Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 02:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe
-
Size
455KB
-
MD5
4a95c4737c3d2d34c68cdbe7e841e547
-
SHA1
708ed77fef0fa022195701f9ef380b1abcfc727e
-
SHA256
b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7
-
SHA512
db0b439d24847574c9d2dca6c2c8011402d1fc3848c4924ecaf4fe02b9229668bc7b5026a6b3c84950baf4e4dc1b47fcab9dbc67aedeaf8c68aead663fcc5fe9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRc:q7Tc2NYHUrAwfMp3CDRc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2928-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/364-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/264-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/364-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/320-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1768-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/952-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1840-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2704-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-768-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-778-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-822-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-877-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-911-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-939-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/720-1784-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3444 hnnbtn.exe 364 xrrrxrr.exe 2340 ttbnhh.exe 1112 bhnbtn.exe 2104 jdpjj.exe 2024 nnbbhh.exe 556 dvddv.exe 1840 lfrrflx.exe 3132 tbhbtt.exe 2184 pjppp.exe 4684 fllllxf.exe 4948 bhhhnh.exe 3632 vjvpp.exe 3564 9lxrlrl.exe 4724 xrffxxx.exe 4152 bbnnnn.exe 2264 vvddd.exe 5008 1fllffl.exe 228 fflflll.exe 952 nttntt.exe 1576 bhtnht.exe 1608 jddvd.exe 2632 rrffxxr.exe 4956 xlrrrrx.exe 2476 thtnnh.exe 1688 dvjdv.exe 1920 ppppd.exe 3552 rlrllfx.exe 3300 bnttnn.exe 1212 ttbhbh.exe 2716 vdpjd.exe 1768 djjvj.exe 2364 rrxrrll.exe 4308 tntnnn.exe 1584 hbbbbb.exe 1700 djvpj.exe 4752 xxlllrx.exe 2676 xrxxrrr.exe 4164 nthbbh.exe 4312 vdjdv.exe 4588 rrfxxxx.exe 2852 ttbbbn.exe 1948 ntthtn.exe 1120 pvjdd.exe 4172 3jvdv.exe 320 xxxrfxx.exe 3472 bthbhh.exe 4592 bnbbbb.exe 1400 pvdvp.exe 852 xxfxxrr.exe 1388 xffrxrl.exe 4256 tttnnn.exe 3924 dpddj.exe 2984 dddvv.exe 2548 rxxxrxx.exe 4448 3hbbbb.exe 3096 tnbtnb.exe 776 rrrrrrr.exe 1748 lfllfff.exe 2260 bhnnnn.exe 5112 5vvdd.exe 2648 dpdvv.exe 4060 lfrxxff.exe 364 tbhhtt.exe -
resource yara_rule behavioral2/memory/2928-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/364-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1388-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/264-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/364-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3300-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/952-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1840-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2704-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-768-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-911-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-939-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxlrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlllllr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2928 wrote to memory of 3444 2928 b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe 82 PID 2928 wrote to memory of 3444 2928 b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe 82 PID 2928 wrote to memory of 3444 2928 b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe 82 PID 3444 wrote to memory of 364 3444 hnnbtn.exe 146 PID 3444 wrote to memory of 364 3444 hnnbtn.exe 146 PID 3444 wrote to memory of 364 3444 hnnbtn.exe 146 PID 364 wrote to memory of 2340 364 xrrrxrr.exe 84 PID 364 wrote to memory of 2340 364 xrrrxrr.exe 84 PID 364 wrote to memory of 2340 364 xrrrxrr.exe 84 PID 2340 wrote to memory of 1112 2340 ttbnhh.exe 85 PID 2340 wrote to memory of 1112 2340 ttbnhh.exe 85 PID 2340 wrote to memory of 1112 2340 ttbnhh.exe 85 PID 1112 wrote to memory of 2104 1112 bhnbtn.exe 150 PID 1112 wrote to memory of 2104 1112 bhnbtn.exe 150 PID 1112 wrote to memory of 2104 1112 bhnbtn.exe 150 PID 2104 wrote to memory of 2024 2104 jdpjj.exe 87 PID 2104 wrote to memory of 2024 2104 jdpjj.exe 87 PID 2104 wrote to memory of 2024 2104 jdpjj.exe 87 PID 2024 wrote to memory of 556 2024 nnbbhh.exe 88 PID 2024 wrote to memory of 556 2024 nnbbhh.exe 88 PID 2024 wrote to memory of 556 2024 nnbbhh.exe 88 PID 556 wrote to memory of 1840 556 dvddv.exe 89 PID 556 wrote to memory of 1840 556 dvddv.exe 89 PID 556 wrote to memory of 1840 556 dvddv.exe 89 PID 1840 wrote to memory of 3132 1840 lfrrflx.exe 90 PID 1840 wrote to memory of 3132 1840 lfrrflx.exe 90 PID 1840 wrote to memory of 3132 1840 lfrrflx.exe 90 PID 3132 wrote to memory of 2184 3132 tbhbtt.exe 91 PID 3132 wrote to memory of 2184 3132 tbhbtt.exe 91 PID 3132 wrote to memory of 2184 3132 tbhbtt.exe 91 PID 2184 wrote to memory of 4684 2184 pjppp.exe 92 PID 2184 wrote to memory of 4684 2184 pjppp.exe 92 PID 2184 wrote to memory of 4684 2184 pjppp.exe 92 PID 4684 wrote to memory of 4948 4684 fllllxf.exe 93 PID 4684 wrote to memory of 4948 4684 fllllxf.exe 93 PID 4684 wrote to memory of 4948 4684 fllllxf.exe 93 PID 4948 wrote to memory of 3632 4948 bhhhnh.exe 94 PID 4948 wrote to memory of 3632 4948 bhhhnh.exe 94 PID 4948 wrote to memory of 3632 4948 bhhhnh.exe 94 PID 3632 wrote to memory of 3564 3632 vjvpp.exe 95 PID 3632 wrote to memory of 3564 3632 vjvpp.exe 95 PID 3632 wrote to memory of 3564 3632 vjvpp.exe 95 PID 3564 wrote to memory of 4724 3564 9lxrlrl.exe 96 PID 3564 wrote to memory of 4724 3564 9lxrlrl.exe 96 PID 3564 wrote to memory of 4724 3564 9lxrlrl.exe 96 PID 4724 wrote to memory of 4152 4724 xrffxxx.exe 97 PID 4724 wrote to memory of 4152 4724 xrffxxx.exe 97 PID 4724 wrote to memory of 4152 4724 xrffxxx.exe 97 PID 4152 wrote to memory of 2264 4152 bbnnnn.exe 98 PID 4152 wrote to memory of 2264 4152 bbnnnn.exe 98 PID 4152 wrote to memory of 2264 4152 bbnnnn.exe 98 PID 2264 wrote to memory of 5008 2264 vvddd.exe 99 PID 2264 wrote to memory of 5008 2264 vvddd.exe 99 PID 2264 wrote to memory of 5008 2264 vvddd.exe 99 PID 5008 wrote to memory of 228 5008 1fllffl.exe 100 PID 5008 wrote to memory of 228 5008 1fllffl.exe 100 PID 5008 wrote to memory of 228 5008 1fllffl.exe 100 PID 228 wrote to memory of 952 228 fflflll.exe 101 PID 228 wrote to memory of 952 228 fflflll.exe 101 PID 228 wrote to memory of 952 228 fflflll.exe 101 PID 952 wrote to memory of 1576 952 nttntt.exe 102 PID 952 wrote to memory of 1576 952 nttntt.exe 102 PID 952 wrote to memory of 1576 952 nttntt.exe 102 PID 1576 wrote to memory of 1608 1576 bhtnht.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe"C:\Users\Admin\AppData\Local\Temp\b821c56b74ed9acf592fc3251047cbbb3f4ca737835f17cd1ec6e6b92ef675f7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\hnnbtn.exec:\hnnbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\xrrrxrr.exec:\xrrrxrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
\??\c:\ttbnhh.exec:\ttbnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\bhnbtn.exec:\bhnbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\jdpjj.exec:\jdpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\nnbbhh.exec:\nnbbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\dvddv.exec:\dvddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\lfrrflx.exec:\lfrrflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\tbhbtt.exec:\tbhbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\pjppp.exec:\pjppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\fllllxf.exec:\fllllxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\bhhhnh.exec:\bhhhnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\vjvpp.exec:\vjvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\9lxrlrl.exec:\9lxrlrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\xrffxxx.exec:\xrffxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\bbnnnn.exec:\bbnnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\vvddd.exec:\vvddd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\1fllffl.exec:\1fllffl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\fflflll.exec:\fflflll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\nttntt.exec:\nttntt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\bhtnht.exec:\bhtnht.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\jddvd.exec:\jddvd.exe23⤵
- Executes dropped EXE
PID:1608 -
\??\c:\rrffxxr.exec:\rrffxxr.exe24⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xlrrrrx.exec:\xlrrrrx.exe25⤵
- Executes dropped EXE
PID:4956 -
\??\c:\thtnnh.exec:\thtnnh.exe26⤵
- Executes dropped EXE
PID:2476 -
\??\c:\dvjdv.exec:\dvjdv.exe27⤵
- Executes dropped EXE
PID:1688 -
\??\c:\ppppd.exec:\ppppd.exe28⤵
- Executes dropped EXE
PID:1920 -
\??\c:\rlrllfx.exec:\rlrllfx.exe29⤵
- Executes dropped EXE
PID:3552 -
\??\c:\bnttnn.exec:\bnttnn.exe30⤵
- Executes dropped EXE
PID:3300 -
\??\c:\ttbhbh.exec:\ttbhbh.exe31⤵
- Executes dropped EXE
PID:1212 -
\??\c:\vdpjd.exec:\vdpjd.exe32⤵
- Executes dropped EXE
PID:2716 -
\??\c:\djjvj.exec:\djjvj.exe33⤵
- Executes dropped EXE
PID:1768 -
\??\c:\rrxrrll.exec:\rrxrrll.exe34⤵
- Executes dropped EXE
PID:2364 -
\??\c:\tntnnn.exec:\tntnnn.exe35⤵
- Executes dropped EXE
PID:4308 -
\??\c:\hbbbbb.exec:\hbbbbb.exe36⤵
- Executes dropped EXE
PID:1584 -
\??\c:\djvpj.exec:\djvpj.exe37⤵
- Executes dropped EXE
PID:1700 -
\??\c:\xxlllrx.exec:\xxlllrx.exe38⤵
- Executes dropped EXE
PID:4752 -
\??\c:\xrxxrrr.exec:\xrxxrrr.exe39⤵
- Executes dropped EXE
PID:2676 -
\??\c:\nthbbh.exec:\nthbbh.exe40⤵
- Executes dropped EXE
PID:4164 -
\??\c:\vdjdv.exec:\vdjdv.exe41⤵
- Executes dropped EXE
PID:4312 -
\??\c:\rrfxxxx.exec:\rrfxxxx.exe42⤵
- Executes dropped EXE
PID:4588 -
\??\c:\ttbbbn.exec:\ttbbbn.exe43⤵
- Executes dropped EXE
PID:2852 -
\??\c:\ntthtn.exec:\ntthtn.exe44⤵
- Executes dropped EXE
PID:1948 -
\??\c:\pvjdd.exec:\pvjdd.exe45⤵
- Executes dropped EXE
PID:1120 -
\??\c:\3jvdv.exec:\3jvdv.exe46⤵
- Executes dropped EXE
PID:4172 -
\??\c:\xxxrfxx.exec:\xxxrfxx.exe47⤵
- Executes dropped EXE
PID:320 -
\??\c:\bthbhh.exec:\bthbhh.exe48⤵
- Executes dropped EXE
PID:3472 -
\??\c:\bnbbbb.exec:\bnbbbb.exe49⤵
- Executes dropped EXE
PID:4592 -
\??\c:\pvdvp.exec:\pvdvp.exe50⤵
- Executes dropped EXE
PID:1400 -
\??\c:\xxfxxrr.exec:\xxfxxrr.exe51⤵
- Executes dropped EXE
PID:852 -
\??\c:\xffrxrl.exec:\xffrxrl.exe52⤵
- Executes dropped EXE
PID:1388 -
\??\c:\tttnnn.exec:\tttnnn.exe53⤵
- Executes dropped EXE
PID:4256 -
\??\c:\dpddj.exec:\dpddj.exe54⤵
- Executes dropped EXE
PID:3924 -
\??\c:\dddvv.exec:\dddvv.exe55⤵
- Executes dropped EXE
PID:2984 -
\??\c:\rxxxrxx.exec:\rxxxrxx.exe56⤵
- Executes dropped EXE
PID:2548 -
\??\c:\3hbbbb.exec:\3hbbbb.exe57⤵
- Executes dropped EXE
PID:4448 -
\??\c:\tnbtnb.exec:\tnbtnb.exe58⤵
- Executes dropped EXE
PID:3096 -
\??\c:\ppvpj.exec:\ppvpj.exe59⤵PID:4380
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe60⤵
- Executes dropped EXE
PID:776 -
\??\c:\lfllfff.exec:\lfllfff.exe61⤵
- Executes dropped EXE
PID:1748 -
\??\c:\bhnnnn.exec:\bhnnnn.exe62⤵
- Executes dropped EXE
PID:2260 -
\??\c:\5vvdd.exec:\5vvdd.exe63⤵
- Executes dropped EXE
PID:5112 -
\??\c:\dpdvv.exec:\dpdvv.exe64⤵
- Executes dropped EXE
PID:2648 -
\??\c:\lfrxxff.exec:\lfrxxff.exe65⤵
- Executes dropped EXE
PID:4060 -
\??\c:\tbhhtt.exec:\tbhhtt.exe66⤵
- Executes dropped EXE
PID:364 -
\??\c:\nntnnh.exec:\nntnnh.exe67⤵PID:1484
-
\??\c:\5jdvp.exec:\5jdvp.exe68⤵PID:3576
-
\??\c:\lrfxrrl.exec:\lrfxrrl.exe69⤵PID:3736
-
\??\c:\xrrrrrx.exec:\xrrrrrx.exe70⤵PID:2104
-
\??\c:\9bhhbb.exec:\9bhhbb.exe71⤵PID:264
-
\??\c:\dvddd.exec:\dvddd.exe72⤵PID:2996
-
\??\c:\rlffffl.exec:\rlffffl.exe73⤵PID:3652
-
\??\c:\nhhhbb.exec:\nhhhbb.exe74⤵PID:516
-
\??\c:\nnthhn.exec:\nnthhn.exe75⤵PID:1460
-
\??\c:\vjvvp.exec:\vjvvp.exe76⤵PID:216
-
\??\c:\xxllllr.exec:\xxllllr.exe77⤵PID:1852
-
\??\c:\nhnhhn.exec:\nhnhhn.exe78⤵
- System Location Discovery: System Language Discovery
PID:1012 -
\??\c:\pjjpd.exec:\pjjpd.exe79⤵PID:1408
-
\??\c:\bnhnnn.exec:\bnhnnn.exe80⤵PID:2288
-
\??\c:\tnnnnn.exec:\tnnnnn.exe81⤵PID:2388
-
\??\c:\nhnhnt.exec:\nhnhnt.exe82⤵PID:3112
-
\??\c:\hntbhh.exec:\hntbhh.exe83⤵PID:5044
-
\??\c:\rxxxfll.exec:\rxxxfll.exe84⤵
- System Location Discovery: System Language Discovery
PID:1652 -
\??\c:\hhnhhh.exec:\hhnhhh.exe85⤵PID:1780
-
\??\c:\nnbbnn.exec:\nnbbnn.exe86⤵PID:4408
-
\??\c:\rrxxxlr.exec:\rrxxxlr.exe87⤵PID:1320
-
\??\c:\ntnnhb.exec:\ntnnhb.exe88⤵PID:2704
-
\??\c:\nnhhhn.exec:\nnhhhn.exe89⤵PID:1420
-
\??\c:\nhnnhh.exec:\nhnnhh.exe90⤵PID:8
-
\??\c:\jddvv.exec:\jddvv.exe91⤵PID:4076
-
\??\c:\djddd.exec:\djddd.exe92⤵PID:4304
-
\??\c:\hbttnn.exec:\hbttnn.exe93⤵PID:1492
-
\??\c:\rfrrxfx.exec:\rfrrxfx.exe94⤵PID:1768
-
\??\c:\jjvdd.exec:\jjvdd.exe95⤵PID:4400
-
\??\c:\xlrxrxx.exec:\xlrxrxx.exe96⤵PID:3044
-
\??\c:\1xxxxxx.exec:\1xxxxxx.exe97⤵PID:4636
-
\??\c:\bbhhhh.exec:\bbhhhh.exe98⤵PID:3276
-
\??\c:\jvjjv.exec:\jvjjv.exe99⤵PID:2576
-
\??\c:\9xlllrr.exec:\9xlllrr.exe100⤵PID:4164
-
\??\c:\xfllrrf.exec:\xfllrrf.exe101⤵PID:4620
-
\??\c:\jjdvj.exec:\jjdvj.exe102⤵PID:4596
-
\??\c:\nhhbnn.exec:\nhhbnn.exe103⤵PID:2852
-
\??\c:\ppvvd.exec:\ppvvd.exe104⤵PID:1284
-
\??\c:\rlrrrrl.exec:\rlrrrrl.exe105⤵PID:1120
-
\??\c:\fxrlfxx.exec:\fxrlfxx.exe106⤵PID:3372
-
\??\c:\bnnbhh.exec:\bnnbhh.exe107⤵PID:3744
-
\??\c:\jdjjj.exec:\jdjjj.exe108⤵PID:4592
-
\??\c:\xlllllr.exec:\xlllllr.exe109⤵
- System Location Discovery: System Language Discovery
PID:4916 -
\??\c:\lrxxxff.exec:\lrxxxff.exe110⤵PID:852
-
\??\c:\bthhhn.exec:\bthhhn.exe111⤵PID:1816
-
\??\c:\ppvvp.exec:\ppvvp.exe112⤵PID:4196
-
\??\c:\fllllrr.exec:\fllllrr.exe113⤵PID:4884
-
\??\c:\btnnnt.exec:\btnnnt.exe114⤵PID:3924
-
\??\c:\bbtnbb.exec:\bbtnbb.exe115⤵PID:3408
-
\??\c:\jjppv.exec:\jjppv.exe116⤵PID:564
-
\??\c:\7frrrxf.exec:\7frrrxf.exe117⤵PID:3872
-
\??\c:\hbnnnt.exec:\hbnnnt.exe118⤵PID:4492
-
\??\c:\jdpvv.exec:\jdpvv.exe119⤵PID:2132
-
\??\c:\xrllffx.exec:\xrllffx.exe120⤵PID:4388
-
\??\c:\htbbbh.exec:\htbbbh.exe121⤵PID:4416
-
\??\c:\hbtnhn.exec:\hbtnhn.exe122⤵PID:1748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-