Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/12/2024, 01:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bf59e88eee2ed0dd5ff404e78f75ba1c34580aa850bb0b51ae99881e1be7d886N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
bf59e88eee2ed0dd5ff404e78f75ba1c34580aa850bb0b51ae99881e1be7d886N.exe
-
Size
454KB
-
MD5
fa6bbe5a4a7758cf76bef3769567fa50
-
SHA1
b28ba3d4815b241ecadd73d414bece2fa1ed2e1c
-
SHA256
bf59e88eee2ed0dd5ff404e78f75ba1c34580aa850bb0b51ae99881e1be7d886
-
SHA512
9ec5602ac85eeb0adcf2f5703ee6aa1fff313b871ebe4e7cc474c5fcaa67d051f07ba9defd31c3560c58dffde07c6202e0ff87fb59abd94f412046e6665766b0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2848-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2560-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1992-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1100-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2864-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/848-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-694-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-884-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-1133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-1236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-1397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3024 bthtbn.exe 3100 dppdv.exe 3108 1rlxlxl.exe 2004 7tnbhb.exe 2560 1bthhb.exe 2596 rfxlrfr.exe 2548 vdvpd.exe 4116 xlfrlfr.exe 1992 rxfxrrl.exe 1500 btnntn.exe 1476 llxlrrr.exe 2184 bntnhb.exe 2132 3jjdp.exe 1384 3bnbht.exe 232 thhtnh.exe 3560 rflxllf.exe 5024 nhhbnh.exe 1952 ffrlxxx.exe 1520 vjddp.exe 5076 vjjvj.exe 4484 xrlxrrl.exe 4104 vvpjj.exe 1144 rllfxrl.exe 2252 hbbtnb.exe 2392 thhbbt.exe 3576 pjjdv.exe 2076 dvdvp.exe 456 7ffffff.exe 1260 hhnbnh.exe 3772 pdjdj.exe 5016 vdjdp.exe 3796 lflfxxf.exe 2120 hntnhb.exe 3500 bhhtbt.exe 2440 btbnhb.exe 1128 pddpp.exe 4272 rllfflf.exe 1600 pvvvj.exe 4936 1jvjd.exe 3224 thnbtt.exe 2852 pddpd.exe 2156 1llfrrf.exe 1352 1tnhnn.exe 920 dpjvj.exe 1368 pppvp.exe 3364 5ffxlll.exe 3756 7nthhb.exe 3580 vjvjv.exe 3116 ffrfffl.exe 4768 thbnbt.exe 1100 3bbnnh.exe 1232 3vdpv.exe 5068 3lxxxfx.exe 2260 hhbtnh.exe 2340 vjvvj.exe 2864 fxlfxxf.exe 1924 9xrlxfx.exe 4716 nnhbbt.exe 964 pvdpd.exe 1040 lfflxlx.exe 5000 5frfrlf.exe 4048 bhhbnh.exe 2292 vjdpp.exe 4212 xffxrrl.exe -
resource yara_rule behavioral2/memory/2848-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2560-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2560-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1992-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2252-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1100-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2864-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/848-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4196-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-884-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrflffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxlxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2848 wrote to memory of 3024 2848 bf59e88eee2ed0dd5ff404e78f75ba1c34580aa850bb0b51ae99881e1be7d886N.exe 82 PID 2848 wrote to memory of 3024 2848 bf59e88eee2ed0dd5ff404e78f75ba1c34580aa850bb0b51ae99881e1be7d886N.exe 82 PID 2848 wrote to memory of 3024 2848 bf59e88eee2ed0dd5ff404e78f75ba1c34580aa850bb0b51ae99881e1be7d886N.exe 82 PID 3024 wrote to memory of 3100 3024 bthtbn.exe 83 PID 3024 wrote to memory of 3100 3024 bthtbn.exe 83 PID 3024 wrote to memory of 3100 3024 bthtbn.exe 83 PID 3100 wrote to memory of 3108 3100 dppdv.exe 84 PID 3100 wrote to memory of 3108 3100 dppdv.exe 84 PID 3100 wrote to memory of 3108 3100 dppdv.exe 84 PID 3108 wrote to memory of 2004 3108 1rlxlxl.exe 85 PID 3108 wrote to memory of 2004 3108 1rlxlxl.exe 85 PID 3108 wrote to memory of 2004 3108 1rlxlxl.exe 85 PID 2004 wrote to memory of 2560 2004 7tnbhb.exe 86 PID 2004 wrote to memory of 2560 2004 7tnbhb.exe 86 PID 2004 wrote to memory of 2560 2004 7tnbhb.exe 86 PID 2560 wrote to memory of 2596 2560 1bthhb.exe 87 PID 2560 wrote to memory of 2596 2560 1bthhb.exe 87 PID 2560 wrote to memory of 2596 2560 1bthhb.exe 87 PID 2596 wrote to memory of 2548 2596 rfxlrfr.exe 88 PID 2596 wrote to memory of 2548 2596 rfxlrfr.exe 88 PID 2596 wrote to memory of 2548 2596 rfxlrfr.exe 88 PID 2548 wrote to memory of 4116 2548 vdvpd.exe 89 PID 2548 wrote to memory of 4116 2548 vdvpd.exe 89 PID 2548 wrote to memory of 4116 2548 vdvpd.exe 89 PID 4116 wrote to memory of 1992 4116 xlfrlfr.exe 90 PID 4116 wrote to memory of 1992 4116 xlfrlfr.exe 90 PID 4116 wrote to memory of 1992 4116 xlfrlfr.exe 90 PID 1992 wrote to memory of 1500 1992 rxfxrrl.exe 91 PID 1992 wrote to memory of 1500 1992 rxfxrrl.exe 91 PID 1992 wrote to memory of 1500 1992 rxfxrrl.exe 91 PID 1500 wrote to memory of 1476 1500 btnntn.exe 92 PID 1500 wrote to memory of 1476 1500 btnntn.exe 92 PID 1500 wrote to memory of 1476 1500 btnntn.exe 92 PID 1476 wrote to memory of 2184 1476 llxlrrr.exe 93 PID 1476 wrote to memory of 2184 1476 llxlrrr.exe 93 PID 1476 wrote to memory of 2184 1476 llxlrrr.exe 93 PID 2184 wrote to memory of 2132 2184 bntnhb.exe 94 PID 2184 wrote to memory of 2132 2184 bntnhb.exe 94 PID 2184 wrote to memory of 2132 2184 bntnhb.exe 94 PID 2132 wrote to memory of 1384 2132 3jjdp.exe 95 PID 2132 wrote to memory of 1384 2132 3jjdp.exe 95 PID 2132 wrote to memory of 1384 2132 3jjdp.exe 95 PID 1384 wrote to memory of 232 1384 3bnbht.exe 96 PID 1384 wrote to memory of 232 1384 3bnbht.exe 96 PID 1384 wrote to memory of 232 1384 3bnbht.exe 96 PID 232 wrote to memory of 3560 232 thhtnh.exe 97 PID 232 wrote to memory of 3560 232 thhtnh.exe 97 PID 232 wrote to memory of 3560 232 thhtnh.exe 97 PID 3560 wrote to memory of 5024 3560 rflxllf.exe 98 PID 3560 wrote to memory of 5024 3560 rflxllf.exe 98 PID 3560 wrote to memory of 5024 3560 rflxllf.exe 98 PID 5024 wrote to memory of 1952 5024 nhhbnh.exe 99 PID 5024 wrote to memory of 1952 5024 nhhbnh.exe 99 PID 5024 wrote to memory of 1952 5024 nhhbnh.exe 99 PID 1952 wrote to memory of 1520 1952 ffrlxxx.exe 100 PID 1952 wrote to memory of 1520 1952 ffrlxxx.exe 100 PID 1952 wrote to memory of 1520 1952 ffrlxxx.exe 100 PID 1520 wrote to memory of 5076 1520 vjddp.exe 101 PID 1520 wrote to memory of 5076 1520 vjddp.exe 101 PID 1520 wrote to memory of 5076 1520 vjddp.exe 101 PID 5076 wrote to memory of 4484 5076 vjjvj.exe 102 PID 5076 wrote to memory of 4484 5076 vjjvj.exe 102 PID 5076 wrote to memory of 4484 5076 vjjvj.exe 102 PID 4484 wrote to memory of 4104 4484 xrlxrrl.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf59e88eee2ed0dd5ff404e78f75ba1c34580aa850bb0b51ae99881e1be7d886N.exe"C:\Users\Admin\AppData\Local\Temp\bf59e88eee2ed0dd5ff404e78f75ba1c34580aa850bb0b51ae99881e1be7d886N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\bthtbn.exec:\bthtbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\dppdv.exec:\dppdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\1rlxlxl.exec:\1rlxlxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\7tnbhb.exec:\7tnbhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\1bthhb.exec:\1bthhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\rfxlrfr.exec:\rfxlrfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\vdvpd.exec:\vdvpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\xlfrlfr.exec:\xlfrlfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\rxfxrrl.exec:\rxfxrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\btnntn.exec:\btnntn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\llxlrrr.exec:\llxlrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\bntnhb.exec:\bntnhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\3jjdp.exec:\3jjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\3bnbht.exec:\3bnbht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\thhtnh.exec:\thhtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\rflxllf.exec:\rflxllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\nhhbnh.exec:\nhhbnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\ffrlxxx.exec:\ffrlxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\vjddp.exec:\vjddp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\vjjvj.exec:\vjjvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\xrlxrrl.exec:\xrlxrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\vvpjj.exec:\vvpjj.exe23⤵
- Executes dropped EXE
PID:4104 -
\??\c:\rllfxrl.exec:\rllfxrl.exe24⤵
- Executes dropped EXE
PID:1144 -
\??\c:\hbbtnb.exec:\hbbtnb.exe25⤵
- Executes dropped EXE
PID:2252 -
\??\c:\thhbbt.exec:\thhbbt.exe26⤵
- Executes dropped EXE
PID:2392 -
\??\c:\pjjdv.exec:\pjjdv.exe27⤵
- Executes dropped EXE
PID:3576 -
\??\c:\dvdvp.exec:\dvdvp.exe28⤵
- Executes dropped EXE
PID:2076 -
\??\c:\7ffffff.exec:\7ffffff.exe29⤵
- Executes dropped EXE
PID:456 -
\??\c:\hhnbnh.exec:\hhnbnh.exe30⤵
- Executes dropped EXE
PID:1260 -
\??\c:\pdjdj.exec:\pdjdj.exe31⤵
- Executes dropped EXE
PID:3772 -
\??\c:\vdjdp.exec:\vdjdp.exe32⤵
- Executes dropped EXE
PID:5016 -
\??\c:\lflfxxf.exec:\lflfxxf.exe33⤵
- Executes dropped EXE
PID:3796 -
\??\c:\hntnhb.exec:\hntnhb.exe34⤵
- Executes dropped EXE
PID:2120 -
\??\c:\bhhtbt.exec:\bhhtbt.exe35⤵
- Executes dropped EXE
PID:3500 -
\??\c:\btbnhb.exec:\btbnhb.exe36⤵
- Executes dropped EXE
PID:2440 -
\??\c:\pddpp.exec:\pddpp.exe37⤵
- Executes dropped EXE
PID:1128 -
\??\c:\rllfflf.exec:\rllfflf.exe38⤵
- Executes dropped EXE
PID:4272 -
\??\c:\pvvvj.exec:\pvvvj.exe39⤵
- Executes dropped EXE
PID:1600 -
\??\c:\1jvjd.exec:\1jvjd.exe40⤵
- Executes dropped EXE
PID:4936 -
\??\c:\thnbtt.exec:\thnbtt.exe41⤵
- Executes dropped EXE
PID:3224 -
\??\c:\pddpd.exec:\pddpd.exe42⤵
- Executes dropped EXE
PID:2852 -
\??\c:\1llfrrf.exec:\1llfrrf.exe43⤵
- Executes dropped EXE
PID:2156 -
\??\c:\1tnhnn.exec:\1tnhnn.exe44⤵
- Executes dropped EXE
PID:1352 -
\??\c:\dpjvj.exec:\dpjvj.exe45⤵
- Executes dropped EXE
PID:920 -
\??\c:\pppvp.exec:\pppvp.exe46⤵
- Executes dropped EXE
PID:1368 -
\??\c:\5ffxlll.exec:\5ffxlll.exe47⤵
- Executes dropped EXE
PID:3364 -
\??\c:\7nthhb.exec:\7nthhb.exe48⤵
- Executes dropped EXE
PID:3756 -
\??\c:\vjvjv.exec:\vjvjv.exe49⤵
- Executes dropped EXE
PID:3580 -
\??\c:\ffrfffl.exec:\ffrfffl.exe50⤵
- Executes dropped EXE
PID:3116 -
\??\c:\thbnbt.exec:\thbnbt.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4768 -
\??\c:\3bbnnh.exec:\3bbnnh.exe52⤵
- Executes dropped EXE
PID:1100 -
\??\c:\3vdpv.exec:\3vdpv.exe53⤵
- Executes dropped EXE
PID:1232 -
\??\c:\3lxxxfx.exec:\3lxxxfx.exe54⤵
- Executes dropped EXE
PID:5068 -
\??\c:\hhbtnh.exec:\hhbtnh.exe55⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vjvvj.exec:\vjvvj.exe56⤵
- Executes dropped EXE
PID:2340 -
\??\c:\fxlfxxf.exec:\fxlfxxf.exe57⤵
- Executes dropped EXE
PID:2864 -
\??\c:\9xrlxfx.exec:\9xrlxfx.exe58⤵
- Executes dropped EXE
PID:1924 -
\??\c:\nnhbbt.exec:\nnhbbt.exe59⤵
- Executes dropped EXE
PID:4716 -
\??\c:\pvdpd.exec:\pvdpd.exe60⤵
- Executes dropped EXE
PID:964 -
\??\c:\lfflxlx.exec:\lfflxlx.exe61⤵
- Executes dropped EXE
PID:1040 -
\??\c:\5frfrlf.exec:\5frfrlf.exe62⤵
- Executes dropped EXE
PID:5000 -
\??\c:\bhhbnh.exec:\bhhbnh.exe63⤵
- Executes dropped EXE
PID:4048 -
\??\c:\vjdpp.exec:\vjdpp.exe64⤵
- Executes dropped EXE
PID:2292 -
\??\c:\xffxrrl.exec:\xffxrrl.exe65⤵
- Executes dropped EXE
PID:4212 -
\??\c:\lrxrffr.exec:\lrxrffr.exe66⤵PID:4116
-
\??\c:\bnhttn.exec:\bnhttn.exe67⤵PID:2220
-
\??\c:\3pvdp.exec:\3pvdp.exe68⤵PID:3900
-
\??\c:\xfllxxr.exec:\xfllxxr.exe69⤵PID:4512
-
\??\c:\nbbnhb.exec:\nbbnhb.exe70⤵PID:3316
-
\??\c:\5ddvp.exec:\5ddvp.exe71⤵PID:2200
-
\??\c:\5pjdv.exec:\5pjdv.exe72⤵PID:2132
-
\??\c:\lflxxrr.exec:\lflxxrr.exe73⤵PID:3592
-
\??\c:\bttbnh.exec:\bttbnh.exe74⤵PID:4472
-
\??\c:\jvvjd.exec:\jvvjd.exe75⤵PID:1960
-
\??\c:\lrlfxrf.exec:\lrlfxrf.exe76⤵PID:3752
-
\??\c:\fllxrlf.exec:\fllxrlf.exe77⤵PID:1288
-
\??\c:\hnbtnn.exec:\hnbtnn.exe78⤵PID:4500
-
\??\c:\dddjj.exec:\dddjj.exe79⤵PID:1188
-
\??\c:\5rlxrlx.exec:\5rlxrlx.exe80⤵PID:1096
-
\??\c:\1hhbtt.exec:\1hhbtt.exe81⤵PID:2224
-
\??\c:\5bhhht.exec:\5bhhht.exe82⤵PID:4448
-
\??\c:\5dvjd.exec:\5dvjd.exe83⤵PID:2000
-
\??\c:\3fllllr.exec:\3fllllr.exe84⤵PID:2960
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe85⤵PID:2104
-
\??\c:\btbnbt.exec:\btbnbt.exe86⤵PID:1376
-
\??\c:\3pdpd.exec:\3pdpd.exe87⤵PID:860
-
\??\c:\3rxfxxx.exec:\3rxfxxx.exe88⤵PID:1620
-
\??\c:\3rxrrxx.exec:\3rxrrxx.exe89⤵PID:2392
-
\??\c:\nnnhbb.exec:\nnnhbb.exe90⤵PID:3492
-
\??\c:\7vdvj.exec:\7vdvj.exe91⤵PID:3728
-
\??\c:\frxrllx.exec:\frxrllx.exe92⤵PID:4892
-
\??\c:\9nhnnb.exec:\9nhnnb.exe93⤵PID:848
-
\??\c:\vjvpj.exec:\vjvpj.exe94⤵PID:372
-
\??\c:\1xrfrlr.exec:\1xrfrlr.exe95⤵PID:3276
-
\??\c:\xrxxfff.exec:\xrxxfff.exe96⤵PID:1688
-
\??\c:\nbnnhb.exec:\nbnnhb.exe97⤵PID:1740
-
\??\c:\pdvjv.exec:\pdvjv.exe98⤵PID:2888
-
\??\c:\5dddv.exec:\5dddv.exe99⤵PID:3616
-
\??\c:\1rxrxrr.exec:\1rxrxrr.exe100⤵PID:4088
-
\??\c:\hbbtnn.exec:\hbbtnn.exe101⤵PID:3244
-
\??\c:\vddjd.exec:\vddjd.exe102⤵PID:2516
-
\??\c:\vvpjj.exec:\vvpjj.exe103⤵PID:1128
-
\??\c:\7xfrrrl.exec:\7xfrrrl.exe104⤵PID:1676
-
\??\c:\btbbhh.exec:\btbbhh.exe105⤵PID:3140
-
\??\c:\hbnhbb.exec:\hbnhbb.exe106⤵PID:4268
-
\??\c:\jpjpj.exec:\jpjpj.exe107⤵PID:1648
-
\??\c:\frfrxrl.exec:\frfrxrl.exe108⤵PID:4428
-
\??\c:\frrlxxl.exec:\frrlxxl.exe109⤵PID:3632
-
\??\c:\nnnhbb.exec:\nnnhbb.exe110⤵PID:2620
-
\??\c:\ddvjd.exec:\ddvjd.exe111⤵PID:4924
-
\??\c:\pdjvd.exec:\pdjvd.exe112⤵PID:3128
-
\??\c:\5fxrlll.exec:\5fxrlll.exe113⤵PID:4948
-
\??\c:\bbhbtt.exec:\bbhbtt.exe114⤵PID:3336
-
\??\c:\pdjpv.exec:\pdjpv.exe115⤵PID:4028
-
\??\c:\xxxrfxr.exec:\xxxrfxr.exe116⤵PID:5028
-
\??\c:\tnnhbt.exec:\tnnhbt.exe117⤵PID:1900
-
\??\c:\7fxrllf.exec:\7fxrllf.exe118⤵PID:1576
-
\??\c:\httbtn.exec:\httbtn.exe119⤵PID:2328
-
\??\c:\pdjdv.exec:\pdjdv.exe120⤵PID:4528
-
\??\c:\pdjdp.exec:\pdjdp.exe121⤵PID:640
-
\??\c:\5rfxxxf.exec:\5rfxxxf.exe122⤵PID:3792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-