Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 06:26
Behavioral task
behavioral1
Sample
05e8e031d4f5fcf02c1c6a1f8f823d67271b3f36e3e091f147cd53c87ac015b1N.exe
Resource
win7-20240903-en
General
-
Target
05e8e031d4f5fcf02c1c6a1f8f823d67271b3f36e3e091f147cd53c87ac015b1N.exe
-
Size
283KB
-
MD5
5fa29f749455d87eaebdf09837c124a0
-
SHA1
9f5102b3280a473e0d2cbd004e801471d026511b
-
SHA256
05e8e031d4f5fcf02c1c6a1f8f823d67271b3f36e3e091f147cd53c87ac015b1
-
SHA512
f484bdb38c489286485e5f2749deb685e20c5eefcb91608b0d4074c5658a91f3c0c74aa4c6c25a8558fe47f1b2de52506c91f6b20b375c0e74669795210811c7
-
SSDEEP
6144:7cm4FmowdHoSoXSBcm4Vcm4FmowdHoSphra+cm4FMhraHcpOaKHpz:B4wFHoSoXW434wFHoS3eg4aeFaKHpz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1312-7-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4564-15-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2624-19-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4080-27-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3284-35-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4224-39-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1432-48-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4884-56-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4084-55-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4884-62-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3960-69-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1936-75-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4680-82-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/624-106-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4912-97-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3224-90-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2900-114-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3156-120-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2568-226-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/264-324-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3048-321-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/264-317-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2192-314-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2084-309-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2192-307-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1416-304-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2084-302-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/916-301-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1416-297-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4836-296-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/916-292-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1492-291-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/184-287-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1492-283-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2820-279-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/184-277-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4360-276-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2820-273-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/5116-272-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4704-268-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1972-262-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4704-259-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3784-257-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3092-253-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3784-251-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/5092-248-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2000-245-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4652-240-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2416-236-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2568-232-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2112-229-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3068-223-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3864-219-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4996-209-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1108-206-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4996-201-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3512-196-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1448-190-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3512-186-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1348-183-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3312-179-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3312-169-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3856-168-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1164-156-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bbthbt.exe3btbth.exevpvpp.exexfxrlfx.exevvjvp.exedpvjd.exeppvjv.exenbnbbt.exedppjd.exethhtnh.exeddjvj.exevpvjv.exellffffl.exetnthhn.exedjpjp.exe7lrlffx.exehhtnbb.exehhbhnh.exepjddv.exexfllrrf.exe7xrrlll.exehbbbbt.exevvdvp.exe1pvvp.exefxfffff.exetnbbtt.exehhbhbn.exejdpjj.exejjdvp.exe1xlffff.exeffxflrx.exenbnhbb.exepjjjd.exe9djjd.exerfrxxxx.exe9lrfflr.exehthnhn.exejvdvp.exevvvpj.exe1xfxffl.exelxxxrrl.exenhnhbb.exenntntt.exeppvpd.exedpdvp.exe7frlxfx.exehhhhtt.exedjjvv.exejdppp.exelflfxrl.exenhtttt.exenbhbtt.exepdddv.exejppvp.exe3xlflfl.exe5lfxrxr.exehbhhhh.exedpdvp.exejjvvv.exefffxrrx.exe5lxxrxr.exentbbbb.exejdjpj.exejjvdd.exepid process 4564 bbthbt.exe 2624 3btbth.exe 4080 vpvpp.exe 3284 xfxrlfx.exe 4224 vvjvp.exe 1432 dpvjd.exe 4084 ppvjv.exe 4884 nbnbbt.exe 3960 dppjd.exe 1936 thhtnh.exe 4680 ddjvj.exe 3224 vpvjv.exe 4912 llffffl.exe 624 tnthhn.exe 2900 djpjp.exe 3156 7lrlffx.exe 3276 hhtnbb.exe 456 hhbhnh.exe 2136 pjddv.exe 3148 xfllrrf.exe 1164 7xrrlll.exe 3856 hbbbbt.exe 2904 vvdvp.exe 3312 1pvvp.exe 1348 fxfffff.exe 1448 tnbbtt.exe 3512 hhbhbn.exe 1108 jdpjj.exe 4996 jjdvp.exe 3864 1xlffff.exe 3068 ffxflrx.exe 2112 nbnhbb.exe 2568 pjjjd.exe 2416 9djjd.exe 4652 rfrxxxx.exe 2000 9lrfflr.exe 5092 hthnhn.exe 3092 jvdvp.exe 3784 vvvpj.exe 1972 1xfxffl.exe 4704 lxxxrrl.exe 5116 nhnhbb.exe 4360 nntntt.exe 2820 ppvpd.exe 184 dpdvp.exe 1492 7frlxfx.exe 4836 hhhhtt.exe 916 djjvv.exe 1416 jdppp.exe 2084 lflfxrl.exe 2192 nhtttt.exe 3048 nbhbtt.exe 264 pdddv.exe 2616 jppvp.exe 208 3xlflfl.exe 228 5lfxrxr.exe 1820 hbhhhh.exe 1808 dpdvp.exe 2848 jjvvv.exe 4380 fffxrrx.exe 3948 5lxxrxr.exe 4472 ntbbbb.exe 3936 jdjpj.exe 1272 jjvdd.exe -
Processes:
resource yara_rule behavioral2/memory/1312-0-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4564-4-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1312-7-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\3btbth.exe upx \??\c:\bbthbt.exe upx C:\vpvpp.exe upx behavioral2/memory/4564-15-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/2624-12-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4080-20-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/2624-19-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\xfxrlfx.exe upx behavioral2/memory/4080-27-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3284-26-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\vvjvp.exe upx behavioral2/memory/3284-35-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4224-33-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\dpvjd.exe upx behavioral2/memory/1432-42-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4224-39-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\ppvjv.exe upx behavioral2/memory/1432-48-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4084-47-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\nbnbbt.exe upx behavioral2/memory/4884-56-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4084-55-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\dppjd.exe upx behavioral2/memory/4884-62-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3960-61-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\thhtnh.exe upx behavioral2/memory/1936-68-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3960-69-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\ddjvj.exe upx behavioral2/memory/1936-75-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4680-76-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3224-84-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\vpvjv.exe upx behavioral2/memory/4680-82-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\llffffl.exe upx behavioral2/memory/4912-91-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\tnthhn.exe upx behavioral2/memory/624-99-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/2900-103-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/624-106-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3156-110-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\7lrlffx.exe upx \??\c:\djpjp.exe upx behavioral2/memory/4912-97-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3224-90-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/2900-114-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3156-120-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/456-125-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/2136-131-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\xfllrrf.exe upx \??\c:\7xrrlll.exe upx \??\c:\hbbbbt.exe upx C:\vvdvp.exe upx behavioral2/memory/2904-161-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\fxfffff.exe upx \??\c:\tnbbtt.exe upx \??\c:\jdpjj.exe upx \??\c:\ffxflrx.exe upx behavioral2/memory/2568-226-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/264-324-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3048-321-0x0000000000400000-0x000000000044D000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
bnnnhh.exe5tbthh.exebnthbb.exexlfxffx.exe1djjd.exexffrxff.exejppjj.exexffxxxx.exe3fxrfxl.exehhnntt.exennttnb.exerxrrfxl.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
05e8e031d4f5fcf02c1c6a1f8f823d67271b3f36e3e091f147cd53c87ac015b1N.exebbthbt.exe3btbth.exevpvpp.exexfxrlfx.exevvjvp.exedpvjd.exeppvjv.exenbnbbt.exedppjd.exethhtnh.exeddjvj.exevpvjv.exellffffl.exetnthhn.exedjpjp.exe7lrlffx.exehhtnbb.exehhbhnh.exepjddv.exexfllrrf.exe7xrrlll.exedescription pid process target process PID 1312 wrote to memory of 4564 1312 05e8e031d4f5fcf02c1c6a1f8f823d67271b3f36e3e091f147cd53c87ac015b1N.exe bbthbt.exe PID 1312 wrote to memory of 4564 1312 05e8e031d4f5fcf02c1c6a1f8f823d67271b3f36e3e091f147cd53c87ac015b1N.exe bbthbt.exe PID 1312 wrote to memory of 4564 1312 05e8e031d4f5fcf02c1c6a1f8f823d67271b3f36e3e091f147cd53c87ac015b1N.exe bbthbt.exe PID 4564 wrote to memory of 2624 4564 bbthbt.exe 3btbth.exe PID 4564 wrote to memory of 2624 4564 bbthbt.exe 3btbth.exe PID 4564 wrote to memory of 2624 4564 bbthbt.exe 3btbth.exe PID 2624 wrote to memory of 4080 2624 3btbth.exe vpvpp.exe PID 2624 wrote to memory of 4080 2624 3btbth.exe vpvpp.exe PID 2624 wrote to memory of 4080 2624 3btbth.exe vpvpp.exe PID 4080 wrote to memory of 3284 4080 vpvpp.exe xfxrlfx.exe PID 4080 wrote to memory of 3284 4080 vpvpp.exe xfxrlfx.exe PID 4080 wrote to memory of 3284 4080 vpvpp.exe xfxrlfx.exe PID 3284 wrote to memory of 4224 3284 xfxrlfx.exe vvjvp.exe PID 3284 wrote to memory of 4224 3284 xfxrlfx.exe vvjvp.exe PID 3284 wrote to memory of 4224 3284 xfxrlfx.exe vvjvp.exe PID 4224 wrote to memory of 1432 4224 vvjvp.exe dpvjd.exe PID 4224 wrote to memory of 1432 4224 vvjvp.exe dpvjd.exe PID 4224 wrote to memory of 1432 4224 vvjvp.exe dpvjd.exe PID 1432 wrote to memory of 4084 1432 dpvjd.exe ppvjv.exe PID 1432 wrote to memory of 4084 1432 dpvjd.exe ppvjv.exe PID 1432 wrote to memory of 4084 1432 dpvjd.exe ppvjv.exe PID 4084 wrote to memory of 4884 4084 ppvjv.exe nbnbbt.exe PID 4084 wrote to memory of 4884 4084 ppvjv.exe nbnbbt.exe PID 4084 wrote to memory of 4884 4084 ppvjv.exe nbnbbt.exe PID 4884 wrote to memory of 3960 4884 nbnbbt.exe dppjd.exe PID 4884 wrote to memory of 3960 4884 nbnbbt.exe dppjd.exe PID 4884 wrote to memory of 3960 4884 nbnbbt.exe dppjd.exe PID 3960 wrote to memory of 1936 3960 dppjd.exe thhtnh.exe PID 3960 wrote to memory of 1936 3960 dppjd.exe thhtnh.exe PID 3960 wrote to memory of 1936 3960 dppjd.exe thhtnh.exe PID 1936 wrote to memory of 4680 1936 thhtnh.exe ddjvj.exe PID 1936 wrote to memory of 4680 1936 thhtnh.exe ddjvj.exe PID 1936 wrote to memory of 4680 1936 thhtnh.exe ddjvj.exe PID 4680 wrote to memory of 3224 4680 ddjvj.exe vpvjv.exe PID 4680 wrote to memory of 3224 4680 ddjvj.exe vpvjv.exe PID 4680 wrote to memory of 3224 4680 ddjvj.exe vpvjv.exe PID 3224 wrote to memory of 4912 3224 vpvjv.exe llffffl.exe PID 3224 wrote to memory of 4912 3224 vpvjv.exe llffffl.exe PID 3224 wrote to memory of 4912 3224 vpvjv.exe llffffl.exe PID 4912 wrote to memory of 624 4912 llffffl.exe tnthhn.exe PID 4912 wrote to memory of 624 4912 llffffl.exe tnthhn.exe PID 4912 wrote to memory of 624 4912 llffffl.exe tnthhn.exe PID 624 wrote to memory of 2900 624 tnthhn.exe djpjp.exe PID 624 wrote to memory of 2900 624 tnthhn.exe djpjp.exe PID 624 wrote to memory of 2900 624 tnthhn.exe djpjp.exe PID 2900 wrote to memory of 3156 2900 djpjp.exe 7lrlffx.exe PID 2900 wrote to memory of 3156 2900 djpjp.exe 7lrlffx.exe PID 2900 wrote to memory of 3156 2900 djpjp.exe 7lrlffx.exe PID 3156 wrote to memory of 3276 3156 7lrlffx.exe hhtnbb.exe PID 3156 wrote to memory of 3276 3156 7lrlffx.exe hhtnbb.exe PID 3156 wrote to memory of 3276 3156 7lrlffx.exe hhtnbb.exe PID 3276 wrote to memory of 456 3276 hhtnbb.exe hhbhnh.exe PID 3276 wrote to memory of 456 3276 hhtnbb.exe hhbhnh.exe PID 3276 wrote to memory of 456 3276 hhtnbb.exe hhbhnh.exe PID 456 wrote to memory of 2136 456 hhbhnh.exe pjddv.exe PID 456 wrote to memory of 2136 456 hhbhnh.exe pjddv.exe PID 456 wrote to memory of 2136 456 hhbhnh.exe pjddv.exe PID 2136 wrote to memory of 3148 2136 pjddv.exe xfllrrf.exe PID 2136 wrote to memory of 3148 2136 pjddv.exe xfllrrf.exe PID 2136 wrote to memory of 3148 2136 pjddv.exe xfllrrf.exe PID 3148 wrote to memory of 1164 3148 xfllrrf.exe 7xrrlll.exe PID 3148 wrote to memory of 1164 3148 xfllrrf.exe 7xrrlll.exe PID 3148 wrote to memory of 1164 3148 xfllrrf.exe 7xrrlll.exe PID 1164 wrote to memory of 3856 1164 7xrrlll.exe 5lrlfff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05e8e031d4f5fcf02c1c6a1f8f823d67271b3f36e3e091f147cd53c87ac015b1N.exe"C:\Users\Admin\AppData\Local\Temp\05e8e031d4f5fcf02c1c6a1f8f823d67271b3f36e3e091f147cd53c87ac015b1N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\bbthbt.exec:\bbthbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\3btbth.exec:\3btbth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\vpvpp.exec:\vpvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\xfxrlfx.exec:\xfxrlfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\vvjvp.exec:\vvjvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\dpvjd.exec:\dpvjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\ppvjv.exec:\ppvjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\nbnbbt.exec:\nbnbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\dppjd.exec:\dppjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\thhtnh.exec:\thhtnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\ddjvj.exec:\ddjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\vpvjv.exec:\vpvjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\llffffl.exec:\llffffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\tnthhn.exec:\tnthhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\djpjp.exec:\djpjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\7lrlffx.exec:\7lrlffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\hhtnbb.exec:\hhtnbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\hhbhnh.exec:\hhbhnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\pjddv.exec:\pjddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\xfllrrf.exec:\xfllrrf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\7xrrlll.exec:\7xrrlll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\hbbbbt.exec:\hbbbbt.exe23⤵
- Executes dropped EXE
PID:3856 -
\??\c:\vvdvp.exec:\vvdvp.exe24⤵
- Executes dropped EXE
PID:2904 -
\??\c:\1pvvp.exec:\1pvvp.exe25⤵
- Executes dropped EXE
PID:3312 -
\??\c:\fxfffff.exec:\fxfffff.exe26⤵
- Executes dropped EXE
PID:1348 -
\??\c:\tnbbtt.exec:\tnbbtt.exe27⤵
- Executes dropped EXE
PID:1448 -
\??\c:\hhbhbn.exec:\hhbhbn.exe28⤵
- Executes dropped EXE
PID:3512 -
\??\c:\jdpjj.exec:\jdpjj.exe29⤵
- Executes dropped EXE
PID:1108 -
\??\c:\jjdvp.exec:\jjdvp.exe30⤵
- Executes dropped EXE
PID:4996 -
\??\c:\1xlffff.exec:\1xlffff.exe31⤵
- Executes dropped EXE
PID:3864 -
\??\c:\ffxflrx.exec:\ffxflrx.exe32⤵
- Executes dropped EXE
PID:3068 -
\??\c:\nbnhbb.exec:\nbnhbb.exe33⤵
- Executes dropped EXE
PID:2112 -
\??\c:\pjjjd.exec:\pjjjd.exe34⤵
- Executes dropped EXE
PID:2568 -
\??\c:\9djjd.exec:\9djjd.exe35⤵
- Executes dropped EXE
PID:2416 -
\??\c:\rfrxxxx.exec:\rfrxxxx.exe36⤵
- Executes dropped EXE
PID:4652 -
\??\c:\9lrfflr.exec:\9lrfflr.exe37⤵
- Executes dropped EXE
PID:2000 -
\??\c:\hthnhn.exec:\hthnhn.exe38⤵
- Executes dropped EXE
PID:5092 -
\??\c:\jvdvp.exec:\jvdvp.exe39⤵
- Executes dropped EXE
PID:3092 -
\??\c:\vvvpj.exec:\vvvpj.exe40⤵
- Executes dropped EXE
PID:3784 -
\??\c:\1xfxffl.exec:\1xfxffl.exe41⤵
- Executes dropped EXE
PID:1972 -
\??\c:\lxxxrrl.exec:\lxxxrrl.exe42⤵
- Executes dropped EXE
PID:4704 -
\??\c:\nhnhbb.exec:\nhnhbb.exe43⤵
- Executes dropped EXE
PID:5116 -
\??\c:\nntntt.exec:\nntntt.exe44⤵
- Executes dropped EXE
PID:4360 -
\??\c:\ppvpd.exec:\ppvpd.exe45⤵
- Executes dropped EXE
PID:2820 -
\??\c:\dpdvp.exec:\dpdvp.exe46⤵
- Executes dropped EXE
PID:184 -
\??\c:\7frlxfx.exec:\7frlxfx.exe47⤵
- Executes dropped EXE
PID:1492 -
\??\c:\hhhhtt.exec:\hhhhtt.exe48⤵
- Executes dropped EXE
PID:4836 -
\??\c:\djjvv.exec:\djjvv.exe49⤵
- Executes dropped EXE
PID:916 -
\??\c:\jdppp.exec:\jdppp.exe50⤵
- Executes dropped EXE
PID:1416 -
\??\c:\lflfxrl.exec:\lflfxrl.exe51⤵
- Executes dropped EXE
PID:2084 -
\??\c:\nhtttt.exec:\nhtttt.exe52⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nbhbtt.exec:\nbhbtt.exe53⤵
- Executes dropped EXE
PID:3048 -
\??\c:\pdddv.exec:\pdddv.exe54⤵
- Executes dropped EXE
PID:264 -
\??\c:\jppvp.exec:\jppvp.exe55⤵
- Executes dropped EXE
PID:2616 -
\??\c:\3xlflfl.exec:\3xlflfl.exe56⤵
- Executes dropped EXE
PID:208 -
\??\c:\5lfxrxr.exec:\5lfxrxr.exe57⤵
- Executes dropped EXE
PID:228 -
\??\c:\hbhhhh.exec:\hbhhhh.exe58⤵
- Executes dropped EXE
PID:1820 -
\??\c:\dpdvp.exec:\dpdvp.exe59⤵
- Executes dropped EXE
PID:1808 -
\??\c:\jjvvv.exec:\jjvvv.exe60⤵
- Executes dropped EXE
PID:2848 -
\??\c:\fffxrrx.exec:\fffxrrx.exe61⤵
- Executes dropped EXE
PID:4380 -
\??\c:\5lxxrxr.exec:\5lxxrxr.exe62⤵
- Executes dropped EXE
PID:3948 -
\??\c:\ntbbbb.exec:\ntbbbb.exe63⤵
- Executes dropped EXE
PID:4472 -
\??\c:\jdjpj.exec:\jdjpj.exe64⤵
- Executes dropped EXE
PID:3936 -
\??\c:\jjvdd.exec:\jjvdd.exe65⤵
- Executes dropped EXE
PID:1272 -
\??\c:\rrffrrx.exec:\rrffrrx.exe66⤵PID:2368
-
\??\c:\xrffxxx.exec:\xrffxxx.exe67⤵PID:1296
-
\??\c:\btbbtt.exec:\btbbtt.exe68⤵PID:4280
-
\??\c:\vpvpj.exec:\vpvpj.exe69⤵PID:4832
-
\??\c:\dddvp.exec:\dddvp.exe70⤵PID:3240
-
\??\c:\9lrlffx.exec:\9lrlffx.exe71⤵PID:4332
-
\??\c:\5bhhbb.exec:\5bhhbb.exe72⤵PID:1116
-
\??\c:\3dppj.exec:\3dppj.exe73⤵PID:5056
-
\??\c:\djvpj.exec:\djvpj.exe74⤵PID:2992
-
\??\c:\5lrlfff.exec:\5lrlfff.exe75⤵PID:3856
-
\??\c:\nbbbbb.exec:\nbbbbb.exe76⤵PID:1572
-
\??\c:\7nttnn.exec:\7nttnn.exe77⤵PID:4536
-
\??\c:\ppjvj.exec:\ppjvj.exe78⤵PID:3556
-
\??\c:\hthhtt.exec:\hthhtt.exe79⤵PID:4372
-
\??\c:\nhtnht.exec:\nhtnht.exe80⤵PID:1464
-
\??\c:\pvvpj.exec:\pvvpj.exe81⤵PID:2652
-
\??\c:\rrrlfll.exec:\rrrlfll.exe82⤵PID:464
-
\??\c:\ddddv.exec:\ddddv.exe83⤵PID:2568
-
\??\c:\9xffrxr.exec:\9xffrxr.exe84⤵PID:2296
-
\??\c:\dpvpj.exec:\dpvpj.exe85⤵PID:3656
-
\??\c:\5xrlllf.exec:\5xrlllf.exe86⤵PID:3404
-
\??\c:\9bhhbn.exec:\9bhhbn.exe87⤵PID:3784
-
\??\c:\djdvv.exec:\djdvv.exe88⤵PID:64
-
\??\c:\3fxrfxl.exec:\3fxrfxl.exe89⤵
- System Location Discovery: System Language Discovery
PID:5008 -
\??\c:\tbtbhb.exec:\tbtbhb.exe90⤵PID:4452
-
\??\c:\3pvdp.exec:\3pvdp.exe91⤵PID:848
-
\??\c:\ffflrrx.exec:\ffflrrx.exe92⤵PID:4772
-
\??\c:\7jjvp.exec:\7jjvp.exe93⤵PID:5048
-
\??\c:\pjdvj.exec:\pjdvj.exe94⤵PID:4836
-
\??\c:\hnthtt.exec:\hnthtt.exe95⤵PID:1416
-
\??\c:\hhbnhb.exec:\hhbnhb.exe96⤵PID:3284
-
\??\c:\ttbhhh.exec:\ttbhhh.exe97⤵PID:2976
-
\??\c:\vpdvp.exec:\vpdvp.exe98⤵PID:2616
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe99⤵PID:2828
-
\??\c:\llfxllx.exec:\llfxllx.exe100⤵PID:3772
-
\??\c:\tnbbbb.exec:\tnbbbb.exe101⤵PID:4676
-
\??\c:\jjdpj.exec:\jjdpj.exe102⤵PID:628
-
\??\c:\xffxxrl.exec:\xffxxrl.exe103⤵PID:5072
-
\??\c:\nhbtnn.exec:\nhbtnn.exe104⤵PID:1808
-
\??\c:\nnhbtt.exec:\nnhbtt.exe105⤵PID:4924
-
\??\c:\jjddv.exec:\jjddv.exe106⤵PID:4540
-
\??\c:\rllxxrx.exec:\rllxxrx.exe107⤵PID:4896
-
\??\c:\rflffxx.exec:\rflffxx.exe108⤵PID:820
-
\??\c:\hhnntt.exec:\hhnntt.exe109⤵
- System Location Discovery: System Language Discovery
PID:4776 -
\??\c:\jpvdp.exec:\jpvdp.exe110⤵PID:2760
-
\??\c:\fxxrflf.exec:\fxxrflf.exe111⤵PID:4148
-
\??\c:\llrrllf.exec:\llrrllf.exe112⤵PID:4912
-
\??\c:\pvvvp.exec:\pvvvp.exe113⤵PID:4424
-
\??\c:\lflxxrr.exec:\lflxxrr.exe114⤵PID:2932
-
\??\c:\nbbtnn.exec:\nbbtnn.exe115⤵PID:1396
-
\??\c:\nbhtnh.exec:\nbhtnh.exe116⤵PID:2904
-
\??\c:\pdvvj.exec:\pdvvj.exe117⤵PID:3276
-
\??\c:\lxxrrxr.exec:\lxxrrxr.exe118⤵PID:456
-
\??\c:\btthnh.exec:\btthnh.exe119⤵PID:1772
-
\??\c:\tnhnnn.exec:\tnhnnn.exe120⤵PID:3904
-
\??\c:\jvddv.exec:\jvddv.exe121⤵PID:2144
-
\??\c:\lxxxfff.exec:\lxxxfff.exe122⤵PID:3472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-