Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 20:22
Behavioral task
behavioral1
Sample
1e866cfd55fe4a4278bf87eb03adf6cc2b5a4ffa21a18af6c1c67776c2b3a6f1.exe
Resource
win7-20240903-en
General
-
Target
1e866cfd55fe4a4278bf87eb03adf6cc2b5a4ffa21a18af6c1c67776c2b3a6f1.exe
-
Size
332KB
-
MD5
ebe4f2dd0b0eff38500e24b0a88532a4
-
SHA1
2f66b39cfa051a7717423a11861b745a3e8e73a3
-
SHA256
1e866cfd55fe4a4278bf87eb03adf6cc2b5a4ffa21a18af6c1c67776c2b3a6f1
-
SHA512
fab7ecfc4518d6722379cb66c26f52cb495720affb55f15a1ddb0bb672c30e8df4a18dbc52ccc03e70a7d877f3cda6ed6a01e70467996bbbc586e15961de6087
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbel:R4wFHoSHYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/232-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2356-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3420-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/400-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2464-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1164-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1564-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4228-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1636-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3888-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2632-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4724-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1028-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2812-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3472-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2068-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2320-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/112-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4492-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3660-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1540-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4228-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/372-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1720-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/528-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1536-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2908-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4216-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2496-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4248-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2112-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1512-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3684-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5056-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-490-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-575-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2596-640-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5088-725-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3828-839-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4548-1148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-1207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rxllxfl.exebhtnnn.exehbthhn.exe000240.exethhtnb.exe684600.exehthbth.exe648624.exejpjjp.exelfxrlll.exe268866.exexrxlfrr.exelxfflll.exenhnbtn.exebbnnbt.exe2400448.exe026800.exe060426.exexrxllff.exe262444.exe646262.exefrxxrrl.exe688826.exevjjjd.exehttbtb.exexlxrllf.exe686800.exejjjdp.exe1fllxlx.exedvpvp.exexlxrlfx.exe2488888.exe284862.exe822660.exenhbnhb.exedddpd.exe206022.exe28888.exe22602.exe40204.exepdjdv.exe6806462.exepvpdj.exe44604.exe62482.exepdpdj.exe1rfflrl.exe86226.exe3ffxfff.exepdvpp.exelfrlrlx.exentnhbt.exenttnnh.exeffxlxrf.exeflrlfxr.exe68482.exevpppj.exem8042.exenhbntn.exe886082.exe888826.exe2666044.exe08844.exe48824.exepid Process 232 rxllxfl.exe 2356 bhtnnn.exe 4700 hbthhn.exe 3684 000240.exe 3420 thhtnb.exe 4336 684600.exe 1512 hthbth.exe 552 648624.exe 4412 jpjjp.exe 2012 lfxrlll.exe 3984 268866.exe 2112 xrxlfrr.exe 4084 lxfflll.exe 4248 nhnbtn.exe 400 bbnnbt.exe 2464 2400448.exe 2496 026800.exe 1164 060426.exe 1564 xrxllff.exe 2540 262444.exe 3536 646262.exe 4228 frxxrrl.exe 1636 688826.exe 1576 vjjjd.exe 608 httbtb.exe 1260 xlxrllf.exe 2872 686800.exe 4216 jjjdp.exe 4108 1fllxlx.exe 912 dvpvp.exe 4900 xlxrlfx.exe 4924 2488888.exe 2408 284862.exe 2908 822660.exe 748 nhbnhb.exe 3888 dddpd.exe 1388 206022.exe 2632 28888.exe 1728 22602.exe 4724 40204.exe 1696 pdjdv.exe 1536 6806462.exe 4576 pvpdj.exe 3828 44604.exe 112 62482.exe 3328 pdpdj.exe 4368 1rfflrl.exe 4004 86226.exe 528 3ffxfff.exe 1720 pdvpp.exe 1028 lfrlrlx.exe 372 ntnhbt.exe 3596 nttnnh.exe 1904 ffxlxrf.exe 4676 flrlfxr.exe 624 68482.exe 1832 vpppj.exe 3652 m8042.exe 656 nhbntn.exe 4712 886082.exe 3684 888826.exe 3420 2666044.exe 1604 08844.exe 5116 48824.exe -
Processes:
resource yara_rule behavioral2/memory/4580-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b7a-3.dat upx behavioral2/memory/232-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4580-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2356-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c61-10.dat upx behavioral2/files/0x0007000000023c66-12.dat upx behavioral2/memory/2356-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c67-19.dat upx behavioral2/memory/4700-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c68-26.dat upx behavioral2/memory/3420-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c69-30.dat upx behavioral2/files/0x0007000000023c6a-36.dat upx behavioral2/files/0x0007000000023c6b-39.dat upx behavioral2/files/0x0007000000023c6c-46.dat upx behavioral2/memory/552-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c6e-54.dat upx behavioral2/memory/2112-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c71-71.dat upx behavioral2/files/0x0008000000023c62-74.dat upx behavioral2/memory/400-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2464-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1164-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1564-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c77-105.dat upx behavioral2/files/0x0007000000023c78-110.dat upx behavioral2/memory/3536-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c76-100.dat upx behavioral2/memory/4228-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1636-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c7b-120.dat upx behavioral2/files/0x0007000000023c7c-123.dat upx behavioral2/files/0x0007000000023c80-142.dat upx behavioral2/files/0x0007000000023c81-146.dat upx behavioral2/files/0x0007000000023c83-155.dat upx behavioral2/memory/4924-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2408-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3888-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2632-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4724-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1028-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2812-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3472-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2068-254-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2320-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/112-348-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4492-354-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3328-351-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3660-333-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4032-310-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2872-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1540-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4228-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/872-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4712-227-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/624-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/372-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1720-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/528-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4368-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1536-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2908-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4900-151-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
444860.exe0400000.exehbhnnn.exentbbtt.exevpppj.exedvjdp.exe88480.exetbhbnh.exennbthh.exexlfffff.exe066844.exe882288.exeddjpj.exei466600.exe268866.exevpdvp.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 444860.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0400000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88480.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 066844.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 882288.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i466600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 268866.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1e866cfd55fe4a4278bf87eb03adf6cc2b5a4ffa21a18af6c1c67776c2b3a6f1.exerxllxfl.exebhtnnn.exehbthhn.exe000240.exethhtnb.exe684600.exehthbth.exe648624.exejpjjp.exelfxrlll.exe268866.exexrxlfrr.exelxfflll.exenhnbtn.exebbnnbt.exe2400448.exe026800.exe060426.exexrxllff.exe262444.exe646262.exedescription pid Process procid_target PID 4580 wrote to memory of 232 4580 1e866cfd55fe4a4278bf87eb03adf6cc2b5a4ffa21a18af6c1c67776c2b3a6f1.exe 83 PID 4580 wrote to memory of 232 4580 1e866cfd55fe4a4278bf87eb03adf6cc2b5a4ffa21a18af6c1c67776c2b3a6f1.exe 83 PID 4580 wrote to memory of 232 4580 1e866cfd55fe4a4278bf87eb03adf6cc2b5a4ffa21a18af6c1c67776c2b3a6f1.exe 83 PID 232 wrote to memory of 2356 232 rxllxfl.exe 213 PID 232 wrote to memory of 2356 232 rxllxfl.exe 213 PID 232 wrote to memory of 2356 232 rxllxfl.exe 213 PID 2356 wrote to memory of 4700 2356 bhtnnn.exe 85 PID 2356 wrote to memory of 4700 2356 bhtnnn.exe 85 PID 2356 wrote to memory of 4700 2356 bhtnnn.exe 85 PID 4700 wrote to memory of 3684 4700 hbthhn.exe 144 PID 4700 wrote to memory of 3684 4700 hbthhn.exe 144 PID 4700 wrote to memory of 3684 4700 hbthhn.exe 144 PID 3684 wrote to memory of 3420 3684 000240.exe 145 PID 3684 wrote to memory of 3420 3684 000240.exe 145 PID 3684 wrote to memory of 3420 3684 000240.exe 145 PID 3420 wrote to memory of 4336 3420 thhtnb.exe 88 PID 3420 wrote to memory of 4336 3420 thhtnb.exe 88 PID 3420 wrote to memory of 4336 3420 thhtnb.exe 88 PID 4336 wrote to memory of 1512 4336 684600.exe 222 PID 4336 wrote to memory of 1512 4336 684600.exe 222 PID 4336 wrote to memory of 1512 4336 684600.exe 222 PID 1512 wrote to memory of 552 1512 hthbth.exe 90 PID 1512 wrote to memory of 552 1512 hthbth.exe 90 PID 1512 wrote to memory of 552 1512 hthbth.exe 90 PID 552 wrote to memory of 4412 552 648624.exe 91 PID 552 wrote to memory of 4412 552 648624.exe 91 PID 552 wrote to memory of 4412 552 648624.exe 91 PID 4412 wrote to memory of 2012 4412 jpjjp.exe 92 PID 4412 wrote to memory of 2012 4412 jpjjp.exe 92 PID 4412 wrote to memory of 2012 4412 jpjjp.exe 92 PID 2012 wrote to memory of 3984 2012 lfxrlll.exe 93 PID 2012 wrote to memory of 3984 2012 lfxrlll.exe 93 PID 2012 wrote to memory of 3984 2012 lfxrlll.exe 93 PID 3984 wrote to memory of 2112 3984 268866.exe 227 PID 3984 wrote to memory of 2112 3984 268866.exe 227 PID 3984 wrote to memory of 2112 3984 268866.exe 227 PID 2112 wrote to memory of 4084 2112 xrxlfrr.exe 95 PID 2112 wrote to memory of 4084 2112 xrxlfrr.exe 95 PID 2112 wrote to memory of 4084 2112 xrxlfrr.exe 95 PID 4084 wrote to memory of 4248 4084 lxfflll.exe 96 PID 4084 wrote to memory of 4248 4084 lxfflll.exe 96 PID 4084 wrote to memory of 4248 4084 lxfflll.exe 96 PID 4248 wrote to memory of 400 4248 nhnbtn.exe 232 PID 4248 wrote to memory of 400 4248 nhnbtn.exe 232 PID 4248 wrote to memory of 400 4248 nhnbtn.exe 232 PID 400 wrote to memory of 2464 400 bbnnbt.exe 98 PID 400 wrote to memory of 2464 400 bbnnbt.exe 98 PID 400 wrote to memory of 2464 400 bbnnbt.exe 98 PID 2464 wrote to memory of 2496 2464 2400448.exe 99 PID 2464 wrote to memory of 2496 2464 2400448.exe 99 PID 2464 wrote to memory of 2496 2464 2400448.exe 99 PID 2496 wrote to memory of 1164 2496 026800.exe 100 PID 2496 wrote to memory of 1164 2496 026800.exe 100 PID 2496 wrote to memory of 1164 2496 026800.exe 100 PID 1164 wrote to memory of 1564 1164 060426.exe 101 PID 1164 wrote to memory of 1564 1164 060426.exe 101 PID 1164 wrote to memory of 1564 1164 060426.exe 101 PID 1564 wrote to memory of 2540 1564 xrxllff.exe 102 PID 1564 wrote to memory of 2540 1564 xrxllff.exe 102 PID 1564 wrote to memory of 2540 1564 xrxllff.exe 102 PID 2540 wrote to memory of 3536 2540 262444.exe 103 PID 2540 wrote to memory of 3536 2540 262444.exe 103 PID 2540 wrote to memory of 3536 2540 262444.exe 103 PID 3536 wrote to memory of 4228 3536 646262.exe 169
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e866cfd55fe4a4278bf87eb03adf6cc2b5a4ffa21a18af6c1c67776c2b3a6f1.exe"C:\Users\Admin\AppData\Local\Temp\1e866cfd55fe4a4278bf87eb03adf6cc2b5a4ffa21a18af6c1c67776c2b3a6f1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\rxllxfl.exec:\rxllxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\bhtnnn.exec:\bhtnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\hbthhn.exec:\hbthhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\000240.exec:\000240.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\thhtnb.exec:\thhtnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\684600.exec:\684600.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\hthbth.exec:\hthbth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\648624.exec:\648624.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\jpjjp.exec:\jpjjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\lfxrlll.exec:\lfxrlll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\268866.exec:\268866.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\xrxlfrr.exec:\xrxlfrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\lxfflll.exec:\lxfflll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\nhnbtn.exec:\nhnbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\bbnnbt.exec:\bbnnbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\2400448.exec:\2400448.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\026800.exec:\026800.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\060426.exec:\060426.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\xrxllff.exec:\xrxllff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\262444.exec:\262444.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\646262.exec:\646262.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\frxxrrl.exec:\frxxrrl.exe23⤵
- Executes dropped EXE
PID:4228 -
\??\c:\688826.exec:\688826.exe24⤵
- Executes dropped EXE
PID:1636 -
\??\c:\vjjjd.exec:\vjjjd.exe25⤵
- Executes dropped EXE
PID:1576 -
\??\c:\httbtb.exec:\httbtb.exe26⤵
- Executes dropped EXE
PID:608 -
\??\c:\xlxrllf.exec:\xlxrllf.exe27⤵
- Executes dropped EXE
PID:1260 -
\??\c:\686800.exec:\686800.exe28⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jjjdp.exec:\jjjdp.exe29⤵
- Executes dropped EXE
PID:4216 -
\??\c:\1fllxlx.exec:\1fllxlx.exe30⤵
- Executes dropped EXE
PID:4108 -
\??\c:\dvpvp.exec:\dvpvp.exe31⤵
- Executes dropped EXE
PID:912 -
\??\c:\xlxrlfx.exec:\xlxrlfx.exe32⤵
- Executes dropped EXE
PID:4900 -
\??\c:\2488888.exec:\2488888.exe33⤵
- Executes dropped EXE
PID:4924 -
\??\c:\284862.exec:\284862.exe34⤵
- Executes dropped EXE
PID:2408 -
\??\c:\822660.exec:\822660.exe35⤵
- Executes dropped EXE
PID:2908 -
\??\c:\nhbnhb.exec:\nhbnhb.exe36⤵
- Executes dropped EXE
PID:748 -
\??\c:\dddpd.exec:\dddpd.exe37⤵
- Executes dropped EXE
PID:3888 -
\??\c:\206022.exec:\206022.exe38⤵
- Executes dropped EXE
PID:1388 -
\??\c:\28888.exec:\28888.exe39⤵
- Executes dropped EXE
PID:2632 -
\??\c:\22602.exec:\22602.exe40⤵
- Executes dropped EXE
PID:1728 -
\??\c:\40204.exec:\40204.exe41⤵
- Executes dropped EXE
PID:4724 -
\??\c:\pdjdv.exec:\pdjdv.exe42⤵
- Executes dropped EXE
PID:1696 -
\??\c:\6806462.exec:\6806462.exe43⤵
- Executes dropped EXE
PID:1536 -
\??\c:\pvpdj.exec:\pvpdj.exe44⤵
- Executes dropped EXE
PID:4576 -
\??\c:\44604.exec:\44604.exe45⤵
- Executes dropped EXE
PID:3828 -
\??\c:\62482.exec:\62482.exe46⤵
- Executes dropped EXE
PID:112 -
\??\c:\pdpdj.exec:\pdpdj.exe47⤵
- Executes dropped EXE
PID:3328 -
\??\c:\1rfflrl.exec:\1rfflrl.exe48⤵
- Executes dropped EXE
PID:4368 -
\??\c:\86226.exec:\86226.exe49⤵
- Executes dropped EXE
PID:4004 -
\??\c:\3ffxfff.exec:\3ffxfff.exe50⤵
- Executes dropped EXE
PID:528 -
\??\c:\pdvpp.exec:\pdvpp.exe51⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lfrlrlx.exec:\lfrlrlx.exe52⤵
- Executes dropped EXE
PID:1028 -
\??\c:\ntnhbt.exec:\ntnhbt.exe53⤵
- Executes dropped EXE
PID:372 -
\??\c:\nttnnh.exec:\nttnnh.exe54⤵
- Executes dropped EXE
PID:3596 -
\??\c:\ffxlxrf.exec:\ffxlxrf.exe55⤵
- Executes dropped EXE
PID:1904 -
\??\c:\6026682.exec:\6026682.exe56⤵PID:2792
-
\??\c:\flrlfxr.exec:\flrlfxr.exe57⤵
- Executes dropped EXE
PID:4676 -
\??\c:\68482.exec:\68482.exe58⤵
- Executes dropped EXE
PID:624 -
\??\c:\vpppj.exec:\vpppj.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1832 -
\??\c:\m8042.exec:\m8042.exe60⤵
- Executes dropped EXE
PID:3652 -
\??\c:\nhbntn.exec:\nhbntn.exe61⤵
- Executes dropped EXE
PID:656 -
\??\c:\886082.exec:\886082.exe62⤵
- Executes dropped EXE
PID:4712 -
\??\c:\888826.exec:\888826.exe63⤵
- Executes dropped EXE
PID:3684 -
\??\c:\2666044.exec:\2666044.exe64⤵
- Executes dropped EXE
PID:3420 -
\??\c:\08844.exec:\08844.exe65⤵
- Executes dropped EXE
PID:1604 -
\??\c:\48824.exec:\48824.exe66⤵
- Executes dropped EXE
PID:5116 -
\??\c:\046884.exec:\046884.exe67⤵PID:4464
-
\??\c:\9rxrllf.exec:\9rxrllf.exe68⤵PID:2812
-
\??\c:\pvdvp.exec:\pvdvp.exe69⤵PID:3472
-
\??\c:\ddpjj.exec:\ddpjj.exe70⤵PID:3384
-
\??\c:\xffrllr.exec:\xffrllr.exe71⤵PID:3368
-
\??\c:\680488.exec:\680488.exe72⤵PID:4372
-
\??\c:\thbhhh.exec:\thbhhh.exe73⤵PID:5068
-
\??\c:\8464860.exec:\8464860.exe74⤵PID:2068
-
\??\c:\hhbbbb.exec:\hhbbbb.exe75⤵PID:2768
-
\??\c:\xllffll.exec:\xllffll.exe76⤵PID:2608
-
\??\c:\rffxrrf.exec:\rffxrrf.exe77⤵PID:1648
-
\??\c:\080088.exec:\080088.exe78⤵PID:872
-
\??\c:\hhhhhh.exec:\hhhhhh.exe79⤵PID:1052
-
\??\c:\hhtnbb.exec:\hhtnbb.exe80⤵PID:1768
-
\??\c:\466666.exec:\466666.exe81⤵PID:1860
-
\??\c:\jdddv.exec:\jdddv.exe82⤵PID:3868
-
\??\c:\flfffff.exec:\flfffff.exe83⤵PID:1120
-
\??\c:\0084888.exec:\0084888.exe84⤵PID:2580
-
\??\c:\04600.exec:\04600.exe85⤵PID:224
-
\??\c:\vjjjd.exec:\vjjjd.exe86⤵PID:364
-
\??\c:\4248084.exec:\4248084.exe87⤵PID:4176
-
\??\c:\8060666.exec:\8060666.exe88⤵PID:4228
-
\??\c:\rlrxrrr.exec:\rlrxrrr.exe89⤵PID:2320
-
\??\c:\2006480.exec:\2006480.exe90⤵PID:3084
-
\??\c:\6482224.exec:\6482224.exe91⤵PID:2292
-
\??\c:\0066288.exec:\0066288.exe92⤵PID:1540
-
\??\c:\e60088.exec:\e60088.exe93⤵PID:4560
-
\??\c:\480660.exec:\480660.exe94⤵PID:3244
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe95⤵PID:3480
-
\??\c:\42226.exec:\42226.exe96⤵PID:2872
-
\??\c:\xrrfxlf.exec:\xrrfxlf.exe97⤵PID:4208
-
\??\c:\dpjvj.exec:\dpjvj.exe98⤵PID:444
-
\??\c:\3pvvv.exec:\3pvvv.exe99⤵PID:4032
-
\??\c:\xlxfxfl.exec:\xlxfxfl.exe100⤵PID:1988
-
\??\c:\3bbhhh.exec:\3bbhhh.exe101⤵PID:8
-
\??\c:\tbhbbt.exec:\tbhbbt.exe102⤵PID:4984
-
\??\c:\4682600.exec:\4682600.exe103⤵PID:2796
-
\??\c:\pvvvp.exec:\pvvvp.exe104⤵PID:184
-
\??\c:\4660022.exec:\4660022.exe105⤵PID:3932
-
\??\c:\28444.exec:\28444.exe106⤵PID:3852
-
\??\c:\g2626.exec:\g2626.exe107⤵PID:992
-
\??\c:\c026666.exec:\c026666.exe108⤵PID:3888
-
\??\c:\pdvjd.exec:\pdvjd.exe109⤵PID:1388
-
\??\c:\djppd.exec:\djppd.exe110⤵PID:3660
-
\??\c:\468260.exec:\468260.exe111⤵PID:4196
-
\??\c:\88422.exec:\88422.exe112⤵PID:4832
-
\??\c:\846428.exec:\846428.exe113⤵PID:5020
-
\??\c:\c288266.exec:\c288266.exe114⤵PID:2228
-
\??\c:\8248260.exec:\8248260.exe115⤵PID:4136
-
\??\c:\thnhbt.exec:\thnhbt.exe116⤵PID:2784
-
\??\c:\pvpdp.exec:\pvpdp.exe117⤵PID:112
-
\??\c:\684824.exec:\684824.exe118⤵PID:3328
-
\??\c:\7jpjj.exec:\7jpjj.exe119⤵PID:4492
-
\??\c:\jdpdv.exec:\jdpdv.exe120⤵PID:5088
-
\??\c:\flfxxff.exec:\flfxxff.exe121⤵PID:864
-
\??\c:\rlxxffl.exec:\rlxxffl.exe122⤵PID:4808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-