Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-10-2024 13:51
Behavioral task
behavioral1
Sample
e6c6f9a029b8860176db9731b177a7c6eaa1a1c32665dc77098a64ceef9f5c97N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
e6c6f9a029b8860176db9731b177a7c6eaa1a1c32665dc77098a64ceef9f5c97N.exe
-
Size
331KB
-
MD5
3e8cd6771fcc45660c67d16bf81ddb80
-
SHA1
94a61af86e74411a44a18858419947d05f21fd38
-
SHA256
e6c6f9a029b8860176db9731b177a7c6eaa1a1c32665dc77098a64ceef9f5c97
-
SHA512
240c0ba376755867eb54de0ad0770e960941d4624262c8f141c035fad09eed61c2cb73c5a425d8113c70be9d5cb23fa669992d4195fb47db94a5c6d51aa5b7c3
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeC:R4wFHoSHYHUrAwfMp3CDC
Malware Config
Signatures
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2472-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4012-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2324-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/740-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3224-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2860-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2092-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4796-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3728-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4016-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/736-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3376-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4152-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1560-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1480-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3904-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3876-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2240-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2712-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2420-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2660-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3204-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4244-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1896-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/740-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/848-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1348-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2612-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4796-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/736-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1220-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2116-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/540-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3152-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2712-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2420-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1848-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3452-464-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1984-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3728-562-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-589-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-903-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3240 thnbtn.exe 4852 lrrxlxl.exe 3548 bhnhbt.exe 4012 jjjvj.exe 2276 tnthnh.exe 2324 dpjpd.exe 740 fxxfrxx.exe 3224 bnhbnb.exe 4148 fllxxrl.exe 3552 vvvjv.exe 2860 llfrxrf.exe 3508 nnnbnh.exe 2092 ppvdp.exe 1880 pdjpd.exe 4796 frrflxl.exe 3728 vpjvp.exe 4024 xlfrfrf.exe 5012 bbhbnh.exe 4016 vjdpd.exe 736 jvpvj.exe 4340 ntbthh.exe 3376 jpjdd.exe 4824 lfxfrfr.exe 4152 nhbhtn.exe 2852 lfrflfx.exe 3712 3bnhtn.exe 1560 jvvpp.exe 4544 3pjvv.exe 1480 fllfrfr.exe 3904 hnhbnh.exe 2280 3rfllxl.exe 3876 bntnbn.exe 1984 rrxlxlx.exe 2240 hbtbbn.exe 2320 hhbtht.exe 2796 pjpvp.exe 1388 5vpvd.exe 3152 rfxlrlx.exe 2676 thbnbt.exe 2712 vjddp.exe 2420 rfxfxlx.exe 5076 fllrfrf.exe 2028 hbtnbn.exe 4996 vppdp.exe 4168 pvjvj.exe 2660 rxrflxl.exe 1588 hhbthb.exe 3472 jdjvp.exe 3244 xfxlxlx.exe 4536 5tbnbt.exe 3480 hnhtnn.exe 4464 ppjvd.exe 820 xflxrrl.exe 3204 pvjvj.exe 4220 dvpdp.exe 5112 htnbht.exe 208 5bthtn.exe 4244 vjdpv.exe 2928 jjdpd.exe 2148 rrxlrxl.exe 1080 hththh.exe 4144 dpdpv.exe 1896 3lxlxrl.exe 740 llxlrlx.exe -
resource yara_rule behavioral2/memory/2472-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233f4-3.dat upx behavioral2/memory/2472-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233f9-8.dat upx behavioral2/memory/3240-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fd-11.dat upx behavioral2/memory/4852-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3548-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fe-18.dat upx behavioral2/files/0x00070000000233ff-23.dat upx behavioral2/memory/4012-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2276-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023401-30.dat upx behavioral2/memory/2324-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/740-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023402-34.dat upx behavioral2/files/0x0007000000023403-39.dat upx behavioral2/memory/740-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3224-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023404-45.dat upx behavioral2/files/0x0007000000023405-49.dat upx behavioral2/memory/4148-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023406-54.dat upx behavioral2/memory/3552-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2860-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023407-59.dat upx behavioral2/files/0x0007000000023408-64.dat upx behavioral2/memory/3508-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023409-69.dat upx behavioral2/memory/2092-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340a-73.dat upx behavioral2/files/0x000700000002340b-78.dat upx behavioral2/memory/4796-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340c-83.dat upx behavioral2/memory/3728-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340d-88.dat upx behavioral2/memory/5012-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233fa-92.dat upx behavioral2/memory/4016-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340e-97.dat upx behavioral2/files/0x000700000002340f-102.dat upx behavioral2/memory/736-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023410-107.dat upx behavioral2/files/0x0007000000023411-111.dat upx behavioral2/memory/3376-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023413-116.dat upx behavioral2/memory/4824-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4152-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023414-122.dat upx behavioral2/files/0x0007000000023415-126.dat upx behavioral2/files/0x0007000000023416-130.dat upx behavioral2/memory/1560-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3712-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023417-137.dat upx behavioral2/files/0x0007000000023418-142.dat upx behavioral2/memory/4544-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023419-146.dat upx behavioral2/memory/1480-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3904-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341a-151.dat upx behavioral2/memory/3904-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341b-156.dat upx behavioral2/memory/3876-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2240-165-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfrrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2472 wrote to memory of 3240 2472 e6c6f9a029b8860176db9731b177a7c6eaa1a1c32665dc77098a64ceef9f5c97N.exe 82 PID 2472 wrote to memory of 3240 2472 e6c6f9a029b8860176db9731b177a7c6eaa1a1c32665dc77098a64ceef9f5c97N.exe 82 PID 2472 wrote to memory of 3240 2472 e6c6f9a029b8860176db9731b177a7c6eaa1a1c32665dc77098a64ceef9f5c97N.exe 82 PID 3240 wrote to memory of 4852 3240 thnbtn.exe 83 PID 3240 wrote to memory of 4852 3240 thnbtn.exe 83 PID 3240 wrote to memory of 4852 3240 thnbtn.exe 83 PID 4852 wrote to memory of 3548 4852 lrrxlxl.exe 84 PID 4852 wrote to memory of 3548 4852 lrrxlxl.exe 84 PID 4852 wrote to memory of 3548 4852 lrrxlxl.exe 84 PID 3548 wrote to memory of 4012 3548 bhnhbt.exe 85 PID 3548 wrote to memory of 4012 3548 bhnhbt.exe 85 PID 3548 wrote to memory of 4012 3548 bhnhbt.exe 85 PID 4012 wrote to memory of 2276 4012 jjjvj.exe 86 PID 4012 wrote to memory of 2276 4012 jjjvj.exe 86 PID 4012 wrote to memory of 2276 4012 jjjvj.exe 86 PID 2276 wrote to memory of 2324 2276 tnthnh.exe 87 PID 2276 wrote to memory of 2324 2276 tnthnh.exe 87 PID 2276 wrote to memory of 2324 2276 tnthnh.exe 87 PID 2324 wrote to memory of 740 2324 dpjpd.exe 88 PID 2324 wrote to memory of 740 2324 dpjpd.exe 88 PID 2324 wrote to memory of 740 2324 dpjpd.exe 88 PID 740 wrote to memory of 3224 740 fxxfrxx.exe 89 PID 740 wrote to memory of 3224 740 fxxfrxx.exe 89 PID 740 wrote to memory of 3224 740 fxxfrxx.exe 89 PID 3224 wrote to memory of 4148 3224 bnhbnb.exe 90 PID 3224 wrote to memory of 4148 3224 bnhbnb.exe 90 PID 3224 wrote to memory of 4148 3224 bnhbnb.exe 90 PID 4148 wrote to memory of 3552 4148 fllxxrl.exe 91 PID 4148 wrote to memory of 3552 4148 fllxxrl.exe 91 PID 4148 wrote to memory of 3552 4148 fllxxrl.exe 91 PID 3552 wrote to memory of 2860 3552 vvvjv.exe 92 PID 3552 wrote to memory of 2860 3552 vvvjv.exe 92 PID 3552 wrote to memory of 2860 3552 vvvjv.exe 92 PID 2860 wrote to memory of 3508 2860 llfrxrf.exe 93 PID 2860 wrote to memory of 3508 2860 llfrxrf.exe 93 PID 2860 wrote to memory of 3508 2860 llfrxrf.exe 93 PID 3508 wrote to memory of 2092 3508 nnnbnh.exe 94 PID 3508 wrote to memory of 2092 3508 nnnbnh.exe 94 PID 3508 wrote to memory of 2092 3508 nnnbnh.exe 94 PID 2092 wrote to memory of 1880 2092 ppvdp.exe 95 PID 2092 wrote to memory of 1880 2092 ppvdp.exe 95 PID 2092 wrote to memory of 1880 2092 ppvdp.exe 95 PID 1880 wrote to memory of 4796 1880 pdjpd.exe 96 PID 1880 wrote to memory of 4796 1880 pdjpd.exe 96 PID 1880 wrote to memory of 4796 1880 pdjpd.exe 96 PID 4796 wrote to memory of 3728 4796 frrflxl.exe 97 PID 4796 wrote to memory of 3728 4796 frrflxl.exe 97 PID 4796 wrote to memory of 3728 4796 frrflxl.exe 97 PID 3728 wrote to memory of 4024 3728 vpjvp.exe 98 PID 3728 wrote to memory of 4024 3728 vpjvp.exe 98 PID 3728 wrote to memory of 4024 3728 vpjvp.exe 98 PID 4024 wrote to memory of 5012 4024 xlfrfrf.exe 99 PID 4024 wrote to memory of 5012 4024 xlfrfrf.exe 99 PID 4024 wrote to memory of 5012 4024 xlfrfrf.exe 99 PID 5012 wrote to memory of 4016 5012 bbhbnh.exe 100 PID 5012 wrote to memory of 4016 5012 bbhbnh.exe 100 PID 5012 wrote to memory of 4016 5012 bbhbnh.exe 100 PID 4016 wrote to memory of 736 4016 vjdpd.exe 101 PID 4016 wrote to memory of 736 4016 vjdpd.exe 101 PID 4016 wrote to memory of 736 4016 vjdpd.exe 101 PID 736 wrote to memory of 4340 736 jvpvj.exe 102 PID 736 wrote to memory of 4340 736 jvpvj.exe 102 PID 736 wrote to memory of 4340 736 jvpvj.exe 102 PID 4340 wrote to memory of 3376 4340 ntbthh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6c6f9a029b8860176db9731b177a7c6eaa1a1c32665dc77098a64ceef9f5c97N.exe"C:\Users\Admin\AppData\Local\Temp\e6c6f9a029b8860176db9731b177a7c6eaa1a1c32665dc77098a64ceef9f5c97N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\thnbtn.exec:\thnbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\lrrxlxl.exec:\lrrxlxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\bhnhbt.exec:\bhnhbt.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\jjjvj.exec:\jjjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\tnthnh.exec:\tnthnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\dpjpd.exec:\dpjpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\fxxfrxx.exec:\fxxfrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\bnhbnb.exec:\bnhbnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\fllxxrl.exec:\fllxxrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\vvvjv.exec:\vvvjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\llfrxrf.exec:\llfrxrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\nnnbnh.exec:\nnnbnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\ppvdp.exec:\ppvdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\pdjpd.exec:\pdjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\frrflxl.exec:\frrflxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\vpjvp.exec:\vpjvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\xlfrfrf.exec:\xlfrfrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\bbhbnh.exec:\bbhbnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\vjdpd.exec:\vjdpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\jvpvj.exec:\jvpvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\ntbthh.exec:\ntbthh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\jpjdd.exec:\jpjdd.exe23⤵
- Executes dropped EXE
PID:3376 -
\??\c:\lfxfrfr.exec:\lfxfrfr.exe24⤵
- Executes dropped EXE
PID:4824 -
\??\c:\nhbhtn.exec:\nhbhtn.exe25⤵
- Executes dropped EXE
PID:4152 -
\??\c:\lfrflfx.exec:\lfrflfx.exe26⤵
- Executes dropped EXE
PID:2852 -
\??\c:\3bnhtn.exec:\3bnhtn.exe27⤵
- Executes dropped EXE
PID:3712 -
\??\c:\jvvpp.exec:\jvvpp.exe28⤵
- Executes dropped EXE
PID:1560 -
\??\c:\3pjvv.exec:\3pjvv.exe29⤵
- Executes dropped EXE
PID:4544 -
\??\c:\fllfrfr.exec:\fllfrfr.exe30⤵
- Executes dropped EXE
PID:1480 -
\??\c:\hnhbnh.exec:\hnhbnh.exe31⤵
- Executes dropped EXE
PID:3904 -
\??\c:\3rfllxl.exec:\3rfllxl.exe32⤵
- Executes dropped EXE
PID:2280 -
\??\c:\bntnbn.exec:\bntnbn.exe33⤵
- Executes dropped EXE
PID:3876 -
\??\c:\rrxlxlx.exec:\rrxlxlx.exe34⤵
- Executes dropped EXE
PID:1984 -
\??\c:\hbtbbn.exec:\hbtbbn.exe35⤵
- Executes dropped EXE
PID:2240 -
\??\c:\hhbtht.exec:\hhbtht.exe36⤵
- Executes dropped EXE
PID:2320 -
\??\c:\pjpvp.exec:\pjpvp.exe37⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5vpvd.exec:\5vpvd.exe38⤵
- Executes dropped EXE
PID:1388 -
\??\c:\rfxlrlx.exec:\rfxlrlx.exe39⤵
- Executes dropped EXE
PID:3152 -
\??\c:\thbnbt.exec:\thbnbt.exe40⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vjddp.exec:\vjddp.exe41⤵
- Executes dropped EXE
PID:2712 -
\??\c:\rfxfxlx.exec:\rfxfxlx.exe42⤵
- Executes dropped EXE
PID:2420 -
\??\c:\fllrfrf.exec:\fllrfrf.exe43⤵
- Executes dropped EXE
PID:5076 -
\??\c:\hbtnbn.exec:\hbtnbn.exe44⤵
- Executes dropped EXE
PID:2028 -
\??\c:\vppdp.exec:\vppdp.exe45⤵
- Executes dropped EXE
PID:4996 -
\??\c:\pvjvj.exec:\pvjvj.exe46⤵
- Executes dropped EXE
PID:4168 -
\??\c:\rxrflxl.exec:\rxrflxl.exe47⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hhbthb.exec:\hhbthb.exe48⤵
- Executes dropped EXE
PID:1588 -
\??\c:\jdjvp.exec:\jdjvp.exe49⤵
- Executes dropped EXE
PID:3472 -
\??\c:\xfxlxlx.exec:\xfxlxlx.exe50⤵
- Executes dropped EXE
PID:3244 -
\??\c:\5tbnbt.exec:\5tbnbt.exe51⤵
- Executes dropped EXE
PID:4536 -
\??\c:\hnhtnn.exec:\hnhtnn.exe52⤵
- Executes dropped EXE
PID:3480 -
\??\c:\ppjvd.exec:\ppjvd.exe53⤵
- Executes dropped EXE
PID:4464 -
\??\c:\xflxrrl.exec:\xflxrrl.exe54⤵
- Executes dropped EXE
PID:820 -
\??\c:\pvjvj.exec:\pvjvj.exe55⤵
- Executes dropped EXE
PID:3204 -
\??\c:\dvpdp.exec:\dvpdp.exe56⤵
- Executes dropped EXE
PID:4220 -
\??\c:\htnbht.exec:\htnbht.exe57⤵
- Executes dropped EXE
PID:5112 -
\??\c:\5bthtn.exec:\5bthtn.exe58⤵
- Executes dropped EXE
PID:208 -
\??\c:\vjdpv.exec:\vjdpv.exe59⤵
- Executes dropped EXE
PID:4244 -
\??\c:\jjdpd.exec:\jjdpd.exe60⤵
- Executes dropped EXE
PID:2928 -
\??\c:\rrxlrxl.exec:\rrxlrxl.exe61⤵
- Executes dropped EXE
PID:2148 -
\??\c:\hththh.exec:\hththh.exe62⤵
- Executes dropped EXE
PID:1080 -
\??\c:\dpdpv.exec:\dpdpv.exe63⤵
- Executes dropped EXE
PID:4144 -
\??\c:\3lxlxrl.exec:\3lxlxrl.exe64⤵
- Executes dropped EXE
PID:1896 -
\??\c:\llxlrlx.exec:\llxlrlx.exe65⤵
- Executes dropped EXE
PID:740 -
\??\c:\ntnhth.exec:\ntnhth.exe66⤵PID:848
-
\??\c:\vdvjp.exec:\vdvjp.exe67⤵PID:1348
-
\??\c:\lxfrlxl.exec:\lxfrlxl.exe68⤵PID:4960
-
\??\c:\xfxlxlx.exec:\xfxlxlx.exe69⤵PID:384
-
\??\c:\7hnhtb.exec:\7hnhtb.exe70⤵PID:4656
-
\??\c:\nhhnbt.exec:\nhhnbt.exe71⤵PID:1464
-
\??\c:\pjjdp.exec:\pjjdp.exe72⤵PID:3444
-
\??\c:\fffrxrf.exec:\fffrxrf.exe73⤵PID:2556
-
\??\c:\nbtbnb.exec:\nbtbnb.exe74⤵PID:4884
-
\??\c:\nhhtbt.exec:\nhhtbt.exe75⤵PID:2612
-
\??\c:\pdvpd.exec:\pdvpd.exe76⤵PID:2332
-
\??\c:\xlxfrfl.exec:\xlxfrfl.exe77⤵PID:4796
-
\??\c:\llrfrfx.exec:\llrfrfx.exe78⤵PID:2456
-
\??\c:\thhtnb.exec:\thhtnb.exe79⤵
- System Location Discovery: System Language Discovery
PID:2180 -
\??\c:\hbbnbt.exec:\hbbnbt.exe80⤵PID:948
-
\??\c:\jddvd.exec:\jddvd.exe81⤵PID:3416
-
\??\c:\3xrflxl.exec:\3xrflxl.exe82⤵PID:4460
-
\??\c:\rllxlxl.exec:\rllxlxl.exe83⤵PID:2484
-
\??\c:\ntbnth.exec:\ntbnth.exe84⤵PID:1380
-
\??\c:\dppdd.exec:\dppdd.exe85⤵PID:736
-
\??\c:\dpvjd.exec:\dpvjd.exe86⤵PID:2204
-
\??\c:\hhbnhb.exec:\hhbnhb.exe87⤵PID:528
-
\??\c:\vdvvv.exec:\vdvvv.exe88⤵PID:1436
-
\??\c:\rrrrxxr.exec:\rrrrxxr.exe89⤵PID:4824
-
\??\c:\lxlxlxl.exec:\lxlxlxl.exe90⤵PID:1220
-
\??\c:\9ttnhb.exec:\9ttnhb.exe91⤵PID:1192
-
\??\c:\vpvjv.exec:\vpvjv.exe92⤵PID:2468
-
\??\c:\pppdp.exec:\pppdp.exe93⤵PID:4896
-
\??\c:\lxrlxlf.exec:\lxrlxlf.exe94⤵PID:4368
-
\??\c:\9lrlflf.exec:\9lrlflf.exe95⤵PID:3832
-
\??\c:\nbtnhh.exec:\nbtnhh.exe96⤵PID:5020
-
\??\c:\3dpjd.exec:\3dpjd.exe97⤵
- System Location Discovery: System Language Discovery
PID:2116 -
\??\c:\rrlfllx.exec:\rrlfllx.exe98⤵PID:4400
-
\??\c:\ttbtbt.exec:\ttbtbt.exe99⤵PID:2380
-
\??\c:\tbbnbt.exec:\tbbnbt.exe100⤵PID:4472
-
\??\c:\pjpjv.exec:\pjpjv.exe101⤵PID:3328
-
\??\c:\lxxxlxr.exec:\lxxxlxr.exe102⤵PID:540
-
\??\c:\ntthhb.exec:\ntthhb.exe103⤵PID:4912
-
\??\c:\hhhthn.exec:\hhhthn.exe104⤵
- System Location Discovery: System Language Discovery
PID:4496 -
\??\c:\vdvpj.exec:\vdvpj.exe105⤵PID:4088
-
\??\c:\5frfrfx.exec:\5frfrfx.exe106⤵PID:2540
-
\??\c:\rflxfxl.exec:\rflxfxl.exe107⤵PID:3100
-
\??\c:\hbhbnh.exec:\hbhbnh.exe108⤵PID:3152
-
\??\c:\7tnbnn.exec:\7tnbnn.exe109⤵PID:4752
-
\??\c:\jvvdj.exec:\jvvdj.exe110⤵PID:2712
-
\??\c:\rxxlrlx.exec:\rxxlrlx.exe111⤵PID:2420
-
\??\c:\lxrfrlf.exec:\lxrfrlf.exe112⤵PID:2424
-
\??\c:\nnttbb.exec:\nnttbb.exe113⤵PID:2028
-
\??\c:\dpdvj.exec:\dpdvj.exe114⤵PID:4996
-
\??\c:\ppdvv.exec:\ppdvv.exe115⤵PID:1108
-
\??\c:\rxffrrr.exec:\rxffrrr.exe116⤵PID:3488
-
\??\c:\bttnbb.exec:\bttnbb.exe117⤵PID:4992
-
\??\c:\hbbnbt.exec:\hbbnbt.exe118⤵PID:1848
-
\??\c:\9jjdp.exec:\9jjdp.exe119⤵PID:4008
-
\??\c:\rflxlxr.exec:\rflxlxr.exe120⤵PID:3132
-
\??\c:\xflfrlx.exec:\xflfrlx.exe121⤵PID:4316
-
\??\c:\hhbtnh.exec:\hhbtnh.exe122⤵PID:2388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-