Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 02:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d407a7e1f17c18e77a99ce7a7a9c89e447c3859d4923ef98dd4b34355a3c843fN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
d407a7e1f17c18e77a99ce7a7a9c89e447c3859d4923ef98dd4b34355a3c843fN.exe
-
Size
453KB
-
MD5
43c73cb8683a3388574134e2174927e0
-
SHA1
2f0af82b6a5836710d06ffb25c843e909007ad9d
-
SHA256
d407a7e1f17c18e77a99ce7a7a9c89e447c3859d4923ef98dd4b34355a3c843f
-
SHA512
fc108952b0364ef7681f1f682f62b8d148cf3d1a128adaaf1e4516020092648e5596b71b97c0e30f757d1eed139370baa4c1d2f2cec8cb28b5f7d124457ab265
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3336-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/752-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1408-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1336-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/320-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2624-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-683-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-1077-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-1141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-1268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-1557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/980-1576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/316-1815-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4700 bnhtnn.exe 3676 3ffxrrl.exe 2236 htthbh.exe 4728 nhnnhb.exe 724 hbbbtb.exe 3432 rflxrfl.exe 3136 bttbbb.exe 4736 3bbtnn.exe 5012 djvjv.exe 3396 vdvjv.exe 3940 frffxxr.exe 5032 lrffxxr.exe 1064 hbbtnh.exe 3032 dpvjv.exe 4936 xrflfrx.exe 1952 nhbtbt.exe 3556 pjpjd.exe 2192 9rfxffx.exe 4040 tbnhbb.exe 2268 jpvpd.exe 2248 xlrrlll.exe 3692 btbbbb.exe 1964 vppjd.exe 4400 dvvpd.exe 1728 3fxxxfx.exe 4392 bnnhbt.exe 4972 3vpjj.exe 1184 lfxfrxr.exe 752 thntht.exe 544 vpvpv.exe 2328 rxxrlfx.exe 1408 htbtnn.exe 4452 1pvpp.exe 3180 dppjj.exe 2416 lrlrxxx.exe 3764 5httbb.exe 4156 pddpd.exe 4288 fffrlxr.exe 1860 flxrllf.exe 3928 hnbtnh.exe 864 vjpjd.exe 4512 rfxlrfl.exe 3132 tnhbtt.exe 2436 dppjj.exe 804 dpvpj.exe 4396 lfffffx.exe 4000 bthhbn.exe 3976 vdjdv.exe 4700 3llflll.exe 4072 5rxxflx.exe 3676 9bhbtt.exe 4764 vpppj.exe 244 xlxrrrr.exe 2044 9pddd.exe 3476 dvjjj.exe 3340 7nbthh.exe 3876 fxrlfxr.exe 3912 thnbtt.exe 3428 3pdvp.exe 3808 htbbbb.exe 408 1jpjj.exe 5080 rlrrrrr.exe 2776 nnnbth.exe 4464 dvdpd.exe -
resource yara_rule behavioral2/memory/3336-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/724-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/752-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1408-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2044-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1336-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2624-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-1077-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-1141-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5btnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3336 wrote to memory of 4700 3336 d407a7e1f17c18e77a99ce7a7a9c89e447c3859d4923ef98dd4b34355a3c843fN.exe 83 PID 3336 wrote to memory of 4700 3336 d407a7e1f17c18e77a99ce7a7a9c89e447c3859d4923ef98dd4b34355a3c843fN.exe 83 PID 3336 wrote to memory of 4700 3336 d407a7e1f17c18e77a99ce7a7a9c89e447c3859d4923ef98dd4b34355a3c843fN.exe 83 PID 4700 wrote to memory of 3676 4700 bnhtnn.exe 84 PID 4700 wrote to memory of 3676 4700 bnhtnn.exe 84 PID 4700 wrote to memory of 3676 4700 bnhtnn.exe 84 PID 3676 wrote to memory of 2236 3676 3ffxrrl.exe 85 PID 3676 wrote to memory of 2236 3676 3ffxrrl.exe 85 PID 3676 wrote to memory of 2236 3676 3ffxrrl.exe 85 PID 2236 wrote to memory of 4728 2236 htthbh.exe 86 PID 2236 wrote to memory of 4728 2236 htthbh.exe 86 PID 2236 wrote to memory of 4728 2236 htthbh.exe 86 PID 4728 wrote to memory of 724 4728 nhnnhb.exe 87 PID 4728 wrote to memory of 724 4728 nhnnhb.exe 87 PID 4728 wrote to memory of 724 4728 nhnnhb.exe 87 PID 724 wrote to memory of 3432 724 hbbbtb.exe 88 PID 724 wrote to memory of 3432 724 hbbbtb.exe 88 PID 724 wrote to memory of 3432 724 hbbbtb.exe 88 PID 3432 wrote to memory of 3136 3432 rflxrfl.exe 89 PID 3432 wrote to memory of 3136 3432 rflxrfl.exe 89 PID 3432 wrote to memory of 3136 3432 rflxrfl.exe 89 PID 3136 wrote to memory of 4736 3136 bttbbb.exe 90 PID 3136 wrote to memory of 4736 3136 bttbbb.exe 90 PID 3136 wrote to memory of 4736 3136 bttbbb.exe 90 PID 4736 wrote to memory of 5012 4736 3bbtnn.exe 91 PID 4736 wrote to memory of 5012 4736 3bbtnn.exe 91 PID 4736 wrote to memory of 5012 4736 3bbtnn.exe 91 PID 5012 wrote to memory of 3396 5012 djvjv.exe 92 PID 5012 wrote to memory of 3396 5012 djvjv.exe 92 PID 5012 wrote to memory of 3396 5012 djvjv.exe 92 PID 3396 wrote to memory of 3940 3396 vdvjv.exe 93 PID 3396 wrote to memory of 3940 3396 vdvjv.exe 93 PID 3396 wrote to memory of 3940 3396 vdvjv.exe 93 PID 3940 wrote to memory of 5032 3940 frffxxr.exe 94 PID 3940 wrote to memory of 5032 3940 frffxxr.exe 94 PID 3940 wrote to memory of 5032 3940 frffxxr.exe 94 PID 5032 wrote to memory of 1064 5032 lrffxxr.exe 95 PID 5032 wrote to memory of 1064 5032 lrffxxr.exe 95 PID 5032 wrote to memory of 1064 5032 lrffxxr.exe 95 PID 1064 wrote to memory of 3032 1064 hbbtnh.exe 96 PID 1064 wrote to memory of 3032 1064 hbbtnh.exe 96 PID 1064 wrote to memory of 3032 1064 hbbtnh.exe 96 PID 3032 wrote to memory of 4936 3032 dpvjv.exe 97 PID 3032 wrote to memory of 4936 3032 dpvjv.exe 97 PID 3032 wrote to memory of 4936 3032 dpvjv.exe 97 PID 4936 wrote to memory of 1952 4936 xrflfrx.exe 98 PID 4936 wrote to memory of 1952 4936 xrflfrx.exe 98 PID 4936 wrote to memory of 1952 4936 xrflfrx.exe 98 PID 1952 wrote to memory of 3556 1952 nhbtbt.exe 99 PID 1952 wrote to memory of 3556 1952 nhbtbt.exe 99 PID 1952 wrote to memory of 3556 1952 nhbtbt.exe 99 PID 3556 wrote to memory of 2192 3556 pjpjd.exe 100 PID 3556 wrote to memory of 2192 3556 pjpjd.exe 100 PID 3556 wrote to memory of 2192 3556 pjpjd.exe 100 PID 2192 wrote to memory of 4040 2192 9rfxffx.exe 101 PID 2192 wrote to memory of 4040 2192 9rfxffx.exe 101 PID 2192 wrote to memory of 4040 2192 9rfxffx.exe 101 PID 4040 wrote to memory of 2268 4040 tbnhbb.exe 102 PID 4040 wrote to memory of 2268 4040 tbnhbb.exe 102 PID 4040 wrote to memory of 2268 4040 tbnhbb.exe 102 PID 2268 wrote to memory of 2248 2268 jpvpd.exe 103 PID 2268 wrote to memory of 2248 2268 jpvpd.exe 103 PID 2268 wrote to memory of 2248 2268 jpvpd.exe 103 PID 2248 wrote to memory of 3692 2248 xlrrlll.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d407a7e1f17c18e77a99ce7a7a9c89e447c3859d4923ef98dd4b34355a3c843fN.exe"C:\Users\Admin\AppData\Local\Temp\d407a7e1f17c18e77a99ce7a7a9c89e447c3859d4923ef98dd4b34355a3c843fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\bnhtnn.exec:\bnhtnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\3ffxrrl.exec:\3ffxrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\htthbh.exec:\htthbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\nhnnhb.exec:\nhnnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\hbbbtb.exec:\hbbbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
\??\c:\rflxrfl.exec:\rflxrfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\bttbbb.exec:\bttbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\3bbtnn.exec:\3bbtnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\djvjv.exec:\djvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\vdvjv.exec:\vdvjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\frffxxr.exec:\frffxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\lrffxxr.exec:\lrffxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\hbbtnh.exec:\hbbtnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\dpvjv.exec:\dpvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\xrflfrx.exec:\xrflfrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\nhbtbt.exec:\nhbtbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\pjpjd.exec:\pjpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\9rfxffx.exec:\9rfxffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\tbnhbb.exec:\tbnhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\jpvpd.exec:\jpvpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\xlrrlll.exec:\xlrrlll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\btbbbb.exec:\btbbbb.exe23⤵
- Executes dropped EXE
PID:3692 -
\??\c:\vppjd.exec:\vppjd.exe24⤵
- Executes dropped EXE
PID:1964 -
\??\c:\dvvpd.exec:\dvvpd.exe25⤵
- Executes dropped EXE
PID:4400 -
\??\c:\3fxxxfx.exec:\3fxxxfx.exe26⤵
- Executes dropped EXE
PID:1728 -
\??\c:\bnnhbt.exec:\bnnhbt.exe27⤵
- Executes dropped EXE
PID:4392 -
\??\c:\3vpjj.exec:\3vpjj.exe28⤵
- Executes dropped EXE
PID:4972 -
\??\c:\lfxfrxr.exec:\lfxfrxr.exe29⤵
- Executes dropped EXE
PID:1184 -
\??\c:\thntht.exec:\thntht.exe30⤵
- Executes dropped EXE
PID:752 -
\??\c:\vpvpv.exec:\vpvpv.exe31⤵
- Executes dropped EXE
PID:544 -
\??\c:\rxxrlfx.exec:\rxxrlfx.exe32⤵
- Executes dropped EXE
PID:2328 -
\??\c:\htbtnn.exec:\htbtnn.exe33⤵
- Executes dropped EXE
PID:1408 -
\??\c:\1pvpp.exec:\1pvpp.exe34⤵
- Executes dropped EXE
PID:4452 -
\??\c:\dppjj.exec:\dppjj.exe35⤵
- Executes dropped EXE
PID:3180 -
\??\c:\lrlrxxx.exec:\lrlrxxx.exe36⤵
- Executes dropped EXE
PID:2416 -
\??\c:\5httbb.exec:\5httbb.exe37⤵
- Executes dropped EXE
PID:3764 -
\??\c:\pddpd.exec:\pddpd.exe38⤵
- Executes dropped EXE
PID:4156 -
\??\c:\fffrlxr.exec:\fffrlxr.exe39⤵
- Executes dropped EXE
PID:4288 -
\??\c:\flxrllf.exec:\flxrllf.exe40⤵
- Executes dropped EXE
PID:1860 -
\??\c:\hnbtnh.exec:\hnbtnh.exe41⤵
- Executes dropped EXE
PID:3928 -
\??\c:\vjpjd.exec:\vjpjd.exe42⤵
- Executes dropped EXE
PID:864 -
\??\c:\rfxlrfl.exec:\rfxlrfl.exe43⤵
- Executes dropped EXE
PID:4512 -
\??\c:\tnhbtt.exec:\tnhbtt.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3132 -
\??\c:\dppjj.exec:\dppjj.exe45⤵
- Executes dropped EXE
PID:2436 -
\??\c:\dpvpj.exec:\dpvpj.exe46⤵
- Executes dropped EXE
PID:804 -
\??\c:\lfffffx.exec:\lfffffx.exe47⤵
- Executes dropped EXE
PID:4396 -
\??\c:\bthhbn.exec:\bthhbn.exe48⤵
- Executes dropped EXE
PID:4000 -
\??\c:\vdjdv.exec:\vdjdv.exe49⤵
- Executes dropped EXE
PID:3976 -
\??\c:\3llflll.exec:\3llflll.exe50⤵
- Executes dropped EXE
PID:4700 -
\??\c:\5rxxflx.exec:\5rxxflx.exe51⤵
- Executes dropped EXE
PID:4072 -
\??\c:\9bhbtt.exec:\9bhbtt.exe52⤵
- Executes dropped EXE
PID:3676 -
\??\c:\vpppj.exec:\vpppj.exe53⤵
- Executes dropped EXE
PID:4764 -
\??\c:\xlxrrrr.exec:\xlxrrrr.exe54⤵
- Executes dropped EXE
PID:244 -
\??\c:\9pddd.exec:\9pddd.exe55⤵
- Executes dropped EXE
PID:2044 -
\??\c:\dvjjj.exec:\dvjjj.exe56⤵
- Executes dropped EXE
PID:3476 -
\??\c:\7nbthh.exec:\7nbthh.exe57⤵
- Executes dropped EXE
PID:3340 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe58⤵
- Executes dropped EXE
PID:3876 -
\??\c:\thnbtt.exec:\thnbtt.exe59⤵
- Executes dropped EXE
PID:3912 -
\??\c:\3pdvp.exec:\3pdvp.exe60⤵
- Executes dropped EXE
PID:3428 -
\??\c:\htbbbb.exec:\htbbbb.exe61⤵
- Executes dropped EXE
PID:3808 -
\??\c:\1jpjj.exec:\1jpjj.exe62⤵
- Executes dropped EXE
PID:408 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe63⤵
- Executes dropped EXE
PID:5080 -
\??\c:\nnnbth.exec:\nnnbth.exe64⤵
- Executes dropped EXE
PID:2776 -
\??\c:\dvdpd.exec:\dvdpd.exe65⤵
- Executes dropped EXE
PID:4464 -
\??\c:\xfrllfx.exec:\xfrllfx.exe66⤵PID:2216
-
\??\c:\9dpjd.exec:\9dpjd.exe67⤵PID:972
-
\??\c:\xflfxxr.exec:\xflfxxr.exe68⤵PID:2796
-
\??\c:\bhntnn.exec:\bhntnn.exe69⤵PID:4376
-
\??\c:\vdjdj.exec:\vdjdj.exe70⤵PID:2232
-
\??\c:\frrlxrf.exec:\frrlxrf.exe71⤵PID:2064
-
\??\c:\nbbbtb.exec:\nbbbtb.exe72⤵
- System Location Discovery: System Language Discovery
PID:4240 -
\??\c:\pjjjj.exec:\pjjjj.exe73⤵PID:392
-
\??\c:\rllllrf.exec:\rllllrf.exe74⤵PID:1440
-
\??\c:\bthbhh.exec:\bthbhh.exe75⤵PID:4920
-
\??\c:\dvppp.exec:\dvppp.exe76⤵PID:2212
-
\??\c:\lffxrfx.exec:\lffxrfx.exe77⤵PID:4104
-
\??\c:\3bhnht.exec:\3bhnht.exe78⤵PID:2240
-
\??\c:\dvvpp.exec:\dvvpp.exe79⤵PID:2960
-
\??\c:\nbhhhh.exec:\nbhhhh.exe80⤵PID:3044
-
\??\c:\djjdj.exec:\djjdj.exe81⤵PID:3424
-
\??\c:\flfxrlx.exec:\flfxrlx.exe82⤵PID:752
-
\??\c:\tnnhhb.exec:\tnnhhb.exe83⤵PID:3164
-
\??\c:\jjvvv.exec:\jjvvv.exe84⤵PID:4456
-
\??\c:\btnhbt.exec:\btnhbt.exe85⤵PID:4112
-
\??\c:\frxxrrr.exec:\frxxrrr.exe86⤵PID:4452
-
\??\c:\ntbbtb.exec:\ntbbtb.exe87⤵PID:3260
-
\??\c:\jjddd.exec:\jjddd.exe88⤵PID:2000
-
\??\c:\lxxrfrr.exec:\lxxrfrr.exe89⤵PID:3764
-
\??\c:\3nhhbb.exec:\3nhhbb.exe90⤵PID:764
-
\??\c:\jvpdp.exec:\jvpdp.exe91⤵PID:4688
-
\??\c:\lrxlrlf.exec:\lrxlrlf.exe92⤵PID:4468
-
\??\c:\tnhbtb.exec:\tnhbtb.exe93⤵PID:2500
-
\??\c:\dvjvp.exec:\dvjvp.exe94⤵PID:4948
-
\??\c:\lflffxx.exec:\lflffxx.exe95⤵PID:4432
-
\??\c:\7jvpv.exec:\7jvpv.exe96⤵PID:1696
-
\??\c:\xxlflrx.exec:\xxlflrx.exe97⤵PID:1336
-
\??\c:\5jddv.exec:\5jddv.exe98⤵PID:2388
-
\??\c:\bnbbtt.exec:\bnbbtt.exe99⤵PID:1468
-
\??\c:\nbnnnt.exec:\nbnnnt.exe100⤵PID:1000
-
\??\c:\nnhbnn.exec:\nnhbnn.exe101⤵PID:556
-
\??\c:\jdjdd.exec:\jdjdd.exe102⤵PID:808
-
\??\c:\frxrllf.exec:\frxrllf.exe103⤵PID:320
-
\??\c:\ntbbbh.exec:\ntbbbh.exe104⤵PID:980
-
\??\c:\vdjpp.exec:\vdjpp.exe105⤵PID:2692
-
\??\c:\rfrlflf.exec:\rfrlflf.exe106⤵PID:4984
-
\??\c:\rrlrxxf.exec:\rrlrxxf.exe107⤵PID:224
-
\??\c:\bthbbn.exec:\bthbbn.exe108⤵PID:2380
-
\??\c:\ppjjd.exec:\ppjjd.exe109⤵PID:4768
-
\??\c:\xlffxxr.exec:\xlffxxr.exe110⤵PID:1132
-
\??\c:\hhnhtt.exec:\hhnhtt.exe111⤵PID:2964
-
\??\c:\vvpjd.exec:\vvpjd.exe112⤵PID:4824
-
\??\c:\rxxxrll.exec:\rxxxrll.exe113⤵PID:2180
-
\??\c:\bhtnnh.exec:\bhtnnh.exe114⤵PID:3700
-
\??\c:\jdjdd.exec:\jdjdd.exe115⤵PID:3568
-
\??\c:\pjjjj.exec:\pjjjj.exe116⤵PID:3396
-
\??\c:\lfxrrrl.exec:\lfxrrrl.exe117⤵PID:3532
-
\??\c:\nbnnhn.exec:\nbnnhn.exe118⤵PID:2164
-
\??\c:\5pvpj.exec:\5pvpj.exe119⤵PID:2776
-
\??\c:\frxrllf.exec:\frxrllf.exe120⤵PID:3140
-
\??\c:\fxxrlll.exec:\fxxrlll.exe121⤵PID:2440
-
\??\c:\1tnnnb.exec:\1tnnnb.exe122⤵PID:2672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-