Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 02:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe
-
Size
453KB
-
MD5
1ed920f9954d0971060e9a75577cd7ac
-
SHA1
16f3876f008c05239a2ea00423cda1762a2959ac
-
SHA256
98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720
-
SHA512
66ac63cab28eeddc2b79905b29fc94fff96ca64956406ee7e3e8aa71ba9bf00420627f45bf904a8bedf43b31091af88bd20a40267f363ad97214333224cd69c8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeW:q7Tc2NYHUrAwfMp3CDW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1656-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/984-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/908-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2680-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-818-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-822-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-928-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-971-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-1068-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-1465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2852 3fxlffx.exe 2168 nhnhhb.exe 2364 5jvpj.exe 1036 9ppjv.exe 972 fllxrlx.exe 4944 vddvj.exe 3768 thbthh.exe 4948 7rrlxrl.exe 1664 jddvp.exe 4216 nhbthb.exe 984 5bbnbt.exe 4744 rflrllf.exe 4676 9dddp.exe 2552 3frlrll.exe 2840 bthtbh.exe 3512 rlrrxxf.exe 4832 1rlfrrl.exe 3704 pjdvp.exe 244 hhtbtt.exe 5044 dpdpj.exe 3036 tnnhhh.exe 2708 lffxrrl.exe 2164 hhtnhh.exe 3092 xrxxlfx.exe 3076 pvvjv.exe 1532 nbhbbt.exe 4176 vvjdj.exe 1896 bnnbnh.exe 908 vvjvp.exe 2388 lflfrrl.exe 1964 tnhbtt.exe 4552 djddp.exe 4268 vddvj.exe 2300 xfffffx.exe 2640 1bbtnn.exe 2508 bthbnn.exe 2956 3pjvj.exe 4732 lfllrlx.exe 1192 vjdpp.exe 2716 xxlffff.exe 2336 rrxlfxl.exe 4548 hthhnh.exe 1156 ddjdd.exe 1812 rlllxrx.exe 4628 htbtnn.exe 4708 nbhbtt.exe 3584 jppdp.exe 1040 flrlfff.exe 4840 hhnnhh.exe 3392 vdvdp.exe 1656 rllfrrl.exe 1972 bnnhtn.exe 3676 dpdvv.exe 3396 pvjdv.exe 2364 rflxrrl.exe 3608 3bhntt.exe 1036 dvjjp.exe 3112 dpvpj.exe 4748 rrxrlxr.exe 4408 bhbbtt.exe 2772 vvvpj.exe 4760 dpvvv.exe 4872 lrlxfrl.exe 2700 htbnnn.exe -
resource yara_rule behavioral2/memory/1656-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/984-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/908-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-818-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-928-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-971-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-1068-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1656 wrote to memory of 2852 1656 98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe 81 PID 1656 wrote to memory of 2852 1656 98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe 81 PID 1656 wrote to memory of 2852 1656 98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe 81 PID 2852 wrote to memory of 2168 2852 3fxlffx.exe 82 PID 2852 wrote to memory of 2168 2852 3fxlffx.exe 82 PID 2852 wrote to memory of 2168 2852 3fxlffx.exe 82 PID 2168 wrote to memory of 2364 2168 nhnhhb.exe 83 PID 2168 wrote to memory of 2364 2168 nhnhhb.exe 83 PID 2168 wrote to memory of 2364 2168 nhnhhb.exe 83 PID 2364 wrote to memory of 1036 2364 5jvpj.exe 84 PID 2364 wrote to memory of 1036 2364 5jvpj.exe 84 PID 2364 wrote to memory of 1036 2364 5jvpj.exe 84 PID 1036 wrote to memory of 972 1036 9ppjv.exe 85 PID 1036 wrote to memory of 972 1036 9ppjv.exe 85 PID 1036 wrote to memory of 972 1036 9ppjv.exe 85 PID 972 wrote to memory of 4944 972 fllxrlx.exe 86 PID 972 wrote to memory of 4944 972 fllxrlx.exe 86 PID 972 wrote to memory of 4944 972 fllxrlx.exe 86 PID 4944 wrote to memory of 3768 4944 vddvj.exe 87 PID 4944 wrote to memory of 3768 4944 vddvj.exe 87 PID 4944 wrote to memory of 3768 4944 vddvj.exe 87 PID 3768 wrote to memory of 4948 3768 thbthh.exe 88 PID 3768 wrote to memory of 4948 3768 thbthh.exe 88 PID 3768 wrote to memory of 4948 3768 thbthh.exe 88 PID 4948 wrote to memory of 1664 4948 7rrlxrl.exe 89 PID 4948 wrote to memory of 1664 4948 7rrlxrl.exe 89 PID 4948 wrote to memory of 1664 4948 7rrlxrl.exe 89 PID 1664 wrote to memory of 4216 1664 jddvp.exe 90 PID 1664 wrote to memory of 4216 1664 jddvp.exe 90 PID 1664 wrote to memory of 4216 1664 jddvp.exe 90 PID 4216 wrote to memory of 984 4216 nhbthb.exe 91 PID 4216 wrote to memory of 984 4216 nhbthb.exe 91 PID 4216 wrote to memory of 984 4216 nhbthb.exe 91 PID 984 wrote to memory of 4744 984 5bbnbt.exe 92 PID 984 wrote to memory of 4744 984 5bbnbt.exe 92 PID 984 wrote to memory of 4744 984 5bbnbt.exe 92 PID 4744 wrote to memory of 4676 4744 rflrllf.exe 93 PID 4744 wrote to memory of 4676 4744 rflrllf.exe 93 PID 4744 wrote to memory of 4676 4744 rflrllf.exe 93 PID 4676 wrote to memory of 2552 4676 9dddp.exe 94 PID 4676 wrote to memory of 2552 4676 9dddp.exe 94 PID 4676 wrote to memory of 2552 4676 9dddp.exe 94 PID 2552 wrote to memory of 2840 2552 3frlrll.exe 95 PID 2552 wrote to memory of 2840 2552 3frlrll.exe 95 PID 2552 wrote to memory of 2840 2552 3frlrll.exe 95 PID 2840 wrote to memory of 3512 2840 bthtbh.exe 96 PID 2840 wrote to memory of 3512 2840 bthtbh.exe 96 PID 2840 wrote to memory of 3512 2840 bthtbh.exe 96 PID 3512 wrote to memory of 4832 3512 rlrrxxf.exe 97 PID 3512 wrote to memory of 4832 3512 rlrrxxf.exe 97 PID 3512 wrote to memory of 4832 3512 rlrrxxf.exe 97 PID 4832 wrote to memory of 3704 4832 1rlfrrl.exe 98 PID 4832 wrote to memory of 3704 4832 1rlfrrl.exe 98 PID 4832 wrote to memory of 3704 4832 1rlfrrl.exe 98 PID 3704 wrote to memory of 244 3704 pjdvp.exe 99 PID 3704 wrote to memory of 244 3704 pjdvp.exe 99 PID 3704 wrote to memory of 244 3704 pjdvp.exe 99 PID 244 wrote to memory of 5044 244 hhtbtt.exe 100 PID 244 wrote to memory of 5044 244 hhtbtt.exe 100 PID 244 wrote to memory of 5044 244 hhtbtt.exe 100 PID 5044 wrote to memory of 3036 5044 dpdpj.exe 101 PID 5044 wrote to memory of 3036 5044 dpdpj.exe 101 PID 5044 wrote to memory of 3036 5044 dpdpj.exe 101 PID 3036 wrote to memory of 2708 3036 tnnhhh.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe"C:\Users\Admin\AppData\Local\Temp\98f6a9eb5af52fca53cceedf89688553b42758ea49e4b4a52d493ec5d0e20720.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\3fxlffx.exec:\3fxlffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\nhnhhb.exec:\nhnhhb.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\5jvpj.exec:\5jvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\9ppjv.exec:\9ppjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\fllxrlx.exec:\fllxrlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\vddvj.exec:\vddvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\thbthh.exec:\thbthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\7rrlxrl.exec:\7rrlxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\jddvp.exec:\jddvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\nhbthb.exec:\nhbthb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\5bbnbt.exec:\5bbnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\rflrllf.exec:\rflrllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\9dddp.exec:\9dddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\3frlrll.exec:\3frlrll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\bthtbh.exec:\bthtbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rlrrxxf.exec:\rlrrxxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\1rlfrrl.exec:\1rlfrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\pjdvp.exec:\pjdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\hhtbtt.exec:\hhtbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
\??\c:\dpdpj.exec:\dpdpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\tnnhhh.exec:\tnnhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\lffxrrl.exec:\lffxrrl.exe23⤵
- Executes dropped EXE
PID:2708 -
\??\c:\hhtnhh.exec:\hhtnhh.exe24⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xrxxlfx.exec:\xrxxlfx.exe25⤵
- Executes dropped EXE
PID:3092 -
\??\c:\pvvjv.exec:\pvvjv.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3076 -
\??\c:\nbhbbt.exec:\nbhbbt.exe27⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vvjdj.exec:\vvjdj.exe28⤵
- Executes dropped EXE
PID:4176 -
\??\c:\bnnbnh.exec:\bnnbnh.exe29⤵
- Executes dropped EXE
PID:1896 -
\??\c:\vvjvp.exec:\vvjvp.exe30⤵
- Executes dropped EXE
PID:908 -
\??\c:\lflfrrl.exec:\lflfrrl.exe31⤵
- Executes dropped EXE
PID:2388 -
\??\c:\tnhbtt.exec:\tnhbtt.exe32⤵
- Executes dropped EXE
PID:1964 -
\??\c:\djddp.exec:\djddp.exe33⤵
- Executes dropped EXE
PID:4552 -
\??\c:\vddvj.exec:\vddvj.exe34⤵
- Executes dropped EXE
PID:4268 -
\??\c:\xfffffx.exec:\xfffffx.exe35⤵
- Executes dropped EXE
PID:2300 -
\??\c:\1bbtnn.exec:\1bbtnn.exe36⤵
- Executes dropped EXE
PID:2640 -
\??\c:\bthbnn.exec:\bthbnn.exe37⤵
- Executes dropped EXE
PID:2508 -
\??\c:\3pjvj.exec:\3pjvj.exe38⤵
- Executes dropped EXE
PID:2956 -
\??\c:\lfllrlx.exec:\lfllrlx.exe39⤵
- Executes dropped EXE
PID:4732 -
\??\c:\vjdpp.exec:\vjdpp.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1192 -
\??\c:\xxlffff.exec:\xxlffff.exe41⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rrxlfxl.exec:\rrxlfxl.exe42⤵
- Executes dropped EXE
PID:2336 -
\??\c:\hthhnh.exec:\hthhnh.exe43⤵
- Executes dropped EXE
PID:4548 -
\??\c:\ddjdd.exec:\ddjdd.exe44⤵
- Executes dropped EXE
PID:1156 -
\??\c:\rlllxrx.exec:\rlllxrx.exe45⤵
- Executes dropped EXE
PID:1812 -
\??\c:\htbtnn.exec:\htbtnn.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4628 -
\??\c:\nbhbtt.exec:\nbhbtt.exe47⤵
- Executes dropped EXE
PID:4708 -
\??\c:\jppdp.exec:\jppdp.exe48⤵
- Executes dropped EXE
PID:3584 -
\??\c:\flrlfff.exec:\flrlfff.exe49⤵
- Executes dropped EXE
PID:1040 -
\??\c:\hhnnhh.exec:\hhnnhh.exe50⤵
- Executes dropped EXE
PID:4840 -
\??\c:\vdvdp.exec:\vdvdp.exe51⤵
- Executes dropped EXE
PID:3392 -
\??\c:\rllfrrl.exec:\rllfrrl.exe52⤵
- Executes dropped EXE
PID:1656 -
\??\c:\bnnhtn.exec:\bnnhtn.exe53⤵
- Executes dropped EXE
PID:1972 -
\??\c:\dpdvv.exec:\dpdvv.exe54⤵
- Executes dropped EXE
PID:3676 -
\??\c:\pvjdv.exec:\pvjdv.exe55⤵
- Executes dropped EXE
PID:3396 -
\??\c:\rflxrrl.exec:\rflxrrl.exe56⤵
- Executes dropped EXE
PID:2364 -
\??\c:\3bhntt.exec:\3bhntt.exe57⤵
- Executes dropped EXE
PID:3608 -
\??\c:\dvjjp.exec:\dvjjp.exe58⤵
- Executes dropped EXE
PID:1036 -
\??\c:\dpvpj.exec:\dpvpj.exe59⤵
- Executes dropped EXE
PID:3112 -
\??\c:\rrxrlxr.exec:\rrxrlxr.exe60⤵
- Executes dropped EXE
PID:4748 -
\??\c:\bhbbtt.exec:\bhbbtt.exe61⤵
- Executes dropped EXE
PID:4408 -
\??\c:\vvvpj.exec:\vvvpj.exe62⤵
- Executes dropped EXE
PID:2772 -
\??\c:\dpvvv.exec:\dpvvv.exe63⤵
- Executes dropped EXE
PID:4760 -
\??\c:\lrlxfrl.exec:\lrlxfrl.exe64⤵
- Executes dropped EXE
PID:4872 -
\??\c:\htbnnn.exec:\htbnnn.exe65⤵
- Executes dropped EXE
PID:2700 -
\??\c:\jvvjd.exec:\jvvjd.exe66⤵PID:1440
-
\??\c:\xxfxrrr.exec:\xxfxrrr.exe67⤵PID:1276
-
\??\c:\htnnhn.exec:\htnnhn.exe68⤵PID:1272
-
\??\c:\jjdvj.exec:\jjdvj.exe69⤵PID:4960
-
\??\c:\xrfrlfx.exec:\xrfrlfx.exe70⤵PID:2760
-
\??\c:\9nhhbh.exec:\9nhhbh.exe71⤵PID:444
-
\??\c:\3ntnnn.exec:\3ntnnn.exe72⤵PID:2160
-
\??\c:\9pvvp.exec:\9pvvp.exe73⤵PID:116
-
\??\c:\llllfxr.exec:\llllfxr.exe74⤵PID:3424
-
\??\c:\hbhbtt.exec:\hbhbtt.exe75⤵PID:2800
-
\??\c:\1vvpd.exec:\1vvpd.exe76⤵PID:4900
-
\??\c:\rxxrrlf.exec:\rxxrrlf.exe77⤵
- System Location Discovery: System Language Discovery
PID:2136 -
\??\c:\lrffxxr.exec:\lrffxxr.exe78⤵PID:3240
-
\??\c:\htbtnb.exec:\htbtnb.exe79⤵PID:2708
-
\??\c:\vjpjj.exec:\vjpjj.exe80⤵PID:4240
-
\??\c:\jjjdd.exec:\jjjdd.exe81⤵PID:2628
-
\??\c:\lrffxxl.exec:\lrffxxl.exe82⤵PID:4888
-
\??\c:\bttnhb.exec:\bttnhb.exe83⤵PID:3076
-
\??\c:\vjjvj.exec:\vjjvj.exe84⤵PID:2680
-
\??\c:\frxxrxr.exec:\frxxrxr.exe85⤵PID:3964
-
\??\c:\hhbthb.exec:\hhbthb.exe86⤵PID:3592
-
\??\c:\jdvpj.exec:\jdvpj.exe87⤵PID:3548
-
\??\c:\rllfrlf.exec:\rllfrlf.exe88⤵PID:3640
-
\??\c:\xxlfxxr.exec:\xxlfxxr.exe89⤵PID:404
-
\??\c:\htbbtn.exec:\htbbtn.exe90⤵PID:2724
-
\??\c:\vdpjd.exec:\vdpjd.exe91⤵PID:4692
-
\??\c:\7jvvj.exec:\7jvvj.exe92⤵PID:2696
-
\??\c:\xxfxllx.exec:\xxfxllx.exe93⤵PID:4268
-
\??\c:\hntnhb.exec:\hntnhb.exe94⤵PID:2632
-
\??\c:\3ddpd.exec:\3ddpd.exe95⤵PID:2640
-
\??\c:\5xxrrfx.exec:\5xxrrfx.exe96⤵PID:5056
-
\??\c:\hhnhbb.exec:\hhnhbb.exe97⤵PID:2956
-
\??\c:\nhnnnn.exec:\nhnnnn.exe98⤵PID:2240
-
\??\c:\djjdj.exec:\djjdj.exe99⤵PID:1400
-
\??\c:\xrrlffx.exec:\xrrlffx.exe100⤵PID:4080
-
\??\c:\ffrxrlf.exec:\ffrxrlf.exe101⤵PID:1456
-
\??\c:\tbhtnn.exec:\tbhtnn.exe102⤵PID:1556
-
\??\c:\9ppjv.exec:\9ppjv.exe103⤵PID:2076
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe104⤵PID:3600
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe105⤵
- System Location Discovery: System Language Discovery
PID:464 -
\??\c:\nbhbbt.exec:\nbhbbt.exe106⤵PID:1196
-
\??\c:\ppdpp.exec:\ppdpp.exe107⤵PID:1828
-
\??\c:\rxlfflf.exec:\rxlfflf.exe108⤵PID:3524
-
\??\c:\rrxffff.exec:\rrxffff.exe109⤵PID:3056
-
\??\c:\bbhttn.exec:\bbhttn.exe110⤵PID:4456
-
\??\c:\1djdp.exec:\1djdp.exe111⤵PID:3392
-
\??\c:\7ffxllf.exec:\7ffxllf.exe112⤵PID:1032
-
\??\c:\frlrfxf.exec:\frlrfxf.exe113⤵PID:1268
-
\??\c:\tbhbtt.exec:\tbhbtt.exe114⤵PID:5012
-
\??\c:\pvdvp.exec:\pvdvp.exe115⤵
- System Location Discovery: System Language Discovery
PID:3388 -
\??\c:\jjpdv.exec:\jjpdv.exe116⤵PID:3504
-
\??\c:\nnthtn.exec:\nnthtn.exe117⤵PID:3608
-
\??\c:\nbnbtn.exec:\nbnbtn.exe118⤵PID:2208
-
\??\c:\vjdvp.exec:\vjdvp.exe119⤵PID:1036
-
\??\c:\llxllxr.exec:\llxllxr.exe120⤵PID:3544
-
\??\c:\llrrrrr.exec:\llrrrrr.exe121⤵PID:5008
-
\??\c:\vjdvp.exec:\vjdvp.exe122⤵PID:2772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-