Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 00:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b15826266f8a734f8165dbb783e15a6cbadec194f4ba3e99a6d9015a7932a832N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b15826266f8a734f8165dbb783e15a6cbadec194f4ba3e99a6d9015a7932a832N.exe
-
Size
454KB
-
MD5
1d41f0323c5e9114efb45416420fe200
-
SHA1
7fd2b646aea5a298a503044a23a7964f68a56084
-
SHA256
b15826266f8a734f8165dbb783e15a6cbadec194f4ba3e99a6d9015a7932a832
-
SHA512
e8304f7dffb9c10ce3c5f7f0512079f0893ae5ba715ca3f30d743331b1ff732d055b0a102cab4567c44798b4c05b8060417228f5e7cb9ad2707d5e7abaa2c377
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetd:q7Tc2NYHUrAwfMp3CDtd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3164-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1296-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/832-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/316-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2568-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2112-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2812-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/956-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/316-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1268-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3748-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1148-751-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-755-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2784-801-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-877-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-965-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1236-1314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-1400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-1847-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1296 5lxxxff.exe 832 hbbttn.exe 2096 hbhhhb.exe 2024 jpddj.exe 1820 pvpvp.exe 3932 hhtbbh.exe 2516 hbtbnn.exe 4564 nnhtth.exe 316 3jdvp.exe 4984 tbnttb.exe 1268 7ppjd.exe 3480 vvjvj.exe 1056 rxrrfff.exe 2548 tttttt.exe 2508 jjpvj.exe 3904 ddjdj.exe 2568 hthnnh.exe 2112 vdjjp.exe 1196 lxrllff.exe 3028 hbnnnb.exe 4820 pddvv.exe 1140 7rffffr.exe 1428 thbtnh.exe 3724 tnhbtb.exe 5056 dpvvd.exe 4172 ddjjd.exe 2924 3lfxxxr.exe 4056 fxfxrrr.exe 3140 7jddv.exe 5068 jpvjd.exe 4340 ffxfxfr.exe 3324 nnbbhn.exe 3916 3xxxllr.exe 1348 bhnhbt.exe 4848 pdjdp.exe 1724 rflfffx.exe 2232 7tbbtt.exe 2552 vppjv.exe 4088 5lfrflx.exe 2812 nbhbnb.exe 3572 pppjd.exe 4360 lxfxrrl.exe 3756 jpdvp.exe 3172 5rxrrrr.exe 2808 thbbbb.exe 3188 pjvpp.exe 3184 xlrrrrr.exe 4328 thnhbb.exe 956 pjjjj.exe 3368 bnhhhh.exe 2436 xrfxllf.exe 4916 nhnhhh.exe 3740 dvvvp.exe 4128 xrfxfxr.exe 856 vjjjd.exe 3512 fxfxrrr.exe 3932 xrfxxxr.exe 2164 hbhbbn.exe 2424 dvdvd.exe 3200 lfrxxlx.exe 316 nhtnhh.exe 544 7pdvv.exe 4480 7rrlffx.exe 1268 thnhbb.exe -
resource yara_rule behavioral2/memory/3164-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1296-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/832-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/316-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2568-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1196-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2112-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3140-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/956-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/316-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3748-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2784-801-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-965-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3164 wrote to memory of 1296 3164 b15826266f8a734f8165dbb783e15a6cbadec194f4ba3e99a6d9015a7932a832N.exe 83 PID 3164 wrote to memory of 1296 3164 b15826266f8a734f8165dbb783e15a6cbadec194f4ba3e99a6d9015a7932a832N.exe 83 PID 3164 wrote to memory of 1296 3164 b15826266f8a734f8165dbb783e15a6cbadec194f4ba3e99a6d9015a7932a832N.exe 83 PID 1296 wrote to memory of 832 1296 5lxxxff.exe 84 PID 1296 wrote to memory of 832 1296 5lxxxff.exe 84 PID 1296 wrote to memory of 832 1296 5lxxxff.exe 84 PID 832 wrote to memory of 2096 832 hbbttn.exe 85 PID 832 wrote to memory of 2096 832 hbbttn.exe 85 PID 832 wrote to memory of 2096 832 hbbttn.exe 85 PID 2096 wrote to memory of 2024 2096 hbhhhb.exe 86 PID 2096 wrote to memory of 2024 2096 hbhhhb.exe 86 PID 2096 wrote to memory of 2024 2096 hbhhhb.exe 86 PID 2024 wrote to memory of 1820 2024 jpddj.exe 87 PID 2024 wrote to memory of 1820 2024 jpddj.exe 87 PID 2024 wrote to memory of 1820 2024 jpddj.exe 87 PID 1820 wrote to memory of 3932 1820 pvpvp.exe 88 PID 1820 wrote to memory of 3932 1820 pvpvp.exe 88 PID 1820 wrote to memory of 3932 1820 pvpvp.exe 88 PID 3932 wrote to memory of 2516 3932 hhtbbh.exe 89 PID 3932 wrote to memory of 2516 3932 hhtbbh.exe 89 PID 3932 wrote to memory of 2516 3932 hhtbbh.exe 89 PID 2516 wrote to memory of 4564 2516 hbtbnn.exe 90 PID 2516 wrote to memory of 4564 2516 hbtbnn.exe 90 PID 2516 wrote to memory of 4564 2516 hbtbnn.exe 90 PID 4564 wrote to memory of 316 4564 nnhtth.exe 91 PID 4564 wrote to memory of 316 4564 nnhtth.exe 91 PID 4564 wrote to memory of 316 4564 nnhtth.exe 91 PID 316 wrote to memory of 4984 316 3jdvp.exe 92 PID 316 wrote to memory of 4984 316 3jdvp.exe 92 PID 316 wrote to memory of 4984 316 3jdvp.exe 92 PID 4984 wrote to memory of 1268 4984 tbnttb.exe 93 PID 4984 wrote to memory of 1268 4984 tbnttb.exe 93 PID 4984 wrote to memory of 1268 4984 tbnttb.exe 93 PID 1268 wrote to memory of 3480 1268 7ppjd.exe 94 PID 1268 wrote to memory of 3480 1268 7ppjd.exe 94 PID 1268 wrote to memory of 3480 1268 7ppjd.exe 94 PID 3480 wrote to memory of 1056 3480 vvjvj.exe 95 PID 3480 wrote to memory of 1056 3480 vvjvj.exe 95 PID 3480 wrote to memory of 1056 3480 vvjvj.exe 95 PID 1056 wrote to memory of 2548 1056 rxrrfff.exe 96 PID 1056 wrote to memory of 2548 1056 rxrrfff.exe 96 PID 1056 wrote to memory of 2548 1056 rxrrfff.exe 96 PID 2548 wrote to memory of 2508 2548 tttttt.exe 97 PID 2548 wrote to memory of 2508 2548 tttttt.exe 97 PID 2548 wrote to memory of 2508 2548 tttttt.exe 97 PID 2508 wrote to memory of 3904 2508 jjpvj.exe 98 PID 2508 wrote to memory of 3904 2508 jjpvj.exe 98 PID 2508 wrote to memory of 3904 2508 jjpvj.exe 98 PID 3904 wrote to memory of 2568 3904 ddjdj.exe 99 PID 3904 wrote to memory of 2568 3904 ddjdj.exe 99 PID 3904 wrote to memory of 2568 3904 ddjdj.exe 99 PID 2568 wrote to memory of 2112 2568 hthnnh.exe 100 PID 2568 wrote to memory of 2112 2568 hthnnh.exe 100 PID 2568 wrote to memory of 2112 2568 hthnnh.exe 100 PID 2112 wrote to memory of 1196 2112 vdjjp.exe 101 PID 2112 wrote to memory of 1196 2112 vdjjp.exe 101 PID 2112 wrote to memory of 1196 2112 vdjjp.exe 101 PID 1196 wrote to memory of 3028 1196 lxrllff.exe 102 PID 1196 wrote to memory of 3028 1196 lxrllff.exe 102 PID 1196 wrote to memory of 3028 1196 lxrllff.exe 102 PID 3028 wrote to memory of 4820 3028 hbnnnb.exe 103 PID 3028 wrote to memory of 4820 3028 hbnnnb.exe 103 PID 3028 wrote to memory of 4820 3028 hbnnnb.exe 103 PID 4820 wrote to memory of 1140 4820 pddvv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b15826266f8a734f8165dbb783e15a6cbadec194f4ba3e99a6d9015a7932a832N.exe"C:\Users\Admin\AppData\Local\Temp\b15826266f8a734f8165dbb783e15a6cbadec194f4ba3e99a6d9015a7932a832N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\5lxxxff.exec:\5lxxxff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\hbbttn.exec:\hbbttn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\hbhhhb.exec:\hbhhhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\jpddj.exec:\jpddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\pvpvp.exec:\pvpvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\hhtbbh.exec:\hhtbbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\hbtbnn.exec:\hbtbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\nnhtth.exec:\nnhtth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\3jdvp.exec:\3jdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\tbnttb.exec:\tbnttb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\7ppjd.exec:\7ppjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\vvjvj.exec:\vvjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\rxrrfff.exec:\rxrrfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\tttttt.exec:\tttttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\jjpvj.exec:\jjpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\ddjdj.exec:\ddjdj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\hthnnh.exec:\hthnnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\vdjjp.exec:\vdjjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\lxrllff.exec:\lxrllff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\hbnnnb.exec:\hbnnnb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\pddvv.exec:\pddvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\7rffffr.exec:\7rffffr.exe23⤵
- Executes dropped EXE
PID:1140 -
\??\c:\thbtnh.exec:\thbtnh.exe24⤵
- Executes dropped EXE
PID:1428 -
\??\c:\tnhbtb.exec:\tnhbtb.exe25⤵
- Executes dropped EXE
PID:3724 -
\??\c:\dpvvd.exec:\dpvvd.exe26⤵
- Executes dropped EXE
PID:5056 -
\??\c:\ddjjd.exec:\ddjjd.exe27⤵
- Executes dropped EXE
PID:4172 -
\??\c:\3lfxxxr.exec:\3lfxxxr.exe28⤵
- Executes dropped EXE
PID:2924 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe29⤵
- Executes dropped EXE
PID:4056 -
\??\c:\7jddv.exec:\7jddv.exe30⤵
- Executes dropped EXE
PID:3140 -
\??\c:\jpvjd.exec:\jpvjd.exe31⤵
- Executes dropped EXE
PID:5068 -
\??\c:\ffxfxfr.exec:\ffxfxfr.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4340 -
\??\c:\nnbbhn.exec:\nnbbhn.exe33⤵
- Executes dropped EXE
PID:3324 -
\??\c:\3xxxllr.exec:\3xxxllr.exe34⤵
- Executes dropped EXE
PID:3916 -
\??\c:\bhnhbt.exec:\bhnhbt.exe35⤵
- Executes dropped EXE
PID:1348 -
\??\c:\pdjdp.exec:\pdjdp.exe36⤵
- Executes dropped EXE
PID:4848 -
\??\c:\rflfffx.exec:\rflfffx.exe37⤵
- Executes dropped EXE
PID:1724 -
\??\c:\7tbbtt.exec:\7tbbtt.exe38⤵
- Executes dropped EXE
PID:2232 -
\??\c:\vppjv.exec:\vppjv.exe39⤵
- Executes dropped EXE
PID:2552 -
\??\c:\5lfrflx.exec:\5lfrflx.exe40⤵
- Executes dropped EXE
PID:4088 -
\??\c:\nbhbnb.exec:\nbhbnb.exe41⤵
- Executes dropped EXE
PID:2812 -
\??\c:\pppjd.exec:\pppjd.exe42⤵
- Executes dropped EXE
PID:3572 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe43⤵
- Executes dropped EXE
PID:4360 -
\??\c:\jpdvp.exec:\jpdvp.exe44⤵
- Executes dropped EXE
PID:3756 -
\??\c:\5rxrrrr.exec:\5rxrrrr.exe45⤵
- Executes dropped EXE
PID:3172 -
\??\c:\thbbbb.exec:\thbbbb.exe46⤵
- Executes dropped EXE
PID:2808 -
\??\c:\pjvpp.exec:\pjvpp.exe47⤵
- Executes dropped EXE
PID:3188 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe48⤵
- Executes dropped EXE
PID:3184 -
\??\c:\thnhbb.exec:\thnhbb.exe49⤵
- Executes dropped EXE
PID:4328 -
\??\c:\pjjjj.exec:\pjjjj.exe50⤵
- Executes dropped EXE
PID:956 -
\??\c:\bnhhhh.exec:\bnhhhh.exe51⤵
- Executes dropped EXE
PID:3368 -
\??\c:\xrfxllf.exec:\xrfxllf.exe52⤵
- Executes dropped EXE
PID:2436 -
\??\c:\nhnhhh.exec:\nhnhhh.exe53⤵
- Executes dropped EXE
PID:4916 -
\??\c:\dvvvp.exec:\dvvvp.exe54⤵
- Executes dropped EXE
PID:3740 -
\??\c:\xrfxfxr.exec:\xrfxfxr.exe55⤵
- Executes dropped EXE
PID:4128 -
\??\c:\vjjjd.exec:\vjjjd.exe56⤵
- Executes dropped EXE
PID:856 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe57⤵
- Executes dropped EXE
PID:3512 -
\??\c:\xrfxxxr.exec:\xrfxxxr.exe58⤵
- Executes dropped EXE
PID:3932 -
\??\c:\hbhbbn.exec:\hbhbbn.exe59⤵
- Executes dropped EXE
PID:2164 -
\??\c:\dvdvd.exec:\dvdvd.exe60⤵
- Executes dropped EXE
PID:2424 -
\??\c:\lfrxxlx.exec:\lfrxxlx.exe61⤵
- Executes dropped EXE
PID:3200 -
\??\c:\nhtnhh.exec:\nhtnhh.exe62⤵
- Executes dropped EXE
PID:316 -
\??\c:\7pdvv.exec:\7pdvv.exe63⤵
- Executes dropped EXE
PID:544 -
\??\c:\7rrlffx.exec:\7rrlffx.exe64⤵
- Executes dropped EXE
PID:4480 -
\??\c:\thnhbb.exec:\thnhbb.exe65⤵
- Executes dropped EXE
PID:1268 -
\??\c:\9thbbh.exec:\9thbbh.exe66⤵PID:1680
-
\??\c:\xrrxffr.exec:\xrrxffr.exe67⤵PID:4400
-
\??\c:\3ttntn.exec:\3ttntn.exe68⤵PID:4752
-
\??\c:\5pdjd.exec:\5pdjd.exe69⤵PID:2332
-
\??\c:\xxfllff.exec:\xxfllff.exe70⤵PID:2372
-
\??\c:\bbbntb.exec:\bbbntb.exe71⤵PID:4352
-
\??\c:\jjdvd.exec:\jjdvd.exe72⤵PID:1188
-
\??\c:\llxxrrr.exec:\llxxrrr.exe73⤵PID:2776
-
\??\c:\hbhbbb.exec:\hbhbbb.exe74⤵PID:4560
-
\??\c:\pjvpj.exec:\pjvpj.exe75⤵PID:4296
-
\??\c:\xrrllff.exec:\xrrllff.exe76⤵PID:2240
-
\??\c:\rlfrlll.exec:\rlfrlll.exe77⤵PID:3080
-
\??\c:\pjddd.exec:\pjddd.exe78⤵PID:2788
-
\??\c:\1vppj.exec:\1vppj.exe79⤵PID:2940
-
\??\c:\3rxrxfx.exec:\3rxrxfx.exe80⤵PID:1140
-
\??\c:\tbhbhb.exec:\tbhbhb.exe81⤵PID:1588
-
\??\c:\9jvpd.exec:\9jvpd.exe82⤵PID:760
-
\??\c:\3rxrflf.exec:\3rxrflf.exe83⤵PID:1220
-
\??\c:\nnntnb.exec:\nnntnb.exe84⤵PID:1332
-
\??\c:\3vpjd.exec:\3vpjd.exe85⤵PID:1900
-
\??\c:\rxrrxff.exec:\rxrrxff.exe86⤵PID:4148
-
\??\c:\nnntth.exec:\nnntth.exe87⤵PID:4064
-
\??\c:\thhbtn.exec:\thhbtn.exe88⤵PID:4952
-
\??\c:\3pjdv.exec:\3pjdv.exe89⤵PID:3088
-
\??\c:\9xfxlrl.exec:\9xfxlrl.exe90⤵PID:4960
-
\??\c:\nhhbtn.exec:\nhhbtn.exe91⤵PID:3304
-
\??\c:\jvppj.exec:\jvppj.exe92⤵PID:5040
-
\??\c:\xrfrrfx.exec:\xrfrrfx.exe93⤵PID:4736
-
\??\c:\1ffxrrl.exec:\1ffxrrl.exe94⤵PID:3324
-
\??\c:\pjjvv.exec:\pjjvv.exe95⤵PID:3272
-
\??\c:\jpjjj.exec:\jpjjj.exe96⤵PID:4676
-
\??\c:\lxfffff.exec:\lxfffff.exe97⤵
- System Location Discovery: System Language Discovery
PID:4848 -
\??\c:\1ntntt.exec:\1ntntt.exe98⤵PID:4548
-
\??\c:\vppjj.exec:\vppjj.exe99⤵PID:2604
-
\??\c:\5pjpp.exec:\5pjpp.exe100⤵PID:3112
-
\??\c:\5rrlffx.exec:\5rrlffx.exe101⤵PID:1280
-
\??\c:\btnhnn.exec:\btnhnn.exe102⤵PID:4088
-
\??\c:\djvvp.exec:\djvvp.exe103⤵PID:3676
-
\??\c:\ddvpp.exec:\ddvpp.exe104⤵PID:4592
-
\??\c:\rlfxxxx.exec:\rlfxxxx.exe105⤵PID:1888
-
\??\c:\hntbtn.exec:\hntbtn.exe106⤵PID:1580
-
\??\c:\djvpj.exec:\djvpj.exe107⤵PID:3000
-
\??\c:\dpjvp.exec:\dpjvp.exe108⤵PID:548
-
\??\c:\lxxfffr.exec:\lxxfffr.exe109⤵PID:4440
-
\??\c:\3hhbtt.exec:\3hhbtt.exe110⤵PID:4432
-
\??\c:\vppdv.exec:\vppdv.exe111⤵PID:60
-
\??\c:\fffllrx.exec:\fffllrx.exe112⤵PID:3384
-
\??\c:\1thbbb.exec:\1thbbb.exe113⤵PID:3872
-
\??\c:\pvdvv.exec:\pvdvv.exe114⤵PID:1208
-
\??\c:\frffxfx.exec:\frffxfx.exe115⤵PID:2436
-
\??\c:\btnhbb.exec:\btnhbb.exe116⤵PID:2092
-
\??\c:\hnbhhb.exec:\hnbhhb.exe117⤵PID:4788
-
\??\c:\jjvvv.exec:\jjvvv.exe118⤵PID:408
-
\??\c:\lfxxfxr.exec:\lfxxfxr.exe119⤵PID:4472
-
\??\c:\rfrlflf.exec:\rfrlflf.exe120⤵PID:1980
-
\??\c:\bbbbtt.exec:\bbbbtt.exe121⤵PID:1524
-
\??\c:\dpdpd.exec:\dpdpd.exe122⤵PID:2036
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-