Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 02:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
952be498c6e00ae4ea4d0d2d260cb8a06f14d448224d997eeb106eaa1dfd399c.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
952be498c6e00ae4ea4d0d2d260cb8a06f14d448224d997eeb106eaa1dfd399c.exe
-
Size
454KB
-
MD5
1ad5dd99e789dedb7d04392d0409afdd
-
SHA1
762fd9014082bc0b5cf2d24bcb87806be5b26f9b
-
SHA256
952be498c6e00ae4ea4d0d2d260cb8a06f14d448224d997eeb106eaa1dfd399c
-
SHA512
0d8c5d9ce5e2e1580f574d34b1c073dc2680ac823e61e230f78af96b2dcf6a91a3fd769c66cd5e390eaa6eb4b3da73fcb55813eb2d0e52f636b462f2c26c9d25
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe4:q7Tc2NYHUrAwfMp3CD4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/1828-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/652-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3792-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/652-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2072-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2560-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/616-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1904-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2092-629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-945-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4628-1018-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3792-1425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-1733-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2548 c800664.exe 876 btnbtn.exe 1940 htbnbh.exe 4676 thbnbb.exe 4788 frxllff.exe 2164 thbnbt.exe 4548 jjpdp.exe 3976 c046282.exe 5052 002444.exe 624 66206.exe 3216 7lllfff.exe 4808 jpvpp.exe 5000 86608.exe 4388 a0420.exe 3240 frlxlxr.exe 652 6622086.exe 1176 jvvjv.exe 2960 ddjjv.exe 4464 htbbtn.exe 2344 vpjpv.exe 536 jvvpp.exe 2312 22442.exe 1056 1hbnhb.exe 2440 400482.exe 4592 26882.exe 4336 64804.exe 2508 0826048.exe 4984 c848642.exe 5092 xlxrlfr.exe 4616 804242.exe 3032 rxxrxrl.exe 1164 3ttthh.exe 3676 840644.exe 4564 ddjdv.exe 3488 8802068.exe 3060 bttbbh.exe 2860 246666.exe 4088 xrrllrr.exe 2124 dvddj.exe 4552 0682604.exe 5036 22466.exe 4732 jddvp.exe 4380 088260.exe 4492 hbtnhh.exe 4220 nhbtbb.exe 4424 08000.exe 4216 3bbtnn.exe 3516 vdvvp.exe 3524 8084882.exe 4696 22220.exe 4360 22826.exe 4200 8600482.exe 4236 lxffxrl.exe 1912 862048.exe 4820 60626.exe 4704 xlllfff.exe 4800 nntthb.exe 2164 ntnnhb.exe 316 dvpjp.exe 3180 httnbt.exe 3792 9bnhhh.exe 2416 rlrlffx.exe 2084 jvdpv.exe 5116 pjdvp.exe -
resource yara_rule behavioral2/memory/1828-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/652-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/652-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1164-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3792-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/652-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2072-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2560-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/616-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1904-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1444-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2092-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-904-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-945-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4628-1018-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82268.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66086.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 440822.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o468226.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2288260.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02848.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1828 wrote to memory of 2548 1828 952be498c6e00ae4ea4d0d2d260cb8a06f14d448224d997eeb106eaa1dfd399c.exe 84 PID 1828 wrote to memory of 2548 1828 952be498c6e00ae4ea4d0d2d260cb8a06f14d448224d997eeb106eaa1dfd399c.exe 84 PID 1828 wrote to memory of 2548 1828 952be498c6e00ae4ea4d0d2d260cb8a06f14d448224d997eeb106eaa1dfd399c.exe 84 PID 2548 wrote to memory of 876 2548 c800664.exe 85 PID 2548 wrote to memory of 876 2548 c800664.exe 85 PID 2548 wrote to memory of 876 2548 c800664.exe 85 PID 876 wrote to memory of 1940 876 btnbtn.exe 86 PID 876 wrote to memory of 1940 876 btnbtn.exe 86 PID 876 wrote to memory of 1940 876 btnbtn.exe 86 PID 1940 wrote to memory of 4676 1940 htbnbh.exe 87 PID 1940 wrote to memory of 4676 1940 htbnbh.exe 87 PID 1940 wrote to memory of 4676 1940 htbnbh.exe 87 PID 4676 wrote to memory of 4788 4676 thbnbb.exe 88 PID 4676 wrote to memory of 4788 4676 thbnbb.exe 88 PID 4676 wrote to memory of 4788 4676 thbnbb.exe 88 PID 4788 wrote to memory of 2164 4788 frxllff.exe 89 PID 4788 wrote to memory of 2164 4788 frxllff.exe 89 PID 4788 wrote to memory of 2164 4788 frxllff.exe 89 PID 2164 wrote to memory of 4548 2164 thbnbt.exe 90 PID 2164 wrote to memory of 4548 2164 thbnbt.exe 90 PID 2164 wrote to memory of 4548 2164 thbnbt.exe 90 PID 4548 wrote to memory of 3976 4548 jjpdp.exe 91 PID 4548 wrote to memory of 3976 4548 jjpdp.exe 91 PID 4548 wrote to memory of 3976 4548 jjpdp.exe 91 PID 3976 wrote to memory of 5052 3976 c046282.exe 92 PID 3976 wrote to memory of 5052 3976 c046282.exe 92 PID 3976 wrote to memory of 5052 3976 c046282.exe 92 PID 5052 wrote to memory of 624 5052 002444.exe 93 PID 5052 wrote to memory of 624 5052 002444.exe 93 PID 5052 wrote to memory of 624 5052 002444.exe 93 PID 624 wrote to memory of 3216 624 66206.exe 94 PID 624 wrote to memory of 3216 624 66206.exe 94 PID 624 wrote to memory of 3216 624 66206.exe 94 PID 3216 wrote to memory of 4808 3216 7lllfff.exe 95 PID 3216 wrote to memory of 4808 3216 7lllfff.exe 95 PID 3216 wrote to memory of 4808 3216 7lllfff.exe 95 PID 4808 wrote to memory of 5000 4808 jpvpp.exe 96 PID 4808 wrote to memory of 5000 4808 jpvpp.exe 96 PID 4808 wrote to memory of 5000 4808 jpvpp.exe 96 PID 5000 wrote to memory of 4388 5000 86608.exe 97 PID 5000 wrote to memory of 4388 5000 86608.exe 97 PID 5000 wrote to memory of 4388 5000 86608.exe 97 PID 4388 wrote to memory of 3240 4388 a0420.exe 98 PID 4388 wrote to memory of 3240 4388 a0420.exe 98 PID 4388 wrote to memory of 3240 4388 a0420.exe 98 PID 3240 wrote to memory of 652 3240 frlxlxr.exe 99 PID 3240 wrote to memory of 652 3240 frlxlxr.exe 99 PID 3240 wrote to memory of 652 3240 frlxlxr.exe 99 PID 652 wrote to memory of 1176 652 6622086.exe 100 PID 652 wrote to memory of 1176 652 6622086.exe 100 PID 652 wrote to memory of 1176 652 6622086.exe 100 PID 1176 wrote to memory of 2960 1176 jvvjv.exe 101 PID 1176 wrote to memory of 2960 1176 jvvjv.exe 101 PID 1176 wrote to memory of 2960 1176 jvvjv.exe 101 PID 2960 wrote to memory of 4464 2960 ddjjv.exe 102 PID 2960 wrote to memory of 4464 2960 ddjjv.exe 102 PID 2960 wrote to memory of 4464 2960 ddjjv.exe 102 PID 4464 wrote to memory of 2344 4464 htbbtn.exe 103 PID 4464 wrote to memory of 2344 4464 htbbtn.exe 103 PID 4464 wrote to memory of 2344 4464 htbbtn.exe 103 PID 2344 wrote to memory of 536 2344 vpjpv.exe 104 PID 2344 wrote to memory of 536 2344 vpjpv.exe 104 PID 2344 wrote to memory of 536 2344 vpjpv.exe 104 PID 536 wrote to memory of 2312 536 jvvpp.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\952be498c6e00ae4ea4d0d2d260cb8a06f14d448224d997eeb106eaa1dfd399c.exe"C:\Users\Admin\AppData\Local\Temp\952be498c6e00ae4ea4d0d2d260cb8a06f14d448224d997eeb106eaa1dfd399c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\c800664.exec:\c800664.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\btnbtn.exec:\btnbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\htbnbh.exec:\htbnbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\thbnbb.exec:\thbnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\frxllff.exec:\frxllff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\thbnbt.exec:\thbnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\jjpdp.exec:\jjpdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\c046282.exec:\c046282.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\002444.exec:\002444.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\66206.exec:\66206.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\7lllfff.exec:\7lllfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\jpvpp.exec:\jpvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\86608.exec:\86608.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\a0420.exec:\a0420.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\frlxlxr.exec:\frlxlxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\6622086.exec:\6622086.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\jvvjv.exec:\jvvjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\ddjjv.exec:\ddjjv.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\htbbtn.exec:\htbbtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\vpjpv.exec:\vpjpv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\jvvpp.exec:\jvvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\22442.exec:\22442.exe23⤵
- Executes dropped EXE
PID:2312 -
\??\c:\1hbnhb.exec:\1hbnhb.exe24⤵
- Executes dropped EXE
PID:1056 -
\??\c:\400482.exec:\400482.exe25⤵
- Executes dropped EXE
PID:2440 -
\??\c:\26882.exec:\26882.exe26⤵
- Executes dropped EXE
PID:4592 -
\??\c:\64804.exec:\64804.exe27⤵
- Executes dropped EXE
PID:4336 -
\??\c:\0826048.exec:\0826048.exe28⤵
- Executes dropped EXE
PID:2508 -
\??\c:\c848642.exec:\c848642.exe29⤵
- Executes dropped EXE
PID:4984 -
\??\c:\xlxrlfr.exec:\xlxrlfr.exe30⤵
- Executes dropped EXE
PID:5092 -
\??\c:\804242.exec:\804242.exe31⤵
- Executes dropped EXE
PID:4616 -
\??\c:\rxxrxrl.exec:\rxxrxrl.exe32⤵
- Executes dropped EXE
PID:3032 -
\??\c:\3ttthh.exec:\3ttthh.exe33⤵
- Executes dropped EXE
PID:1164 -
\??\c:\840644.exec:\840644.exe34⤵
- Executes dropped EXE
PID:3676 -
\??\c:\ddjdv.exec:\ddjdv.exe35⤵
- Executes dropped EXE
PID:4564 -
\??\c:\8802068.exec:\8802068.exe36⤵
- Executes dropped EXE
PID:3488 -
\??\c:\bttbbh.exec:\bttbbh.exe37⤵
- Executes dropped EXE
PID:3060 -
\??\c:\246666.exec:\246666.exe38⤵
- Executes dropped EXE
PID:2860 -
\??\c:\xrrllrr.exec:\xrrllrr.exe39⤵
- Executes dropped EXE
PID:4088 -
\??\c:\dvddj.exec:\dvddj.exe40⤵
- Executes dropped EXE
PID:2124 -
\??\c:\0682604.exec:\0682604.exe41⤵
- Executes dropped EXE
PID:4552 -
\??\c:\22466.exec:\22466.exe42⤵
- Executes dropped EXE
PID:5036 -
\??\c:\jddvp.exec:\jddvp.exe43⤵
- Executes dropped EXE
PID:4732 -
\??\c:\088260.exec:\088260.exe44⤵
- Executes dropped EXE
PID:4380 -
\??\c:\hbtnhh.exec:\hbtnhh.exe45⤵
- Executes dropped EXE
PID:4492 -
\??\c:\nhbtbb.exec:\nhbtbb.exe46⤵
- Executes dropped EXE
PID:4220 -
\??\c:\08000.exec:\08000.exe47⤵
- Executes dropped EXE
PID:4424 -
\??\c:\3bbtnn.exec:\3bbtnn.exe48⤵
- Executes dropped EXE
PID:4216 -
\??\c:\vdvvp.exec:\vdvvp.exe49⤵
- Executes dropped EXE
PID:3516 -
\??\c:\8084882.exec:\8084882.exe50⤵
- Executes dropped EXE
PID:3524 -
\??\c:\22220.exec:\22220.exe51⤵
- Executes dropped EXE
PID:4696 -
\??\c:\22826.exec:\22826.exe52⤵
- Executes dropped EXE
PID:4360 -
\??\c:\8600482.exec:\8600482.exe53⤵
- Executes dropped EXE
PID:4200 -
\??\c:\lxffxrl.exec:\lxffxrl.exe54⤵
- Executes dropped EXE
PID:4236 -
\??\c:\862048.exec:\862048.exe55⤵
- Executes dropped EXE
PID:1912 -
\??\c:\60626.exec:\60626.exe56⤵
- Executes dropped EXE
PID:4820 -
\??\c:\xlllfff.exec:\xlllfff.exe57⤵
- Executes dropped EXE
PID:4704 -
\??\c:\nntthb.exec:\nntthb.exe58⤵
- Executes dropped EXE
PID:4800 -
\??\c:\ntnnhb.exec:\ntnnhb.exe59⤵
- Executes dropped EXE
PID:2164 -
\??\c:\dvpjp.exec:\dvpjp.exe60⤵
- Executes dropped EXE
PID:316 -
\??\c:\httnbt.exec:\httnbt.exe61⤵
- Executes dropped EXE
PID:3180 -
\??\c:\9bnhhh.exec:\9bnhhh.exe62⤵
- Executes dropped EXE
PID:3792 -
\??\c:\rlrlffx.exec:\rlrlffx.exe63⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jvdpv.exec:\jvdpv.exe64⤵
- Executes dropped EXE
PID:2084 -
\??\c:\pjdvp.exec:\pjdvp.exe65⤵
- Executes dropped EXE
PID:5116 -
\??\c:\684488.exec:\684488.exe66⤵PID:404
-
\??\c:\vvvdv.exec:\vvvdv.exe67⤵PID:2608
-
\??\c:\tbbnnn.exec:\tbbnnn.exe68⤵PID:2768
-
\??\c:\pdjdd.exec:\pdjdd.exe69⤵PID:3440
-
\??\c:\66866.exec:\66866.exe70⤵PID:4076
-
\??\c:\bhhbtt.exec:\bhhbtt.exe71⤵PID:4072
-
\??\c:\0666044.exec:\0666044.exe72⤵PID:3860
-
\??\c:\3vpvj.exec:\3vpvj.exe73⤵PID:652
-
\??\c:\o864000.exec:\o864000.exe74⤵PID:4668
-
\??\c:\dvpjv.exec:\dvpjv.exe75⤵PID:3184
-
\??\c:\664222.exec:\664222.exe76⤵PID:2072
-
\??\c:\tbbtnh.exec:\tbbtnh.exe77⤵PID:4560
-
\??\c:\80844.exec:\80844.exe78⤵PID:2240
-
\??\c:\fxfrrll.exec:\fxfrrll.exe79⤵PID:536
-
\??\c:\pjpjd.exec:\pjpjd.exe80⤵PID:4052
-
\??\c:\842468.exec:\842468.exe81⤵PID:2380
-
\??\c:\6062660.exec:\6062660.exe82⤵PID:3324
-
\??\c:\8882600.exec:\8882600.exe83⤵PID:4056
-
\??\c:\hhtbtt.exec:\hhtbtt.exe84⤵PID:3124
-
\??\c:\hnnhhh.exec:\hnnhhh.exe85⤵PID:2268
-
\??\c:\i064840.exec:\i064840.exe86⤵PID:4468
-
\??\c:\5tthtt.exec:\5tthtt.exe87⤵PID:5016
-
\??\c:\xrxrrlr.exec:\xrxrrlr.exe88⤵PID:916
-
\??\c:\82268.exec:\82268.exe89⤵
- System Location Discovery: System Language Discovery
PID:4536 -
\??\c:\8608260.exec:\8608260.exe90⤵PID:4524
-
\??\c:\hhttbt.exec:\hhttbt.exe91⤵PID:3948
-
\??\c:\088480.exec:\088480.exe92⤵PID:3752
-
\??\c:\c808204.exec:\c808204.exe93⤵PID:1816
-
\??\c:\w22628.exec:\w22628.exe94⤵PID:1844
-
\??\c:\468600.exec:\468600.exe95⤵PID:1496
-
\??\c:\c282606.exec:\c282606.exe96⤵PID:1772
-
\??\c:\rflflxf.exec:\rflflxf.exe97⤵PID:1460
-
\??\c:\62086.exec:\62086.exe98⤵PID:1804
-
\??\c:\djdvp.exec:\djdvp.exe99⤵PID:1580
-
\??\c:\rllfxrl.exec:\rllfxrl.exe100⤵PID:2860
-
\??\c:\nbnbth.exec:\nbnbth.exe101⤵PID:2560
-
\??\c:\8626048.exec:\8626048.exe102⤵PID:3428
-
\??\c:\fllxlfr.exec:\fllxlfr.exe103⤵PID:4108
-
\??\c:\frxlffx.exec:\frxlffx.exe104⤵PID:2636
-
\??\c:\8620048.exec:\8620048.exe105⤵PID:4732
-
\??\c:\o060860.exec:\o060860.exe106⤵PID:4380
-
\??\c:\hnthbt.exec:\hnthbt.exe107⤵PID:4492
-
\??\c:\860422.exec:\860422.exe108⤵PID:4428
-
\??\c:\nhhntn.exec:\nhhntn.exe109⤵PID:1492
-
\??\c:\668648.exec:\668648.exe110⤵PID:4880
-
\??\c:\w08660.exec:\w08660.exe111⤵PID:616
-
\??\c:\88864.exec:\88864.exe112⤵PID:3848
-
\??\c:\xffxrfx.exec:\xffxrfx.exe113⤵PID:3912
-
\??\c:\2888602.exec:\2888602.exe114⤵PID:1832
-
\??\c:\868666.exec:\868666.exe115⤵PID:412
-
\??\c:\o064208.exec:\o064208.exe116⤵PID:2388
-
\??\c:\frfrrrx.exec:\frfrrrx.exe117⤵PID:4236
-
\??\c:\48486.exec:\48486.exe118⤵PID:3364
-
\??\c:\5jdvj.exec:\5jdvj.exe119⤵PID:1032
-
\??\c:\866048.exec:\866048.exe120⤵PID:2832
-
\??\c:\httnbt.exec:\httnbt.exe121⤵PID:1700
-
\??\c:\hbhbbt.exec:\hbhbbt.exe122⤵PID:720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-