Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 05:20
Behavioral task
behavioral1
Sample
8013f1510bd452bcee43a0de06ee64a017900ddd3c675eac49a0895c6cc0620bN.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
8013f1510bd452bcee43a0de06ee64a017900ddd3c675eac49a0895c6cc0620bN.exe
-
Size
247KB
-
MD5
740b89d759207a0f6c63fe87b3e972d0
-
SHA1
1f086bc5906f7af9e55c89d8f65980dc7dd8742d
-
SHA256
8013f1510bd452bcee43a0de06ee64a017900ddd3c675eac49a0895c6cc0620b
-
SHA512
338ccca8562bb51674762e392888e628b8cd06725076deb079f8799d29bc3b53c03a414294aecb976ef4fef9d562a06bd9cac42e94115bb3c42f8b5d6d9b571c
-
SSDEEP
3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+6r:ccm4FmowdHoSi9EIBftapTs4WZazj
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/704-7-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2176-11-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4436-18-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3700-24-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3960-30-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2216-35-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4072-41-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5048-47-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2668-53-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3716-59-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1276-70-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3856-76-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2836-84-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4660-89-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/824-93-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3104-100-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2064-106-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3704-112-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/848-118-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3596-131-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4836-141-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4164-146-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3920-152-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2384-159-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3992-169-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1436-165-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4172-175-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1556-191-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/592-199-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2556-203-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4928-210-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/716-214-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3032-221-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2436-228-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4576-232-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/464-236-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1552-246-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4916-266-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4820-273-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/624-280-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1396-288-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2688-294-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3052-297-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1980-331-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2064-350-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3704-354-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2868-358-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4304-365-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4172-405-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4884-418-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4780-428-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1832-453-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3008-538-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3856-548-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1188-644-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1728-693-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3052-733-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2448-782-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1040-786-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3084-820-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2220-879-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5060-1146-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/592-1273-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3180-1345-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2176 dpjjp.exe 4436 rllxffr.exe 3700 5pvjv.exe 3960 fxxlfxx.exe 2216 dvjdp.exe 4072 xrxllfx.exe 5048 5bbthh.exe 2668 fxlxrlf.exe 3716 tnbnhb.exe 4480 vjdpj.exe 1276 rxfrflx.exe 3856 bbttbt.exe 2836 pdpjp.exe 4660 lfffxrf.exe 824 htthtn.exe 3104 nhnnbt.exe 2064 rxfrrlx.exe 3704 9vdvj.exe 848 jvjvd.exe 540 fflfxrr.exe 3596 nhbnhb.exe 1680 dddpd.exe 4836 5flfllx.exe 4164 vpddv.exe 3920 hhhbtn.exe 2384 ddppp.exe 1436 rxrfrlf.exe 3992 ttbbhb.exe 4172 vdjdd.exe 3952 frlxlfr.exe 4248 lxlflfr.exe 1556 hthbnh.exe 2256 7ddvv.exe 592 frfxxlf.exe 2556 bthbnh.exe 2248 pjdvj.exe 4928 xllfxrr.exe 716 hbtntt.exe 3772 9bbtnh.exe 3032 1pjdj.exe 2220 7rlffrl.exe 2436 xlxxlff.exe 4576 httnbt.exe 464 pddpd.exe 1256 jddvp.exe 2624 xrxrxrx.exe 1552 bnthbt.exe 3392 nbnnbb.exe 2128 9vdpd.exe 4412 rlxxrxf.exe 4400 htthbt.exe 1016 ntnbtn.exe 4916 3vpdj.exe 2856 3xfxxrr.exe 4820 frlrfrx.exe 2172 nthhnh.exe 624 dvdvd.exe 1752 rrlxrlx.exe 3928 hntnbh.exe 1396 9jpjv.exe 2688 ppjvv.exe 3052 fxlxflx.exe 1480 3httht.exe 4664 htbnhb.exe -
resource yara_rule behavioral2/memory/704-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000023487-3.dat upx behavioral2/memory/704-7-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000800000002348a-9.dat upx behavioral2/memory/2176-11-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002348f-15.dat upx behavioral2/memory/4436-18-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023490-21.dat upx behavioral2/memory/3700-24-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023491-27.dat upx behavioral2/memory/3960-30-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023492-33.dat upx behavioral2/memory/2216-35-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4072-41-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023493-39.dat upx behavioral2/files/0x0007000000023494-45.dat upx behavioral2/memory/5048-47-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023495-51.dat upx behavioral2/memory/2668-53-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023496-57.dat upx behavioral2/memory/3716-59-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023497-63.dat upx behavioral2/memory/1276-70-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023498-68.dat upx behavioral2/files/0x0007000000023499-74.dat upx behavioral2/memory/3856-76-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002349a-80.dat upx behavioral2/memory/2836-84-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002349b-87.dat upx behavioral2/memory/4660-89-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002349c-94.dat upx behavioral2/memory/824-93-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002349d-98.dat upx behavioral2/memory/3104-100-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002349e-107.dat upx behavioral2/memory/2064-106-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002349f-110.dat upx behavioral2/memory/3704-112-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000234a0-116.dat upx behavioral2/memory/848-118-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000234a1-124.dat upx behavioral2/files/0x00070000000234a2-127.dat upx behavioral2/memory/3596-131-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000234a3-134.dat upx behavioral2/files/0x00070000000234a4-138.dat upx behavioral2/memory/4836-141-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000234a5-144.dat upx behavioral2/memory/4164-146-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000234a6-150.dat upx behavioral2/memory/3920-152-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000234a7-155.dat upx behavioral2/memory/2384-159-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000234a8-162.dat upx behavioral2/memory/3992-169-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000234a9-170.dat upx behavioral2/memory/1436-165-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4172-175-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000234aa-176.dat upx behavioral2/files/0x00070000000234ab-182.dat upx behavioral2/files/0x00070000000234ac-185.dat upx behavioral2/memory/2256-192-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1556-191-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/592-199-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2556-203-0x0000000000400000-0x0000000000436000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhnn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 704 wrote to memory of 2176 704 8013f1510bd452bcee43a0de06ee64a017900ddd3c675eac49a0895c6cc0620bN.exe 82 PID 704 wrote to memory of 2176 704 8013f1510bd452bcee43a0de06ee64a017900ddd3c675eac49a0895c6cc0620bN.exe 82 PID 704 wrote to memory of 2176 704 8013f1510bd452bcee43a0de06ee64a017900ddd3c675eac49a0895c6cc0620bN.exe 82 PID 2176 wrote to memory of 4436 2176 dpjjp.exe 83 PID 2176 wrote to memory of 4436 2176 dpjjp.exe 83 PID 2176 wrote to memory of 4436 2176 dpjjp.exe 83 PID 4436 wrote to memory of 3700 4436 rllxffr.exe 84 PID 4436 wrote to memory of 3700 4436 rllxffr.exe 84 PID 4436 wrote to memory of 3700 4436 rllxffr.exe 84 PID 3700 wrote to memory of 3960 3700 5pvjv.exe 85 PID 3700 wrote to memory of 3960 3700 5pvjv.exe 85 PID 3700 wrote to memory of 3960 3700 5pvjv.exe 85 PID 3960 wrote to memory of 2216 3960 fxxlfxx.exe 86 PID 3960 wrote to memory of 2216 3960 fxxlfxx.exe 86 PID 3960 wrote to memory of 2216 3960 fxxlfxx.exe 86 PID 2216 wrote to memory of 4072 2216 dvjdp.exe 87 PID 2216 wrote to memory of 4072 2216 dvjdp.exe 87 PID 2216 wrote to memory of 4072 2216 dvjdp.exe 87 PID 4072 wrote to memory of 5048 4072 xrxllfx.exe 88 PID 4072 wrote to memory of 5048 4072 xrxllfx.exe 88 PID 4072 wrote to memory of 5048 4072 xrxllfx.exe 88 PID 5048 wrote to memory of 2668 5048 5bbthh.exe 89 PID 5048 wrote to memory of 2668 5048 5bbthh.exe 89 PID 5048 wrote to memory of 2668 5048 5bbthh.exe 89 PID 2668 wrote to memory of 3716 2668 fxlxrlf.exe 90 PID 2668 wrote to memory of 3716 2668 fxlxrlf.exe 90 PID 2668 wrote to memory of 3716 2668 fxlxrlf.exe 90 PID 3716 wrote to memory of 4480 3716 tnbnhb.exe 91 PID 3716 wrote to memory of 4480 3716 tnbnhb.exe 91 PID 3716 wrote to memory of 4480 3716 tnbnhb.exe 91 PID 4480 wrote to memory of 1276 4480 vjdpj.exe 92 PID 4480 wrote to memory of 1276 4480 vjdpj.exe 92 PID 4480 wrote to memory of 1276 4480 vjdpj.exe 92 PID 1276 wrote to memory of 3856 1276 rxfrflx.exe 93 PID 1276 wrote to memory of 3856 1276 rxfrflx.exe 93 PID 1276 wrote to memory of 3856 1276 rxfrflx.exe 93 PID 3856 wrote to memory of 2836 3856 bbttbt.exe 94 PID 3856 wrote to memory of 2836 3856 bbttbt.exe 94 PID 3856 wrote to memory of 2836 3856 bbttbt.exe 94 PID 2836 wrote to memory of 4660 2836 pdpjp.exe 95 PID 2836 wrote to memory of 4660 2836 pdpjp.exe 95 PID 2836 wrote to memory of 4660 2836 pdpjp.exe 95 PID 4660 wrote to memory of 824 4660 lfffxrf.exe 96 PID 4660 wrote to memory of 824 4660 lfffxrf.exe 96 PID 4660 wrote to memory of 824 4660 lfffxrf.exe 96 PID 824 wrote to memory of 3104 824 htthtn.exe 97 PID 824 wrote to memory of 3104 824 htthtn.exe 97 PID 824 wrote to memory of 3104 824 htthtn.exe 97 PID 3104 wrote to memory of 2064 3104 nhnnbt.exe 98 PID 3104 wrote to memory of 2064 3104 nhnnbt.exe 98 PID 3104 wrote to memory of 2064 3104 nhnnbt.exe 98 PID 2064 wrote to memory of 3704 2064 rxfrrlx.exe 99 PID 2064 wrote to memory of 3704 2064 rxfrrlx.exe 99 PID 2064 wrote to memory of 3704 2064 rxfrrlx.exe 99 PID 3704 wrote to memory of 848 3704 9vdvj.exe 100 PID 3704 wrote to memory of 848 3704 9vdvj.exe 100 PID 3704 wrote to memory of 848 3704 9vdvj.exe 100 PID 848 wrote to memory of 540 848 jvjvd.exe 101 PID 848 wrote to memory of 540 848 jvjvd.exe 101 PID 848 wrote to memory of 540 848 jvjvd.exe 101 PID 540 wrote to memory of 3596 540 fflfxrr.exe 102 PID 540 wrote to memory of 3596 540 fflfxrr.exe 102 PID 540 wrote to memory of 3596 540 fflfxrr.exe 102 PID 3596 wrote to memory of 1680 3596 nhbnhb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\8013f1510bd452bcee43a0de06ee64a017900ddd3c675eac49a0895c6cc0620bN.exe"C:\Users\Admin\AppData\Local\Temp\8013f1510bd452bcee43a0de06ee64a017900ddd3c675eac49a0895c6cc0620bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:704 -
\??\c:\dpjjp.exec:\dpjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\rllxffr.exec:\rllxffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\5pvjv.exec:\5pvjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\fxxlfxx.exec:\fxxlfxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\dvjdp.exec:\dvjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\xrxllfx.exec:\xrxllfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\5bbthh.exec:\5bbthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\fxlxrlf.exec:\fxlxrlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\tnbnhb.exec:\tnbnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\vjdpj.exec:\vjdpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\rxfrflx.exec:\rxfrflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\bbttbt.exec:\bbttbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\pdpjp.exec:\pdpjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\lfffxrf.exec:\lfffxrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\htthtn.exec:\htthtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\nhnnbt.exec:\nhnnbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\rxfrrlx.exec:\rxfrrlx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\9vdvj.exec:\9vdvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\jvjvd.exec:\jvjvd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\fflfxrr.exec:\fflfxrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\nhbnhb.exec:\nhbnhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\dddpd.exec:\dddpd.exe23⤵
- Executes dropped EXE
PID:1680 -
\??\c:\5flfllx.exec:\5flfllx.exe24⤵
- Executes dropped EXE
PID:4836 -
\??\c:\vpddv.exec:\vpddv.exe25⤵
- Executes dropped EXE
PID:4164 -
\??\c:\hhhbtn.exec:\hhhbtn.exe26⤵
- Executes dropped EXE
PID:3920 -
\??\c:\ddppp.exec:\ddppp.exe27⤵
- Executes dropped EXE
PID:2384 -
\??\c:\rxrfrlf.exec:\rxrfrlf.exe28⤵
- Executes dropped EXE
PID:1436 -
\??\c:\ttbbhb.exec:\ttbbhb.exe29⤵
- Executes dropped EXE
PID:3992 -
\??\c:\vdjdd.exec:\vdjdd.exe30⤵
- Executes dropped EXE
PID:4172 -
\??\c:\frlxlfr.exec:\frlxlfr.exe31⤵
- Executes dropped EXE
PID:3952 -
\??\c:\lxlflfr.exec:\lxlflfr.exe32⤵
- Executes dropped EXE
PID:4248 -
\??\c:\hthbnh.exec:\hthbnh.exe33⤵
- Executes dropped EXE
PID:1556 -
\??\c:\7ddvv.exec:\7ddvv.exe34⤵
- Executes dropped EXE
PID:2256 -
\??\c:\frfxxlf.exec:\frfxxlf.exe35⤵
- Executes dropped EXE
PID:592 -
\??\c:\bthbnh.exec:\bthbnh.exe36⤵
- Executes dropped EXE
PID:2556 -
\??\c:\pjdvj.exec:\pjdvj.exe37⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xllfxrr.exec:\xllfxrr.exe38⤵
- Executes dropped EXE
PID:4928 -
\??\c:\hbtntt.exec:\hbtntt.exe39⤵
- Executes dropped EXE
PID:716 -
\??\c:\9bbtnh.exec:\9bbtnh.exe40⤵
- Executes dropped EXE
PID:3772 -
\??\c:\1pjdj.exec:\1pjdj.exe41⤵
- Executes dropped EXE
PID:3032 -
\??\c:\7rlffrl.exec:\7rlffrl.exe42⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xlxxlff.exec:\xlxxlff.exe43⤵
- Executes dropped EXE
PID:2436 -
\??\c:\httnbt.exec:\httnbt.exe44⤵
- Executes dropped EXE
PID:4576 -
\??\c:\pddpd.exec:\pddpd.exe45⤵
- Executes dropped EXE
PID:464 -
\??\c:\jddvp.exec:\jddvp.exe46⤵
- Executes dropped EXE
PID:1256 -
\??\c:\xrxrxrx.exec:\xrxrxrx.exe47⤵
- Executes dropped EXE
PID:2624 -
\??\c:\bnthbt.exec:\bnthbt.exe48⤵
- Executes dropped EXE
PID:1552 -
\??\c:\nbnnbb.exec:\nbnnbb.exe49⤵
- Executes dropped EXE
PID:3392 -
\??\c:\9vdpd.exec:\9vdpd.exe50⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rlxxrxf.exec:\rlxxrxf.exe51⤵
- Executes dropped EXE
PID:4412 -
\??\c:\htthbt.exec:\htthbt.exe52⤵
- Executes dropped EXE
PID:4400 -
\??\c:\ntnbtn.exec:\ntnbtn.exe53⤵
- Executes dropped EXE
PID:1016 -
\??\c:\3vpdj.exec:\3vpdj.exe54⤵
- Executes dropped EXE
PID:4916 -
\??\c:\3xfxxrr.exec:\3xfxxrr.exe55⤵
- Executes dropped EXE
PID:2856 -
\??\c:\frlrfrx.exec:\frlrfrx.exe56⤵
- Executes dropped EXE
PID:4820 -
\??\c:\nthhnh.exec:\nthhnh.exe57⤵
- Executes dropped EXE
PID:2172 -
\??\c:\dvdvd.exec:\dvdvd.exe58⤵
- Executes dropped EXE
PID:624 -
\??\c:\rrlxrlx.exec:\rrlxrlx.exe59⤵
- Executes dropped EXE
PID:1752 -
\??\c:\hntnbh.exec:\hntnbh.exe60⤵
- Executes dropped EXE
PID:3928 -
\??\c:\9jpjv.exec:\9jpjv.exe61⤵
- Executes dropped EXE
PID:1396 -
\??\c:\ppjvv.exec:\ppjvv.exe62⤵
- Executes dropped EXE
PID:2688 -
\??\c:\fxlxflx.exec:\fxlxflx.exe63⤵
- Executes dropped EXE
PID:3052 -
\??\c:\3httht.exec:\3httht.exe64⤵
- Executes dropped EXE
PID:1480 -
\??\c:\htbnhb.exec:\htbnhb.exe65⤵
- Executes dropped EXE
PID:4664 -
\??\c:\dpvjv.exec:\dpvjv.exe66⤵PID:2668
-
\??\c:\rflxfxr.exec:\rflxfxr.exe67⤵
- System Location Discovery: System Language Discovery
PID:1284 -
\??\c:\lrxxlrr.exec:\lrxxlrr.exe68⤵PID:3716
-
\??\c:\nhthnh.exec:\nhthnh.exe69⤵PID:3556
-
\??\c:\btnhbb.exec:\btnhbb.exe70⤵PID:3008
-
\??\c:\pvjdv.exec:\pvjdv.exe71⤵PID:2620
-
\??\c:\xfxlrfx.exec:\xfxlrfx.exe72⤵PID:2484
-
\??\c:\xxxlxrl.exec:\xxxlxrl.exe73⤵PID:3012
-
\??\c:\hbttnh.exec:\hbttnh.exe74⤵PID:1980
-
\??\c:\hhhbnb.exec:\hhhbnb.exe75⤵PID:4888
-
\??\c:\ddjvd.exec:\ddjvd.exe76⤵PID:3692
-
\??\c:\1frffxl.exec:\1frffxl.exe77⤵PID:3184
-
\??\c:\frxrrll.exec:\frxrrll.exe78⤵PID:4776
-
\??\c:\1ntnbt.exec:\1ntnbt.exe79⤵PID:2976
-
\??\c:\thbtth.exec:\thbtth.exe80⤵PID:2064
-
\??\c:\vppvj.exec:\vppvj.exe81⤵PID:3704
-
\??\c:\rrrfrrl.exec:\rrrfrrl.exe82⤵PID:2868
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe83⤵PID:3456
-
\??\c:\ntbnhb.exec:\ntbnhb.exe84⤵PID:4304
-
\??\c:\5vvpp.exec:\5vvpp.exe85⤵PID:4388
-
\??\c:\vpdpd.exec:\vpdpd.exe86⤵PID:4920
-
\??\c:\xfxrfxr.exec:\xfxrfxr.exe87⤵PID:2276
-
\??\c:\xrffrrl.exec:\xrffrrl.exe88⤵PID:2196
-
\??\c:\ntthtt.exec:\ntthtt.exe89⤵PID:800
-
\??\c:\dvvjv.exec:\dvvjv.exe90⤵PID:1684
-
\??\c:\lrxrllf.exec:\lrxrllf.exe91⤵PID:3584
-
\??\c:\llfxrll.exec:\llfxrll.exe92⤵PID:4132
-
\??\c:\btbtbt.exec:\btbtbt.exe93⤵PID:2596
-
\??\c:\pjdvd.exec:\pjdvd.exe94⤵PID:4168
-
\??\c:\9ddpp.exec:\9ddpp.exe95⤵PID:1504
-
\??\c:\fffrffr.exec:\fffrffr.exe96⤵PID:3088
-
\??\c:\xxrxlfx.exec:\xxrxlfx.exe97⤵PID:4172
-
\??\c:\9btnbt.exec:\9btnbt.exe98⤵PID:2536
-
\??\c:\3ppjp.exec:\3ppjp.exe99⤵PID:3444
-
\??\c:\9fxlflx.exec:\9fxlflx.exe100⤵PID:4248
-
\??\c:\rffxlfx.exec:\rffxlfx.exe101⤵PID:4884
-
\??\c:\nttnhh.exec:\nttnhh.exe102⤵PID:2208
-
\??\c:\jvvjd.exec:\jvvjd.exe103⤵PID:1600
-
\??\c:\httnth.exec:\httnth.exe104⤵PID:4780
-
\??\c:\bthnnh.exec:\bthnnh.exe105⤵PID:1584
-
\??\c:\3jjdp.exec:\3jjdp.exe106⤵PID:3336
-
\??\c:\pjdvd.exec:\pjdvd.exe107⤵PID:4580
-
\??\c:\xfrffrr.exec:\xfrffrr.exe108⤵PID:2892
-
\??\c:\nbtntn.exec:\nbtntn.exe109⤵PID:4844
-
\??\c:\5hhttn.exec:\5hhttn.exe110⤵PID:3488
-
\??\c:\5pvdj.exec:\5pvdj.exe111⤵PID:2532
-
\??\c:\5rxrfxl.exec:\5rxrfxl.exe112⤵PID:1832
-
\??\c:\frrlffx.exec:\frrlffx.exe113⤵PID:1560
-
\??\c:\hnnnbt.exec:\hnnnbt.exe114⤵PID:3720
-
\??\c:\pdddv.exec:\pdddv.exe115⤵
- System Location Discovery: System Language Discovery
PID:1800 -
\??\c:\5dpjv.exec:\5dpjv.exe116⤵PID:3744
-
\??\c:\frxrxlf.exec:\frxrxlf.exe117⤵PID:3568
-
\??\c:\xlxrlrf.exec:\xlxrlrf.exe118⤵PID:4408
-
\??\c:\htbnhb.exec:\htbnhb.exe119⤵PID:1356
-
\??\c:\jdvjv.exec:\jdvjv.exe120⤵PID:3680
-
\??\c:\pjdpd.exec:\pjdpd.exe121⤵
- System Location Discovery: System Language Discovery
PID:1744 -
\??\c:\1rrlxxl.exec:\1rrlxxl.exe122⤵PID:2980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-