Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 07:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8eb5824e39b9cfea66be9c53577ef503c902b539134e139c5f2115afcae01acb.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
8eb5824e39b9cfea66be9c53577ef503c902b539134e139c5f2115afcae01acb.exe
-
Size
453KB
-
MD5
46415c86eca42713aea3dd7af18ac01c
-
SHA1
aebd7129f3467ce63fcf77596e52cc866f67e47c
-
SHA256
8eb5824e39b9cfea66be9c53577ef503c902b539134e139c5f2115afcae01acb
-
SHA512
790c779140fa5055564c3435b667114315b0383ffd3034d1b0d46bec462caca6a2747d7c608007b22d1dc81705c096fb85ef8673ce265275df3774422b0a22d1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3348-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2680-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1344-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3160-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1272-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1484-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-707-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-882-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-908-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-1160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-1314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-1673-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-1699-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3348 bbntnb.exe 1124 jdjpp.exe 1064 thnbbb.exe 1344 jvdjd.exe 1128 xflfrrl.exe 624 htbtnn.exe 1144 ntbnhh.exe 2016 lllfxrr.exe 3160 hhnhnn.exe 3496 ddjjd.exe 3820 1ntnhh.exe 4648 nnbhth.exe 4644 rxfxxxr.exe 4784 thbtnn.exe 2976 vpvpd.exe 1272 5rlxlfx.exe 396 nnthhh.exe 1580 btbtht.exe 1604 fffxrrx.exe 2720 tntnhh.exe 2748 jvdvv.exe 1916 fffxxxx.exe 3760 btbbbb.exe 4400 jdjjj.exe 1484 rrfrrrr.exe 2412 nhbbtt.exe 1960 ddpjp.exe 3424 xrlfxff.exe 1736 ttbbth.exe 996 hbbtnh.exe 5020 pjvpv.exe 3464 rxrlxrx.exe 4000 bhnbtb.exe 4084 9ntnnb.exe 608 jdjjd.exe 3028 5xrlfrl.exe 3284 xlrfxfx.exe 3408 bbhbtn.exe 5044 ppppp.exe 4208 3rxrflx.exe 3628 7ttnhn.exe 1908 bbthtb.exe 2724 vdvpp.exe 4344 fxffllr.exe 4396 thhbtt.exe 2160 ttbttt.exe 1288 pvdjd.exe 3348 3lxrlrl.exe 4776 hbtnnn.exe 2536 1xxxxll.exe 5052 dpddp.exe 1496 vpvvd.exe 4068 xffffxx.exe 2076 tnthth.exe 924 jjjjp.exe 920 nhhbbb.exe 1812 rlrrrrl.exe 3428 ppjdd.exe 3596 fxxrllf.exe 2276 nnntnh.exe 4988 dvdjj.exe 1892 btnbnn.exe 4648 5hnhtn.exe 5032 jvpvj.exe -
resource yara_rule behavioral2/memory/3348-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1344-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3160-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1272-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1484-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3312-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-882-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-908-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-1160-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2680 wrote to memory of 3348 2680 8eb5824e39b9cfea66be9c53577ef503c902b539134e139c5f2115afcae01acb.exe 82 PID 2680 wrote to memory of 3348 2680 8eb5824e39b9cfea66be9c53577ef503c902b539134e139c5f2115afcae01acb.exe 82 PID 2680 wrote to memory of 3348 2680 8eb5824e39b9cfea66be9c53577ef503c902b539134e139c5f2115afcae01acb.exe 82 PID 3348 wrote to memory of 1124 3348 bbntnb.exe 83 PID 3348 wrote to memory of 1124 3348 bbntnb.exe 83 PID 3348 wrote to memory of 1124 3348 bbntnb.exe 83 PID 1124 wrote to memory of 1064 1124 jdjpp.exe 84 PID 1124 wrote to memory of 1064 1124 jdjpp.exe 84 PID 1124 wrote to memory of 1064 1124 jdjpp.exe 84 PID 1064 wrote to memory of 1344 1064 thnbbb.exe 85 PID 1064 wrote to memory of 1344 1064 thnbbb.exe 85 PID 1064 wrote to memory of 1344 1064 thnbbb.exe 85 PID 1344 wrote to memory of 1128 1344 jvdjd.exe 86 PID 1344 wrote to memory of 1128 1344 jvdjd.exe 86 PID 1344 wrote to memory of 1128 1344 jvdjd.exe 86 PID 1128 wrote to memory of 624 1128 xflfrrl.exe 87 PID 1128 wrote to memory of 624 1128 xflfrrl.exe 87 PID 1128 wrote to memory of 624 1128 xflfrrl.exe 87 PID 624 wrote to memory of 1144 624 htbtnn.exe 88 PID 624 wrote to memory of 1144 624 htbtnn.exe 88 PID 624 wrote to memory of 1144 624 htbtnn.exe 88 PID 1144 wrote to memory of 2016 1144 ntbnhh.exe 89 PID 1144 wrote to memory of 2016 1144 ntbnhh.exe 89 PID 1144 wrote to memory of 2016 1144 ntbnhh.exe 89 PID 2016 wrote to memory of 3160 2016 lllfxrr.exe 90 PID 2016 wrote to memory of 3160 2016 lllfxrr.exe 90 PID 2016 wrote to memory of 3160 2016 lllfxrr.exe 90 PID 3160 wrote to memory of 3496 3160 hhnhnn.exe 91 PID 3160 wrote to memory of 3496 3160 hhnhnn.exe 91 PID 3160 wrote to memory of 3496 3160 hhnhnn.exe 91 PID 3496 wrote to memory of 3820 3496 ddjjd.exe 92 PID 3496 wrote to memory of 3820 3496 ddjjd.exe 92 PID 3496 wrote to memory of 3820 3496 ddjjd.exe 92 PID 3820 wrote to memory of 4648 3820 1ntnhh.exe 93 PID 3820 wrote to memory of 4648 3820 1ntnhh.exe 93 PID 3820 wrote to memory of 4648 3820 1ntnhh.exe 93 PID 4648 wrote to memory of 4644 4648 nnbhth.exe 94 PID 4648 wrote to memory of 4644 4648 nnbhth.exe 94 PID 4648 wrote to memory of 4644 4648 nnbhth.exe 94 PID 4644 wrote to memory of 4784 4644 rxfxxxr.exe 95 PID 4644 wrote to memory of 4784 4644 rxfxxxr.exe 95 PID 4644 wrote to memory of 4784 4644 rxfxxxr.exe 95 PID 4784 wrote to memory of 2976 4784 thbtnn.exe 96 PID 4784 wrote to memory of 2976 4784 thbtnn.exe 96 PID 4784 wrote to memory of 2976 4784 thbtnn.exe 96 PID 2976 wrote to memory of 1272 2976 vpvpd.exe 97 PID 2976 wrote to memory of 1272 2976 vpvpd.exe 97 PID 2976 wrote to memory of 1272 2976 vpvpd.exe 97 PID 1272 wrote to memory of 396 1272 5rlxlfx.exe 98 PID 1272 wrote to memory of 396 1272 5rlxlfx.exe 98 PID 1272 wrote to memory of 396 1272 5rlxlfx.exe 98 PID 396 wrote to memory of 1580 396 nnthhh.exe 99 PID 396 wrote to memory of 1580 396 nnthhh.exe 99 PID 396 wrote to memory of 1580 396 nnthhh.exe 99 PID 1580 wrote to memory of 1604 1580 btbtht.exe 100 PID 1580 wrote to memory of 1604 1580 btbtht.exe 100 PID 1580 wrote to memory of 1604 1580 btbtht.exe 100 PID 1604 wrote to memory of 2720 1604 fffxrrx.exe 101 PID 1604 wrote to memory of 2720 1604 fffxrrx.exe 101 PID 1604 wrote to memory of 2720 1604 fffxrrx.exe 101 PID 2720 wrote to memory of 2748 2720 tntnhh.exe 102 PID 2720 wrote to memory of 2748 2720 tntnhh.exe 102 PID 2720 wrote to memory of 2748 2720 tntnhh.exe 102 PID 2748 wrote to memory of 1916 2748 jvdvv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\8eb5824e39b9cfea66be9c53577ef503c902b539134e139c5f2115afcae01acb.exe"C:\Users\Admin\AppData\Local\Temp\8eb5824e39b9cfea66be9c53577ef503c902b539134e139c5f2115afcae01acb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\bbntnb.exec:\bbntnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\jdjpp.exec:\jdjpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\thnbbb.exec:\thnbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\jvdjd.exec:\jvdjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\xflfrrl.exec:\xflfrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\htbtnn.exec:\htbtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\ntbnhh.exec:\ntbnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\lllfxrr.exec:\lllfxrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\hhnhnn.exec:\hhnhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\ddjjd.exec:\ddjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\1ntnhh.exec:\1ntnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\nnbhth.exec:\nnbhth.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\rxfxxxr.exec:\rxfxxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\thbtnn.exec:\thbtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\vpvpd.exec:\vpvpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\5rlxlfx.exec:\5rlxlfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\nnthhh.exec:\nnthhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\btbtht.exec:\btbtht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\fffxrrx.exec:\fffxrrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\tntnhh.exec:\tntnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jvdvv.exec:\jvdvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\fffxxxx.exec:\fffxxxx.exe23⤵
- Executes dropped EXE
PID:1916 -
\??\c:\btbbbb.exec:\btbbbb.exe24⤵
- Executes dropped EXE
PID:3760 -
\??\c:\jdjjj.exec:\jdjjj.exe25⤵
- Executes dropped EXE
PID:4400 -
\??\c:\rrfrrrr.exec:\rrfrrrr.exe26⤵
- Executes dropped EXE
PID:1484 -
\??\c:\nhbbtt.exec:\nhbbtt.exe27⤵
- Executes dropped EXE
PID:2412 -
\??\c:\ddpjp.exec:\ddpjp.exe28⤵
- Executes dropped EXE
PID:1960 -
\??\c:\xrlfxff.exec:\xrlfxff.exe29⤵
- Executes dropped EXE
PID:3424 -
\??\c:\ttbbth.exec:\ttbbth.exe30⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hbbtnh.exec:\hbbtnh.exe31⤵
- Executes dropped EXE
PID:996 -
\??\c:\pjvpv.exec:\pjvpv.exe32⤵
- Executes dropped EXE
PID:5020 -
\??\c:\rxrlxrx.exec:\rxrlxrx.exe33⤵
- Executes dropped EXE
PID:3464 -
\??\c:\bhnbtb.exec:\bhnbtb.exe34⤵
- Executes dropped EXE
PID:4000 -
\??\c:\9ntnnb.exec:\9ntnnb.exe35⤵
- Executes dropped EXE
PID:4084 -
\??\c:\jdjjd.exec:\jdjjd.exe36⤵
- Executes dropped EXE
PID:608 -
\??\c:\5xrlfrl.exec:\5xrlfrl.exe37⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xlrfxfx.exec:\xlrfxfx.exe38⤵
- Executes dropped EXE
PID:3284 -
\??\c:\bbhbtn.exec:\bbhbtn.exe39⤵
- Executes dropped EXE
PID:3408 -
\??\c:\ppppp.exec:\ppppp.exe40⤵
- Executes dropped EXE
PID:5044 -
\??\c:\3rxrflx.exec:\3rxrflx.exe41⤵
- Executes dropped EXE
PID:4208 -
\??\c:\7ttnhn.exec:\7ttnhn.exe42⤵
- Executes dropped EXE
PID:3628 -
\??\c:\bbthtb.exec:\bbthtb.exe43⤵
- Executes dropped EXE
PID:1908 -
\??\c:\vdvpp.exec:\vdvpp.exe44⤵
- Executes dropped EXE
PID:2724 -
\??\c:\fxffllr.exec:\fxffllr.exe45⤵
- Executes dropped EXE
PID:4344 -
\??\c:\thhbtt.exec:\thhbtt.exe46⤵
- Executes dropped EXE
PID:4396 -
\??\c:\ttbttt.exec:\ttbttt.exe47⤵
- Executes dropped EXE
PID:2160 -
\??\c:\pvdjd.exec:\pvdjd.exe48⤵
- Executes dropped EXE
PID:1288 -
\??\c:\3lxrlrl.exec:\3lxrlrl.exe49⤵
- Executes dropped EXE
PID:3348 -
\??\c:\hbtnnn.exec:\hbtnnn.exe50⤵
- Executes dropped EXE
PID:4776 -
\??\c:\1xxxxll.exec:\1xxxxll.exe51⤵
- Executes dropped EXE
PID:2536 -
\??\c:\dpddp.exec:\dpddp.exe52⤵
- Executes dropped EXE
PID:5052 -
\??\c:\vpvvd.exec:\vpvvd.exe53⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xffffxx.exec:\xffffxx.exe54⤵
- Executes dropped EXE
PID:4068 -
\??\c:\tnthth.exec:\tnthth.exe55⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jjjjp.exec:\jjjjp.exe56⤵
- Executes dropped EXE
PID:924 -
\??\c:\nhhbbb.exec:\nhhbbb.exe57⤵
- Executes dropped EXE
PID:920 -
\??\c:\rlrrrrl.exec:\rlrrrrl.exe58⤵
- Executes dropped EXE
PID:1812 -
\??\c:\ppjdd.exec:\ppjdd.exe59⤵
- Executes dropped EXE
PID:3428 -
\??\c:\fxxrllf.exec:\fxxrllf.exe60⤵
- Executes dropped EXE
PID:3596 -
\??\c:\nnntnh.exec:\nnntnh.exe61⤵
- Executes dropped EXE
PID:2276 -
\??\c:\dvdjj.exec:\dvdjj.exe62⤵
- Executes dropped EXE
PID:4988 -
\??\c:\btnbnn.exec:\btnbnn.exe63⤵
- Executes dropped EXE
PID:1892 -
\??\c:\5hnhtn.exec:\5hnhtn.exe64⤵
- Executes dropped EXE
PID:4648 -
\??\c:\jvpvj.exec:\jvpvj.exe65⤵
- Executes dropped EXE
PID:5032 -
\??\c:\vdvvj.exec:\vdvvj.exe66⤵PID:2084
-
\??\c:\pjdvd.exec:\pjdvd.exe67⤵PID:3312
-
\??\c:\nhbbbb.exec:\nhbbbb.exe68⤵PID:2348
-
\??\c:\vpvpj.exec:\vpvpj.exe69⤵PID:3316
-
\??\c:\rlllffx.exec:\rlllffx.exe70⤵PID:1528
-
\??\c:\xxffxxx.exec:\xxffxxx.exe71⤵PID:956
-
\??\c:\nhbthh.exec:\nhbthh.exe72⤵
- System Location Discovery: System Language Discovery
PID:5048 -
\??\c:\vppjj.exec:\vppjj.exe73⤵PID:2956
-
\??\c:\5rxrrxx.exec:\5rxrrxx.exe74⤵PID:888
-
\??\c:\bthhnh.exec:\bthhnh.exe75⤵PID:5112
-
\??\c:\pjpjp.exec:\pjpjp.exe76⤵PID:2996
-
\??\c:\1jpjd.exec:\1jpjd.exe77⤵PID:2104
-
\??\c:\xffxrrr.exec:\xffxrrr.exe78⤵PID:4184
-
\??\c:\3bnhbb.exec:\3bnhbb.exe79⤵PID:1784
-
\??\c:\ddjvp.exec:\ddjvp.exe80⤵PID:4732
-
\??\c:\pppjj.exec:\pppjj.exe81⤵PID:5036
-
\??\c:\lfrxrfx.exec:\lfrxrfx.exe82⤵PID:2060
-
\??\c:\3nbbnt.exec:\3nbbnt.exe83⤵PID:2696
-
\??\c:\vppjd.exec:\vppjd.exe84⤵PID:4916
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe85⤵PID:3320
-
\??\c:\1tnhbh.exec:\1tnhbh.exe86⤵PID:3508
-
\??\c:\jvpjv.exec:\jvpjv.exe87⤵PID:2116
-
\??\c:\1ppdv.exec:\1ppdv.exe88⤵PID:3172
-
\??\c:\xrlrlff.exec:\xrlrlff.exe89⤵PID:4984
-
\??\c:\tttnnn.exec:\tttnnn.exe90⤵PID:2128
-
\??\c:\jjvpv.exec:\jjvpv.exe91⤵PID:1932
-
\??\c:\frrlffx.exec:\frrlffx.exe92⤵PID:3056
-
\??\c:\nthbtt.exec:\nthbtt.exe93⤵PID:5104
-
\??\c:\bthhhh.exec:\bthhhh.exe94⤵PID:708
-
\??\c:\9rlfxxx.exec:\9rlfxxx.exe95⤵PID:872
-
\??\c:\frrflxx.exec:\frrflxx.exe96⤵PID:2304
-
\??\c:\ntbhbt.exec:\ntbhbt.exe97⤵PID:2616
-
\??\c:\vdjdv.exec:\vdjdv.exe98⤵PID:3548
-
\??\c:\ffrlrrx.exec:\ffrlrrx.exe99⤵PID:3716
-
\??\c:\hbhhbb.exec:\hbhhbb.exe100⤵PID:1412
-
\??\c:\bnbbtb.exec:\bnbbtb.exe101⤵PID:4232
-
\??\c:\ddjjd.exec:\ddjjd.exe102⤵PID:4948
-
\??\c:\frllllx.exec:\frllllx.exe103⤵PID:3756
-
\??\c:\9bbttt.exec:\9bbttt.exe104⤵PID:1208
-
\??\c:\jpjvj.exec:\jpjvj.exe105⤵PID:1948
-
\??\c:\5lrlfrf.exec:\5lrlfrf.exe106⤵PID:2668
-
\??\c:\nbhbth.exec:\nbhbth.exe107⤵PID:3068
-
\??\c:\vpdvd.exec:\vpdvd.exe108⤵PID:2432
-
\??\c:\djvpj.exec:\djvpj.exe109⤵PID:1904
-
\??\c:\rrrlllf.exec:\rrrlllf.exe110⤵PID:3216
-
\??\c:\9nnhbb.exec:\9nnhbb.exe111⤵PID:4592
-
\??\c:\ddppp.exec:\ddppp.exe112⤵PID:3528
-
\??\c:\frflrfr.exec:\frflrfr.exe113⤵PID:4484
-
\??\c:\hthhbb.exec:\hthhbb.exe114⤵PID:3260
-
\??\c:\djvvd.exec:\djvvd.exe115⤵PID:4776
-
\??\c:\jpddv.exec:\jpddv.exe116⤵PID:2536
-
\??\c:\5fllxxx.exec:\5fllxxx.exe117⤵PID:3492
-
\??\c:\bbtttt.exec:\bbtttt.exe118⤵PID:4952
-
\??\c:\dvppv.exec:\dvppv.exe119⤵PID:3244
-
\??\c:\rrlfflr.exec:\rrlfflr.exe120⤵PID:3908
-
\??\c:\thhbtb.exec:\thhbtb.exe121⤵PID:4992
-
\??\c:\djpdp.exec:\djpdp.exe122⤵PID:5012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-