Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 01:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3fc0d66009d49d5cc86c430bded5981586251e78abe5a432bcdec58cf5287aa4.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
3fc0d66009d49d5cc86c430bded5981586251e78abe5a432bcdec58cf5287aa4.exe
-
Size
455KB
-
MD5
fd29874125f0360d3a1e601663fad100
-
SHA1
658d7e04d299559f8f679a68d71db9382570ce1c
-
SHA256
3fc0d66009d49d5cc86c430bded5981586251e78abe5a432bcdec58cf5287aa4
-
SHA512
a480490c9c8f7f892812707c7247f40a67564c245a5aed8a9d5577454d2286cb5896408e4e24f56e4884cafd13d99748ffcbfecc9aa1f4904ba9ce249fab22ed
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1276-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/988-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1296-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1120-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/336-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-748-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-759-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-787-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-803-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-1309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5012 bnthtn.exe 5100 jjjdd.exe 1276 lrrfrfx.exe 336 5nbbbn.exe 3688 nbbtbt.exe 4860 3jjdv.exe 4920 xxfxrlf.exe 1120 rrfxrrx.exe 1696 hhttnh.exe 2460 jpvjd.exe 1296 pdjvp.exe 3440 xrrlxrx.exe 2292 7hnbhb.exe 868 ppvjd.exe 4632 5dpdv.exe 1048 rxfxrrr.exe 3208 tbbnhb.exe 920 1tthtt.exe 2120 vjpjv.exe 1968 9llfxlx.exe 780 bnbhth.exe 3296 9tbtnn.exe 2372 jppdd.exe 988 7llfffl.exe 2652 xxlrllf.exe 1004 nhhnht.exe 4060 jdvdp.exe 4900 pjjdd.exe 4480 ffrlxxl.exe 2484 1ntnhh.exe 2084 1vvpp.exe 4484 jddvj.exe 1900 fxrfxrf.exe 3744 btthnb.exe 4568 9hhthh.exe 4460 7vvpj.exe 3764 9fffxxr.exe 3860 fxlfffx.exe 556 9nnbtn.exe 1924 vjdvp.exe 3704 jjpdd.exe 2400 5ffxfxf.exe 3800 nbnbtn.exe 4788 hbhbnt.exe 232 jdpjj.exe 4984 xllfffr.exe 4400 lffrlxr.exe 4528 tnnnnh.exe 2184 jvvjd.exe 4592 pddvj.exe 1572 llrlxxr.exe 1188 hhnhtn.exe 468 tntnnn.exe 3676 vpvvd.exe 4028 3xxrlfx.exe 4448 httnhb.exe 4372 tbhtnh.exe 4804 pddpj.exe 968 htbbtn.exe 2912 thnhbb.exe 1132 7jdjd.exe 4036 rlfrllx.exe 3164 lrxrfxr.exe 4332 nnthbn.exe -
resource yara_rule behavioral2/memory/5012-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1276-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/988-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1296-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1120-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/336-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-759-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fc0d66009d49d5cc86c430bded5981586251e78abe5a432bcdec58cf5287aa4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4876 wrote to memory of 5012 4876 3fc0d66009d49d5cc86c430bded5981586251e78abe5a432bcdec58cf5287aa4.exe 82 PID 4876 wrote to memory of 5012 4876 3fc0d66009d49d5cc86c430bded5981586251e78abe5a432bcdec58cf5287aa4.exe 82 PID 4876 wrote to memory of 5012 4876 3fc0d66009d49d5cc86c430bded5981586251e78abe5a432bcdec58cf5287aa4.exe 82 PID 5012 wrote to memory of 5100 5012 bnthtn.exe 83 PID 5012 wrote to memory of 5100 5012 bnthtn.exe 83 PID 5012 wrote to memory of 5100 5012 bnthtn.exe 83 PID 5100 wrote to memory of 1276 5100 jjjdd.exe 84 PID 5100 wrote to memory of 1276 5100 jjjdd.exe 84 PID 5100 wrote to memory of 1276 5100 jjjdd.exe 84 PID 1276 wrote to memory of 336 1276 lrrfrfx.exe 85 PID 1276 wrote to memory of 336 1276 lrrfrfx.exe 85 PID 1276 wrote to memory of 336 1276 lrrfrfx.exe 85 PID 336 wrote to memory of 3688 336 5nbbbn.exe 86 PID 336 wrote to memory of 3688 336 5nbbbn.exe 86 PID 336 wrote to memory of 3688 336 5nbbbn.exe 86 PID 3688 wrote to memory of 4860 3688 nbbtbt.exe 87 PID 3688 wrote to memory of 4860 3688 nbbtbt.exe 87 PID 3688 wrote to memory of 4860 3688 nbbtbt.exe 87 PID 4860 wrote to memory of 4920 4860 3jjdv.exe 88 PID 4860 wrote to memory of 4920 4860 3jjdv.exe 88 PID 4860 wrote to memory of 4920 4860 3jjdv.exe 88 PID 4920 wrote to memory of 1120 4920 xxfxrlf.exe 89 PID 4920 wrote to memory of 1120 4920 xxfxrlf.exe 89 PID 4920 wrote to memory of 1120 4920 xxfxrlf.exe 89 PID 1120 wrote to memory of 1696 1120 rrfxrrx.exe 90 PID 1120 wrote to memory of 1696 1120 rrfxrrx.exe 90 PID 1120 wrote to memory of 1696 1120 rrfxrrx.exe 90 PID 1696 wrote to memory of 2460 1696 hhttnh.exe 91 PID 1696 wrote to memory of 2460 1696 hhttnh.exe 91 PID 1696 wrote to memory of 2460 1696 hhttnh.exe 91 PID 2460 wrote to memory of 1296 2460 jpvjd.exe 92 PID 2460 wrote to memory of 1296 2460 jpvjd.exe 92 PID 2460 wrote to memory of 1296 2460 jpvjd.exe 92 PID 1296 wrote to memory of 3440 1296 pdjvp.exe 93 PID 1296 wrote to memory of 3440 1296 pdjvp.exe 93 PID 1296 wrote to memory of 3440 1296 pdjvp.exe 93 PID 3440 wrote to memory of 2292 3440 xrrlxrx.exe 94 PID 3440 wrote to memory of 2292 3440 xrrlxrx.exe 94 PID 3440 wrote to memory of 2292 3440 xrrlxrx.exe 94 PID 2292 wrote to memory of 868 2292 7hnbhb.exe 95 PID 2292 wrote to memory of 868 2292 7hnbhb.exe 95 PID 2292 wrote to memory of 868 2292 7hnbhb.exe 95 PID 868 wrote to memory of 4632 868 ppvjd.exe 96 PID 868 wrote to memory of 4632 868 ppvjd.exe 96 PID 868 wrote to memory of 4632 868 ppvjd.exe 96 PID 4632 wrote to memory of 1048 4632 5dpdv.exe 97 PID 4632 wrote to memory of 1048 4632 5dpdv.exe 97 PID 4632 wrote to memory of 1048 4632 5dpdv.exe 97 PID 1048 wrote to memory of 3208 1048 rxfxrrr.exe 98 PID 1048 wrote to memory of 3208 1048 rxfxrrr.exe 98 PID 1048 wrote to memory of 3208 1048 rxfxrrr.exe 98 PID 3208 wrote to memory of 920 3208 tbbnhb.exe 99 PID 3208 wrote to memory of 920 3208 tbbnhb.exe 99 PID 3208 wrote to memory of 920 3208 tbbnhb.exe 99 PID 920 wrote to memory of 2120 920 1tthtt.exe 100 PID 920 wrote to memory of 2120 920 1tthtt.exe 100 PID 920 wrote to memory of 2120 920 1tthtt.exe 100 PID 2120 wrote to memory of 1968 2120 vjpjv.exe 101 PID 2120 wrote to memory of 1968 2120 vjpjv.exe 101 PID 2120 wrote to memory of 1968 2120 vjpjv.exe 101 PID 1968 wrote to memory of 780 1968 9llfxlx.exe 102 PID 1968 wrote to memory of 780 1968 9llfxlx.exe 102 PID 1968 wrote to memory of 780 1968 9llfxlx.exe 102 PID 780 wrote to memory of 3296 780 bnbhth.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fc0d66009d49d5cc86c430bded5981586251e78abe5a432bcdec58cf5287aa4.exe"C:\Users\Admin\AppData\Local\Temp\3fc0d66009d49d5cc86c430bded5981586251e78abe5a432bcdec58cf5287aa4.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\bnthtn.exec:\bnthtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\jjjdd.exec:\jjjdd.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\lrrfrfx.exec:\lrrfrfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\5nbbbn.exec:\5nbbbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\nbbtbt.exec:\nbbtbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\3jjdv.exec:\3jjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\xxfxrlf.exec:\xxfxrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\rrfxrrx.exec:\rrfxrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\hhttnh.exec:\hhttnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\jpvjd.exec:\jpvjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\pdjvp.exec:\pdjvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\xrrlxrx.exec:\xrrlxrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\7hnbhb.exec:\7hnbhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\ppvjd.exec:\ppvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\5dpdv.exec:\5dpdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\rxfxrrr.exec:\rxfxrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\tbbnhb.exec:\tbbnhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\1tthtt.exec:\1tthtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\vjpjv.exec:\vjpjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\9llfxlx.exec:\9llfxlx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\bnbhth.exec:\bnbhth.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\9tbtnn.exec:\9tbtnn.exe23⤵
- Executes dropped EXE
PID:3296 -
\??\c:\jppdd.exec:\jppdd.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2372 -
\??\c:\7llfffl.exec:\7llfffl.exe25⤵
- Executes dropped EXE
PID:988 -
\??\c:\xxlrllf.exec:\xxlrllf.exe26⤵
- Executes dropped EXE
PID:2652 -
\??\c:\nhhnht.exec:\nhhnht.exe27⤵
- Executes dropped EXE
PID:1004 -
\??\c:\jdvdp.exec:\jdvdp.exe28⤵
- Executes dropped EXE
PID:4060 -
\??\c:\pjjdd.exec:\pjjdd.exe29⤵
- Executes dropped EXE
PID:4900 -
\??\c:\ffrlxxl.exec:\ffrlxxl.exe30⤵
- Executes dropped EXE
PID:4480 -
\??\c:\1ntnhh.exec:\1ntnhh.exe31⤵
- Executes dropped EXE
PID:2484 -
\??\c:\1vvpp.exec:\1vvpp.exe32⤵
- Executes dropped EXE
PID:2084 -
\??\c:\jddvj.exec:\jddvj.exe33⤵
- Executes dropped EXE
PID:4484 -
\??\c:\fxrfxrf.exec:\fxrfxrf.exe34⤵
- Executes dropped EXE
PID:1900 -
\??\c:\btthnb.exec:\btthnb.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3744 -
\??\c:\9hhthh.exec:\9hhthh.exe36⤵
- Executes dropped EXE
PID:4568 -
\??\c:\7vvpj.exec:\7vvpj.exe37⤵
- Executes dropped EXE
PID:4460 -
\??\c:\9fffxxr.exec:\9fffxxr.exe38⤵
- Executes dropped EXE
PID:3764 -
\??\c:\fxlfffx.exec:\fxlfffx.exe39⤵
- Executes dropped EXE
PID:3860 -
\??\c:\9nnbtn.exec:\9nnbtn.exe40⤵
- Executes dropped EXE
PID:556 -
\??\c:\vjdvp.exec:\vjdvp.exe41⤵
- Executes dropped EXE
PID:1924 -
\??\c:\jjpdd.exec:\jjpdd.exe42⤵
- Executes dropped EXE
PID:3704 -
\??\c:\5ffxfxf.exec:\5ffxfxf.exe43⤵
- Executes dropped EXE
PID:2400 -
\??\c:\nbnbtn.exec:\nbnbtn.exe44⤵
- Executes dropped EXE
PID:3800 -
\??\c:\hbhbnt.exec:\hbhbnt.exe45⤵
- Executes dropped EXE
PID:4788 -
\??\c:\jdpjj.exec:\jdpjj.exe46⤵
- Executes dropped EXE
PID:232 -
\??\c:\xllfffr.exec:\xllfffr.exe47⤵
- Executes dropped EXE
PID:4984 -
\??\c:\lffrlxr.exec:\lffrlxr.exe48⤵
- Executes dropped EXE
PID:4400 -
\??\c:\tnnnnh.exec:\tnnnnh.exe49⤵
- Executes dropped EXE
PID:4528 -
\??\c:\jvvjd.exec:\jvvjd.exe50⤵
- Executes dropped EXE
PID:2184 -
\??\c:\pddvj.exec:\pddvj.exe51⤵
- Executes dropped EXE
PID:4592 -
\??\c:\llrlxxr.exec:\llrlxxr.exe52⤵
- Executes dropped EXE
PID:1572 -
\??\c:\hhnhtn.exec:\hhnhtn.exe53⤵
- Executes dropped EXE
PID:1188 -
\??\c:\tntnnn.exec:\tntnnn.exe54⤵
- Executes dropped EXE
PID:468 -
\??\c:\vpvvd.exec:\vpvvd.exe55⤵
- Executes dropped EXE
PID:3676 -
\??\c:\3xxrlfx.exec:\3xxrlfx.exe56⤵
- Executes dropped EXE
PID:4028 -
\??\c:\httnhb.exec:\httnhb.exe57⤵
- Executes dropped EXE
PID:4448 -
\??\c:\tbhtnh.exec:\tbhtnh.exe58⤵
- Executes dropped EXE
PID:4372 -
\??\c:\pddpj.exec:\pddpj.exe59⤵
- Executes dropped EXE
PID:4804 -
\??\c:\htbbtn.exec:\htbbtn.exe60⤵
- Executes dropped EXE
PID:968 -
\??\c:\thnhbb.exec:\thnhbb.exe61⤵
- Executes dropped EXE
PID:2912 -
\??\c:\7jdjd.exec:\7jdjd.exe62⤵
- Executes dropped EXE
PID:1132 -
\??\c:\rlfrllx.exec:\rlfrllx.exe63⤵
- Executes dropped EXE
PID:4036 -
\??\c:\lrxrfxr.exec:\lrxrfxr.exe64⤵
- Executes dropped EXE
PID:3164 -
\??\c:\nnthbn.exec:\nnthbn.exe65⤵
- Executes dropped EXE
PID:4332 -
\??\c:\1vdvj.exec:\1vdvj.exe66⤵PID:2076
-
\??\c:\9dpjd.exec:\9dpjd.exe67⤵PID:2632
-
\??\c:\ffxxrll.exec:\ffxxrll.exe68⤵PID:1768
-
\??\c:\5tthnn.exec:\5tthnn.exe69⤵PID:2892
-
\??\c:\jvpjd.exec:\jvpjd.exe70⤵PID:2120
-
\??\c:\vdjdv.exec:\vdjdv.exe71⤵PID:3252
-
\??\c:\lrrfxrf.exec:\lrrfxrf.exe72⤵PID:3216
-
\??\c:\7ttnbb.exec:\7ttnbb.exe73⤵PID:4884
-
\??\c:\vjpjd.exec:\vjpjd.exe74⤵PID:2628
-
\??\c:\xxrlrrr.exec:\xxrlrrr.exe75⤵PID:864
-
\??\c:\nbhtnh.exec:\nbhtnh.exe76⤵PID:1368
-
\??\c:\3vvpd.exec:\3vvpd.exe77⤵PID:3256
-
\??\c:\rffrllf.exec:\rffrllf.exe78⤵PID:1992
-
\??\c:\bnthbt.exec:\bnthbt.exe79⤵PID:2464
-
\??\c:\htthtn.exec:\htthtn.exe80⤵PID:2484
-
\??\c:\jjddj.exec:\jjddj.exe81⤵PID:2084
-
\??\c:\xlrfxxr.exec:\xlrfxxr.exe82⤵PID:1928
-
\??\c:\nhnbhh.exec:\nhnbhh.exe83⤵PID:1192
-
\??\c:\nhbthb.exec:\nhbthb.exe84⤵PID:1152
-
\??\c:\vppjd.exec:\vppjd.exe85⤵PID:3856
-
\??\c:\rrrfrlx.exec:\rrrfrlx.exe86⤵PID:4892
-
\??\c:\btbtbh.exec:\btbtbh.exe87⤵PID:3188
-
\??\c:\rxfrlxl.exec:\rxfrlxl.exe88⤵PID:3284
-
\??\c:\nbthhb.exec:\nbthhb.exe89⤵PID:4108
-
\??\c:\dvpjd.exec:\dvpjd.exe90⤵PID:1924
-
\??\c:\9bbthh.exec:\9bbthh.exe91⤵PID:3816
-
\??\c:\dpjdv.exec:\dpjdv.exe92⤵PID:2672
-
\??\c:\lflxrlx.exec:\lflxrlx.exe93⤵PID:1540
-
\??\c:\bnthbh.exec:\bnthbh.exe94⤵PID:4984
-
\??\c:\htnnnn.exec:\htnnnn.exe95⤵PID:4404
-
\??\c:\jpddv.exec:\jpddv.exe96⤵PID:3408
-
\??\c:\fllxxrf.exec:\fllxxrf.exe97⤵PID:1576
-
\??\c:\nntnhb.exec:\nntnhb.exe98⤵PID:4592
-
\??\c:\jvdpv.exec:\jvdpv.exe99⤵PID:5108
-
\??\c:\bhnbtn.exec:\bhnbtn.exe100⤵PID:3140
-
\??\c:\rlfxlxl.exec:\rlfxlxl.exe101⤵PID:1188
-
\??\c:\xrllrrr.exec:\xrllrrr.exe102⤵PID:4520
-
\??\c:\5xfrllf.exec:\5xfrllf.exe103⤵PID:1068
-
\??\c:\5ntnnn.exec:\5ntnnn.exe104⤵PID:1304
-
\??\c:\flfrllx.exec:\flfrllx.exe105⤵PID:3324
-
\??\c:\nbbbtt.exec:\nbbbtt.exe106⤵PID:4524
-
\??\c:\tntnhh.exec:\tntnhh.exe107⤵PID:4080
-
\??\c:\vddvp.exec:\vddvp.exe108⤵PID:1412
-
\??\c:\bntnnb.exec:\bntnnb.exe109⤵PID:5096
-
\??\c:\nhhbtn.exec:\nhhbtn.exe110⤵PID:4572
-
\??\c:\7vjdd.exec:\7vjdd.exe111⤵PID:536
-
\??\c:\lflfxxr.exec:\lflfxxr.exe112⤵PID:2308
-
\??\c:\pddvp.exec:\pddvp.exe113⤵PID:4840
-
\??\c:\vppvp.exec:\vppvp.exe114⤵PID:3224
-
\??\c:\hbbnhb.exec:\hbbnhb.exe115⤵PID:3016
-
\??\c:\jvvpj.exec:\jvvpj.exe116⤵PID:3992
-
\??\c:\hntnbn.exec:\hntnbn.exe117⤵PID:2844
-
\??\c:\vpvdv.exec:\vpvdv.exe118⤵PID:2128
-
\??\c:\bhttnh.exec:\bhttnh.exe119⤵PID:4064
-
\??\c:\bbhbth.exec:\bbhbth.exe120⤵PID:4436
-
\??\c:\dppjv.exec:\dppjv.exe121⤵PID:1768
-
\??\c:\3ntnnn.exec:\3ntnnn.exe122⤵
- System Location Discovery: System Language Discovery
PID:4204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-