Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/12/2024, 02:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b10a543d3e4ba3b8d0443ca6e43e1ebe5476e7eec0b0da6313e986abc92c573aN.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
b10a543d3e4ba3b8d0443ca6e43e1ebe5476e7eec0b0da6313e986abc92c573aN.exe
-
Size
452KB
-
MD5
30d5fa3c3b1fd3c9be8aae0543b7c740
-
SHA1
b5adca0ffdb69e67eef7af0a2d5ea06ba58d3216
-
SHA256
b10a543d3e4ba3b8d0443ca6e43e1ebe5476e7eec0b0da6313e986abc92c573a
-
SHA512
0f59e67e7ca294adae6e8be2bcbe06b243a51becc2e66f45f5f1fe0cbe62442cc7950e6deee330fbf3e2da90e38e7aef0c3ccce8db33825fda1737c5800e95e7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeu:q7Tc2NYHUrAwfMp3CDu
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1964-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1136-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3860-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2836-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/312-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-874-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-1302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-1355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-1389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3444 bthnnb.exe 4200 nhbbbb.exe 2020 xrffrxx.exe 2212 1bhhbh.exe 3920 ffxrrll.exe 916 bthhhn.exe 2064 9xlffff.exe 2984 ppjjv.exe 3656 5flllll.exe 1136 hhnnnn.exe 2600 hntnnt.exe 1728 vppjv.exe 1436 jvvpj.exe 1580 xlrrrxx.exe 1624 7httth.exe 2088 ntnnnt.exe 3660 ppddd.exe 208 flrrrrx.exe 2408 dvddj.exe 3864 7llfxxx.exe 4216 3bhbhn.exe 544 lllffxx.exe 2684 tthnnh.exe 3308 rflffff.exe 3148 xfrrrrl.exe 3776 vvjjj.exe 4032 ffrrllf.exe 3860 3frrxxr.exe 920 lxlrxfl.exe 4472 1hhhhn.exe 4868 vpvdd.exe 3700 xxfrlxl.exe 1864 bbbbbt.exe 3808 tntttb.exe 4304 hbttnn.exe 2468 pjdjj.exe 2556 hbbbbn.exe 4760 hbtnhb.exe 4912 9vvpp.exe 4896 lrxfflx.exe 3044 5nnntb.exe 3972 djdjv.exe 2076 rlxllfx.exe 4776 nnttth.exe 2440 htnhnn.exe 1464 9pvjj.exe 3232 rlxxxll.exe 4588 hhtbbh.exe 4328 dvpjv.exe 2244 tbbbbn.exe 3400 nntttb.exe 3560 7xffllx.exe 1564 7ntnnn.exe 1216 btttbh.exe 1492 rflxxfl.exe 3916 nhthhb.exe 3576 bbnttt.exe 3028 pjvvv.exe 548 5hnnhn.exe 320 nnnnnb.exe 2984 rrllffx.exe 3616 xflllrr.exe 4992 jjjdv.exe 624 rlrrlrl.exe -
resource yara_rule behavioral2/memory/1964-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1136-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3860-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/312-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-874-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rffxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rlffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffflf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1964 wrote to memory of 3444 1964 b10a543d3e4ba3b8d0443ca6e43e1ebe5476e7eec0b0da6313e986abc92c573aN.exe 83 PID 1964 wrote to memory of 3444 1964 b10a543d3e4ba3b8d0443ca6e43e1ebe5476e7eec0b0da6313e986abc92c573aN.exe 83 PID 1964 wrote to memory of 3444 1964 b10a543d3e4ba3b8d0443ca6e43e1ebe5476e7eec0b0da6313e986abc92c573aN.exe 83 PID 3444 wrote to memory of 4200 3444 bthnnb.exe 84 PID 3444 wrote to memory of 4200 3444 bthnnb.exe 84 PID 3444 wrote to memory of 4200 3444 bthnnb.exe 84 PID 4200 wrote to memory of 2020 4200 nhbbbb.exe 85 PID 4200 wrote to memory of 2020 4200 nhbbbb.exe 85 PID 4200 wrote to memory of 2020 4200 nhbbbb.exe 85 PID 2020 wrote to memory of 2212 2020 xrffrxx.exe 86 PID 2020 wrote to memory of 2212 2020 xrffrxx.exe 86 PID 2020 wrote to memory of 2212 2020 xrffrxx.exe 86 PID 2212 wrote to memory of 3920 2212 1bhhbh.exe 87 PID 2212 wrote to memory of 3920 2212 1bhhbh.exe 87 PID 2212 wrote to memory of 3920 2212 1bhhbh.exe 87 PID 3920 wrote to memory of 916 3920 ffxrrll.exe 88 PID 3920 wrote to memory of 916 3920 ffxrrll.exe 88 PID 3920 wrote to memory of 916 3920 ffxrrll.exe 88 PID 916 wrote to memory of 2064 916 bthhhn.exe 89 PID 916 wrote to memory of 2064 916 bthhhn.exe 89 PID 916 wrote to memory of 2064 916 bthhhn.exe 89 PID 2064 wrote to memory of 2984 2064 9xlffff.exe 90 PID 2064 wrote to memory of 2984 2064 9xlffff.exe 90 PID 2064 wrote to memory of 2984 2064 9xlffff.exe 90 PID 2984 wrote to memory of 3656 2984 ppjjv.exe 91 PID 2984 wrote to memory of 3656 2984 ppjjv.exe 91 PID 2984 wrote to memory of 3656 2984 ppjjv.exe 91 PID 3656 wrote to memory of 1136 3656 5flllll.exe 92 PID 3656 wrote to memory of 1136 3656 5flllll.exe 92 PID 3656 wrote to memory of 1136 3656 5flllll.exe 92 PID 1136 wrote to memory of 2600 1136 hhnnnn.exe 93 PID 1136 wrote to memory of 2600 1136 hhnnnn.exe 93 PID 1136 wrote to memory of 2600 1136 hhnnnn.exe 93 PID 2600 wrote to memory of 1728 2600 hntnnt.exe 94 PID 2600 wrote to memory of 1728 2600 hntnnt.exe 94 PID 2600 wrote to memory of 1728 2600 hntnnt.exe 94 PID 1728 wrote to memory of 1436 1728 vppjv.exe 95 PID 1728 wrote to memory of 1436 1728 vppjv.exe 95 PID 1728 wrote to memory of 1436 1728 vppjv.exe 95 PID 1436 wrote to memory of 1580 1436 jvvpj.exe 96 PID 1436 wrote to memory of 1580 1436 jvvpj.exe 96 PID 1436 wrote to memory of 1580 1436 jvvpj.exe 96 PID 1580 wrote to memory of 1624 1580 xlrrrxx.exe 97 PID 1580 wrote to memory of 1624 1580 xlrrrxx.exe 97 PID 1580 wrote to memory of 1624 1580 xlrrrxx.exe 97 PID 1624 wrote to memory of 2088 1624 7httth.exe 98 PID 1624 wrote to memory of 2088 1624 7httth.exe 98 PID 1624 wrote to memory of 2088 1624 7httth.exe 98 PID 2088 wrote to memory of 3660 2088 ntnnnt.exe 99 PID 2088 wrote to memory of 3660 2088 ntnnnt.exe 99 PID 2088 wrote to memory of 3660 2088 ntnnnt.exe 99 PID 3660 wrote to memory of 208 3660 ppddd.exe 100 PID 3660 wrote to memory of 208 3660 ppddd.exe 100 PID 3660 wrote to memory of 208 3660 ppddd.exe 100 PID 208 wrote to memory of 2408 208 flrrrrx.exe 101 PID 208 wrote to memory of 2408 208 flrrrrx.exe 101 PID 208 wrote to memory of 2408 208 flrrrrx.exe 101 PID 2408 wrote to memory of 3864 2408 dvddj.exe 102 PID 2408 wrote to memory of 3864 2408 dvddj.exe 102 PID 2408 wrote to memory of 3864 2408 dvddj.exe 102 PID 3864 wrote to memory of 4216 3864 7llfxxx.exe 103 PID 3864 wrote to memory of 4216 3864 7llfxxx.exe 103 PID 3864 wrote to memory of 4216 3864 7llfxxx.exe 103 PID 4216 wrote to memory of 544 4216 3bhbhn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b10a543d3e4ba3b8d0443ca6e43e1ebe5476e7eec0b0da6313e986abc92c573aN.exe"C:\Users\Admin\AppData\Local\Temp\b10a543d3e4ba3b8d0443ca6e43e1ebe5476e7eec0b0da6313e986abc92c573aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\bthnnb.exec:\bthnnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\nhbbbb.exec:\nhbbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\xrffrxx.exec:\xrffrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\1bhhbh.exec:\1bhhbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\ffxrrll.exec:\ffxrrll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\bthhhn.exec:\bthhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\9xlffff.exec:\9xlffff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\ppjjv.exec:\ppjjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\5flllll.exec:\5flllll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\hhnnnn.exec:\hhnnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\hntnnt.exec:\hntnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\vppjv.exec:\vppjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\jvvpj.exec:\jvvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\xlrrrxx.exec:\xlrrrxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\7httth.exec:\7httth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\ntnnnt.exec:\ntnnnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\ppddd.exec:\ppddd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\flrrrrx.exec:\flrrrrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\dvddj.exec:\dvddj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\7llfxxx.exec:\7llfxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\3bhbhn.exec:\3bhbhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\lllffxx.exec:\lllffxx.exe23⤵
- Executes dropped EXE
PID:544 -
\??\c:\tthnnh.exec:\tthnnh.exe24⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rflffff.exec:\rflffff.exe25⤵
- Executes dropped EXE
PID:3308 -
\??\c:\xfrrrrl.exec:\xfrrrrl.exe26⤵
- Executes dropped EXE
PID:3148 -
\??\c:\vvjjj.exec:\vvjjj.exe27⤵
- Executes dropped EXE
PID:3776 -
\??\c:\ffrrllf.exec:\ffrrllf.exe28⤵
- Executes dropped EXE
PID:4032 -
\??\c:\3frrxxr.exec:\3frrxxr.exe29⤵
- Executes dropped EXE
PID:3860 -
\??\c:\lxlrxfl.exec:\lxlrxfl.exe30⤵
- Executes dropped EXE
PID:920 -
\??\c:\1hhhhn.exec:\1hhhhn.exe31⤵
- Executes dropped EXE
PID:4472 -
\??\c:\vpvdd.exec:\vpvdd.exe32⤵
- Executes dropped EXE
PID:4868 -
\??\c:\xxfrlxl.exec:\xxfrlxl.exe33⤵
- Executes dropped EXE
PID:3700 -
\??\c:\bbbbbt.exec:\bbbbbt.exe34⤵
- Executes dropped EXE
PID:1864 -
\??\c:\tntttb.exec:\tntttb.exe35⤵
- Executes dropped EXE
PID:3808 -
\??\c:\hbttnn.exec:\hbttnn.exe36⤵
- Executes dropped EXE
PID:4304 -
\??\c:\pjdjj.exec:\pjdjj.exe37⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hbbbbn.exec:\hbbbbn.exe38⤵
- Executes dropped EXE
PID:2556 -
\??\c:\hbtnhb.exec:\hbtnhb.exe39⤵
- Executes dropped EXE
PID:4760 -
\??\c:\9vvpp.exec:\9vvpp.exe40⤵
- Executes dropped EXE
PID:4912 -
\??\c:\lrxfflx.exec:\lrxfflx.exe41⤵
- Executes dropped EXE
PID:4896 -
\??\c:\5nnntb.exec:\5nnntb.exe42⤵
- Executes dropped EXE
PID:3044 -
\??\c:\djdjv.exec:\djdjv.exe43⤵
- Executes dropped EXE
PID:3972 -
\??\c:\rlxllfx.exec:\rlxllfx.exe44⤵
- Executes dropped EXE
PID:2076 -
\??\c:\nnttth.exec:\nnttth.exe45⤵
- Executes dropped EXE
PID:4776 -
\??\c:\htnhnn.exec:\htnhnn.exe46⤵
- Executes dropped EXE
PID:2440 -
\??\c:\9pvjj.exec:\9pvjj.exe47⤵
- Executes dropped EXE
PID:1464 -
\??\c:\rlxxxll.exec:\rlxxxll.exe48⤵
- Executes dropped EXE
PID:3232 -
\??\c:\hhtbbh.exec:\hhtbbh.exe49⤵
- Executes dropped EXE
PID:4588 -
\??\c:\dvpjv.exec:\dvpjv.exe50⤵
- Executes dropped EXE
PID:4328 -
\??\c:\tbbbbn.exec:\tbbbbn.exe51⤵
- Executes dropped EXE
PID:2244 -
\??\c:\nntttb.exec:\nntttb.exe52⤵
- Executes dropped EXE
PID:3400 -
\??\c:\7xffllx.exec:\7xffllx.exe53⤵
- Executes dropped EXE
PID:3560 -
\??\c:\7ntnnn.exec:\7ntnnn.exe54⤵
- Executes dropped EXE
PID:1564 -
\??\c:\btttbh.exec:\btttbh.exe55⤵
- Executes dropped EXE
PID:1216 -
\??\c:\rflxxfl.exec:\rflxxfl.exe56⤵
- Executes dropped EXE
PID:1492 -
\??\c:\nhthhb.exec:\nhthhb.exe57⤵
- Executes dropped EXE
PID:3916 -
\??\c:\bbnttt.exec:\bbnttt.exe58⤵
- Executes dropped EXE
PID:3576 -
\??\c:\pjvvv.exec:\pjvvv.exe59⤵
- Executes dropped EXE
PID:3028 -
\??\c:\5hnnhn.exec:\5hnnhn.exe60⤵
- Executes dropped EXE
PID:548 -
\??\c:\nnnnnb.exec:\nnnnnb.exe61⤵
- Executes dropped EXE
PID:320 -
\??\c:\rrllffx.exec:\rrllffx.exe62⤵
- Executes dropped EXE
PID:2984 -
\??\c:\xflllrr.exec:\xflllrr.exe63⤵
- Executes dropped EXE
PID:3616 -
\??\c:\jjjdv.exec:\jjjdv.exe64⤵
- Executes dropped EXE
PID:4992 -
\??\c:\rlrrlrl.exec:\rlrrlrl.exe65⤵
- Executes dropped EXE
PID:624 -
\??\c:\nttbtt.exec:\nttbtt.exe66⤵PID:5108
-
\??\c:\dvvpj.exec:\dvvpj.exe67⤵PID:264
-
\??\c:\7fllfff.exec:\7fllfff.exe68⤵PID:5040
-
\??\c:\thhtnt.exec:\thhtnt.exe69⤵PID:1336
-
\??\c:\pjppj.exec:\pjppj.exe70⤵PID:3976
-
\??\c:\xfllrxx.exec:\xfllrxx.exe71⤵PID:4424
-
\??\c:\tnbttt.exec:\tnbttt.exe72⤵PID:4316
-
\??\c:\dpdvj.exec:\dpdvj.exe73⤵PID:2180
-
\??\c:\ppddd.exec:\ppddd.exe74⤵PID:3772
-
\??\c:\fffffxx.exec:\fffffxx.exe75⤵PID:1844
-
\??\c:\nhntbh.exec:\nhntbh.exe76⤵PID:4436
-
\??\c:\vjvvd.exec:\vjvvd.exe77⤵PID:1652
-
\??\c:\7fflflf.exec:\7fflflf.exe78⤵PID:4068
-
\??\c:\btthbb.exec:\btthbb.exe79⤵PID:3116
-
\??\c:\vpvpj.exec:\vpvpj.exe80⤵PID:2460
-
\??\c:\3fxlfxx.exec:\3fxlfxx.exe81⤵PID:8
-
\??\c:\hhhnnh.exec:\hhhnnh.exe82⤵PID:2464
-
\??\c:\vjvvp.exec:\vjvvp.exe83⤵PID:4460
-
\??\c:\7xxxfll.exec:\7xxxfll.exe84⤵PID:2092
-
\??\c:\nhttbb.exec:\nhttbb.exe85⤵PID:3384
-
\??\c:\tnbhnn.exec:\tnbhnn.exe86⤵PID:1928
-
\??\c:\pjvvv.exec:\pjvvv.exe87⤵PID:3296
-
\??\c:\rrflfll.exec:\rrflfll.exe88⤵PID:4324
-
\??\c:\htbbnt.exec:\htbbnt.exe89⤵PID:4860
-
\??\c:\jvdvp.exec:\jvdvp.exe90⤵PID:2316
-
\??\c:\dddvv.exec:\dddvv.exe91⤵PID:920
-
\??\c:\lrllfxf.exec:\lrllfxf.exe92⤵PID:1576
-
\??\c:\hnnnnn.exec:\hnnnnn.exe93⤵PID:664
-
\??\c:\ddjjj.exec:\ddjjj.exe94⤵PID:5088
-
\??\c:\5ffffff.exec:\5ffffff.exe95⤵PID:3764
-
\??\c:\hntbtb.exec:\hntbtb.exe96⤵PID:2496
-
\??\c:\vjdvv.exec:\vjdvv.exe97⤵PID:2976
-
\??\c:\lxlffxx.exec:\lxlffxx.exe98⤵PID:1456
-
\??\c:\ffxxrxr.exec:\ffxxrxr.exe99⤵PID:1416
-
\??\c:\nhhtnn.exec:\nhhtnn.exe100⤵PID:3640
-
\??\c:\jdpvp.exec:\jdpvp.exe101⤵PID:2744
-
\??\c:\xxrrxff.exec:\xxrrxff.exe102⤵PID:4680
-
\??\c:\ttbbbh.exec:\ttbbbh.exe103⤵PID:4896
-
\??\c:\jdvvp.exec:\jdvvp.exe104⤵PID:3628
-
\??\c:\lllrlrl.exec:\lllrlrl.exe105⤵PID:1148
-
\??\c:\bbnttb.exec:\bbnttb.exe106⤵PID:2076
-
\??\c:\vvdpv.exec:\vvdpv.exe107⤵PID:4776
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe108⤵PID:1164
-
\??\c:\xxxxrxr.exec:\xxxxrxr.exe109⤵PID:1748
-
\??\c:\1nttth.exec:\1nttth.exe110⤵PID:3232
-
\??\c:\jvddd.exec:\jvddd.exe111⤵PID:4888
-
\??\c:\rrxffxf.exec:\rrxffxf.exe112⤵PID:4328
-
\??\c:\thtttb.exec:\thtttb.exe113⤵PID:1444
-
\??\c:\dvpjd.exec:\dvpjd.exe114⤵PID:3560
-
\??\c:\lfrrrxx.exec:\lfrrrxx.exe115⤵PID:4700
-
\??\c:\tnnbnn.exec:\tnnbnn.exe116⤵PID:4192
-
\??\c:\dvpjj.exec:\dvpjj.exe117⤵PID:4124
-
\??\c:\jvjpj.exec:\jvjpj.exe118⤵PID:4772
-
\??\c:\rxffxxx.exec:\rxffxxx.exe119⤵PID:876
-
\??\c:\bbttbh.exec:\bbttbh.exe120⤵PID:4132
-
\??\c:\vvpjj.exec:\vvpjj.exe121⤵PID:4828
-
\??\c:\ffffrfl.exec:\ffffrfl.exe122⤵PID:2128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-