Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 21:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
46b844698444932a3f24015f7e46d1637b4923a8a659f86654eed9edb6aad60f.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
46b844698444932a3f24015f7e46d1637b4923a8a659f86654eed9edb6aad60f.exe
-
Size
346KB
-
MD5
f8a64f2c4b35529bdda5e88e089e03c4
-
SHA1
fe302e141d1cbcf237d3558405b58764836518df
-
SHA256
46b844698444932a3f24015f7e46d1637b4923a8a659f86654eed9edb6aad60f
-
SHA512
b8591bc63110e72cbff2c13101e6ca736f8c3bb2609c090b0569de24e1d9f391661b5dffc3803653787d05868d5f420b8eccc8f0781ea732820c32c42648842b
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAt:l7TcbWXZshJX2VGdt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4080-5-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/232-10-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4912-14-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4736-18-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1008-31-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2836-37-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1992-44-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3956-56-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4420-68-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2092-74-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3548-85-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2408-93-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5108-108-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/820-119-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4916-141-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1376-158-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5056-191-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4996-195-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3328-216-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4324-226-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4436-230-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4328-234-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4604-249-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3232-253-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2128-267-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3628-271-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2092-289-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2684-293-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1436-300-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2760-320-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5100-327-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1964-313-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2032-337-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4520-341-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2836-260-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2372-211-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/392-202-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2312-186-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/540-176-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4548-169-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2720-152-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1996-91-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3088-79-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4040-60-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3528-50-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4220-358-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4996-383-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2896-405-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1232-409-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3132-416-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2584-432-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2360-473-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2964-612-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1068-661-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4300-701-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1856-735-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/588-875-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/956-933-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4472-1024-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1352-1271-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3596-1305-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3520-1525-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 232 jdjjp.exe 4912 fffxlxx.exe 4736 hbbntn.exe 1008 jjdvj.exe 2836 dvddv.exe 1992 nbtnnn.exe 3528 9pdvd.exe 3956 fxlfffx.exe 4040 7xfxxxr.exe 4420 9nnbtt.exe 2092 1jjpd.exe 3088 bttnnt.exe 3548 jddjp.exe 2408 7lrrrrr.exe 1996 thhtbn.exe 1492 hnbbtb.exe 5108 jjddd.exe 2024 flllfff.exe 820 nntnhb.exe 3960 1jjjd.exe 1896 hntbhh.exe 4416 1jpjv.exe 4916 lrffxrl.exe 212 bbtbtt.exe 2720 tnhhnn.exe 1376 ddvpj.exe 4220 llfrrfr.exe 4548 vjvpj.exe 540 flrlfrl.exe 3936 bhhhbh.exe 2312 tnnhbb.exe 5056 fxfffff.exe 4996 xxrlffl.exe 2824 bhtnbb.exe 924 dpvvd.exe 392 rffrxxx.exe 1384 thtnnh.exe 2372 nthntb.exe 3328 vvvpp.exe 1232 fxlffxx.exe 1404 lrxlffx.exe 4324 hhthnh.exe 4436 pdvdp.exe 4328 pdjvv.exe 4484 5lrfxrl.exe 3036 ttnhbt.exe 2484 jdvpp.exe 1380 vvvjv.exe 4604 3ffrfxl.exe 3232 5nbtbb.exe 2380 jppdp.exe 2836 pppdj.exe 3288 xrfrfxl.exe 2128 bttntn.exe 3628 bthbht.exe 1692 jjjdv.exe 4092 1ffrllf.exe 4420 tbbhhb.exe 4368 bbbhnb.exe 4172 jdjdp.exe 2092 bbttbt.exe 2684 5pjpj.exe 4432 9lfffff.exe 1436 ffrfrlx.exe -
resource yara_rule behavioral2/memory/4080-5-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/232-10-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4912-14-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4736-18-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1008-24-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1008-31-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2836-32-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2836-37-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1992-44-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3956-56-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4420-68-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2092-74-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3548-85-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2408-93-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5108-108-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/820-119-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4916-141-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/212-142-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1376-158-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5056-191-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4996-195-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3328-216-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4324-226-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4436-230-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4328-234-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4604-249-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3232-253-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2128-267-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3628-271-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2092-289-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2684-293-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1436-300-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2760-320-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5100-327-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1964-313-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2032-337-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4520-341-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2836-260-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3328-212-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2372-211-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/392-202-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2312-186-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/540-176-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4548-169-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2720-152-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1996-91-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3088-79-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4040-60-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3528-50-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4220-358-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4996-383-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2896-405-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1232-409-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3132-416-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2584-432-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3956-454-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2360-473-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2964-612-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1068-661-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4300-701-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1856-735-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3116-817-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/588-875-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/956-933-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4080 wrote to memory of 232 4080 46b844698444932a3f24015f7e46d1637b4923a8a659f86654eed9edb6aad60f.exe 82 PID 4080 wrote to memory of 232 4080 46b844698444932a3f24015f7e46d1637b4923a8a659f86654eed9edb6aad60f.exe 82 PID 4080 wrote to memory of 232 4080 46b844698444932a3f24015f7e46d1637b4923a8a659f86654eed9edb6aad60f.exe 82 PID 232 wrote to memory of 4912 232 jdjjp.exe 83 PID 232 wrote to memory of 4912 232 jdjjp.exe 83 PID 232 wrote to memory of 4912 232 jdjjp.exe 83 PID 4912 wrote to memory of 4736 4912 fffxlxx.exe 84 PID 4912 wrote to memory of 4736 4912 fffxlxx.exe 84 PID 4912 wrote to memory of 4736 4912 fffxlxx.exe 84 PID 4736 wrote to memory of 1008 4736 hbbntn.exe 85 PID 4736 wrote to memory of 1008 4736 hbbntn.exe 85 PID 4736 wrote to memory of 1008 4736 hbbntn.exe 85 PID 1008 wrote to memory of 2836 1008 jjdvj.exe 133 PID 1008 wrote to memory of 2836 1008 jjdvj.exe 133 PID 1008 wrote to memory of 2836 1008 jjdvj.exe 133 PID 2836 wrote to memory of 1992 2836 dvddv.exe 87 PID 2836 wrote to memory of 1992 2836 dvddv.exe 87 PID 2836 wrote to memory of 1992 2836 dvddv.exe 87 PID 1992 wrote to memory of 3528 1992 nbtnnn.exe 88 PID 1992 wrote to memory of 3528 1992 nbtnnn.exe 88 PID 1992 wrote to memory of 3528 1992 nbtnnn.exe 88 PID 3528 wrote to memory of 3956 3528 9pdvd.exe 89 PID 3528 wrote to memory of 3956 3528 9pdvd.exe 89 PID 3528 wrote to memory of 3956 3528 9pdvd.exe 89 PID 3956 wrote to memory of 4040 3956 fxlfffx.exe 90 PID 3956 wrote to memory of 4040 3956 fxlfffx.exe 90 PID 3956 wrote to memory of 4040 3956 fxlfffx.exe 90 PID 4040 wrote to memory of 4420 4040 7xfxxxr.exe 91 PID 4040 wrote to memory of 4420 4040 7xfxxxr.exe 91 PID 4040 wrote to memory of 4420 4040 7xfxxxr.exe 91 PID 4420 wrote to memory of 2092 4420 9nnbtt.exe 142 PID 4420 wrote to memory of 2092 4420 9nnbtt.exe 142 PID 4420 wrote to memory of 2092 4420 9nnbtt.exe 142 PID 2092 wrote to memory of 3088 2092 1jjpd.exe 93 PID 2092 wrote to memory of 3088 2092 1jjpd.exe 93 PID 2092 wrote to memory of 3088 2092 1jjpd.exe 93 PID 3088 wrote to memory of 3548 3088 bttnnt.exe 94 PID 3088 wrote to memory of 3548 3088 bttnnt.exe 94 PID 3088 wrote to memory of 3548 3088 bttnnt.exe 94 PID 3548 wrote to memory of 2408 3548 jddjp.exe 95 PID 3548 wrote to memory of 2408 3548 jddjp.exe 95 PID 3548 wrote to memory of 2408 3548 jddjp.exe 95 PID 2408 wrote to memory of 1996 2408 7lrrrrr.exe 96 PID 2408 wrote to memory of 1996 2408 7lrrrrr.exe 96 PID 2408 wrote to memory of 1996 2408 7lrrrrr.exe 96 PID 1996 wrote to memory of 1492 1996 thhtbn.exe 97 PID 1996 wrote to memory of 1492 1996 thhtbn.exe 97 PID 1996 wrote to memory of 1492 1996 thhtbn.exe 97 PID 1492 wrote to memory of 5108 1492 hnbbtb.exe 98 PID 1492 wrote to memory of 5108 1492 hnbbtb.exe 98 PID 1492 wrote to memory of 5108 1492 hnbbtb.exe 98 PID 5108 wrote to memory of 2024 5108 jjddd.exe 99 PID 5108 wrote to memory of 2024 5108 jjddd.exe 99 PID 5108 wrote to memory of 2024 5108 jjddd.exe 99 PID 2024 wrote to memory of 820 2024 flllfff.exe 100 PID 2024 wrote to memory of 820 2024 flllfff.exe 100 PID 2024 wrote to memory of 820 2024 flllfff.exe 100 PID 820 wrote to memory of 3960 820 nntnhb.exe 101 PID 820 wrote to memory of 3960 820 nntnhb.exe 101 PID 820 wrote to memory of 3960 820 nntnhb.exe 101 PID 3960 wrote to memory of 1896 3960 1jjjd.exe 102 PID 3960 wrote to memory of 1896 3960 1jjjd.exe 102 PID 3960 wrote to memory of 1896 3960 1jjjd.exe 102 PID 1896 wrote to memory of 4416 1896 hntbhh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\46b844698444932a3f24015f7e46d1637b4923a8a659f86654eed9edb6aad60f.exe"C:\Users\Admin\AppData\Local\Temp\46b844698444932a3f24015f7e46d1637b4923a8a659f86654eed9edb6aad60f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\jdjjp.exec:\jdjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\fffxlxx.exec:\fffxlxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\hbbntn.exec:\hbbntn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\jjdvj.exec:\jjdvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\dvddv.exec:\dvddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\nbtnnn.exec:\nbtnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\9pdvd.exec:\9pdvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\fxlfffx.exec:\fxlfffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\7xfxxxr.exec:\7xfxxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\9nnbtt.exec:\9nnbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\1jjpd.exec:\1jjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\bttnnt.exec:\bttnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\jddjp.exec:\jddjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\7lrrrrr.exec:\7lrrrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\thhtbn.exec:\thhtbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\hnbbtb.exec:\hnbbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\jjddd.exec:\jjddd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\flllfff.exec:\flllfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\nntnhb.exec:\nntnhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\1jjjd.exec:\1jjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\hntbhh.exec:\hntbhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\1jpjv.exec:\1jpjv.exe23⤵
- Executes dropped EXE
PID:4416 -
\??\c:\lrffxrl.exec:\lrffxrl.exe24⤵
- Executes dropped EXE
PID:4916 -
\??\c:\bbtbtt.exec:\bbtbtt.exe25⤵
- Executes dropped EXE
PID:212 -
\??\c:\tnhhnn.exec:\tnhhnn.exe26⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ddvpj.exec:\ddvpj.exe27⤵
- Executes dropped EXE
PID:1376 -
\??\c:\llfrrfr.exec:\llfrrfr.exe28⤵
- Executes dropped EXE
PID:4220 -
\??\c:\vjvpj.exec:\vjvpj.exe29⤵
- Executes dropped EXE
PID:4548 -
\??\c:\flrlfrl.exec:\flrlfrl.exe30⤵
- Executes dropped EXE
PID:540 -
\??\c:\bhhhbh.exec:\bhhhbh.exe31⤵
- Executes dropped EXE
PID:3936 -
\??\c:\tnnhbb.exec:\tnnhbb.exe32⤵
- Executes dropped EXE
PID:2312 -
\??\c:\fxfffff.exec:\fxfffff.exe33⤵
- Executes dropped EXE
PID:5056 -
\??\c:\xxrlffl.exec:\xxrlffl.exe34⤵
- Executes dropped EXE
PID:4996 -
\??\c:\bhtnbb.exec:\bhtnbb.exe35⤵
- Executes dropped EXE
PID:2824 -
\??\c:\dpvvd.exec:\dpvvd.exe36⤵
- Executes dropped EXE
PID:924 -
\??\c:\rffrxxx.exec:\rffrxxx.exe37⤵
- Executes dropped EXE
PID:392 -
\??\c:\thtnnh.exec:\thtnnh.exe38⤵
- Executes dropped EXE
PID:1384 -
\??\c:\nthntb.exec:\nthntb.exe39⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vvvpp.exec:\vvvpp.exe40⤵
- Executes dropped EXE
PID:3328 -
\??\c:\fxlffxx.exec:\fxlffxx.exe41⤵
- Executes dropped EXE
PID:1232 -
\??\c:\lrxlffx.exec:\lrxlffx.exe42⤵
- Executes dropped EXE
PID:1404 -
\??\c:\hhthnh.exec:\hhthnh.exe43⤵
- Executes dropped EXE
PID:4324 -
\??\c:\pdvdp.exec:\pdvdp.exe44⤵
- Executes dropped EXE
PID:4436 -
\??\c:\pdjvv.exec:\pdjvv.exe45⤵
- Executes dropped EXE
PID:4328 -
\??\c:\5lrfxrl.exec:\5lrfxrl.exe46⤵
- Executes dropped EXE
PID:4484 -
\??\c:\ttnhbt.exec:\ttnhbt.exe47⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jdvpp.exec:\jdvpp.exe48⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vvvjv.exec:\vvvjv.exe49⤵
- Executes dropped EXE
PID:1380 -
\??\c:\3ffrfxl.exec:\3ffrfxl.exe50⤵
- Executes dropped EXE
PID:4604 -
\??\c:\5nbtbb.exec:\5nbtbb.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3232 -
\??\c:\jppdp.exec:\jppdp.exe52⤵
- Executes dropped EXE
PID:2380 -
\??\c:\pppdj.exec:\pppdj.exe53⤵
- Executes dropped EXE
PID:2836 -
\??\c:\xrfrfxl.exec:\xrfrfxl.exe54⤵
- Executes dropped EXE
PID:3288 -
\??\c:\bttntn.exec:\bttntn.exe55⤵
- Executes dropped EXE
PID:2128 -
\??\c:\bthbht.exec:\bthbht.exe56⤵
- Executes dropped EXE
PID:3628 -
\??\c:\jjjdv.exec:\jjjdv.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1692 -
\??\c:\1ffrllf.exec:\1ffrllf.exe58⤵
- Executes dropped EXE
PID:4092 -
\??\c:\tbbhhb.exec:\tbbhhb.exe59⤵
- Executes dropped EXE
PID:4420 -
\??\c:\bbbhnb.exec:\bbbhnb.exe60⤵
- Executes dropped EXE
PID:4368 -
\??\c:\jdjdp.exec:\jdjdp.exe61⤵
- Executes dropped EXE
PID:4172 -
\??\c:\bbttbt.exec:\bbttbt.exe62⤵
- Executes dropped EXE
PID:2092 -
\??\c:\5pjpj.exec:\5pjpj.exe63⤵
- Executes dropped EXE
PID:2684 -
\??\c:\9lfffff.exec:\9lfffff.exe64⤵
- Executes dropped EXE
PID:4432 -
\??\c:\ffrfrlx.exec:\ffrfrlx.exe65⤵
- Executes dropped EXE
PID:1436 -
\??\c:\btbbnt.exec:\btbbnt.exe66⤵PID:1556
-
\??\c:\dvvdd.exec:\dvvdd.exe67⤵PID:4992
-
\??\c:\ffxrffl.exec:\ffxrffl.exe68⤵PID:4412
-
\??\c:\nbbttn.exec:\nbbttn.exe69⤵PID:1964
-
\??\c:\tnttnh.exec:\tnttnh.exe70⤵
- System Location Discovery: System Language Discovery
PID:2356 -
\??\c:\5djdv.exec:\5djdv.exe71⤵PID:2760
-
\??\c:\pdpjj.exec:\pdpjj.exe72⤵PID:3236
-
\??\c:\flxrlrl.exec:\flxrlrl.exe73⤵PID:5100
-
\??\c:\tttbbh.exec:\tttbbh.exe74⤵PID:1668
-
\??\c:\bhnhhh.exec:\bhnhhh.exe75⤵PID:1896
-
\??\c:\vpjjd.exec:\vpjjd.exe76⤵PID:2032
-
\??\c:\pjpjp.exec:\pjpjp.exe77⤵PID:4520
-
\??\c:\rrrfffx.exec:\rrrfffx.exe78⤵PID:1968
-
\??\c:\ttnhhh.exec:\ttnhhh.exe79⤵
- System Location Discovery: System Language Discovery
PID:552 -
\??\c:\7nbhnb.exec:\7nbhnb.exe80⤵PID:4240
-
\??\c:\dvppp.exec:\dvppp.exe81⤵PID:4492
-
\??\c:\lrfxllr.exec:\lrfxllr.exe82⤵PID:4220
-
\??\c:\5tbhnh.exec:\5tbhnh.exe83⤵PID:4932
-
\??\c:\7jdvv.exec:\7jdvv.exe84⤵PID:2900
-
\??\c:\rrlflrr.exec:\rrlflrr.exe85⤵PID:1736
-
\??\c:\flfxxxx.exec:\flfxxxx.exe86⤵PID:3936
-
\??\c:\tbtbnb.exec:\tbtbnb.exe87⤵PID:2312
-
\??\c:\xxxlffx.exec:\xxxlffx.exe88⤵PID:2384
-
\??\c:\jvdvv.exec:\jvdvv.exe89⤵PID:3880
-
\??\c:\tbnbbh.exec:\tbnbbh.exe90⤵PID:4996
-
\??\c:\9llxxxx.exec:\9llxxxx.exe91⤵PID:1800
-
\??\c:\lrfxrrr.exec:\lrfxrrr.exe92⤵
- System Location Discovery: System Language Discovery
PID:3048 -
\??\c:\xfrrxxl.exec:\xfrrxxl.exe93⤵PID:3308
-
\??\c:\hnttbh.exec:\hnttbh.exe94⤵PID:1384
-
\??\c:\vjvpj.exec:\vjvpj.exe95⤵PID:4252
-
\??\c:\bnnhnt.exec:\bnnhnt.exe96⤵PID:2084
-
\??\c:\dvddv.exec:\dvddv.exe97⤵PID:2896
-
\??\c:\lfffrxr.exec:\lfffrxr.exe98⤵
- System Location Discovery: System Language Discovery
PID:1232 -
\??\c:\vvdvd.exec:\vvdvd.exe99⤵PID:4132
-
\??\c:\rrxrllf.exec:\rrxrllf.exe100⤵PID:3132
-
\??\c:\ffrlxxr.exec:\ffrlxxr.exe101⤵PID:1952
-
\??\c:\htnhbn.exec:\htnhbn.exe102⤵PID:4328
-
\??\c:\vddvp.exec:\vddvp.exe103⤵PID:4780
-
\??\c:\vjdjd.exec:\vjdjd.exe104⤵PID:1016
-
\??\c:\fxlfrxl.exec:\fxlfrxl.exe105⤵PID:2584
-
\??\c:\bbbttt.exec:\bbbttt.exe106⤵PID:3024
-
\??\c:\9dvpj.exec:\9dvpj.exe107⤵
- System Location Discovery: System Language Discovery
PID:1264 -
\??\c:\pdpdp.exec:\pdpdp.exe108⤵PID:4872
-
\??\c:\xxxlfxx.exec:\xxxlfxx.exe109⤵PID:4800
-
\??\c:\bhhbtn.exec:\bhhbtn.exe110⤵PID:2324
-
\??\c:\ttnhtb.exec:\ttnhtb.exe111⤵PID:2836
-
\??\c:\jjvjp.exec:\jjvjp.exe112⤵PID:3528
-
\??\c:\xlxlxrf.exec:\xlxlxrf.exe113⤵PID:3956
-
\??\c:\nttnhh.exec:\nttnhh.exe114⤵PID:3628
-
\??\c:\jppdp.exec:\jppdp.exe115⤵PID:2404
-
\??\c:\lflxlfr.exec:\lflxlfr.exe116⤵PID:5092
-
\??\c:\htbbht.exec:\htbbht.exe117⤵PID:3852
-
\??\c:\7jvpv.exec:\7jvpv.exe118⤵PID:2360
-
\??\c:\pdddd.exec:\pdddd.exe119⤵PID:4700
-
\??\c:\rlxllll.exec:\rlxllll.exe120⤵PID:2284
-
\??\c:\7nhbth.exec:\7nhbth.exe121⤵PID:640
-
\??\c:\dvvvv.exec:\dvvvv.exe122⤵PID:4716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-