Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 01:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ac20f05c31a5c02f1ef632eb091a11dcd3a083b60301d568038084a7ee2726f7.exe
Resource
win7-20240708-en
7 signatures
150 seconds
General
-
Target
ac20f05c31a5c02f1ef632eb091a11dcd3a083b60301d568038084a7ee2726f7.exe
-
Size
454KB
-
MD5
d32eeb6ae5a47def0f83323c8eb06cb9
-
SHA1
d19a910ccab75736b4b663cb1803f8f1bd356099
-
SHA256
ac20f05c31a5c02f1ef632eb091a11dcd3a083b60301d568038084a7ee2726f7
-
SHA512
74e081c81c33c01e39fe6974864f700c38d014b2e18119cdd9cde608fe3c5b50dd00718c0f3d183a7f8520a3bb1351b3f0a394933f0b94d33cf5f5b1b930fd46
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbes:q7Tc2NYHUrAwfMp3CDs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4484-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3140-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3420-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3360-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-690-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-1297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-1701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2232 hhtnbh.exe 2428 llrfxrf.exe 216 pdjvp.exe 880 hbtnbt.exe 3140 jjpvp.exe 2892 jdjdj.exe 928 bhbbth.exe 2592 9xrfxff.exe 3556 ddpjd.exe 1688 nbbtnh.exe 4452 lflfxxr.exe 4172 nnbbnt.exe 3708 pdddv.exe 4356 pjdvj.exe 3416 jdjdj.exe 1508 pvjjj.exe 3076 dppjv.exe 4040 dvjdp.exe 4776 1ntnbb.exe 2208 lflffrf.exe 3712 hnhbtt.exe 3848 lflllff.exe 3684 3dpjv.exe 1196 ffxlfxr.exe 3984 ntnbtn.exe 1828 xlxlrlr.exe 1048 pvdpj.exe 4984 jjvpv.exe 2512 djdvp.exe 4724 rlxrfff.exe 3868 bttnht.exe 4616 bbtnhh.exe 2944 nhnnhh.exe 468 pvpdp.exe 1100 rlxrffr.exe 2932 9hhhbb.exe 3180 hhttnn.exe 2028 7xrrflr.exe 3280 hhtbtt.exe 2724 pdvpj.exe 2552 ffxxrll.exe 2244 7hnbtt.exe 4920 ddpvv.exe 996 vdpjd.exe 4524 xxfxlfx.exe 2056 hnhbhb.exe 1320 vjpjd.exe 452 jjjdv.exe 3024 xxrfrxr.exe 1632 bnnhtt.exe 4484 xrxrflx.exe 2232 btttnn.exe 2380 9tbtnn.exe 3420 pjjdv.exe 3888 3xrlffx.exe 1332 nthbnh.exe 4472 hnnbtn.exe 4000 pvpdp.exe 1984 1xrlffx.exe 1484 nnbtnn.exe 1840 3vdjd.exe 4352 xfffxxx.exe 3148 fffxllf.exe 3556 bhbtnn.exe -
resource yara_rule behavioral2/memory/4484-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3140-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1332-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3360-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/996-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-1297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-1634-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4484 wrote to memory of 2232 4484 ac20f05c31a5c02f1ef632eb091a11dcd3a083b60301d568038084a7ee2726f7.exe 83 PID 4484 wrote to memory of 2232 4484 ac20f05c31a5c02f1ef632eb091a11dcd3a083b60301d568038084a7ee2726f7.exe 83 PID 4484 wrote to memory of 2232 4484 ac20f05c31a5c02f1ef632eb091a11dcd3a083b60301d568038084a7ee2726f7.exe 83 PID 2232 wrote to memory of 2428 2232 hhtnbh.exe 84 PID 2232 wrote to memory of 2428 2232 hhtnbh.exe 84 PID 2232 wrote to memory of 2428 2232 hhtnbh.exe 84 PID 2428 wrote to memory of 216 2428 llrfxrf.exe 85 PID 2428 wrote to memory of 216 2428 llrfxrf.exe 85 PID 2428 wrote to memory of 216 2428 llrfxrf.exe 85 PID 216 wrote to memory of 880 216 pdjvp.exe 86 PID 216 wrote to memory of 880 216 pdjvp.exe 86 PID 216 wrote to memory of 880 216 pdjvp.exe 86 PID 880 wrote to memory of 3140 880 hbtnbt.exe 87 PID 880 wrote to memory of 3140 880 hbtnbt.exe 87 PID 880 wrote to memory of 3140 880 hbtnbt.exe 87 PID 3140 wrote to memory of 2892 3140 jjpvp.exe 88 PID 3140 wrote to memory of 2892 3140 jjpvp.exe 88 PID 3140 wrote to memory of 2892 3140 jjpvp.exe 88 PID 2892 wrote to memory of 928 2892 jdjdj.exe 89 PID 2892 wrote to memory of 928 2892 jdjdj.exe 89 PID 2892 wrote to memory of 928 2892 jdjdj.exe 89 PID 928 wrote to memory of 2592 928 bhbbth.exe 90 PID 928 wrote to memory of 2592 928 bhbbth.exe 90 PID 928 wrote to memory of 2592 928 bhbbth.exe 90 PID 2592 wrote to memory of 3556 2592 9xrfxff.exe 91 PID 2592 wrote to memory of 3556 2592 9xrfxff.exe 91 PID 2592 wrote to memory of 3556 2592 9xrfxff.exe 91 PID 3556 wrote to memory of 1688 3556 ddpjd.exe 92 PID 3556 wrote to memory of 1688 3556 ddpjd.exe 92 PID 3556 wrote to memory of 1688 3556 ddpjd.exe 92 PID 1688 wrote to memory of 4452 1688 nbbtnh.exe 93 PID 1688 wrote to memory of 4452 1688 nbbtnh.exe 93 PID 1688 wrote to memory of 4452 1688 nbbtnh.exe 93 PID 4452 wrote to memory of 4172 4452 lflfxxr.exe 94 PID 4452 wrote to memory of 4172 4452 lflfxxr.exe 94 PID 4452 wrote to memory of 4172 4452 lflfxxr.exe 94 PID 4172 wrote to memory of 3708 4172 nnbbnt.exe 95 PID 4172 wrote to memory of 3708 4172 nnbbnt.exe 95 PID 4172 wrote to memory of 3708 4172 nnbbnt.exe 95 PID 3708 wrote to memory of 4356 3708 pdddv.exe 96 PID 3708 wrote to memory of 4356 3708 pdddv.exe 96 PID 3708 wrote to memory of 4356 3708 pdddv.exe 96 PID 4356 wrote to memory of 3416 4356 pjdvj.exe 97 PID 4356 wrote to memory of 3416 4356 pjdvj.exe 97 PID 4356 wrote to memory of 3416 4356 pjdvj.exe 97 PID 3416 wrote to memory of 1508 3416 jdjdj.exe 98 PID 3416 wrote to memory of 1508 3416 jdjdj.exe 98 PID 3416 wrote to memory of 1508 3416 jdjdj.exe 98 PID 1508 wrote to memory of 3076 1508 pvjjj.exe 99 PID 1508 wrote to memory of 3076 1508 pvjjj.exe 99 PID 1508 wrote to memory of 3076 1508 pvjjj.exe 99 PID 3076 wrote to memory of 4040 3076 dppjv.exe 100 PID 3076 wrote to memory of 4040 3076 dppjv.exe 100 PID 3076 wrote to memory of 4040 3076 dppjv.exe 100 PID 4040 wrote to memory of 4776 4040 dvjdp.exe 101 PID 4040 wrote to memory of 4776 4040 dvjdp.exe 101 PID 4040 wrote to memory of 4776 4040 dvjdp.exe 101 PID 4776 wrote to memory of 2208 4776 1ntnbb.exe 102 PID 4776 wrote to memory of 2208 4776 1ntnbb.exe 102 PID 4776 wrote to memory of 2208 4776 1ntnbb.exe 102 PID 2208 wrote to memory of 3712 2208 lflffrf.exe 103 PID 2208 wrote to memory of 3712 2208 lflffrf.exe 103 PID 2208 wrote to memory of 3712 2208 lflffrf.exe 103 PID 3712 wrote to memory of 3848 3712 hnhbtt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac20f05c31a5c02f1ef632eb091a11dcd3a083b60301d568038084a7ee2726f7.exe"C:\Users\Admin\AppData\Local\Temp\ac20f05c31a5c02f1ef632eb091a11dcd3a083b60301d568038084a7ee2726f7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\hhtnbh.exec:\hhtnbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\llrfxrf.exec:\llrfxrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\pdjvp.exec:\pdjvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\hbtnbt.exec:\hbtnbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\jjpvp.exec:\jjpvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\jdjdj.exec:\jdjdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\bhbbth.exec:\bhbbth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\9xrfxff.exec:\9xrfxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\ddpjd.exec:\ddpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\nbbtnh.exec:\nbbtnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\lflfxxr.exec:\lflfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\nnbbnt.exec:\nnbbnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\pdddv.exec:\pdddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\pjdvj.exec:\pjdvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\jdjdj.exec:\jdjdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\pvjjj.exec:\pvjjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\dppjv.exec:\dppjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\dvjdp.exec:\dvjdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\1ntnbb.exec:\1ntnbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\lflffrf.exec:\lflffrf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\hnhbtt.exec:\hnhbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\lflllff.exec:\lflllff.exe23⤵
- Executes dropped EXE
PID:3848 -
\??\c:\3dpjv.exec:\3dpjv.exe24⤵
- Executes dropped EXE
PID:3684 -
\??\c:\ffxlfxr.exec:\ffxlfxr.exe25⤵
- Executes dropped EXE
PID:1196 -
\??\c:\ntnbtn.exec:\ntnbtn.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3984 -
\??\c:\xlxlrlr.exec:\xlxlrlr.exe27⤵
- Executes dropped EXE
PID:1828 -
\??\c:\pvdpj.exec:\pvdpj.exe28⤵
- Executes dropped EXE
PID:1048 -
\??\c:\jjvpv.exec:\jjvpv.exe29⤵
- Executes dropped EXE
PID:4984 -
\??\c:\djdvp.exec:\djdvp.exe30⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rlxrfff.exec:\rlxrfff.exe31⤵
- Executes dropped EXE
PID:4724 -
\??\c:\bttnht.exec:\bttnht.exe32⤵
- Executes dropped EXE
PID:3868 -
\??\c:\bbtnhh.exec:\bbtnhh.exe33⤵
- Executes dropped EXE
PID:4616 -
\??\c:\nhnnhh.exec:\nhnnhh.exe34⤵
- Executes dropped EXE
PID:2944 -
\??\c:\pvpdp.exec:\pvpdp.exe35⤵
- Executes dropped EXE
PID:468 -
\??\c:\rlxrffr.exec:\rlxrffr.exe36⤵
- Executes dropped EXE
PID:1100 -
\??\c:\9hhhbb.exec:\9hhhbb.exe37⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hhttnn.exec:\hhttnn.exe38⤵
- Executes dropped EXE
PID:3180 -
\??\c:\7xrrflr.exec:\7xrrflr.exe39⤵
- Executes dropped EXE
PID:2028 -
\??\c:\hhtbtt.exec:\hhtbtt.exe40⤵
- Executes dropped EXE
PID:3280 -
\??\c:\pdvpj.exec:\pdvpj.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\ffxxrll.exec:\ffxxrll.exe42⤵
- Executes dropped EXE
PID:2552 -
\??\c:\7hnbtt.exec:\7hnbtt.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2244 -
\??\c:\ddpvv.exec:\ddpvv.exe44⤵
- Executes dropped EXE
PID:4920 -
\??\c:\vdpjd.exec:\vdpjd.exe45⤵
- Executes dropped EXE
PID:996 -
\??\c:\xxfxlfx.exec:\xxfxlfx.exe46⤵
- Executes dropped EXE
PID:4524 -
\??\c:\hnhbhb.exec:\hnhbhb.exe47⤵
- Executes dropped EXE
PID:2056 -
\??\c:\vjpjd.exec:\vjpjd.exe48⤵
- Executes dropped EXE
PID:1320 -
\??\c:\jjjdv.exec:\jjjdv.exe49⤵
- Executes dropped EXE
PID:452 -
\??\c:\xxrfrxr.exec:\xxrfrxr.exe50⤵
- Executes dropped EXE
PID:3024 -
\??\c:\bnnhtt.exec:\bnnhtt.exe51⤵
- Executes dropped EXE
PID:1632 -
\??\c:\pppjv.exec:\pppjv.exe52⤵PID:3696
-
\??\c:\xrxrflx.exec:\xrxrflx.exe53⤵
- Executes dropped EXE
PID:4484 -
\??\c:\btttnn.exec:\btttnn.exe54⤵
- Executes dropped EXE
PID:2232 -
\??\c:\9tbtnn.exec:\9tbtnn.exe55⤵
- Executes dropped EXE
PID:2380 -
\??\c:\pjjdv.exec:\pjjdv.exe56⤵
- Executes dropped EXE
PID:3420 -
\??\c:\3xrlffx.exec:\3xrlffx.exe57⤵
- Executes dropped EXE
PID:3888 -
\??\c:\nthbnh.exec:\nthbnh.exe58⤵
- Executes dropped EXE
PID:1332 -
\??\c:\hnnbtn.exec:\hnnbtn.exe59⤵
- Executes dropped EXE
PID:4472 -
\??\c:\pvpdp.exec:\pvpdp.exe60⤵
- Executes dropped EXE
PID:4000 -
\??\c:\1xrlffx.exec:\1xrlffx.exe61⤵
- Executes dropped EXE
PID:1984 -
\??\c:\nnbtnn.exec:\nnbtnn.exe62⤵
- Executes dropped EXE
PID:1484 -
\??\c:\3vdjd.exec:\3vdjd.exe63⤵
- Executes dropped EXE
PID:1840 -
\??\c:\xfffxxx.exec:\xfffxxx.exe64⤵
- Executes dropped EXE
PID:4352 -
\??\c:\fffxllf.exec:\fffxllf.exe65⤵
- Executes dropped EXE
PID:3148 -
\??\c:\bhbtnn.exec:\bhbtnn.exe66⤵
- Executes dropped EXE
PID:3556 -
\??\c:\dddpd.exec:\dddpd.exe67⤵PID:4696
-
\??\c:\vddvv.exec:\vddvv.exe68⤵PID:3692
-
\??\c:\llfxrlf.exec:\llfxrlf.exe69⤵PID:1808
-
\??\c:\lxrfllf.exec:\lxrfllf.exe70⤵PID:1408
-
\??\c:\btntth.exec:\btntth.exe71⤵PID:2832
-
\??\c:\3ddjv.exec:\3ddjv.exe72⤵PID:2224
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe73⤵PID:3652
-
\??\c:\9ttnhb.exec:\9ttnhb.exe74⤵PID:3136
-
\??\c:\7vvpp.exec:\7vvpp.exe75⤵PID:2696
-
\??\c:\rxxrrxx.exec:\rxxrrxx.exe76⤵PID:1508
-
\??\c:\bbnhhh.exec:\bbnhhh.exe77⤵PID:2096
-
\??\c:\ttttnn.exec:\ttttnn.exe78⤵PID:1936
-
\??\c:\ppvdj.exec:\ppvdj.exe79⤵PID:1488
-
\??\c:\rxrlxxl.exec:\rxrlxxl.exe80⤵PID:3952
-
\??\c:\7nnhnh.exec:\7nnhnh.exe81⤵PID:2920
-
\??\c:\dpjdv.exec:\dpjdv.exe82⤵PID:3268
-
\??\c:\5ppdp.exec:\5ppdp.exe83⤵PID:2664
-
\??\c:\5xffxxx.exec:\5xffxxx.exe84⤵PID:3960
-
\??\c:\bbhbhb.exec:\bbhbhb.exe85⤵PID:688
-
\??\c:\1ddpj.exec:\1ddpj.exe86⤵PID:4480
-
\??\c:\vdvpd.exec:\vdvpd.exe87⤵PID:1040
-
\??\c:\llxfxxx.exec:\llxfxxx.exe88⤵PID:3232
-
\??\c:\1tnhhh.exec:\1tnhhh.exe89⤵PID:1828
-
\??\c:\jvpjj.exec:\jvpjj.exe90⤵PID:2940
-
\??\c:\rxfrlrl.exec:\rxfrlrl.exe91⤵PID:3796
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe92⤵PID:2736
-
\??\c:\nhbtbb.exec:\nhbtbb.exe93⤵PID:4884
-
\??\c:\dpddj.exec:\dpddj.exe94⤵PID:2732
-
\??\c:\lxxrrfl.exec:\lxxrrfl.exe95⤵PID:5084
-
\??\c:\1nnhbb.exec:\1nnhbb.exe96⤵PID:3868
-
\??\c:\9jjdv.exec:\9jjdv.exe97⤵PID:3572
-
\??\c:\dvvjj.exec:\dvvjj.exe98⤵PID:2944
-
\??\c:\rffxrrl.exec:\rffxrrl.exe99⤵PID:4844
-
\??\c:\lfxxrlf.exec:\lfxxrlf.exe100⤵PID:2288
-
\??\c:\hhhhbh.exec:\hhhhbh.exe101⤵PID:3432
-
\??\c:\1pvvv.exec:\1pvvv.exe102⤵PID:4260
-
\??\c:\7ffxrxl.exec:\7ffxrxl.exe103⤵PID:3004
-
\??\c:\bbbbbn.exec:\bbbbbn.exe104⤵PID:4848
-
\??\c:\vdjjd.exec:\vdjjd.exe105⤵PID:4996
-
\??\c:\7lxrfrl.exec:\7lxrfrl.exe106⤵PID:4912
-
\??\c:\1bhbbn.exec:\1bhbbn.exe107⤵PID:920
-
\??\c:\pjpjp.exec:\pjpjp.exe108⤵PID:3104
-
\??\c:\7jvpj.exec:\7jvpj.exe109⤵PID:2228
-
\??\c:\7llfffx.exec:\7llfffx.exe110⤵PID:2260
-
\??\c:\lffrxxr.exec:\lffrxxr.exe111⤵PID:628
-
\??\c:\hnnhhb.exec:\hnnhhb.exe112⤵PID:3244
-
\??\c:\pvppv.exec:\pvppv.exe113⤵PID:2844
-
\??\c:\lfrlffl.exec:\lfrlffl.exe114⤵PID:4332
-
\??\c:\rlllffl.exec:\rlllffl.exe115⤵PID:4336
-
\??\c:\tbbthh.exec:\tbbthh.exe116⤵
- System Location Discovery: System Language Discovery
PID:2888 -
\??\c:\nbhbtn.exec:\nbhbtn.exe117⤵PID:2252
-
\??\c:\vpjjd.exec:\vpjjd.exe118⤵PID:4456
-
\??\c:\llrfxrx.exec:\llrfxrx.exe119⤵PID:1980
-
\??\c:\hbbtnt.exec:\hbbtnt.exe120⤵PID:2044
-
\??\c:\dpvvp.exec:\dpvvp.exe121⤵PID:412
-
\??\c:\pvpjd.exec:\pvpjd.exe122⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-