Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 03:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbb2efef46183fa6739569ea0a6935e3ed2e14d9c390116f0099069124b42986N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
dbb2efef46183fa6739569ea0a6935e3ed2e14d9c390116f0099069124b42986N.exe
-
Size
454KB
-
MD5
46e37d94f1789887b56abf9fc6a48840
-
SHA1
6615dce57af1ad5fdc11c51b32a3c31d843c4c9b
-
SHA256
dbb2efef46183fa6739569ea0a6935e3ed2e14d9c390116f0099069124b42986
-
SHA512
724ce5cc87840f10048f114d7c1c2a3ccf92d187cdb8735e8c12e9a3fdf5722bf95279593426ea57eb929ab2b4a10c7b3e56826d465957658497d557d0a459eb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/316-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1248-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3816-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2480-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3828-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1328-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2012-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1740-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3160-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-806-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-909-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-1444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1144 bhnhht.exe 2460 rxlflll.exe 1880 bbnhhh.exe 1248 3fxlllr.exe 4024 lfrrllr.exe 3816 pjjdd.exe 3756 llllfll.exe 3012 vdjdv.exe 4816 rxlrrrr.exe 3188 pvjdp.exe 2224 frfxxxr.exe 3712 vvdjp.exe 4992 lrffrrr.exe 2080 bnnnbh.exe 2480 vpvvp.exe 3828 bbbbhh.exe 4404 pvpjj.exe 868 5xfxrrr.exe 404 pvdpj.exe 1552 1thbtb.exe 3664 7llxxrl.exe 1060 bthtbn.exe 3240 jppdv.exe 2600 xxxrffx.exe 4224 djppj.exe 436 vppjd.exe 4744 5jddp.exe 4920 flfrffl.exe 2620 1pvpj.exe 2028 9rxrllr.exe 2728 pvjjj.exe 1328 5fxlfrx.exe 1656 bntnhb.exe 972 9rrlffx.exe 3592 9bhtbb.exe 5080 vpvjd.exe 4108 xxrrflx.exe 2216 3hbttt.exe 4296 thnhnt.exe 4280 vvvvp.exe 4424 rxffxxf.exe 1144 nhhtnh.exe 1988 jvdpj.exe 3700 lxfxrrr.exe 1156 fflfrrr.exe 1312 7nthbb.exe 3972 rrfxrrl.exe 4024 xrlffxx.exe 2148 bnbtnn.exe 4804 7jjjj.exe 2140 rrrxxlf.exe 724 nhhbtt.exe 212 vpvvd.exe 3068 xrrrlfx.exe 408 htnhhb.exe 2968 vdpjd.exe 3236 rlllfxr.exe 4940 ppdpv.exe 2100 1rlffxr.exe 4556 xxxxffx.exe 2080 thhbnn.exe 4916 pvjjj.exe 3168 llxrllr.exe 3716 nhnhhh.exe -
resource yara_rule behavioral2/memory/316-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1248-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1248-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3816-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3828-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2012-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3160-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-806-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rrrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 316 wrote to memory of 1144 316 dbb2efef46183fa6739569ea0a6935e3ed2e14d9c390116f0099069124b42986N.exe 84 PID 316 wrote to memory of 1144 316 dbb2efef46183fa6739569ea0a6935e3ed2e14d9c390116f0099069124b42986N.exe 84 PID 316 wrote to memory of 1144 316 dbb2efef46183fa6739569ea0a6935e3ed2e14d9c390116f0099069124b42986N.exe 84 PID 1144 wrote to memory of 2460 1144 bhnhht.exe 85 PID 1144 wrote to memory of 2460 1144 bhnhht.exe 85 PID 1144 wrote to memory of 2460 1144 bhnhht.exe 85 PID 2460 wrote to memory of 1880 2460 rxlflll.exe 86 PID 2460 wrote to memory of 1880 2460 rxlflll.exe 86 PID 2460 wrote to memory of 1880 2460 rxlflll.exe 86 PID 1880 wrote to memory of 1248 1880 bbnhhh.exe 87 PID 1880 wrote to memory of 1248 1880 bbnhhh.exe 87 PID 1880 wrote to memory of 1248 1880 bbnhhh.exe 87 PID 1248 wrote to memory of 4024 1248 3fxlllr.exe 88 PID 1248 wrote to memory of 4024 1248 3fxlllr.exe 88 PID 1248 wrote to memory of 4024 1248 3fxlllr.exe 88 PID 4024 wrote to memory of 3816 4024 lfrrllr.exe 89 PID 4024 wrote to memory of 3816 4024 lfrrllr.exe 89 PID 4024 wrote to memory of 3816 4024 lfrrllr.exe 89 PID 3816 wrote to memory of 3756 3816 pjjdd.exe 90 PID 3816 wrote to memory of 3756 3816 pjjdd.exe 90 PID 3816 wrote to memory of 3756 3816 pjjdd.exe 90 PID 3756 wrote to memory of 3012 3756 llllfll.exe 91 PID 3756 wrote to memory of 3012 3756 llllfll.exe 91 PID 3756 wrote to memory of 3012 3756 llllfll.exe 91 PID 3012 wrote to memory of 4816 3012 vdjdv.exe 92 PID 3012 wrote to memory of 4816 3012 vdjdv.exe 92 PID 3012 wrote to memory of 4816 3012 vdjdv.exe 92 PID 4816 wrote to memory of 3188 4816 rxlrrrr.exe 93 PID 4816 wrote to memory of 3188 4816 rxlrrrr.exe 93 PID 4816 wrote to memory of 3188 4816 rxlrrrr.exe 93 PID 3188 wrote to memory of 2224 3188 pvjdp.exe 94 PID 3188 wrote to memory of 2224 3188 pvjdp.exe 94 PID 3188 wrote to memory of 2224 3188 pvjdp.exe 94 PID 2224 wrote to memory of 3712 2224 frfxxxr.exe 95 PID 2224 wrote to memory of 3712 2224 frfxxxr.exe 95 PID 2224 wrote to memory of 3712 2224 frfxxxr.exe 95 PID 3712 wrote to memory of 4992 3712 vvdjp.exe 96 PID 3712 wrote to memory of 4992 3712 vvdjp.exe 96 PID 3712 wrote to memory of 4992 3712 vvdjp.exe 96 PID 4992 wrote to memory of 2080 4992 lrffrrr.exe 97 PID 4992 wrote to memory of 2080 4992 lrffrrr.exe 97 PID 4992 wrote to memory of 2080 4992 lrffrrr.exe 97 PID 2080 wrote to memory of 2480 2080 bnnnbh.exe 98 PID 2080 wrote to memory of 2480 2080 bnnnbh.exe 98 PID 2080 wrote to memory of 2480 2080 bnnnbh.exe 98 PID 2480 wrote to memory of 3828 2480 vpvvp.exe 99 PID 2480 wrote to memory of 3828 2480 vpvvp.exe 99 PID 2480 wrote to memory of 3828 2480 vpvvp.exe 99 PID 3828 wrote to memory of 4404 3828 bbbbhh.exe 100 PID 3828 wrote to memory of 4404 3828 bbbbhh.exe 100 PID 3828 wrote to memory of 4404 3828 bbbbhh.exe 100 PID 4404 wrote to memory of 868 4404 pvpjj.exe 101 PID 4404 wrote to memory of 868 4404 pvpjj.exe 101 PID 4404 wrote to memory of 868 4404 pvpjj.exe 101 PID 868 wrote to memory of 404 868 5xfxrrr.exe 102 PID 868 wrote to memory of 404 868 5xfxrrr.exe 102 PID 868 wrote to memory of 404 868 5xfxrrr.exe 102 PID 404 wrote to memory of 1552 404 pvdpj.exe 103 PID 404 wrote to memory of 1552 404 pvdpj.exe 103 PID 404 wrote to memory of 1552 404 pvdpj.exe 103 PID 1552 wrote to memory of 3664 1552 1thbtb.exe 104 PID 1552 wrote to memory of 3664 1552 1thbtb.exe 104 PID 1552 wrote to memory of 3664 1552 1thbtb.exe 104 PID 3664 wrote to memory of 1060 3664 7llxxrl.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbb2efef46183fa6739569ea0a6935e3ed2e14d9c390116f0099069124b42986N.exe"C:\Users\Admin\AppData\Local\Temp\dbb2efef46183fa6739569ea0a6935e3ed2e14d9c390116f0099069124b42986N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\bhnhht.exec:\bhnhht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\rxlflll.exec:\rxlflll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\bbnhhh.exec:\bbnhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\3fxlllr.exec:\3fxlllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\lfrrllr.exec:\lfrrllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\pjjdd.exec:\pjjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\llllfll.exec:\llllfll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\vdjdv.exec:\vdjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\rxlrrrr.exec:\rxlrrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\pvjdp.exec:\pvjdp.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\frfxxxr.exec:\frfxxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\vvdjp.exec:\vvdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\lrffrrr.exec:\lrffrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\bnnnbh.exec:\bnnnbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\vpvvp.exec:\vpvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\bbbbhh.exec:\bbbbhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\pvpjj.exec:\pvpjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\5xfxrrr.exec:\5xfxrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\pvdpj.exec:\pvdpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\1thbtb.exec:\1thbtb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\7llxxrl.exec:\7llxxrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\bthtbn.exec:\bthtbn.exe23⤵
- Executes dropped EXE
PID:1060 -
\??\c:\jppdv.exec:\jppdv.exe24⤵
- Executes dropped EXE
PID:3240 -
\??\c:\xxxrffx.exec:\xxxrffx.exe25⤵
- Executes dropped EXE
PID:2600 -
\??\c:\djppj.exec:\djppj.exe26⤵
- Executes dropped EXE
PID:4224 -
\??\c:\vppjd.exec:\vppjd.exe27⤵
- Executes dropped EXE
PID:436 -
\??\c:\5jddp.exec:\5jddp.exe28⤵
- Executes dropped EXE
PID:4744 -
\??\c:\flfrffl.exec:\flfrffl.exe29⤵
- Executes dropped EXE
PID:4920 -
\??\c:\1pvpj.exec:\1pvpj.exe30⤵
- Executes dropped EXE
PID:2620 -
\??\c:\9rxrllr.exec:\9rxrllr.exe31⤵
- Executes dropped EXE
PID:2028 -
\??\c:\pvjjj.exec:\pvjjj.exe32⤵
- Executes dropped EXE
PID:2728 -
\??\c:\5fxlfrx.exec:\5fxlfrx.exe33⤵
- Executes dropped EXE
PID:1328 -
\??\c:\bntnhb.exec:\bntnhb.exe34⤵
- Executes dropped EXE
PID:1656 -
\??\c:\9rrlffx.exec:\9rrlffx.exe35⤵
- Executes dropped EXE
PID:972 -
\??\c:\9bhtbb.exec:\9bhtbb.exe36⤵
- Executes dropped EXE
PID:3592 -
\??\c:\vpvjd.exec:\vpvjd.exe37⤵
- Executes dropped EXE
PID:5080 -
\??\c:\xxrrflx.exec:\xxrrflx.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4108 -
\??\c:\3hbttt.exec:\3hbttt.exe39⤵
- Executes dropped EXE
PID:2216 -
\??\c:\thnhnt.exec:\thnhnt.exe40⤵
- Executes dropped EXE
PID:4296 -
\??\c:\vvvvp.exec:\vvvvp.exe41⤵
- Executes dropped EXE
PID:4280 -
\??\c:\rxffxxf.exec:\rxffxxf.exe42⤵
- Executes dropped EXE
PID:4424 -
\??\c:\nhhtnh.exec:\nhhtnh.exe43⤵
- Executes dropped EXE
PID:1144 -
\??\c:\jvdpj.exec:\jvdpj.exe44⤵
- Executes dropped EXE
PID:1988 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe45⤵
- Executes dropped EXE
PID:3700 -
\??\c:\fflfrrr.exec:\fflfrrr.exe46⤵
- Executes dropped EXE
PID:1156 -
\??\c:\7nthbb.exec:\7nthbb.exe47⤵
- Executes dropped EXE
PID:1312 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe48⤵
- Executes dropped EXE
PID:3972 -
\??\c:\xrlffxx.exec:\xrlffxx.exe49⤵
- Executes dropped EXE
PID:4024 -
\??\c:\bnbtnn.exec:\bnbtnn.exe50⤵
- Executes dropped EXE
PID:2148 -
\??\c:\7jjjj.exec:\7jjjj.exe51⤵
- Executes dropped EXE
PID:4804 -
\??\c:\rrrxxlf.exec:\rrrxxlf.exe52⤵
- Executes dropped EXE
PID:2140 -
\??\c:\nhhbtt.exec:\nhhbtt.exe53⤵
- Executes dropped EXE
PID:724 -
\??\c:\vpvvd.exec:\vpvvd.exe54⤵
- Executes dropped EXE
PID:212 -
\??\c:\xrrrlfx.exec:\xrrrlfx.exe55⤵
- Executes dropped EXE
PID:3068 -
\??\c:\htnhhb.exec:\htnhhb.exe56⤵
- Executes dropped EXE
PID:408 -
\??\c:\vdpjd.exec:\vdpjd.exe57⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rlllfxr.exec:\rlllfxr.exe58⤵
- Executes dropped EXE
PID:3236 -
\??\c:\ppdpv.exec:\ppdpv.exe59⤵
- Executes dropped EXE
PID:4940 -
\??\c:\1rlffxr.exec:\1rlffxr.exe60⤵
- Executes dropped EXE
PID:2100 -
\??\c:\xxxxffx.exec:\xxxxffx.exe61⤵
- Executes dropped EXE
PID:4556 -
\??\c:\thhbnn.exec:\thhbnn.exe62⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pvjjj.exec:\pvjjj.exe63⤵
- Executes dropped EXE
PID:4916 -
\??\c:\llxrllr.exec:\llxrllr.exe64⤵
- Executes dropped EXE
PID:3168 -
\??\c:\nhnhhh.exec:\nhnhhh.exe65⤵
- Executes dropped EXE
PID:3716 -
\??\c:\ppppd.exec:\ppppd.exe66⤵PID:4016
-
\??\c:\1xflxxf.exec:\1xflxxf.exe67⤵PID:3472
-
\??\c:\bbhbtt.exec:\bbhbtt.exe68⤵PID:1828
-
\??\c:\vvddv.exec:\vvddv.exe69⤵PID:4272
-
\??\c:\lfrllll.exec:\lfrllll.exe70⤵PID:2364
-
\??\c:\tbnbnh.exec:\tbnbnh.exe71⤵PID:3992
-
\??\c:\1ddvp.exec:\1ddvp.exe72⤵PID:1272
-
\??\c:\bbhbtn.exec:\bbhbtn.exe73⤵
- System Location Discovery: System Language Discovery
PID:3988 -
\??\c:\vvdjv.exec:\vvdjv.exe74⤵
- System Location Discovery: System Language Discovery
PID:3240 -
\??\c:\1ddvv.exec:\1ddvv.exe75⤵PID:440
-
\??\c:\fflxxxx.exec:\fflxxxx.exe76⤵PID:3692
-
\??\c:\tbhnbn.exec:\tbhnbn.exe77⤵PID:4572
-
\??\c:\vjdvp.exec:\vjdvp.exe78⤵PID:1128
-
\??\c:\lxlfllf.exec:\lxlfllf.exe79⤵PID:4176
-
\??\c:\rxfxrxr.exec:\rxfxrxr.exe80⤵PID:4188
-
\??\c:\btbttt.exec:\btbttt.exe81⤵
- System Location Discovery: System Language Discovery
PID:4920 -
\??\c:\jddjv.exec:\jddjv.exe82⤵PID:2012
-
\??\c:\9rffxfx.exec:\9rffxfx.exe83⤵PID:4496
-
\??\c:\7hthbb.exec:\7hthbb.exe84⤵PID:4776
-
\??\c:\3ppvj.exec:\3ppvj.exe85⤵PID:4560
-
\??\c:\fxflflf.exec:\fxflflf.exe86⤵PID:1700
-
\??\c:\hthhbb.exec:\hthhbb.exe87⤵PID:4976
-
\??\c:\vpvjd.exec:\vpvjd.exe88⤵PID:4072
-
\??\c:\fxrrllf.exec:\fxrrllf.exe89⤵PID:3428
-
\??\c:\nnnbtn.exec:\nnnbtn.exe90⤵PID:5088
-
\??\c:\1ddpd.exec:\1ddpd.exe91⤵PID:3244
-
\??\c:\xrlfllr.exec:\xrlfllr.exe92⤵PID:2648
-
\??\c:\bthhhh.exec:\bthhhh.exe93⤵PID:1252
-
\??\c:\vvppj.exec:\vvppj.exe94⤵PID:1432
-
\??\c:\5llxrrr.exec:\5llxrrr.exe95⤵PID:984
-
\??\c:\rxlxrlf.exec:\rxlxrlf.exe96⤵PID:4796
-
\??\c:\btbnhb.exec:\btbnhb.exe97⤵PID:1508
-
\??\c:\ppddj.exec:\ppddj.exe98⤵PID:2460
-
\??\c:\xrrfxfr.exec:\xrrfxfr.exe99⤵PID:3220
-
\??\c:\btnhtt.exec:\btnhtt.exe100⤵PID:1880
-
\??\c:\pppjd.exec:\pppjd.exe101⤵PID:1248
-
\??\c:\5rfxrrr.exec:\5rfxrrr.exe102⤵PID:2936
-
\??\c:\nhnhnn.exec:\nhnhnn.exe103⤵PID:4720
-
\??\c:\djvpj.exec:\djvpj.exe104⤵PID:1740
-
\??\c:\jvvdv.exec:\jvvdv.exe105⤵PID:1560
-
\??\c:\lfrlrlx.exec:\lfrlrlx.exe106⤵PID:3756
-
\??\c:\nhbhhh.exec:\nhbhhh.exe107⤵PID:3260
-
\??\c:\pdjjv.exec:\pdjjv.exe108⤵PID:3012
-
\??\c:\rffrrll.exec:\rffrrll.exe109⤵PID:1448
-
\??\c:\3hnbnb.exec:\3hnbnb.exe110⤵PID:4816
-
\??\c:\jjjjd.exec:\jjjjd.exe111⤵PID:212
-
\??\c:\lfflfxr.exec:\lfflfxr.exe112⤵PID:3188
-
\??\c:\nthbtn.exec:\nthbtn.exe113⤵PID:2000
-
\??\c:\jvjdp.exec:\jvjdp.exe114⤵PID:4864
-
\??\c:\lxrflxx.exec:\lxrflxx.exe115⤵PID:3160
-
\??\c:\hnhnbt.exec:\hnhnbt.exe116⤵PID:3772
-
\??\c:\bhnnhn.exec:\bhnnhn.exe117⤵PID:2372
-
\??\c:\vvpjv.exec:\vvpjv.exe118⤵PID:4476
-
\??\c:\1rfxffx.exec:\1rfxffx.exe119⤵PID:1752
-
\??\c:\nbnnbt.exec:\nbnnbt.exe120⤵PID:4428
-
\??\c:\pjdvp.exec:\pjdvp.exe121⤵PID:3828
-
\??\c:\xrfxrll.exec:\xrfxrll.exe122⤵PID:3168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-