Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2024 05:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b06a7a85b95f534b22b500c1900cfa0864917c82362e62948227805e02353cc9.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b06a7a85b95f534b22b500c1900cfa0864917c82362e62948227805e02353cc9.exe
-
Size
455KB
-
MD5
0c95c2876b8d21d73cf6062d2342d9e5
-
SHA1
e344def4d05e12d2317dbd2ff774aaeb5f0c9a41
-
SHA256
b06a7a85b95f534b22b500c1900cfa0864917c82362e62948227805e02353cc9
-
SHA512
4c74ad23edbfcad7604be15fac7c991ad06897d6074609258ce3e38dab57f838a6095792dbe0f5aab3f4ec946cd9e30ec6f4bbee7a6bae34aec7c6d1ddc9a1d7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRlv:q7Tc2NYHUrAwfMp3CDRl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3148-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1264-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2804-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1244-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1280-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1328-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3336-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-734-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-1668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-1804-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4032 frlfxrf.exe 4100 hbbtbt.exe 1180 llfrfxl.exe 3636 ppvpj.exe 1264 rxxrxfr.exe 3824 dvpdv.exe 2804 xfxffrl.exe 2152 htthth.exe 4856 htbttn.exe 1748 jjdpj.exe 1548 xflfrrx.exe 1608 xfxlfxr.exe 4916 tnhnhh.exe 4456 3dvjv.exe 4732 rlrfrlx.exe 4624 pjpjj.exe 1936 hhbnhb.exe 2552 frfrlff.exe 4960 btbnht.exe 4448 dpjdd.exe 3988 nnhhbt.exe 4292 pdpdd.exe 1244 lrxlfxr.exe 700 nhhhbt.exe 4756 3pdpp.exe 4680 frlxlfr.exe 4116 thhthb.exe 1772 fllfrrl.exe 4776 7bbtht.exe 3980 rfxrfxr.exe 3856 5lflxrr.exe 4296 vpdvv.exe 380 7xrfffr.exe 5068 hhbhbt.exe 4068 vppdp.exe 3128 5xfxxxr.exe 4504 hbnhth.exe 2540 thhthb.exe 3668 pvpdj.exe 432 9rxlllx.exe 1280 nhbthb.exe 3484 vjjdp.exe 4904 vpvpd.exe 3212 xrrrlll.exe 4100 thhthb.exe 2936 jdjdv.exe 3964 lflflff.exe 3340 nntntn.exe 3112 vddpj.exe 2040 lxfxfll.exe 1476 nttnbb.exe 4228 jpdpd.exe 3936 vjpjd.exe 2180 1xxrffx.exe 1540 thntbt.exe 3540 pvdvp.exe 3868 lxxlrll.exe 1020 lfxrfff.exe 556 tbthbn.exe 1468 djddj.exe 4916 lflxrlf.exe 3136 9hhtnh.exe 4396 nhhbbt.exe 5040 pjvpv.exe -
resource yara_rule behavioral2/memory/3148-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1264-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2804-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1244-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1280-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3336-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-606-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3148 wrote to memory of 4032 3148 b06a7a85b95f534b22b500c1900cfa0864917c82362e62948227805e02353cc9.exe 83 PID 3148 wrote to memory of 4032 3148 b06a7a85b95f534b22b500c1900cfa0864917c82362e62948227805e02353cc9.exe 83 PID 3148 wrote to memory of 4032 3148 b06a7a85b95f534b22b500c1900cfa0864917c82362e62948227805e02353cc9.exe 83 PID 4032 wrote to memory of 4100 4032 frlfxrf.exe 84 PID 4032 wrote to memory of 4100 4032 frlfxrf.exe 84 PID 4032 wrote to memory of 4100 4032 frlfxrf.exe 84 PID 4100 wrote to memory of 1180 4100 hbbtbt.exe 85 PID 4100 wrote to memory of 1180 4100 hbbtbt.exe 85 PID 4100 wrote to memory of 1180 4100 hbbtbt.exe 85 PID 1180 wrote to memory of 3636 1180 llfrfxl.exe 86 PID 1180 wrote to memory of 3636 1180 llfrfxl.exe 86 PID 1180 wrote to memory of 3636 1180 llfrfxl.exe 86 PID 3636 wrote to memory of 1264 3636 ppvpj.exe 87 PID 3636 wrote to memory of 1264 3636 ppvpj.exe 87 PID 3636 wrote to memory of 1264 3636 ppvpj.exe 87 PID 1264 wrote to memory of 3824 1264 rxxrxfr.exe 88 PID 1264 wrote to memory of 3824 1264 rxxrxfr.exe 88 PID 1264 wrote to memory of 3824 1264 rxxrxfr.exe 88 PID 3824 wrote to memory of 2804 3824 dvpdv.exe 89 PID 3824 wrote to memory of 2804 3824 dvpdv.exe 89 PID 3824 wrote to memory of 2804 3824 dvpdv.exe 89 PID 2804 wrote to memory of 2152 2804 xfxffrl.exe 90 PID 2804 wrote to memory of 2152 2804 xfxffrl.exe 90 PID 2804 wrote to memory of 2152 2804 xfxffrl.exe 90 PID 2152 wrote to memory of 4856 2152 htthth.exe 91 PID 2152 wrote to memory of 4856 2152 htthth.exe 91 PID 2152 wrote to memory of 4856 2152 htthth.exe 91 PID 4856 wrote to memory of 1748 4856 htbttn.exe 92 PID 4856 wrote to memory of 1748 4856 htbttn.exe 92 PID 4856 wrote to memory of 1748 4856 htbttn.exe 92 PID 1748 wrote to memory of 1548 1748 jjdpj.exe 93 PID 1748 wrote to memory of 1548 1748 jjdpj.exe 93 PID 1748 wrote to memory of 1548 1748 jjdpj.exe 93 PID 1548 wrote to memory of 1608 1548 xflfrrx.exe 94 PID 1548 wrote to memory of 1608 1548 xflfrrx.exe 94 PID 1548 wrote to memory of 1608 1548 xflfrrx.exe 94 PID 1608 wrote to memory of 4916 1608 xfxlfxr.exe 95 PID 1608 wrote to memory of 4916 1608 xfxlfxr.exe 95 PID 1608 wrote to memory of 4916 1608 xfxlfxr.exe 95 PID 4916 wrote to memory of 4456 4916 tnhnhh.exe 96 PID 4916 wrote to memory of 4456 4916 tnhnhh.exe 96 PID 4916 wrote to memory of 4456 4916 tnhnhh.exe 96 PID 4456 wrote to memory of 4732 4456 3dvjv.exe 97 PID 4456 wrote to memory of 4732 4456 3dvjv.exe 97 PID 4456 wrote to memory of 4732 4456 3dvjv.exe 97 PID 4732 wrote to memory of 4624 4732 rlrfrlx.exe 98 PID 4732 wrote to memory of 4624 4732 rlrfrlx.exe 98 PID 4732 wrote to memory of 4624 4732 rlrfrlx.exe 98 PID 4624 wrote to memory of 1936 4624 pjpjj.exe 99 PID 4624 wrote to memory of 1936 4624 pjpjj.exe 99 PID 4624 wrote to memory of 1936 4624 pjpjj.exe 99 PID 1936 wrote to memory of 2552 1936 hhbnhb.exe 100 PID 1936 wrote to memory of 2552 1936 hhbnhb.exe 100 PID 1936 wrote to memory of 2552 1936 hhbnhb.exe 100 PID 2552 wrote to memory of 4960 2552 frfrlff.exe 101 PID 2552 wrote to memory of 4960 2552 frfrlff.exe 101 PID 2552 wrote to memory of 4960 2552 frfrlff.exe 101 PID 4960 wrote to memory of 4448 4960 btbnht.exe 102 PID 4960 wrote to memory of 4448 4960 btbnht.exe 102 PID 4960 wrote to memory of 4448 4960 btbnht.exe 102 PID 4448 wrote to memory of 3988 4448 dpjdd.exe 103 PID 4448 wrote to memory of 3988 4448 dpjdd.exe 103 PID 4448 wrote to memory of 3988 4448 dpjdd.exe 103 PID 3988 wrote to memory of 4292 3988 nnhhbt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b06a7a85b95f534b22b500c1900cfa0864917c82362e62948227805e02353cc9.exe"C:\Users\Admin\AppData\Local\Temp\b06a7a85b95f534b22b500c1900cfa0864917c82362e62948227805e02353cc9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\frlfxrf.exec:\frlfxrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\hbbtbt.exec:\hbbtbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\llfrfxl.exec:\llfrfxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\ppvpj.exec:\ppvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\rxxrxfr.exec:\rxxrxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\dvpdv.exec:\dvpdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\xfxffrl.exec:\xfxffrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\htthth.exec:\htthth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\htbttn.exec:\htbttn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\jjdpj.exec:\jjdpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\xflfrrx.exec:\xflfrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\xfxlfxr.exec:\xfxlfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\tnhnhh.exec:\tnhnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\3dvjv.exec:\3dvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\rlrfrlx.exec:\rlrfrlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\pjpjj.exec:\pjpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\hhbnhb.exec:\hhbnhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\frfrlff.exec:\frfrlff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\btbnht.exec:\btbnht.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\dpjdd.exec:\dpjdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\nnhhbt.exec:\nnhhbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\pdpdd.exec:\pdpdd.exe23⤵
- Executes dropped EXE
PID:4292 -
\??\c:\lrxlfxr.exec:\lrxlfxr.exe24⤵
- Executes dropped EXE
PID:1244 -
\??\c:\nhhhbt.exec:\nhhhbt.exe25⤵
- Executes dropped EXE
PID:700 -
\??\c:\3pdpp.exec:\3pdpp.exe26⤵
- Executes dropped EXE
PID:4756 -
\??\c:\frlxlfr.exec:\frlxlfr.exe27⤵
- Executes dropped EXE
PID:4680 -
\??\c:\thhthb.exec:\thhthb.exe28⤵
- Executes dropped EXE
PID:4116 -
\??\c:\fllfrrl.exec:\fllfrrl.exe29⤵
- Executes dropped EXE
PID:1772 -
\??\c:\7bbtht.exec:\7bbtht.exe30⤵
- Executes dropped EXE
PID:4776 -
\??\c:\rfxrfxr.exec:\rfxrfxr.exe31⤵
- Executes dropped EXE
PID:3980 -
\??\c:\5lflxrr.exec:\5lflxrr.exe32⤵
- Executes dropped EXE
PID:3856 -
\??\c:\vpdvv.exec:\vpdvv.exe33⤵
- Executes dropped EXE
PID:4296 -
\??\c:\7xrfffr.exec:\7xrfffr.exe34⤵
- Executes dropped EXE
PID:380 -
\??\c:\hhbhbt.exec:\hhbhbt.exe35⤵
- Executes dropped EXE
PID:5068 -
\??\c:\vppdp.exec:\vppdp.exe36⤵
- Executes dropped EXE
PID:4068 -
\??\c:\5xfxxxr.exec:\5xfxxxr.exe37⤵
- Executes dropped EXE
PID:3128 -
\??\c:\hbnhth.exec:\hbnhth.exe38⤵
- Executes dropped EXE
PID:4504 -
\??\c:\thhthb.exec:\thhthb.exe39⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pvpdj.exec:\pvpdj.exe40⤵
- Executes dropped EXE
PID:3668 -
\??\c:\9rxlllx.exec:\9rxlllx.exe41⤵
- Executes dropped EXE
PID:432 -
\??\c:\nhbthb.exec:\nhbthb.exe42⤵
- Executes dropped EXE
PID:1280 -
\??\c:\vjjdp.exec:\vjjdp.exe43⤵
- Executes dropped EXE
PID:3484 -
\??\c:\vpvpd.exec:\vpvpd.exe44⤵
- Executes dropped EXE
PID:4904 -
\??\c:\xrrrlll.exec:\xrrrlll.exe45⤵
- Executes dropped EXE
PID:3212 -
\??\c:\thhthb.exec:\thhthb.exe46⤵
- Executes dropped EXE
PID:4100 -
\??\c:\jdjdv.exec:\jdjdv.exe47⤵
- Executes dropped EXE
PID:2936 -
\??\c:\lflflff.exec:\lflflff.exe48⤵
- Executes dropped EXE
PID:3964 -
\??\c:\nntntn.exec:\nntntn.exe49⤵
- Executes dropped EXE
PID:3340 -
\??\c:\vddpj.exec:\vddpj.exe50⤵
- Executes dropped EXE
PID:3112 -
\??\c:\lxfxfll.exec:\lxfxfll.exe51⤵
- Executes dropped EXE
PID:2040 -
\??\c:\nttnbb.exec:\nttnbb.exe52⤵
- Executes dropped EXE
PID:1476 -
\??\c:\jpdpd.exec:\jpdpd.exe53⤵
- Executes dropped EXE
PID:4228 -
\??\c:\vjpjd.exec:\vjpjd.exe54⤵
- Executes dropped EXE
PID:3936 -
\??\c:\1xxrffx.exec:\1xxrffx.exe55⤵
- Executes dropped EXE
PID:2180 -
\??\c:\thntbt.exec:\thntbt.exe56⤵
- Executes dropped EXE
PID:1540 -
\??\c:\pvdvp.exec:\pvdvp.exe57⤵
- Executes dropped EXE
PID:3540 -
\??\c:\lxxlrll.exec:\lxxlrll.exe58⤵
- Executes dropped EXE
PID:3868 -
\??\c:\lfxrfff.exec:\lfxrfff.exe59⤵
- Executes dropped EXE
PID:1020 -
\??\c:\tbthbn.exec:\tbthbn.exe60⤵
- Executes dropped EXE
PID:556 -
\??\c:\djddj.exec:\djddj.exe61⤵
- Executes dropped EXE
PID:1468 -
\??\c:\lflxrlf.exec:\lflxrlf.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4916 -
\??\c:\9hhtnh.exec:\9hhtnh.exe63⤵
- Executes dropped EXE
PID:3136 -
\??\c:\nhhbbt.exec:\nhhbbt.exe64⤵
- Executes dropped EXE
PID:4396 -
\??\c:\pjvpv.exec:\pjvpv.exe65⤵
- Executes dropped EXE
PID:5040 -
\??\c:\1fxrllf.exec:\1fxrllf.exe66⤵PID:4188
-
\??\c:\hnthnb.exec:\hnthnb.exe67⤵PID:5004
-
\??\c:\3nbnbt.exec:\3nbnbt.exe68⤵PID:4948
-
\??\c:\vpdvj.exec:\vpdvj.exe69⤵PID:3436
-
\??\c:\nbthbt.exec:\nbthbt.exe70⤵
- System Location Discovery: System Language Discovery
PID:3252 -
\??\c:\nthnth.exec:\nthnth.exe71⤵PID:2172
-
\??\c:\dpjdp.exec:\dpjdp.exe72⤵PID:3652
-
\??\c:\lfxrrll.exec:\lfxrrll.exe73⤵PID:4960
-
\??\c:\lfxrfxr.exec:\lfxrfxr.exe74⤵PID:3032
-
\??\c:\1nhtnh.exec:\1nhtnh.exe75⤵PID:2992
-
\??\c:\jvvpj.exec:\jvvpj.exe76⤵PID:1808
-
\??\c:\rlxlrlr.exec:\rlxlrlr.exe77⤵PID:4292
-
\??\c:\lflxxll.exec:\lflxxll.exe78⤵PID:3680
-
\??\c:\hbhbbb.exec:\hbhbbb.exe79⤵PID:1328
-
\??\c:\pdvjd.exec:\pdvjd.exe80⤵PID:5008
-
\??\c:\1flxrlx.exec:\1flxrlx.exe81⤵PID:3768
-
\??\c:\9ththb.exec:\9ththb.exe82⤵PID:4524
-
\??\c:\pjdvj.exec:\pjdvj.exe83⤵PID:4680
-
\??\c:\5llxfxx.exec:\5llxfxx.exe84⤵PID:4244
-
\??\c:\fxxxrlf.exec:\fxxxrlf.exe85⤵PID:4660
-
\??\c:\3bnbnb.exec:\3bnbnb.exe86⤵PID:848
-
\??\c:\dpjdp.exec:\dpjdp.exe87⤵PID:1984
-
\??\c:\rllfrxl.exec:\rllfrxl.exe88⤵PID:2480
-
\??\c:\llxrflx.exec:\llxrflx.exe89⤵PID:3336
-
\??\c:\3bthbh.exec:\3bthbh.exe90⤵PID:3856
-
\??\c:\jdjvp.exec:\jdjvp.exe91⤵PID:1084
-
\??\c:\frxlrff.exec:\frxlrff.exe92⤵PID:380
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe93⤵PID:632
-
\??\c:\nhnhbt.exec:\nhnhbt.exe94⤵PID:4084
-
\??\c:\vpvpv.exec:\vpvpv.exe95⤵PID:4060
-
\??\c:\xfxlffx.exec:\xfxlffx.exe96⤵PID:4928
-
\??\c:\hnnhtn.exec:\hnnhtn.exe97⤵PID:4164
-
\??\c:\pdpdp.exec:\pdpdp.exe98⤵PID:100
-
\??\c:\rffrfrl.exec:\rffrfrl.exe99⤵PID:4596
-
\??\c:\frxlxrl.exec:\frxlxrl.exe100⤵PID:5108
-
\??\c:\htntnb.exec:\htntnb.exe101⤵PID:3148
-
\??\c:\9vvjd.exec:\9vvjd.exe102⤵PID:3796
-
\??\c:\lffxrlf.exec:\lffxrlf.exe103⤵PID:1216
-
\??\c:\rfrlffx.exec:\rfrlffx.exe104⤵PID:4300
-
\??\c:\nbbbtt.exec:\nbbbtt.exe105⤵PID:1888
-
\??\c:\3dvpj.exec:\3dvpj.exe106⤵PID:2736
-
\??\c:\1flfrrf.exec:\1flfrrf.exe107⤵PID:212
-
\??\c:\9hnhhh.exec:\9hnhhh.exe108⤵PID:4896
-
\??\c:\1hnhtn.exec:\1hnhtn.exe109⤵PID:3824
-
\??\c:\dddpj.exec:\dddpj.exe110⤵PID:412
-
\??\c:\dvvjp.exec:\dvvjp.exe111⤵PID:3776
-
\??\c:\frxxxfl.exec:\frxxxfl.exe112⤵PID:4008
-
\??\c:\ttbtbt.exec:\ttbtbt.exe113⤵PID:4352
-
\??\c:\frxlfrl.exec:\frxlfrl.exe114⤵PID:3408
-
\??\c:\hnbbnn.exec:\hnbbnn.exe115⤵PID:1744
-
\??\c:\bnttnn.exec:\bnttnn.exe116⤵PID:2608
-
\??\c:\vppjp.exec:\vppjp.exe117⤵PID:4716
-
\??\c:\rffrxxl.exec:\rffrxxl.exe118⤵PID:1540
-
\??\c:\hbbhbt.exec:\hbbhbt.exe119⤵PID:2996
-
\??\c:\btthth.exec:\btthth.exe120⤵PID:3304
-
\??\c:\dpjvp.exec:\dpjvp.exe121⤵PID:2392
-
\??\c:\flrfrfr.exec:\flrfrfr.exe122⤵PID:556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-