Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 22:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
430172fab613bc1c2d64c4dc1453aa7c74f48d6209d91da1bbae0330921960a7.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
430172fab613bc1c2d64c4dc1453aa7c74f48d6209d91da1bbae0330921960a7.exe
-
Size
452KB
-
MD5
164431fb08b2464b7ea0d945fcadf177
-
SHA1
b71f8d1baf1290c144e8828446da026bd06ba393
-
SHA256
430172fab613bc1c2d64c4dc1453aa7c74f48d6209d91da1bbae0330921960a7
-
SHA512
7e9cd05094cd8fc19e6f81536daf4f5ad00622d21ffd1107dbc5071bef81c221a58a7e229b6f6c75b5a1bb8bafd4a6441bc979a899da31bb0009430c33c382d5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4660-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3816-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/664-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3752-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-691-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-777-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-808-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-830-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-868-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-902-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-994-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-1007-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4116-1038-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-1099-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4340 bhnhbb.exe 2652 xlllfxr.exe 3512 thbnhb.exe 4968 htnbnh.exe 4616 dvdpv.exe 4984 jvppj.exe 3096 frxrxxr.exe 1676 fxfrlfx.exe 3704 djjvd.exe 3224 fxxrlfx.exe 3388 bbbbtn.exe 2396 pvjdd.exe 4792 5xxxrxr.exe 5064 bbhhtt.exe 32 pdpdv.exe 1360 lffxxxx.exe 960 djddj.exe 4168 5tbttt.exe 4628 xxxxrxr.exe 4732 nhbbtt.exe 2436 rflrlfx.exe 3064 nbhhbb.exe 4516 lfxxrrl.exe 3976 nbhtnh.exe 3816 lrlxrfl.exe 3236 vppdd.exe 5044 frrfxrl.exe 2596 9pjvp.exe 2404 htthbb.exe 968 flrlfrl.exe 4156 bnnbhh.exe 2312 rlrlxxr.exe 2844 1djdv.exe 1344 xlxrxrx.exe 3528 5bbnhb.exe 2336 jjppj.exe 1464 jjjpp.exe 1752 rlrfllr.exe 468 nbbtnh.exe 2424 vpppp.exe 4868 xlxrllr.exe 1748 hbnhbb.exe 4592 9hnhhh.exe 2492 1dppv.exe 1008 frrrrrr.exe 1992 tthbnt.exe 2080 7hbbtt.exe 2360 jddvv.exe 4392 7xrrrrr.exe 1180 httbtt.exe 452 jvpjd.exe 4556 7llfrrr.exe 3632 5hnhnn.exe 3396 hhtnnh.exe 4308 3pvpv.exe 3908 xflxllx.exe 4300 btbnbt.exe 4936 jpvpv.exe 2696 lfxrrrr.exe 3904 hbbtnh.exe 664 vdppj.exe 1060 lxffxxr.exe 400 lflrlfx.exe 3436 thhbtt.exe -
resource yara_rule behavioral2/memory/4660-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3704-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3816-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/664-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-777-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-808-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-830-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-851-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-868-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-902-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-921-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nththh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ththbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4660 wrote to memory of 4340 4660 430172fab613bc1c2d64c4dc1453aa7c74f48d6209d91da1bbae0330921960a7.exe 83 PID 4660 wrote to memory of 4340 4660 430172fab613bc1c2d64c4dc1453aa7c74f48d6209d91da1bbae0330921960a7.exe 83 PID 4660 wrote to memory of 4340 4660 430172fab613bc1c2d64c4dc1453aa7c74f48d6209d91da1bbae0330921960a7.exe 83 PID 4340 wrote to memory of 2652 4340 bhnhbb.exe 84 PID 4340 wrote to memory of 2652 4340 bhnhbb.exe 84 PID 4340 wrote to memory of 2652 4340 bhnhbb.exe 84 PID 2652 wrote to memory of 3512 2652 xlllfxr.exe 85 PID 2652 wrote to memory of 3512 2652 xlllfxr.exe 85 PID 2652 wrote to memory of 3512 2652 xlllfxr.exe 85 PID 3512 wrote to memory of 4968 3512 thbnhb.exe 86 PID 3512 wrote to memory of 4968 3512 thbnhb.exe 86 PID 3512 wrote to memory of 4968 3512 thbnhb.exe 86 PID 4968 wrote to memory of 4616 4968 htnbnh.exe 87 PID 4968 wrote to memory of 4616 4968 htnbnh.exe 87 PID 4968 wrote to memory of 4616 4968 htnbnh.exe 87 PID 4616 wrote to memory of 4984 4616 dvdpv.exe 88 PID 4616 wrote to memory of 4984 4616 dvdpv.exe 88 PID 4616 wrote to memory of 4984 4616 dvdpv.exe 88 PID 4984 wrote to memory of 3096 4984 jvppj.exe 89 PID 4984 wrote to memory of 3096 4984 jvppj.exe 89 PID 4984 wrote to memory of 3096 4984 jvppj.exe 89 PID 3096 wrote to memory of 1676 3096 frxrxxr.exe 90 PID 3096 wrote to memory of 1676 3096 frxrxxr.exe 90 PID 3096 wrote to memory of 1676 3096 frxrxxr.exe 90 PID 1676 wrote to memory of 3704 1676 fxfrlfx.exe 91 PID 1676 wrote to memory of 3704 1676 fxfrlfx.exe 91 PID 1676 wrote to memory of 3704 1676 fxfrlfx.exe 91 PID 3704 wrote to memory of 3224 3704 djjvd.exe 92 PID 3704 wrote to memory of 3224 3704 djjvd.exe 92 PID 3704 wrote to memory of 3224 3704 djjvd.exe 92 PID 3224 wrote to memory of 3388 3224 fxxrlfx.exe 93 PID 3224 wrote to memory of 3388 3224 fxxrlfx.exe 93 PID 3224 wrote to memory of 3388 3224 fxxrlfx.exe 93 PID 3388 wrote to memory of 2396 3388 bbbbtn.exe 94 PID 3388 wrote to memory of 2396 3388 bbbbtn.exe 94 PID 3388 wrote to memory of 2396 3388 bbbbtn.exe 94 PID 2396 wrote to memory of 4792 2396 pvjdd.exe 95 PID 2396 wrote to memory of 4792 2396 pvjdd.exe 95 PID 2396 wrote to memory of 4792 2396 pvjdd.exe 95 PID 4792 wrote to memory of 5064 4792 5xxxrxr.exe 96 PID 4792 wrote to memory of 5064 4792 5xxxrxr.exe 96 PID 4792 wrote to memory of 5064 4792 5xxxrxr.exe 96 PID 5064 wrote to memory of 32 5064 bbhhtt.exe 97 PID 5064 wrote to memory of 32 5064 bbhhtt.exe 97 PID 5064 wrote to memory of 32 5064 bbhhtt.exe 97 PID 32 wrote to memory of 1360 32 pdpdv.exe 98 PID 32 wrote to memory of 1360 32 pdpdv.exe 98 PID 32 wrote to memory of 1360 32 pdpdv.exe 98 PID 1360 wrote to memory of 960 1360 lffxxxx.exe 99 PID 1360 wrote to memory of 960 1360 lffxxxx.exe 99 PID 1360 wrote to memory of 960 1360 lffxxxx.exe 99 PID 960 wrote to memory of 4168 960 djddj.exe 100 PID 960 wrote to memory of 4168 960 djddj.exe 100 PID 960 wrote to memory of 4168 960 djddj.exe 100 PID 4168 wrote to memory of 4628 4168 5tbttt.exe 101 PID 4168 wrote to memory of 4628 4168 5tbttt.exe 101 PID 4168 wrote to memory of 4628 4168 5tbttt.exe 101 PID 4628 wrote to memory of 4732 4628 xxxxrxr.exe 102 PID 4628 wrote to memory of 4732 4628 xxxxrxr.exe 102 PID 4628 wrote to memory of 4732 4628 xxxxrxr.exe 102 PID 4732 wrote to memory of 2436 4732 nhbbtt.exe 103 PID 4732 wrote to memory of 2436 4732 nhbbtt.exe 103 PID 4732 wrote to memory of 2436 4732 nhbbtt.exe 103 PID 2436 wrote to memory of 3064 2436 rflrlfx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\430172fab613bc1c2d64c4dc1453aa7c74f48d6209d91da1bbae0330921960a7.exe"C:\Users\Admin\AppData\Local\Temp\430172fab613bc1c2d64c4dc1453aa7c74f48d6209d91da1bbae0330921960a7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\bhnhbb.exec:\bhnhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\xlllfxr.exec:\xlllfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\thbnhb.exec:\thbnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\htnbnh.exec:\htnbnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\dvdpv.exec:\dvdpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\jvppj.exec:\jvppj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\frxrxxr.exec:\frxrxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\fxfrlfx.exec:\fxfrlfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\djjvd.exec:\djjvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\bbbbtn.exec:\bbbbtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\pvjdd.exec:\pvjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\5xxxrxr.exec:\5xxxrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\bbhhtt.exec:\bbhhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\pdpdv.exec:\pdpdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\lffxxxx.exec:\lffxxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\djddj.exec:\djddj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\5tbttt.exec:\5tbttt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\xxxxrxr.exec:\xxxxrxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\nhbbtt.exec:\nhbbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\rflrlfx.exec:\rflrlfx.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\nbhhbb.exec:\nbhhbb.exe23⤵
- Executes dropped EXE
PID:3064 -
\??\c:\lfxxrrl.exec:\lfxxrrl.exe24⤵
- Executes dropped EXE
PID:4516 -
\??\c:\nbhtnh.exec:\nbhtnh.exe25⤵
- Executes dropped EXE
PID:3976 -
\??\c:\lrlxrfl.exec:\lrlxrfl.exe26⤵
- Executes dropped EXE
PID:3816 -
\??\c:\vppdd.exec:\vppdd.exe27⤵
- Executes dropped EXE
PID:3236 -
\??\c:\frrfxrl.exec:\frrfxrl.exe28⤵
- Executes dropped EXE
PID:5044 -
\??\c:\9pjvp.exec:\9pjvp.exe29⤵
- Executes dropped EXE
PID:2596 -
\??\c:\htthbb.exec:\htthbb.exe30⤵
- Executes dropped EXE
PID:2404 -
\??\c:\flrlfrl.exec:\flrlfrl.exe31⤵
- Executes dropped EXE
PID:968 -
\??\c:\bnnbhh.exec:\bnnbhh.exe32⤵
- Executes dropped EXE
PID:4156 -
\??\c:\rlrlxxr.exec:\rlrlxxr.exe33⤵
- Executes dropped EXE
PID:2312 -
\??\c:\1djdv.exec:\1djdv.exe34⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xlxrxrx.exec:\xlxrxrx.exe35⤵
- Executes dropped EXE
PID:1344 -
\??\c:\5bbnhb.exec:\5bbnhb.exe36⤵
- Executes dropped EXE
PID:3528 -
\??\c:\jjppj.exec:\jjppj.exe37⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jjjpp.exec:\jjjpp.exe38⤵
- Executes dropped EXE
PID:1464 -
\??\c:\rlrfllr.exec:\rlrfllr.exe39⤵
- Executes dropped EXE
PID:1752 -
\??\c:\nbbtnh.exec:\nbbtnh.exe40⤵
- Executes dropped EXE
PID:468 -
\??\c:\vpppp.exec:\vpppp.exe41⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xlxrllr.exec:\xlxrllr.exe42⤵
- Executes dropped EXE
PID:4868 -
\??\c:\hbnhbb.exec:\hbnhbb.exe43⤵
- Executes dropped EXE
PID:1748 -
\??\c:\9hnhhh.exec:\9hnhhh.exe44⤵
- Executes dropped EXE
PID:4592 -
\??\c:\1dppv.exec:\1dppv.exe45⤵
- Executes dropped EXE
PID:2492 -
\??\c:\frrrrrr.exec:\frrrrrr.exe46⤵
- Executes dropped EXE
PID:1008 -
\??\c:\tthbnt.exec:\tthbnt.exe47⤵
- Executes dropped EXE
PID:1992 -
\??\c:\7hbbtt.exec:\7hbbtt.exe48⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jddvv.exec:\jddvv.exe49⤵
- Executes dropped EXE
PID:2360 -
\??\c:\7xrrrrr.exec:\7xrrrrr.exe50⤵
- Executes dropped EXE
PID:4392 -
\??\c:\httbtt.exec:\httbtt.exe51⤵
- Executes dropped EXE
PID:1180 -
\??\c:\1hhbnn.exec:\1hhbnn.exe52⤵PID:4660
-
\??\c:\jvpjd.exec:\jvpjd.exe53⤵
- Executes dropped EXE
PID:452 -
\??\c:\7llfrrr.exec:\7llfrrr.exe54⤵
- Executes dropped EXE
PID:4556 -
\??\c:\5hnhnn.exec:\5hnhnn.exe55⤵
- Executes dropped EXE
PID:3632 -
\??\c:\hhtnnh.exec:\hhtnnh.exe56⤵
- Executes dropped EXE
PID:3396 -
\??\c:\3pvpv.exec:\3pvpv.exe57⤵
- Executes dropped EXE
PID:4308 -
\??\c:\xflxllx.exec:\xflxllx.exe58⤵
- Executes dropped EXE
PID:3908 -
\??\c:\btbnbt.exec:\btbnbt.exe59⤵
- Executes dropped EXE
PID:4300 -
\??\c:\jpvpv.exec:\jpvpv.exe60⤵
- Executes dropped EXE
PID:4936 -
\??\c:\lfxrrrr.exec:\lfxrrrr.exe61⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hbbtnh.exec:\hbbtnh.exe62⤵
- Executes dropped EXE
PID:3904 -
\??\c:\vdppj.exec:\vdppj.exe63⤵
- Executes dropped EXE
PID:664 -
\??\c:\lxffxxr.exec:\lxffxxr.exe64⤵
- Executes dropped EXE
PID:1060 -
\??\c:\lflrlfx.exec:\lflrlfx.exe65⤵
- Executes dropped EXE
PID:400 -
\??\c:\thhbtt.exec:\thhbtt.exe66⤵
- Executes dropped EXE
PID:3436 -
\??\c:\vvjdd.exec:\vvjdd.exe67⤵PID:3224
-
\??\c:\lflfxxr.exec:\lflfxxr.exe68⤵PID:5000
-
\??\c:\nntbnb.exec:\nntbnb.exe69⤵PID:4688
-
\??\c:\pdvvp.exec:\pdvvp.exe70⤵PID:2284
-
\??\c:\rflfxfx.exec:\rflfxfx.exe71⤵PID:5064
-
\??\c:\nbtttn.exec:\nbtttn.exe72⤵PID:32
-
\??\c:\dvpjp.exec:\dvpjp.exe73⤵PID:4880
-
\??\c:\3pppv.exec:\3pppv.exe74⤵PID:2376
-
\??\c:\9rrlrlf.exec:\9rrlrlf.exe75⤵PID:4220
-
\??\c:\nhhhbb.exec:\nhhhbb.exe76⤵
- System Location Discovery: System Language Discovery
PID:864 -
\??\c:\9vpdv.exec:\9vpdv.exe77⤵PID:2392
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe78⤵PID:2716
-
\??\c:\xflffxx.exec:\xflffxx.exe79⤵PID:2288
-
\??\c:\tbbtnh.exec:\tbbtnh.exe80⤵PID:1352
-
\??\c:\djvpp.exec:\djvpp.exe81⤵PID:1824
-
\??\c:\dpjdv.exec:\dpjdv.exe82⤵PID:1892
-
\??\c:\lrfffxx.exec:\lrfffxx.exe83⤵PID:4428
-
\??\c:\7btnbn.exec:\7btnbn.exe84⤵PID:1528
-
\??\c:\5ddpd.exec:\5ddpd.exe85⤵PID:3888
-
\??\c:\ddpjp.exec:\ddpjp.exe86⤵PID:4420
-
\??\c:\9rllrrx.exec:\9rllrrx.exe87⤵PID:4596
-
\??\c:\nnbbhh.exec:\nnbbhh.exe88⤵PID:4188
-
\??\c:\hhhbtn.exec:\hhhbtn.exe89⤵PID:2948
-
\??\c:\vvvpp.exec:\vvvpp.exe90⤵PID:2932
-
\??\c:\lffxrrr.exec:\lffxrrr.exe91⤵PID:3328
-
\??\c:\llxfllx.exec:\llxfllx.exe92⤵PID:1372
-
\??\c:\ntnhhh.exec:\ntnhhh.exe93⤵PID:1304
-
\??\c:\dddvp.exec:\dddvp.exe94⤵PID:3316
-
\??\c:\lrrlxrf.exec:\lrrlxrf.exe95⤵PID:3916
-
\??\c:\bnnbtn.exec:\bnnbtn.exe96⤵PID:440
-
\??\c:\1hhbbb.exec:\1hhbbb.exe97⤵PID:1412
-
\??\c:\pjvvp.exec:\pjvvp.exe98⤵PID:2124
-
\??\c:\rlffxlf.exec:\rlffxlf.exe99⤵PID:3416
-
\??\c:\tbhbtt.exec:\tbhbtt.exe100⤵PID:4672
-
\??\c:\7hhbbb.exec:\7hhbbb.exe101⤵PID:3940
-
\??\c:\pdddp.exec:\pdddp.exe102⤵PID:4488
-
\??\c:\dvjjp.exec:\dvjjp.exe103⤵PID:312
-
\??\c:\frrlxfx.exec:\frrlxfx.exe104⤵PID:3320
-
\??\c:\bntnnn.exec:\bntnnn.exe105⤵PID:2764
-
\??\c:\5jjvd.exec:\5jjvd.exe106⤵PID:1748
-
\??\c:\1llfxxr.exec:\1llfxxr.exe107⤵PID:4444
-
\??\c:\9xllrxf.exec:\9xllrxf.exe108⤵PID:2640
-
\??\c:\hbhbbh.exec:\hbhbbh.exe109⤵PID:1008
-
\??\c:\dvdvp.exec:\dvdvp.exe110⤵PID:1992
-
\??\c:\pdjdv.exec:\pdjdv.exe111⤵PID:4372
-
\??\c:\xrrlffx.exec:\xrrlffx.exe112⤵PID:4376
-
\??\c:\hbhtbt.exec:\hbhtbt.exe113⤵PID:4392
-
\??\c:\bnbtnn.exec:\bnbtnn.exe114⤵PID:2912
-
\??\c:\vdddv.exec:\vdddv.exe115⤵PID:2208
-
\??\c:\rfrllll.exec:\rfrllll.exe116⤵PID:4176
-
\??\c:\lrxxrlf.exec:\lrxxrlf.exe117⤵PID:804
-
\??\c:\tttnbb.exec:\tttnbb.exe118⤵PID:3524
-
\??\c:\vdjjd.exec:\vdjjd.exe119⤵PID:3488
-
\??\c:\frxlxrr.exec:\frxlxrr.exe120⤵PID:1160
-
\??\c:\lfflrlr.exec:\lfflrlr.exe121⤵PID:3908
-
\??\c:\hnthht.exec:\hnthht.exe122⤵PID:4300
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-