Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 11:44
Behavioral task
behavioral1
Sample
e0be8170a3234c32bbceefcf5d6dce800b0c40bcaea87240ea7db8ab9d4dd7cd.exe
Resource
win7-20240903-en
General
-
Target
e0be8170a3234c32bbceefcf5d6dce800b0c40bcaea87240ea7db8ab9d4dd7cd.exe
-
Size
86KB
-
MD5
299858b8db7ae1ab751673b4953185ac
-
SHA1
8630935ba7c234df2fbd6c458e16e25973cd2ad7
-
SHA256
e0be8170a3234c32bbceefcf5d6dce800b0c40bcaea87240ea7db8ab9d4dd7cd
-
SHA512
d5fc972c2907dae8265aea95887d0747350a2f9367d6169043c8871aa671bf181e4aa3b2998a3b4ad7e311ac0961612c027df0a5cb1c9374dd3b5dfb8e3c4d8d
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8yaVskCzYBbKd+XsWgADSNVQfKPgqA22GU:9hOmTsF93UYfwC6GIoutyaVszyKd+XYg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
Processes:
resource yara_rule behavioral2/memory/3552-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1596-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2472-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2364-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1468-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2636-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2040-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1376-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/684-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2420-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3748-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/772-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3884-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3820-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4024-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4440-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/776-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2892-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1084-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2068-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2132-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1552-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2164-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4012-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/936-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3024-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4160-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4444-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2832-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2224-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-460-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3024-525-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4408-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-567-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-577-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2420-611-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1624-663-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/716-889-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-986-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1320-1041-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3344-1726-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hbhbbb.exebbnnnb.exe7bthnn.exew48204.exerfrlrlf.exehhbthb.exe246422.exetnhtht.exehnhthb.exe8686600.exe444868.exe86888.exetbbnbt.exefrlxrlf.exerfrlxrl.exebthbnn.exeffxlrrf.exe86248.exehnhhbt.exennbbnh.exellfxlrl.exe08264.exe08824.exe7dvpv.exexllffll.exe440426.exe022648.exehtbtnn.exe662808.exebbhbbb.exe426648.exe206600.exe5pppd.exe848620.exe2466404.exe244822.exe3lfxxrr.exe2060826.exenhthnn.exe9xxrxff.exehtttnh.exenbnbtn.exe680022.exe488822.exevjjdd.exetbtttt.exe6060042.exeg0608.exeu448042.exedjjjj.exem0002.exenbbtnh.exerxxxrrr.exe0488888.exetbthhh.exefxfxxxr.exenbnbnb.exepddvv.exetnbthn.exe424444.exeo222666.exerxlrxlx.exe6244882.exepjvvv.exepid process 1596 hbhbbb.exe 2472 bbnnnb.exe 4384 7bthnn.exe 2364 w48204.exe 1468 rfrlrlf.exe 4420 hhbthb.exe 2636 246422.exe 2040 tnhtht.exe 1376 hnhthb.exe 2520 8686600.exe 684 444868.exe 3404 86888.exe 2420 tbbnbt.exe 4920 frlxrlf.exe 3748 rfrlxrl.exe 4008 bthbnn.exe 772 ffxlrrf.exe 3400 86248.exe 1692 hnhhbt.exe 4528 nnbbnh.exe 3884 llfxlrl.exe 3820 08264.exe 3244 08824.exe 4024 7dvpv.exe 3408 xllffll.exe 1432 440426.exe 4136 022648.exe 4696 htbtnn.exe 3604 662808.exe 440 bbhbbb.exe 4440 426648.exe 776 206600.exe 4896 5pppd.exe 5104 848620.exe 4612 2466404.exe 4020 244822.exe 1560 3lfxxrr.exe 4340 2060826.exe 4804 nhthnn.exe 4600 9xxrxff.exe 1772 htttnh.exe 4444 nbnbtn.exe 4448 680022.exe 2892 488822.exe 3064 vjjdd.exe 3020 tbtttt.exe 1084 6060042.exe 2068 g0608.exe 2044 u448042.exe 1488 djjjj.exe 3696 m0002.exe 2132 nbbtnh.exe 2000 rxxxrrr.exe 2224 0488888.exe 4692 tbthhh.exe 4764 fxfxxxr.exe 100 nbnbnb.exe 3312 pddvv.exe 1552 tnbthn.exe 2164 424444.exe 380 o222666.exe 2036 rxlrxlx.exe 4180 6244882.exe 3644 pjvvv.exe -
Processes:
resource yara_rule behavioral2/memory/3552-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbhbbb.exe upx behavioral2/memory/3552-4-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbnnnb.exe upx behavioral2/memory/1596-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7bthnn.exe upx behavioral2/memory/2472-18-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\w48204.exe upx behavioral2/memory/2364-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4384-25-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rfrlrlf.exe upx C:\hhbthb.exe upx behavioral2/memory/1468-34-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\246422.exe upx behavioral2/memory/4420-41-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnhtht.exe upx behavioral2/memory/2636-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2040-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hnhthb.exe upx C:\8686600.exe upx behavioral2/memory/1376-58-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\444868.exe upx behavioral2/memory/2520-64-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\86888.exe upx behavioral2/memory/684-70-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbbnbt.exe upx behavioral2/memory/3404-76-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frlxrlf.exe upx behavioral2/memory/2420-84-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rfrlxrl.exe upx C:\bthbnn.exe upx behavioral2/memory/3748-90-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffxlrrf.exe upx behavioral2/memory/4008-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/772-105-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\86248.exe upx \??\c:\hnhhbt.exe upx behavioral2/memory/3400-110-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnbbnh.exe upx \??\c:\llfxlrl.exe upx behavioral2/memory/4528-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3884-122-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\08264.exe upx behavioral2/memory/3884-128-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\08824.exe upx behavioral2/memory/3820-136-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7dvpv.exe upx behavioral2/memory/3244-141-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xllffll.exe upx behavioral2/memory/4024-146-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\440426.exe upx C:\022648.exe upx C:\htbtnn.exe upx C:\662808.exe upx C:\bbhbbb.exe upx behavioral2/memory/3604-172-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\426648.exe upx behavioral2/memory/440-179-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\206600.exe upx behavioral2/memory/4440-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/776-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5104-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4896-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4612-199-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
dpvjd.exehnttth.exe444868.exe3jdjv.exe1lxrrfx.exe8848608.exe3dpdp.exejvddv.exe424488.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 444868.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8848608.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 424488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e0be8170a3234c32bbceefcf5d6dce800b0c40bcaea87240ea7db8ab9d4dd7cd.exehbhbbb.exebbnnnb.exe7bthnn.exew48204.exerfrlrlf.exehhbthb.exe246422.exetnhtht.exehnhthb.exe8686600.exe444868.exe86888.exetbbnbt.exefrlxrlf.exerfrlxrl.exebthbnn.exeffxlrrf.exe86248.exehnhhbt.exennbbnh.exellfxlrl.exedescription pid process target process PID 3552 wrote to memory of 1596 3552 e0be8170a3234c32bbceefcf5d6dce800b0c40bcaea87240ea7db8ab9d4dd7cd.exe hbhbbb.exe PID 3552 wrote to memory of 1596 3552 e0be8170a3234c32bbceefcf5d6dce800b0c40bcaea87240ea7db8ab9d4dd7cd.exe hbhbbb.exe PID 3552 wrote to memory of 1596 3552 e0be8170a3234c32bbceefcf5d6dce800b0c40bcaea87240ea7db8ab9d4dd7cd.exe hbhbbb.exe PID 1596 wrote to memory of 2472 1596 hbhbbb.exe bbnnnb.exe PID 1596 wrote to memory of 2472 1596 hbhbbb.exe bbnnnb.exe PID 1596 wrote to memory of 2472 1596 hbhbbb.exe bbnnnb.exe PID 2472 wrote to memory of 4384 2472 bbnnnb.exe 7bthnn.exe PID 2472 wrote to memory of 4384 2472 bbnnnb.exe 7bthnn.exe PID 2472 wrote to memory of 4384 2472 bbnnnb.exe 7bthnn.exe PID 4384 wrote to memory of 2364 4384 7bthnn.exe w48204.exe PID 4384 wrote to memory of 2364 4384 7bthnn.exe w48204.exe PID 4384 wrote to memory of 2364 4384 7bthnn.exe w48204.exe PID 2364 wrote to memory of 1468 2364 w48204.exe rfrlrlf.exe PID 2364 wrote to memory of 1468 2364 w48204.exe rfrlrlf.exe PID 2364 wrote to memory of 1468 2364 w48204.exe rfrlrlf.exe PID 1468 wrote to memory of 4420 1468 rfrlrlf.exe hhbthb.exe PID 1468 wrote to memory of 4420 1468 rfrlrlf.exe hhbthb.exe PID 1468 wrote to memory of 4420 1468 rfrlrlf.exe hhbthb.exe PID 4420 wrote to memory of 2636 4420 hhbthb.exe 246422.exe PID 4420 wrote to memory of 2636 4420 hhbthb.exe 246422.exe PID 4420 wrote to memory of 2636 4420 hhbthb.exe 246422.exe PID 2636 wrote to memory of 2040 2636 246422.exe tnhtht.exe PID 2636 wrote to memory of 2040 2636 246422.exe tnhtht.exe PID 2636 wrote to memory of 2040 2636 246422.exe tnhtht.exe PID 2040 wrote to memory of 1376 2040 tnhtht.exe hnhthb.exe PID 2040 wrote to memory of 1376 2040 tnhtht.exe hnhthb.exe PID 2040 wrote to memory of 1376 2040 tnhtht.exe hnhthb.exe PID 1376 wrote to memory of 2520 1376 hnhthb.exe 8686600.exe PID 1376 wrote to memory of 2520 1376 hnhthb.exe 8686600.exe PID 1376 wrote to memory of 2520 1376 hnhthb.exe 8686600.exe PID 2520 wrote to memory of 684 2520 8686600.exe 444868.exe PID 2520 wrote to memory of 684 2520 8686600.exe 444868.exe PID 2520 wrote to memory of 684 2520 8686600.exe 444868.exe PID 684 wrote to memory of 3404 684 444868.exe 86888.exe PID 684 wrote to memory of 3404 684 444868.exe 86888.exe PID 684 wrote to memory of 3404 684 444868.exe 86888.exe PID 3404 wrote to memory of 2420 3404 86888.exe tbbnbt.exe PID 3404 wrote to memory of 2420 3404 86888.exe tbbnbt.exe PID 3404 wrote to memory of 2420 3404 86888.exe tbbnbt.exe PID 2420 wrote to memory of 4920 2420 tbbnbt.exe frlxrlf.exe PID 2420 wrote to memory of 4920 2420 tbbnbt.exe frlxrlf.exe PID 2420 wrote to memory of 4920 2420 tbbnbt.exe frlxrlf.exe PID 4920 wrote to memory of 3748 4920 frlxrlf.exe rfrlxrl.exe PID 4920 wrote to memory of 3748 4920 frlxrlf.exe rfrlxrl.exe PID 4920 wrote to memory of 3748 4920 frlxrlf.exe rfrlxrl.exe PID 3748 wrote to memory of 4008 3748 rfrlxrl.exe bthbnn.exe PID 3748 wrote to memory of 4008 3748 rfrlxrl.exe bthbnn.exe PID 3748 wrote to memory of 4008 3748 rfrlxrl.exe bthbnn.exe PID 4008 wrote to memory of 772 4008 bthbnn.exe ffxlrrf.exe PID 4008 wrote to memory of 772 4008 bthbnn.exe ffxlrrf.exe PID 4008 wrote to memory of 772 4008 bthbnn.exe ffxlrrf.exe PID 772 wrote to memory of 3400 772 ffxlrrf.exe 86248.exe PID 772 wrote to memory of 3400 772 ffxlrrf.exe 86248.exe PID 772 wrote to memory of 3400 772 ffxlrrf.exe 86248.exe PID 3400 wrote to memory of 1692 3400 86248.exe hnhhbt.exe PID 3400 wrote to memory of 1692 3400 86248.exe hnhhbt.exe PID 3400 wrote to memory of 1692 3400 86248.exe hnhhbt.exe PID 1692 wrote to memory of 4528 1692 hnhhbt.exe nnbbnh.exe PID 1692 wrote to memory of 4528 1692 hnhhbt.exe nnbbnh.exe PID 1692 wrote to memory of 4528 1692 hnhhbt.exe nnbbnh.exe PID 4528 wrote to memory of 3884 4528 nnbbnh.exe llfxlrl.exe PID 4528 wrote to memory of 3884 4528 nnbbnh.exe llfxlrl.exe PID 4528 wrote to memory of 3884 4528 nnbbnh.exe llfxlrl.exe PID 3884 wrote to memory of 3820 3884 llfxlrl.exe 08264.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0be8170a3234c32bbceefcf5d6dce800b0c40bcaea87240ea7db8ab9d4dd7cd.exe"C:\Users\Admin\AppData\Local\Temp\e0be8170a3234c32bbceefcf5d6dce800b0c40bcaea87240ea7db8ab9d4dd7cd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\hbhbbb.exec:\hbhbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\bbnnnb.exec:\bbnnnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\7bthnn.exec:\7bthnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\w48204.exec:\w48204.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\rfrlrlf.exec:\rfrlrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\hhbthb.exec:\hhbthb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\246422.exec:\246422.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\tnhtht.exec:\tnhtht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\hnhthb.exec:\hnhthb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\8686600.exec:\8686600.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\444868.exec:\444868.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\86888.exec:\86888.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\tbbnbt.exec:\tbbnbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\frlxrlf.exec:\frlxrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\rfrlxrl.exec:\rfrlxrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\bthbnn.exec:\bthbnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\ffxlrrf.exec:\ffxlrrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\86248.exec:\86248.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\hnhhbt.exec:\hnhhbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\nnbbnh.exec:\nnbbnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\llfxlrl.exec:\llfxlrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\08264.exec:\08264.exe23⤵
- Executes dropped EXE
PID:3820 -
\??\c:\08824.exec:\08824.exe24⤵
- Executes dropped EXE
PID:3244 -
\??\c:\7dvpv.exec:\7dvpv.exe25⤵
- Executes dropped EXE
PID:4024 -
\??\c:\xllffll.exec:\xllffll.exe26⤵
- Executes dropped EXE
PID:3408 -
\??\c:\440426.exec:\440426.exe27⤵
- Executes dropped EXE
PID:1432 -
\??\c:\022648.exec:\022648.exe28⤵
- Executes dropped EXE
PID:4136 -
\??\c:\htbtnn.exec:\htbtnn.exe29⤵
- Executes dropped EXE
PID:4696 -
\??\c:\662808.exec:\662808.exe30⤵
- Executes dropped EXE
PID:3604 -
\??\c:\bbhbbb.exec:\bbhbbb.exe31⤵
- Executes dropped EXE
PID:440 -
\??\c:\426648.exec:\426648.exe32⤵
- Executes dropped EXE
PID:4440 -
\??\c:\206600.exec:\206600.exe33⤵
- Executes dropped EXE
PID:776 -
\??\c:\5pppd.exec:\5pppd.exe34⤵
- Executes dropped EXE
PID:4896 -
\??\c:\848620.exec:\848620.exe35⤵
- Executes dropped EXE
PID:5104 -
\??\c:\2466404.exec:\2466404.exe36⤵
- Executes dropped EXE
PID:4612 -
\??\c:\244822.exec:\244822.exe37⤵
- Executes dropped EXE
PID:4020 -
\??\c:\3lfxxrr.exec:\3lfxxrr.exe38⤵
- Executes dropped EXE
PID:1560 -
\??\c:\2060826.exec:\2060826.exe39⤵
- Executes dropped EXE
PID:4340 -
\??\c:\nhthnn.exec:\nhthnn.exe40⤵
- Executes dropped EXE
PID:4804 -
\??\c:\9xxrxff.exec:\9xxrxff.exe41⤵
- Executes dropped EXE
PID:4600 -
\??\c:\htttnh.exec:\htttnh.exe42⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nbnbtn.exec:\nbnbtn.exe43⤵
- Executes dropped EXE
PID:4444 -
\??\c:\680022.exec:\680022.exe44⤵
- Executes dropped EXE
PID:4448 -
\??\c:\488822.exec:\488822.exe45⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vjjdd.exec:\vjjdd.exe46⤵
- Executes dropped EXE
PID:3064 -
\??\c:\tbtttt.exec:\tbtttt.exe47⤵
- Executes dropped EXE
PID:3020 -
\??\c:\6060042.exec:\6060042.exe48⤵
- Executes dropped EXE
PID:1084 -
\??\c:\g0608.exec:\g0608.exe49⤵
- Executes dropped EXE
PID:2068 -
\??\c:\u448042.exec:\u448042.exe50⤵
- Executes dropped EXE
PID:2044 -
\??\c:\djjjj.exec:\djjjj.exe51⤵
- Executes dropped EXE
PID:1488 -
\??\c:\m0002.exec:\m0002.exe52⤵
- Executes dropped EXE
PID:3696 -
\??\c:\nbbtnh.exec:\nbbtnh.exe53⤵
- Executes dropped EXE
PID:2132 -
\??\c:\rxxxrrr.exec:\rxxxrrr.exe54⤵
- Executes dropped EXE
PID:2000 -
\??\c:\0488888.exec:\0488888.exe55⤵
- Executes dropped EXE
PID:2224 -
\??\c:\tbthhh.exec:\tbthhh.exe56⤵
- Executes dropped EXE
PID:4692 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe57⤵
- Executes dropped EXE
PID:4764 -
\??\c:\nbnbnb.exec:\nbnbnb.exe58⤵
- Executes dropped EXE
PID:100 -
\??\c:\pddvv.exec:\pddvv.exe59⤵
- Executes dropped EXE
PID:3312 -
\??\c:\tnbthn.exec:\tnbthn.exe60⤵
- Executes dropped EXE
PID:1552 -
\??\c:\424444.exec:\424444.exe61⤵
- Executes dropped EXE
PID:2164 -
\??\c:\o222666.exec:\o222666.exe62⤵
- Executes dropped EXE
PID:380 -
\??\c:\rxlrxlx.exec:\rxlrxlx.exe63⤵
- Executes dropped EXE
PID:2036 -
\??\c:\6244882.exec:\6244882.exe64⤵
- Executes dropped EXE
PID:4180 -
\??\c:\pjvvv.exec:\pjvvv.exe65⤵
- Executes dropped EXE
PID:3644 -
\??\c:\btbtbt.exec:\btbtbt.exe66⤵PID:3464
-
\??\c:\vppvv.exec:\vppvv.exe67⤵PID:4156
-
\??\c:\hbtnhh.exec:\hbtnhh.exe68⤵PID:3784
-
\??\c:\086224.exec:\086224.exe69⤵PID:4248
-
\??\c:\vpvpj.exec:\vpvpj.exe70⤵PID:4424
-
\??\c:\026026.exec:\026026.exe71⤵PID:1896
-
\??\c:\224488.exec:\224488.exe72⤵PID:932
-
\??\c:\26800.exec:\26800.exe73⤵PID:1116
-
\??\c:\vppjv.exec:\vppjv.exe74⤵PID:4012
-
\??\c:\s4086.exec:\s4086.exe75⤵PID:4656
-
\??\c:\jdvvj.exec:\jdvvj.exe76⤵PID:3256
-
\??\c:\0866268.exec:\0866268.exe77⤵PID:4540
-
\??\c:\26288.exec:\26288.exe78⤵PID:3408
-
\??\c:\86282.exec:\86282.exe79⤵PID:936
-
\??\c:\m8604.exec:\m8604.exe80⤵PID:1028
-
\??\c:\5thhnn.exec:\5thhnn.exe81⤵PID:5024
-
\??\c:\vpvpj.exec:\vpvpj.exe82⤵PID:2916
-
\??\c:\602604.exec:\602604.exe83⤵PID:1444
-
\??\c:\4840000.exec:\4840000.exe84⤵PID:2432
-
\??\c:\pjdjd.exec:\pjdjd.exe85⤵PID:3024
-
\??\c:\o482660.exec:\o482660.exe86⤵PID:4408
-
\??\c:\bbbttt.exec:\bbbttt.exe87⤵PID:3528
-
\??\c:\vpjdp.exec:\vpjdp.exe88⤵PID:4160
-
\??\c:\c066626.exec:\c066626.exe89⤵PID:3248
-
\??\c:\3ppjd.exec:\3ppjd.exe90⤵PID:2412
-
\??\c:\2222000.exec:\2222000.exe91⤵PID:2740
-
\??\c:\bntnhn.exec:\bntnhn.exe92⤵PID:1904
-
\??\c:\04004.exec:\04004.exe93⤵PID:3220
-
\??\c:\dvjdd.exec:\dvjdd.exe94⤵PID:3104
-
\??\c:\flxrllf.exec:\flxrllf.exe95⤵PID:4508
-
\??\c:\040266.exec:\040266.exe96⤵PID:4444
-
\??\c:\9hhnhn.exec:\9hhnhn.exe97⤵PID:3544
-
\??\c:\8062666.exec:\8062666.exe98⤵PID:2892
-
\??\c:\6622464.exec:\6622464.exe99⤵PID:2832
-
\??\c:\828822.exec:\828822.exe100⤵PID:1576
-
\??\c:\a2880.exec:\a2880.exe101⤵PID:2488
-
\??\c:\9dvpj.exec:\9dvpj.exe102⤵PID:4936
-
\??\c:\htttnn.exec:\htttnn.exe103⤵PID:3228
-
\??\c:\2028004.exec:\2028004.exe104⤵PID:2204
-
\??\c:\lffflrx.exec:\lffflrx.exe105⤵PID:1128
-
\??\c:\266600.exec:\266600.exe106⤵PID:1184
-
\??\c:\rflxxfl.exec:\rflxxfl.exe107⤵PID:3620
-
\??\c:\hhhnbt.exec:\hhhnbt.exe108⤵PID:2000
-
\??\c:\1rxrrrx.exec:\1rxrrrx.exe109⤵PID:2224
-
\??\c:\lflxffl.exec:\lflxffl.exe110⤵PID:1972
-
\??\c:\424400.exec:\424400.exe111⤵PID:3260
-
\??\c:\8866662.exec:\8866662.exe112⤵PID:4240
-
\??\c:\fflffrf.exec:\fflffrf.exe113⤵PID:2076
-
\??\c:\640488.exec:\640488.exe114⤵PID:4468
-
\??\c:\fxfffff.exec:\fxfffff.exe115⤵PID:2164
-
\??\c:\jvjjj.exec:\jvjjj.exe116⤵PID:2708
-
\??\c:\thhbtn.exec:\thhbtn.exe117⤵PID:3340
-
\??\c:\w28822.exec:\w28822.exe118⤵PID:3444
-
\??\c:\0428444.exec:\0428444.exe119⤵PID:4556
-
\??\c:\xlflffx.exec:\xlflffx.exe120⤵PID:4948
-
\??\c:\6022880.exec:\6022880.exe121⤵PID:5080
-
\??\c:\7thbnn.exec:\7thbnn.exe122⤵PID:220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-