Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 21:39
Behavioral task
behavioral1
Sample
f53f64157312433eb26f9ca043ad6710N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
f53f64157312433eb26f9ca043ad6710N.exe
-
Size
93KB
-
MD5
f53f64157312433eb26f9ca043ad6710
-
SHA1
e513792b64800d9b8c17680ff30512a6fe2ecee5
-
SHA256
93726498786fa189a2fe0a4726388b3d41337eab97bfbad4d07d69390e175be8
-
SHA512
4d4fe847a391c5646bdfce3b5f634fa74d527769c2a08cef8b27f901622a0ec11fb6c67f14947a5b9b987917b34639c7650e2e08679dafc6aaf9aa0ed0b890d2
-
SSDEEP
1536:cvQBeOGtrYS3srx93UBWfwC6Ggnouy8mVeygryFU2li0gx4EBbhnyLFW+en:chOmTsF93UYfwC6GIoutieyhC2lbgGiF
Malware Config
Signatures
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4972-6-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2580-11-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/516-17-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3424-24-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2592-29-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4944-34-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4724-47-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2420-51-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3092-57-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4428-66-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2228-74-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1048-81-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2400-83-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1476-97-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2516-105-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1100-117-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3408-131-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2548-140-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4172-148-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1612-153-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4372-159-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4764-171-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/452-186-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2892-190-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4712-194-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1480-196-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3736-202-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4308-212-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4320-216-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3268-222-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1808-227-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4124-234-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2504-256-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2612-260-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1452-264-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3348-268-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3000-275-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5084-282-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1672-289-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/636-296-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4480-300-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1516-314-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3376-323-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1060-330-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2012-334-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4840-338-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4176-348-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3500-355-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1900-365-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/864-369-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4712-376-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1092-408-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3272-412-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2888-425-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/772-435-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2116-442-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1048-452-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2760-471-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4872-530-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4040-626-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1040-672-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5104-1063-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2580 bnbtnn.exe 516 5dddv.exe 3424 fffxrxr.exe 2592 fxrllll.exe 4944 jpdpv.exe 4616 pvdvv.exe 4724 nhnhtt.exe 2420 dvddv.exe 3092 ppppj.exe 4428 9hhhnn.exe 4948 bhnnnt.exe 2228 ppvpp.exe 1048 7flfxxx.exe 2400 7frrrxl.exe 3320 bhbtbt.exe 1476 djvpp.exe 2240 vppjd.exe 2516 xfxxflr.exe 1100 bhhhbb.exe 1492 djddd.exe 4620 vjppp.exe 3408 vppjv.exe 2732 7rrlffx.exe 2548 7ttttb.exe 4172 nnnnhh.exe 1612 pjdvv.exe 4372 xlrllxr.exe 3396 tntnnt.exe 4764 jjpjv.exe 4884 vpvpj.exe 1900 rrlfxrl.exe 452 rfxxrrl.exe 2892 thttnn.exe 4712 ddvjj.exe 1480 9flfxff.exe 3736 9rlxxxr.exe 2084 hntttt.exe 1372 pjjdd.exe 4308 pdvvv.exe 4320 9lxrfff.exe 4972 fxxxrrl.exe 3268 nhhhhh.exe 1808 nbhhbb.exe 4640 dppjd.exe 4124 dvdvv.exe 1384 1lrxrrr.exe 4944 xrrrrrr.exe 4616 rfrrrrr.exe 3940 hbnnnt.exe 228 bhnnbn.exe 428 vddvp.exe 2504 djjdv.exe 2612 frrxlfl.exe 1452 xffffff.exe 3348 hhtbtb.exe 4984 5pvvp.exe 3000 pvdpd.exe 5068 rllllll.exe 5084 9rxrllf.exe 1840 thhbtn.exe 1672 dvjjj.exe 1800 vjjdv.exe 636 rlfxxxr.exe 4480 3rfffff.exe -
resource yara_rule behavioral2/memory/4972-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00090000000233e7-3.dat upx behavioral2/memory/4972-6-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0009000000023446-9.dat upx behavioral2/memory/2580-11-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002344a-13.dat upx behavioral2/memory/516-17-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002344b-22.dat upx behavioral2/memory/3424-24-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002344c-27.dat upx behavioral2/memory/2592-29-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002344d-33.dat upx behavioral2/memory/4944-34-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002344f-38.dat upx behavioral2/files/0x0007000000023450-43.dat upx behavioral2/memory/4724-47-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023451-49.dat upx behavioral2/memory/2420-51-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023452-55.dat upx behavioral2/memory/3092-57-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023453-62.dat upx behavioral2/files/0x0007000000023454-67.dat upx behavioral2/memory/4428-66-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023455-72.dat upx behavioral2/memory/2228-74-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1048-81-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2400-83-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023456-79.dat upx behavioral2/files/0x0007000000023457-85.dat upx behavioral2/files/0x0007000000023458-90.dat upx behavioral2/files/0x0007000000023459-95.dat upx behavioral2/memory/1476-97-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002345a-102.dat upx behavioral2/memory/2516-105-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002345c-112.dat upx behavioral2/files/0x000700000002345d-118.dat upx behavioral2/memory/1100-117-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002345e-123.dat upx behavioral2/files/0x000700000002345b-109.dat upx behavioral2/files/0x000700000002345f-128.dat upx behavioral2/memory/3408-131-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023460-135.dat upx behavioral2/memory/2548-140-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023461-142.dat upx behavioral2/files/0x0007000000023462-145.dat upx behavioral2/memory/4172-148-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023463-151.dat upx behavioral2/memory/1612-153-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4372-159-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023464-158.dat upx behavioral2/files/0x0009000000023447-165.dat upx behavioral2/files/0x0007000000023465-168.dat upx behavioral2/memory/4764-171-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023466-175.dat upx behavioral2/files/0x0007000000023467-179.dat upx behavioral2/memory/452-182-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/452-186-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2892-190-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4712-194-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1480-196-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3736-202-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4308-212-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4320-216-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3268-222-0x0000000000400000-0x0000000000436000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1llffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rfxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4972 wrote to memory of 2580 4972 f53f64157312433eb26f9ca043ad6710N.exe 83 PID 4972 wrote to memory of 2580 4972 f53f64157312433eb26f9ca043ad6710N.exe 83 PID 4972 wrote to memory of 2580 4972 f53f64157312433eb26f9ca043ad6710N.exe 83 PID 2580 wrote to memory of 516 2580 bnbtnn.exe 84 PID 2580 wrote to memory of 516 2580 bnbtnn.exe 84 PID 2580 wrote to memory of 516 2580 bnbtnn.exe 84 PID 516 wrote to memory of 3424 516 5dddv.exe 85 PID 516 wrote to memory of 3424 516 5dddv.exe 85 PID 516 wrote to memory of 3424 516 5dddv.exe 85 PID 3424 wrote to memory of 2592 3424 fffxrxr.exe 86 PID 3424 wrote to memory of 2592 3424 fffxrxr.exe 86 PID 3424 wrote to memory of 2592 3424 fffxrxr.exe 86 PID 2592 wrote to memory of 4944 2592 fxrllll.exe 87 PID 2592 wrote to memory of 4944 2592 fxrllll.exe 87 PID 2592 wrote to memory of 4944 2592 fxrllll.exe 87 PID 4944 wrote to memory of 4616 4944 jpdpv.exe 88 PID 4944 wrote to memory of 4616 4944 jpdpv.exe 88 PID 4944 wrote to memory of 4616 4944 jpdpv.exe 88 PID 4616 wrote to memory of 4724 4616 pvdvv.exe 89 PID 4616 wrote to memory of 4724 4616 pvdvv.exe 89 PID 4616 wrote to memory of 4724 4616 pvdvv.exe 89 PID 4724 wrote to memory of 2420 4724 nhnhtt.exe 90 PID 4724 wrote to memory of 2420 4724 nhnhtt.exe 90 PID 4724 wrote to memory of 2420 4724 nhnhtt.exe 90 PID 2420 wrote to memory of 3092 2420 dvddv.exe 91 PID 2420 wrote to memory of 3092 2420 dvddv.exe 91 PID 2420 wrote to memory of 3092 2420 dvddv.exe 91 PID 3092 wrote to memory of 4428 3092 ppppj.exe 92 PID 3092 wrote to memory of 4428 3092 ppppj.exe 92 PID 3092 wrote to memory of 4428 3092 ppppj.exe 92 PID 4428 wrote to memory of 4948 4428 9hhhnn.exe 93 PID 4428 wrote to memory of 4948 4428 9hhhnn.exe 93 PID 4428 wrote to memory of 4948 4428 9hhhnn.exe 93 PID 4948 wrote to memory of 2228 4948 bhnnnt.exe 94 PID 4948 wrote to memory of 2228 4948 bhnnnt.exe 94 PID 4948 wrote to memory of 2228 4948 bhnnnt.exe 94 PID 2228 wrote to memory of 1048 2228 ppvpp.exe 95 PID 2228 wrote to memory of 1048 2228 ppvpp.exe 95 PID 2228 wrote to memory of 1048 2228 ppvpp.exe 95 PID 1048 wrote to memory of 2400 1048 7flfxxx.exe 96 PID 1048 wrote to memory of 2400 1048 7flfxxx.exe 96 PID 1048 wrote to memory of 2400 1048 7flfxxx.exe 96 PID 2400 wrote to memory of 3320 2400 7frrrxl.exe 97 PID 2400 wrote to memory of 3320 2400 7frrrxl.exe 97 PID 2400 wrote to memory of 3320 2400 7frrrxl.exe 97 PID 3320 wrote to memory of 1476 3320 bhbtbt.exe 98 PID 3320 wrote to memory of 1476 3320 bhbtbt.exe 98 PID 3320 wrote to memory of 1476 3320 bhbtbt.exe 98 PID 1476 wrote to memory of 2240 1476 djvpp.exe 99 PID 1476 wrote to memory of 2240 1476 djvpp.exe 99 PID 1476 wrote to memory of 2240 1476 djvpp.exe 99 PID 2240 wrote to memory of 2516 2240 vppjd.exe 100 PID 2240 wrote to memory of 2516 2240 vppjd.exe 100 PID 2240 wrote to memory of 2516 2240 vppjd.exe 100 PID 2516 wrote to memory of 1100 2516 xfxxflr.exe 102 PID 2516 wrote to memory of 1100 2516 xfxxflr.exe 102 PID 2516 wrote to memory of 1100 2516 xfxxflr.exe 102 PID 1100 wrote to memory of 1492 1100 bhhhbb.exe 103 PID 1100 wrote to memory of 1492 1100 bhhhbb.exe 103 PID 1100 wrote to memory of 1492 1100 bhhhbb.exe 103 PID 1492 wrote to memory of 4620 1492 djddd.exe 104 PID 1492 wrote to memory of 4620 1492 djddd.exe 104 PID 1492 wrote to memory of 4620 1492 djddd.exe 104 PID 4620 wrote to memory of 3408 4620 vjppp.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\f53f64157312433eb26f9ca043ad6710N.exe"C:\Users\Admin\AppData\Local\Temp\f53f64157312433eb26f9ca043ad6710N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\bnbtnn.exec:\bnbtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\5dddv.exec:\5dddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\fffxrxr.exec:\fffxrxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\fxrllll.exec:\fxrllll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\jpdpv.exec:\jpdpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\pvdvv.exec:\pvdvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\nhnhtt.exec:\nhnhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\dvddv.exec:\dvddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\ppppj.exec:\ppppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\9hhhnn.exec:\9hhhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\bhnnnt.exec:\bhnnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\ppvpp.exec:\ppvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\7flfxxx.exec:\7flfxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\7frrrxl.exec:\7frrrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\bhbtbt.exec:\bhbtbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\djvpp.exec:\djvpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\vppjd.exec:\vppjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\xfxxflr.exec:\xfxxflr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\bhhhbb.exec:\bhhhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\djddd.exec:\djddd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\vjppp.exec:\vjppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\vppjv.exec:\vppjv.exe23⤵
- Executes dropped EXE
PID:3408 -
\??\c:\7rrlffx.exec:\7rrlffx.exe24⤵
- Executes dropped EXE
PID:2732 -
\??\c:\7ttttb.exec:\7ttttb.exe25⤵
- Executes dropped EXE
PID:2548 -
\??\c:\nnnnhh.exec:\nnnnhh.exe26⤵
- Executes dropped EXE
PID:4172 -
\??\c:\pjdvv.exec:\pjdvv.exe27⤵
- Executes dropped EXE
PID:1612 -
\??\c:\xlrllxr.exec:\xlrllxr.exe28⤵
- Executes dropped EXE
PID:4372 -
\??\c:\tntnnt.exec:\tntnnt.exe29⤵
- Executes dropped EXE
PID:3396 -
\??\c:\jjpjv.exec:\jjpjv.exe30⤵
- Executes dropped EXE
PID:4764 -
\??\c:\vpvpj.exec:\vpvpj.exe31⤵
- Executes dropped EXE
PID:4884 -
\??\c:\rrlfxrl.exec:\rrlfxrl.exe32⤵
- Executes dropped EXE
PID:1900 -
\??\c:\rfxxrrl.exec:\rfxxrrl.exe33⤵
- Executes dropped EXE
PID:452 -
\??\c:\thttnn.exec:\thttnn.exe34⤵
- Executes dropped EXE
PID:2892 -
\??\c:\ddvjj.exec:\ddvjj.exe35⤵
- Executes dropped EXE
PID:4712 -
\??\c:\9flfxff.exec:\9flfxff.exe36⤵
- Executes dropped EXE
PID:1480 -
\??\c:\9rlxxxr.exec:\9rlxxxr.exe37⤵
- Executes dropped EXE
PID:3736 -
\??\c:\hntttt.exec:\hntttt.exe38⤵
- Executes dropped EXE
PID:2084 -
\??\c:\pjjdd.exec:\pjjdd.exe39⤵
- Executes dropped EXE
PID:1372 -
\??\c:\pdvvv.exec:\pdvvv.exe40⤵
- Executes dropped EXE
PID:4308 -
\??\c:\9lxrfff.exec:\9lxrfff.exe41⤵
- Executes dropped EXE
PID:4320 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe42⤵
- Executes dropped EXE
PID:4972 -
\??\c:\nhhhhh.exec:\nhhhhh.exe43⤵
- Executes dropped EXE
PID:3268 -
\??\c:\nbhhbb.exec:\nbhhbb.exe44⤵
- Executes dropped EXE
PID:1808 -
\??\c:\dppjd.exec:\dppjd.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4640 -
\??\c:\dvdvv.exec:\dvdvv.exe46⤵
- Executes dropped EXE
PID:4124 -
\??\c:\1lrxrrr.exec:\1lrxrrr.exe47⤵
- Executes dropped EXE
PID:1384 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe48⤵
- Executes dropped EXE
PID:4944 -
\??\c:\rfrrrrr.exec:\rfrrrrr.exe49⤵
- Executes dropped EXE
PID:4616 -
\??\c:\hbnnnt.exec:\hbnnnt.exe50⤵
- Executes dropped EXE
PID:3940 -
\??\c:\bhnnbn.exec:\bhnnbn.exe51⤵
- Executes dropped EXE
PID:228 -
\??\c:\vddvp.exec:\vddvp.exe52⤵
- Executes dropped EXE
PID:428 -
\??\c:\djjdv.exec:\djjdv.exe53⤵
- Executes dropped EXE
PID:2504 -
\??\c:\frrxlfl.exec:\frrxlfl.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2612 -
\??\c:\xffffff.exec:\xffffff.exe55⤵
- Executes dropped EXE
PID:1452 -
\??\c:\hhtbtb.exec:\hhtbtb.exe56⤵
- Executes dropped EXE
PID:3348 -
\??\c:\5pvvp.exec:\5pvvp.exe57⤵
- Executes dropped EXE
PID:4984 -
\??\c:\pvdpd.exec:\pvdpd.exe58⤵
- Executes dropped EXE
PID:3000 -
\??\c:\rllllll.exec:\rllllll.exe59⤵
- Executes dropped EXE
PID:5068 -
\??\c:\9rxrllf.exec:\9rxrllf.exe60⤵
- Executes dropped EXE
PID:5084 -
\??\c:\thhbtn.exec:\thhbtn.exe61⤵
- Executes dropped EXE
PID:1840 -
\??\c:\dvjjj.exec:\dvjjj.exe62⤵
- Executes dropped EXE
PID:1672 -
\??\c:\vjjdv.exec:\vjjdv.exe63⤵
- Executes dropped EXE
PID:1800 -
\??\c:\rlfxxxr.exec:\rlfxxxr.exe64⤵
- Executes dropped EXE
PID:636 -
\??\c:\3rfffff.exec:\3rfffff.exe65⤵
- Executes dropped EXE
PID:4480 -
\??\c:\tttthh.exec:\tttthh.exe66⤵PID:4812
-
\??\c:\bntnhn.exec:\bntnhn.exe67⤵PID:1160
-
\??\c:\vvdvv.exec:\vvdvv.exe68⤵PID:2196
-
\??\c:\pdjdp.exec:\pdjdp.exe69⤵PID:1516
-
\??\c:\9fffxxx.exec:\9fffxxx.exe70⤵PID:1936
-
\??\c:\xffllrl.exec:\xffllrl.exe71⤵PID:4648
-
\??\c:\3bbbtb.exec:\3bbbtb.exe72⤵PID:3376
-
\??\c:\dvpvj.exec:\dvpvj.exe73⤵PID:3128
-
\??\c:\vpdvv.exec:\vpdvv.exe74⤵PID:1060
-
\??\c:\lrrlfff.exec:\lrrlfff.exe75⤵PID:2012
-
\??\c:\nttnnn.exec:\nttnnn.exe76⤵PID:4840
-
\??\c:\jvvvp.exec:\jvvvp.exe77⤵PID:2664
-
\??\c:\ddjpj.exec:\ddjpj.exe78⤵PID:4024
-
\??\c:\xrxxfll.exec:\xrxxfll.exe79⤵PID:4176
-
\??\c:\fxflfll.exec:\fxflfll.exe80⤵PID:4028
-
\??\c:\nhhhhh.exec:\nhhhhh.exe81⤵PID:3500
-
\??\c:\hbtntt.exec:\hbtntt.exe82⤵PID:1568
-
\??\c:\jddvv.exec:\jddvv.exe83⤵PID:3052
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe84⤵PID:1900
-
\??\c:\9htnhh.exec:\9htnhh.exe85⤵PID:864
-
\??\c:\9dvpd.exec:\9dvpd.exe86⤵PID:400
-
\??\c:\9jppj.exec:\9jppj.exe87⤵PID:4712
-
\??\c:\9rfxxxf.exec:\9rfxxxf.exe88⤵PID:1988
-
\??\c:\3rlllrl.exec:\3rlllrl.exe89⤵PID:1676
-
\??\c:\7bhnnn.exec:\7bhnnn.exe90⤵PID:1152
-
\??\c:\nnntnb.exec:\nnntnb.exe91⤵PID:4016
-
\??\c:\pdddd.exec:\pdddd.exe92⤵PID:1372
-
\??\c:\jpdvp.exec:\jpdvp.exe93⤵PID:4308
-
\??\c:\fflllrr.exec:\fflllrr.exe94⤵PID:2836
-
\??\c:\rlxllll.exec:\rlxllll.exe95⤵PID:2580
-
\??\c:\7bhnnn.exec:\7bhnnn.exe96⤵PID:3268
-
\??\c:\bbnhbb.exec:\bbnhbb.exe97⤵PID:3552
-
\??\c:\vjjjd.exec:\vjjjd.exe98⤵PID:1092
-
\??\c:\9jjdv.exec:\9jjdv.exe99⤵PID:3272
-
\??\c:\pjjjj.exec:\pjjjj.exe100⤵PID:468
-
\??\c:\nbtnhb.exec:\nbtnhb.exe101⤵PID:3700
-
\??\c:\tnhhhb.exec:\tnhhhb.exe102⤵PID:4976
-
\??\c:\pdppj.exec:\pdppj.exe103⤵PID:2888
-
\??\c:\pjjpd.exec:\pjjpd.exe104⤵PID:4912
-
\??\c:\lllfffx.exec:\lllfffx.exe105⤵PID:3980
-
\??\c:\rfxfxxx.exec:\rfxfxxx.exe106⤵PID:772
-
\??\c:\bhhhhh.exec:\bhhhhh.exe107⤵PID:2700
-
\??\c:\5bnhnn.exec:\5bnhnn.exe108⤵PID:2116
-
\??\c:\jppjd.exec:\jppjd.exe109⤵PID:2288
-
\??\c:\frrrffl.exec:\frrrffl.exe110⤵PID:2972
-
\??\c:\lfllfff.exec:\lfllfff.exe111⤵
- System Location Discovery: System Language Discovery
PID:1048 -
\??\c:\1nnnhh.exec:\1nnnhh.exe112⤵PID:3312
-
\??\c:\bbbbhn.exec:\bbbbhn.exe113⤵PID:1588
-
\??\c:\dvvvp.exec:\dvvvp.exe114⤵PID:3696
-
\??\c:\vpppj.exec:\vpppj.exe115⤵PID:2976
-
\??\c:\rflfxxr.exec:\rflfxxr.exe116⤵PID:1476
-
\??\c:\lflffll.exec:\lflffll.exe117⤵PID:2760
-
\??\c:\xffrlrx.exec:\xffrlrx.exe118⤵PID:2368
-
\??\c:\9hbtbb.exec:\9hbtbb.exe119⤵PID:2516
-
\??\c:\bbhhhn.exec:\bbhhhn.exe120⤵PID:4612
-
\??\c:\pdddv.exec:\pdddv.exe121⤵PID:4332
-
\??\c:\vdddp.exec:\vdddp.exe122⤵PID:1728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-