Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 01:17
Static task
static1
Behavioral task
behavioral1
Sample
3729e8722f640f3c800590083c7a35a7473e62a1606436cb290edfbb9bbe737a.exe
Resource
win7-20240903-en
General
-
Target
3729e8722f640f3c800590083c7a35a7473e62a1606436cb290edfbb9bbe737a.exe
-
Size
416KB
-
MD5
da7c400b271ca2f43e7c34b4c5c04400
-
SHA1
48582fea0e6b6d56065cf6692e47191aed03c6cf
-
SHA256
3729e8722f640f3c800590083c7a35a7473e62a1606436cb290edfbb9bbe737a
-
SHA512
e83a5236d42388f3af9a776ea8fbe08a6132546241e750bf2179188fa646dba98a087979c0c5c45e3761f21361fd23c7d61b899e3fa5fc543a2faa995800d044
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFwD7arnDX+X5fFMyeU:8cm7ImGddXmNt251UriZFwfsDX+XtFN9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4036-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2916-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1120-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4248-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2812-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1420-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/832-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4208-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-720-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-727-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-760-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-807-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-890-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-987-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-1009-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 552 hnbbbn.exe 2076 rxfflxr.exe 4304 xrfxxfl.exe 2360 tbnhbh.exe 2708 llxxxff.exe 2916 hnbbbh.exe 1848 hnntnn.exe 4956 pjppp.exe 1592 dpppp.exe 3360 pppjd.exe 5056 frrlllf.exe 4760 tbhhbb.exe 4884 btnhtn.exe 2812 jjjjd.exe 3584 xrllxlf.exe 4576 hhnhtt.exe 2956 pvjpp.exe 1108 lfrrlfx.exe 3180 ntbhnn.exe 1464 vpvpp.exe 3408 flfflxl.exe 1644 bbtthh.exe 3172 vpjvd.exe 4248 xrfrxrr.exe 3564 thbnnn.exe 3440 jvvpp.exe 440 fffflrf.exe 4632 tttthn.exe 4664 jdvvv.exe 1292 rrxxxff.exe 3428 bntnhn.exe 3280 jpdjp.exe 844 rxxxxxx.exe 1120 ntnthn.exe 2868 fllllrr.exe 4796 nhnnnn.exe 1212 pjppd.exe 2872 hnhtbt.exe 2968 hbtntt.exe 3952 vjdjv.exe 1460 lfflrrr.exe 3568 httnnn.exe 3960 ddvpp.exe 344 xrllffr.exe 4964 nnhhhh.exe 4272 jvdjd.exe 1956 xxrlrfl.exe 1420 djjpd.exe 464 rrrrrll.exe 3968 tbhtth.exe 3608 lrfxfff.exe 3944 tnbtbt.exe 3804 nhbhhb.exe 4500 lxxllxx.exe 5068 nbthbt.exe 1160 vdvdj.exe 1860 lrxxflr.exe 3948 bbbthh.exe 4808 vdjjj.exe 1208 lrlrrxf.exe 4032 rfflrfl.exe 2360 vjvpj.exe 832 3dpjp.exe 2132 tbnbbn.exe -
resource yara_rule behavioral2/memory/4036-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1108-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/832-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4208-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-760-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-807-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4036 wrote to memory of 552 4036 3729e8722f640f3c800590083c7a35a7473e62a1606436cb290edfbb9bbe737a.exe 83 PID 4036 wrote to memory of 552 4036 3729e8722f640f3c800590083c7a35a7473e62a1606436cb290edfbb9bbe737a.exe 83 PID 4036 wrote to memory of 552 4036 3729e8722f640f3c800590083c7a35a7473e62a1606436cb290edfbb9bbe737a.exe 83 PID 552 wrote to memory of 2076 552 hnbbbn.exe 84 PID 552 wrote to memory of 2076 552 hnbbbn.exe 84 PID 552 wrote to memory of 2076 552 hnbbbn.exe 84 PID 2076 wrote to memory of 4304 2076 rxfflxr.exe 85 PID 2076 wrote to memory of 4304 2076 rxfflxr.exe 85 PID 2076 wrote to memory of 4304 2076 rxfflxr.exe 85 PID 4304 wrote to memory of 2360 4304 xrfxxfl.exe 86 PID 4304 wrote to memory of 2360 4304 xrfxxfl.exe 86 PID 4304 wrote to memory of 2360 4304 xrfxxfl.exe 86 PID 2360 wrote to memory of 2708 2360 tbnhbh.exe 87 PID 2360 wrote to memory of 2708 2360 tbnhbh.exe 87 PID 2360 wrote to memory of 2708 2360 tbnhbh.exe 87 PID 2708 wrote to memory of 2916 2708 llxxxff.exe 88 PID 2708 wrote to memory of 2916 2708 llxxxff.exe 88 PID 2708 wrote to memory of 2916 2708 llxxxff.exe 88 PID 2916 wrote to memory of 1848 2916 hnbbbh.exe 89 PID 2916 wrote to memory of 1848 2916 hnbbbh.exe 89 PID 2916 wrote to memory of 1848 2916 hnbbbh.exe 89 PID 1848 wrote to memory of 4956 1848 hnntnn.exe 90 PID 1848 wrote to memory of 4956 1848 hnntnn.exe 90 PID 1848 wrote to memory of 4956 1848 hnntnn.exe 90 PID 4956 wrote to memory of 1592 4956 pjppp.exe 91 PID 4956 wrote to memory of 1592 4956 pjppp.exe 91 PID 4956 wrote to memory of 1592 4956 pjppp.exe 91 PID 1592 wrote to memory of 3360 1592 dpppp.exe 92 PID 1592 wrote to memory of 3360 1592 dpppp.exe 92 PID 1592 wrote to memory of 3360 1592 dpppp.exe 92 PID 3360 wrote to memory of 5056 3360 pppjd.exe 93 PID 3360 wrote to memory of 5056 3360 pppjd.exe 93 PID 3360 wrote to memory of 5056 3360 pppjd.exe 93 PID 5056 wrote to memory of 4760 5056 frrlllf.exe 94 PID 5056 wrote to memory of 4760 5056 frrlllf.exe 94 PID 5056 wrote to memory of 4760 5056 frrlllf.exe 94 PID 4760 wrote to memory of 4884 4760 tbhhbb.exe 95 PID 4760 wrote to memory of 4884 4760 tbhhbb.exe 95 PID 4760 wrote to memory of 4884 4760 tbhhbb.exe 95 PID 4884 wrote to memory of 2812 4884 btnhtn.exe 96 PID 4884 wrote to memory of 2812 4884 btnhtn.exe 96 PID 4884 wrote to memory of 2812 4884 btnhtn.exe 96 PID 2812 wrote to memory of 3584 2812 jjjjd.exe 97 PID 2812 wrote to memory of 3584 2812 jjjjd.exe 97 PID 2812 wrote to memory of 3584 2812 jjjjd.exe 97 PID 3584 wrote to memory of 4576 3584 xrllxlf.exe 98 PID 3584 wrote to memory of 4576 3584 xrllxlf.exe 98 PID 3584 wrote to memory of 4576 3584 xrllxlf.exe 98 PID 4576 wrote to memory of 2956 4576 hhnhtt.exe 99 PID 4576 wrote to memory of 2956 4576 hhnhtt.exe 99 PID 4576 wrote to memory of 2956 4576 hhnhtt.exe 99 PID 2956 wrote to memory of 1108 2956 pvjpp.exe 100 PID 2956 wrote to memory of 1108 2956 pvjpp.exe 100 PID 2956 wrote to memory of 1108 2956 pvjpp.exe 100 PID 1108 wrote to memory of 3180 1108 lfrrlfx.exe 101 PID 1108 wrote to memory of 3180 1108 lfrrlfx.exe 101 PID 1108 wrote to memory of 3180 1108 lfrrlfx.exe 101 PID 3180 wrote to memory of 1464 3180 ntbhnn.exe 102 PID 3180 wrote to memory of 1464 3180 ntbhnn.exe 102 PID 3180 wrote to memory of 1464 3180 ntbhnn.exe 102 PID 1464 wrote to memory of 3408 1464 vpvpp.exe 103 PID 1464 wrote to memory of 3408 1464 vpvpp.exe 103 PID 1464 wrote to memory of 3408 1464 vpvpp.exe 103 PID 3408 wrote to memory of 1644 3408 flfflxl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\3729e8722f640f3c800590083c7a35a7473e62a1606436cb290edfbb9bbe737a.exe"C:\Users\Admin\AppData\Local\Temp\3729e8722f640f3c800590083c7a35a7473e62a1606436cb290edfbb9bbe737a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\hnbbbn.exec:\hnbbbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\rxfflxr.exec:\rxfflxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\xrfxxfl.exec:\xrfxxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\tbnhbh.exec:\tbnhbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\llxxxff.exec:\llxxxff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\hnbbbh.exec:\hnbbbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\hnntnn.exec:\hnntnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\pjppp.exec:\pjppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\dpppp.exec:\dpppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\pppjd.exec:\pppjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\frrlllf.exec:\frrlllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\tbhhbb.exec:\tbhhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\btnhtn.exec:\btnhtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\jjjjd.exec:\jjjjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\xrllxlf.exec:\xrllxlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\hhnhtt.exec:\hhnhtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\pvjpp.exec:\pvjpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\lfrrlfx.exec:\lfrrlfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\ntbhnn.exec:\ntbhnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\vpvpp.exec:\vpvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\flfflxl.exec:\flfflxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\bbtthh.exec:\bbtthh.exe23⤵
- Executes dropped EXE
PID:1644 -
\??\c:\vpjvd.exec:\vpjvd.exe24⤵
- Executes dropped EXE
PID:3172 -
\??\c:\xrfrxrr.exec:\xrfrxrr.exe25⤵
- Executes dropped EXE
PID:4248 -
\??\c:\thbnnn.exec:\thbnnn.exe26⤵
- Executes dropped EXE
PID:3564 -
\??\c:\jvvpp.exec:\jvvpp.exe27⤵
- Executes dropped EXE
PID:3440 -
\??\c:\fffflrf.exec:\fffflrf.exe28⤵
- Executes dropped EXE
PID:440 -
\??\c:\tttthn.exec:\tttthn.exe29⤵
- Executes dropped EXE
PID:4632 -
\??\c:\jdvvv.exec:\jdvvv.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4664 -
\??\c:\rrxxxff.exec:\rrxxxff.exe31⤵
- Executes dropped EXE
PID:1292 -
\??\c:\bntnhn.exec:\bntnhn.exe32⤵
- Executes dropped EXE
PID:3428 -
\??\c:\jpdjp.exec:\jpdjp.exe33⤵
- Executes dropped EXE
PID:3280 -
\??\c:\rxxxxxx.exec:\rxxxxxx.exe34⤵
- Executes dropped EXE
PID:844 -
\??\c:\ntnthn.exec:\ntnthn.exe35⤵
- Executes dropped EXE
PID:1120 -
\??\c:\fllllrr.exec:\fllllrr.exe36⤵
- Executes dropped EXE
PID:2868 -
\??\c:\nhnnnn.exec:\nhnnnn.exe37⤵
- Executes dropped EXE
PID:4796 -
\??\c:\pjppd.exec:\pjppd.exe38⤵
- Executes dropped EXE
PID:1212 -
\??\c:\hnhtbt.exec:\hnhtbt.exe39⤵
- Executes dropped EXE
PID:2872 -
\??\c:\hbtntt.exec:\hbtntt.exe40⤵
- Executes dropped EXE
PID:2968 -
\??\c:\vjdjv.exec:\vjdjv.exe41⤵
- Executes dropped EXE
PID:3952 -
\??\c:\lfflrrr.exec:\lfflrrr.exe42⤵
- Executes dropped EXE
PID:1460 -
\??\c:\httnnn.exec:\httnnn.exe43⤵
- Executes dropped EXE
PID:3568 -
\??\c:\ddvpp.exec:\ddvpp.exe44⤵
- Executes dropped EXE
PID:3960 -
\??\c:\xrllffr.exec:\xrllffr.exe45⤵
- Executes dropped EXE
PID:344 -
\??\c:\nnhhhh.exec:\nnhhhh.exe46⤵
- Executes dropped EXE
PID:4964 -
\??\c:\jvdjd.exec:\jvdjd.exe47⤵
- Executes dropped EXE
PID:4272 -
\??\c:\xxrlrfl.exec:\xxrlrfl.exe48⤵
- Executes dropped EXE
PID:1956 -
\??\c:\djjpd.exec:\djjpd.exe49⤵
- Executes dropped EXE
PID:1420 -
\??\c:\rrrrrll.exec:\rrrrrll.exe50⤵
- Executes dropped EXE
PID:464 -
\??\c:\tbhtth.exec:\tbhtth.exe51⤵
- Executes dropped EXE
PID:3968 -
\??\c:\lrfxfff.exec:\lrfxfff.exe52⤵
- Executes dropped EXE
PID:3608 -
\??\c:\tnbtbt.exec:\tnbtbt.exe53⤵
- Executes dropped EXE
PID:3944 -
\??\c:\nhbhhb.exec:\nhbhhb.exe54⤵
- Executes dropped EXE
PID:3804 -
\??\c:\lxxllxx.exec:\lxxllxx.exe55⤵
- Executes dropped EXE
PID:4500 -
\??\c:\nbthbt.exec:\nbthbt.exe56⤵
- Executes dropped EXE
PID:5068 -
\??\c:\vdvdj.exec:\vdvdj.exe57⤵
- Executes dropped EXE
PID:1160 -
\??\c:\lrxxflr.exec:\lrxxflr.exe58⤵
- Executes dropped EXE
PID:1860 -
\??\c:\bbbthh.exec:\bbbthh.exe59⤵
- Executes dropped EXE
PID:3948 -
\??\c:\vdjjj.exec:\vdjjj.exe60⤵
- Executes dropped EXE
PID:4808 -
\??\c:\lrlrrxf.exec:\lrlrrxf.exe61⤵
- Executes dropped EXE
PID:1208 -
\??\c:\rfflrfl.exec:\rfflrfl.exe62⤵
- Executes dropped EXE
PID:4032 -
\??\c:\vjvpj.exec:\vjvpj.exe63⤵
- Executes dropped EXE
PID:2360 -
\??\c:\3dpjp.exec:\3dpjp.exe64⤵
- Executes dropped EXE
PID:832 -
\??\c:\tbnbbn.exec:\tbnbbn.exe65⤵
- Executes dropped EXE
PID:2132 -
\??\c:\jvpdp.exec:\jvpdp.exe66⤵PID:2744
-
\??\c:\rxlrfxx.exec:\rxlrfxx.exe67⤵PID:232
-
\??\c:\7thbbh.exec:\7thbbh.exe68⤵PID:2036
-
\??\c:\pvppp.exec:\pvppp.exe69⤵PID:2288
-
\??\c:\rrlllrf.exec:\rrlllrf.exe70⤵PID:3652
-
\??\c:\jjppp.exec:\jjppp.exe71⤵PID:4208
-
\??\c:\dpdjv.exec:\dpdjv.exe72⤵PID:3576
-
\??\c:\nbbbbh.exec:\nbbbbh.exe73⤵PID:4224
-
\??\c:\djddv.exec:\djddv.exe74⤵PID:2820
-
\??\c:\xfrxlxx.exec:\xfrxlxx.exe75⤵PID:224
-
\??\c:\hnnhtt.exec:\hnnhtt.exe76⤵PID:2812
-
\??\c:\pvvdj.exec:\pvvdj.exe77⤵PID:3584
-
\??\c:\tthhnb.exec:\tthhnb.exe78⤵PID:776
-
\??\c:\ppvvj.exec:\ppvvj.exe79⤵PID:4324
-
\??\c:\lfflxll.exec:\lfflxll.exe80⤵PID:3520
-
\??\c:\bnbhhn.exec:\bnbhhn.exe81⤵PID:3516
-
\??\c:\dpdvd.exec:\dpdvd.exe82⤵PID:2828
-
\??\c:\bbbbbb.exec:\bbbbbb.exe83⤵PID:3408
-
\??\c:\bttnnt.exec:\bttnnt.exe84⤵PID:2632
-
\??\c:\hbbbnb.exec:\hbbbnb.exe85⤵PID:2128
-
\??\c:\pjjjj.exec:\pjjjj.exe86⤵PID:4000
-
\??\c:\rrfxlrr.exec:\rrfxlrr.exe87⤵PID:4360
-
\??\c:\hnhhnn.exec:\hnhhnn.exe88⤵PID:2816
-
\??\c:\jdpjp.exec:\jdpjp.exe89⤵PID:3172
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe90⤵PID:4976
-
\??\c:\btbbhh.exec:\btbbhh.exe91⤵PID:396
-
\??\c:\pjdvd.exec:\pjdvd.exe92⤵PID:2108
-
\??\c:\9ffffll.exec:\9ffffll.exe93⤵PID:1892
-
\??\c:\1nhbbb.exec:\1nhbbb.exe94⤵PID:4600
-
\??\c:\vvddd.exec:\vvddd.exe95⤵PID:844
-
\??\c:\lrrffff.exec:\lrrffff.exe96⤵PID:2016
-
\??\c:\nbttnt.exec:\nbttnt.exe97⤵PID:1912
-
\??\c:\jpjjj.exec:\jpjjj.exe98⤵PID:1440
-
\??\c:\rfxllxf.exec:\rfxllxf.exe99⤵PID:4824
-
\??\c:\rxlllxr.exec:\rxlllxr.exe100⤵PID:4060
-
\??\c:\tbhnnt.exec:\tbhnnt.exe101⤵PID:3916
-
\??\c:\pdjvd.exec:\pdjvd.exe102⤵PID:3012
-
\??\c:\bthhhn.exec:\bthhhn.exe103⤵PID:3464
-
\??\c:\frxxxff.exec:\frxxxff.exe104⤵PID:4772
-
\??\c:\vvdpj.exec:\vvdpj.exe105⤵PID:4972
-
\??\c:\hthhnt.exec:\hthhnt.exe106⤵PID:3052
-
\??\c:\jdppd.exec:\jdppd.exe107⤵
- System Location Discovery: System Language Discovery
PID:344 -
\??\c:\bhnbtb.exec:\bhnbtb.exe108⤵PID:3960
-
\??\c:\jpddd.exec:\jpddd.exe109⤵PID:3940
-
\??\c:\btbbhn.exec:\btbbhn.exe110⤵PID:672
-
\??\c:\xrfxxff.exec:\xrfxxff.exe111⤵PID:4580
-
\??\c:\vvvjj.exec:\vvvjj.exe112⤵PID:2032
-
\??\c:\rrfffff.exec:\rrfffff.exe113⤵PID:2848
-
\??\c:\nhbtbb.exec:\nhbtbb.exe114⤵PID:1232
-
\??\c:\vdjpp.exec:\vdjpp.exe115⤵PID:3928
-
\??\c:\jjppp.exec:\jjppp.exe116⤵
- System Location Discovery: System Language Discovery
PID:3412 -
\??\c:\fxlrfxl.exec:\fxlrfxl.exe117⤵PID:2344
-
\??\c:\nttbbn.exec:\nttbbn.exe118⤵PID:4332
-
\??\c:\vjvvj.exec:\vjvvj.exe119⤵PID:4036
-
\??\c:\llxxffx.exec:\llxxffx.exe120⤵
- System Location Discovery: System Language Discovery
PID:2492 -
\??\c:\bbntht.exec:\bbntht.exe121⤵PID:4052
-
\??\c:\lrrrrxx.exec:\lrrrrxx.exe122⤵PID:1928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-