec:\5rxxrxr.exe89⤵PID:552
-
\??\c:\1pvpp.exec:\1pvpp.exe90⤵PID:1520
-
\??\c:\vdppv.exec:\vdppv.exe91⤵PID:232
-
\??\c:\lxxrllf.exec:\lxxrllf.exe92⤵PID:2580
-
\??\c:\lllfrrl.exec:\lllfrrl.exe93⤵PID:972
-
\??\c:\3ntttt.exec:\3ntttt.exe94⤵PID:2284
-
\??\c:\pjvpp.exec:\pjvpp.exe95⤵PID:4396
-
\??\c:\jpvpd.exec:\jpvpd.exe96⤵PID:2832
-
\??\c:\lfrlfxx.exec:\lfrlfxx.exe97⤵PID:236
-
\??\c:\hhnbhh.exec:\hhnbhh.exe98⤵PID:2256
-
\??\c:\bnhbtn.exec:\bnhbtn.exe99⤵PID:440
-
\??\c:\dpdpv.exec:\dpdpv.exe100⤵PID:4836
-
\??\c:\9lrlllx.exec:\9lrlllx.exe101⤵PID:4816
-
\??\c:\ffrrrrr.exec:\ffrrrrr.exe102⤵PID:1544
-
\??\c:\3hhhnt.exec:\3hhhnt.exe103⤵PID:1260
-
\??\c:\1vppj.exec:\1vppj.exe104⤵PID:4332
-
\??\c:\fflffrr.exec:\fflffrr.exe105⤵PID:3336
-
\??\c:\3rlfxrl.exec:\3rlfxrl.exe106⤵PID:5068
-
\??\c:\3hhbbb.exec:\3hhbbb.exe107⤵PID:1188
-
\??\c:\ddddv.exec:\ddddv.exe108⤵PID:696
-
\??\c:\vppjd.exec:\vppjd.exe109⤵PID:1820
-
\??\c:\3rxxffl.exec:\3rxxffl.exe110⤵PID:3400
-
\??\c:\tbnhnt.exec:\tbnhnt.exe111⤵PID:2268
-
\??\c:\hthbtt.exec:\hthbtt.exe112⤵PID:2460
-
\??\c:\vpvpp.exec:\vpvpp.exe113⤵PID:868
-
\??\c:\dvdvp.exec:\dvdvp.exe114⤵PID:3392
-
\??\c:\llllflf.exec:\llllflf.exe115⤵PID:3512
-
\??\c:\nbtnnn.exec:\nbtnnn.exe116⤵PID:4660
-
\??\c:\btbbth.exec:\btbbth.exe117⤵PID:3212
-
\??\c:\pddvv.exec:\pddvv.exe118⤵PID:4472
-
\??\c:\vdpvp.exec:\vdpvp.exe119⤵PID:4156
-
\??\c:\xxrflfx.exec:\xxrflfx.exe120⤵PID:4664
-
\??\c:\ntnnhh.exec:\ntnnhh.exe121⤵PID:2860
-
\??\c:\1ppjd.exec:\1ppjd.exe122⤵PID:4212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-