Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 21:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe
-
Size
453KB
-
MD5
ce417fdd5c854baf6e47a136ddee9eae
-
SHA1
545b12a384d80b59ba13dcd2a354f7045fe89b30
-
SHA256
d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789
-
SHA512
1809ae6ef8e36605f194387c2c9e3a12c1023b34f2699fc991b5af06d0a3fda399a9c0536dfbb8c4fb48274382611458bc38ee129d5353cade0591bba34bbb04
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3124-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1280-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1036-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1328-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/688-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-1193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-1366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-1495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-1791-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 456 nbbnbt.exe 2816 xxfrffx.exe 4728 hhnbtn.exe 4396 7hnhhb.exe 3896 1rxrffx.exe 3640 vvdpp.exe 1280 llxfxxr.exe 1872 btbttn.exe 1076 5vdvj.exe 1704 ttnbtt.exe 3728 pvjdv.exe 2180 thttnh.exe 1000 pvdvp.exe 1900 rrxxxlf.exe 3024 nththt.exe 924 7xxxrrr.exe 224 nbhbbn.exe 3928 9jjvv.exe 3528 lxrlffr.exe 5052 rlxrxrx.exe 532 bhhbtn.exe 2464 vpvpv.exe 4768 lxrrlll.exe 3524 vpddd.exe 2844 xrxxfrr.exe 3020 btbbbb.exe 1036 ppppj.exe 4232 llfxxll.exe 2308 9tnhbh.exe 512 fxxxrrr.exe 1584 1ntttt.exe 448 vvpvp.exe 4320 vpvpv.exe 4540 fxxrllf.exe 1864 bnttnn.exe 5008 vppjd.exe 1600 vppvp.exe 4408 9fffxxf.exe 652 nhhhht.exe 4720 jjpjp.exe 4496 rxrrxxx.exe 1164 ffrrxxx.exe 64 hbtnhh.exe 1860 vpppj.exe 4016 3rllrrl.exe 4836 ttbttt.exe 1396 pppjd.exe 3548 dpvvp.exe 4048 lfxrlfx.exe 1964 nhhbtn.exe 4416 jjdvv.exe 3780 lfrlllr.exe 1736 htbbtt.exe 5004 vpdjp.exe 5028 jddvj.exe 1872 rlrrllf.exe 3512 btbtnn.exe 3804 bhnhbh.exe 1704 dvvvp.exe 3544 llxrffx.exe 2940 tntnhh.exe 3036 nntnnt.exe 1000 vddvv.exe 432 frlfxrl.exe -
resource yara_rule behavioral2/memory/3124-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1280-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/688-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-846-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3124 wrote to memory of 456 3124 d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe 82 PID 3124 wrote to memory of 456 3124 d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe 82 PID 3124 wrote to memory of 456 3124 d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe 82 PID 456 wrote to memory of 2816 456 nbbnbt.exe 83 PID 456 wrote to memory of 2816 456 nbbnbt.exe 83 PID 456 wrote to memory of 2816 456 nbbnbt.exe 83 PID 2816 wrote to memory of 4728 2816 xxfrffx.exe 84 PID 2816 wrote to memory of 4728 2816 xxfrffx.exe 84 PID 2816 wrote to memory of 4728 2816 xxfrffx.exe 84 PID 4728 wrote to memory of 4396 4728 hhnbtn.exe 85 PID 4728 wrote to memory of 4396 4728 hhnbtn.exe 85 PID 4728 wrote to memory of 4396 4728 hhnbtn.exe 85 PID 4396 wrote to memory of 3896 4396 7hnhhb.exe 86 PID 4396 wrote to memory of 3896 4396 7hnhhb.exe 86 PID 4396 wrote to memory of 3896 4396 7hnhhb.exe 86 PID 3896 wrote to memory of 3640 3896 1rxrffx.exe 87 PID 3896 wrote to memory of 3640 3896 1rxrffx.exe 87 PID 3896 wrote to memory of 3640 3896 1rxrffx.exe 87 PID 3640 wrote to memory of 1280 3640 vvdpp.exe 88 PID 3640 wrote to memory of 1280 3640 vvdpp.exe 88 PID 3640 wrote to memory of 1280 3640 vvdpp.exe 88 PID 1280 wrote to memory of 1872 1280 llxfxxr.exe 89 PID 1280 wrote to memory of 1872 1280 llxfxxr.exe 89 PID 1280 wrote to memory of 1872 1280 llxfxxr.exe 89 PID 1872 wrote to memory of 1076 1872 btbttn.exe 90 PID 1872 wrote to memory of 1076 1872 btbttn.exe 90 PID 1872 wrote to memory of 1076 1872 btbttn.exe 90 PID 1076 wrote to memory of 1704 1076 5vdvj.exe 91 PID 1076 wrote to memory of 1704 1076 5vdvj.exe 91 PID 1076 wrote to memory of 1704 1076 5vdvj.exe 91 PID 1704 wrote to memory of 3728 1704 ttnbtt.exe 92 PID 1704 wrote to memory of 3728 1704 ttnbtt.exe 92 PID 1704 wrote to memory of 3728 1704 ttnbtt.exe 92 PID 3728 wrote to memory of 2180 3728 pvjdv.exe 93 PID 3728 wrote to memory of 2180 3728 pvjdv.exe 93 PID 3728 wrote to memory of 2180 3728 pvjdv.exe 93 PID 2180 wrote to memory of 1000 2180 thttnh.exe 94 PID 2180 wrote to memory of 1000 2180 thttnh.exe 94 PID 2180 wrote to memory of 1000 2180 thttnh.exe 94 PID 1000 wrote to memory of 1900 1000 pvdvp.exe 95 PID 1000 wrote to memory of 1900 1000 pvdvp.exe 95 PID 1000 wrote to memory of 1900 1000 pvdvp.exe 95 PID 1900 wrote to memory of 3024 1900 rrxxxlf.exe 96 PID 1900 wrote to memory of 3024 1900 rrxxxlf.exe 96 PID 1900 wrote to memory of 3024 1900 rrxxxlf.exe 96 PID 3024 wrote to memory of 924 3024 nththt.exe 97 PID 3024 wrote to memory of 924 3024 nththt.exe 97 PID 3024 wrote to memory of 924 3024 nththt.exe 97 PID 924 wrote to memory of 224 924 7xxxrrr.exe 98 PID 924 wrote to memory of 224 924 7xxxrrr.exe 98 PID 924 wrote to memory of 224 924 7xxxrrr.exe 98 PID 224 wrote to memory of 3928 224 nbhbbn.exe 99 PID 224 wrote to memory of 3928 224 nbhbbn.exe 99 PID 224 wrote to memory of 3928 224 nbhbbn.exe 99 PID 3928 wrote to memory of 3528 3928 9jjvv.exe 100 PID 3928 wrote to memory of 3528 3928 9jjvv.exe 100 PID 3928 wrote to memory of 3528 3928 9jjvv.exe 100 PID 3528 wrote to memory of 5052 3528 lxrlffr.exe 101 PID 3528 wrote to memory of 5052 3528 lxrlffr.exe 101 PID 3528 wrote to memory of 5052 3528 lxrlffr.exe 101 PID 5052 wrote to memory of 532 5052 rlxrxrx.exe 102 PID 5052 wrote to memory of 532 5052 rlxrxrx.exe 102 PID 5052 wrote to memory of 532 5052 rlxrxrx.exe 102 PID 532 wrote to memory of 2464 532 bhhbtn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe"C:\Users\Admin\AppData\Local\Temp\d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\nbbnbt.exec:\nbbnbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\xxfrffx.exec:\xxfrffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\hhnbtn.exec:\hhnbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\7hnhhb.exec:\7hnhhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\1rxrffx.exec:\1rxrffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\vvdpp.exec:\vvdpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\llxfxxr.exec:\llxfxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\btbttn.exec:\btbttn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\5vdvj.exec:\5vdvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\ttnbtt.exec:\ttnbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\pvjdv.exec:\pvjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\thttnh.exec:\thttnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\pvdvp.exec:\pvdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\rrxxxlf.exec:\rrxxxlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\nththt.exec:\nththt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\7xxxrrr.exec:\7xxxrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\nbhbbn.exec:\nbhbbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\9jjvv.exec:\9jjvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\lxrlffr.exec:\lxrlffr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\rlxrxrx.exec:\rlxrxrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\bhhbtn.exec:\bhhbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\vpvpv.exec:\vpvpv.exe23⤵
- Executes dropped EXE
PID:2464 -
\??\c:\lxrrlll.exec:\lxrrlll.exe24⤵
- Executes dropped EXE
PID:4768 -
\??\c:\vpddd.exec:\vpddd.exe25⤵
- Executes dropped EXE
PID:3524 -
\??\c:\xrxxfrr.exec:\xrxxfrr.exe26⤵
- Executes dropped EXE
PID:2844 -
\??\c:\btbbbb.exec:\btbbbb.exe27⤵
- Executes dropped EXE
PID:3020 -
\??\c:\ppppj.exec:\ppppj.exe28⤵
- Executes dropped EXE
PID:1036 -
\??\c:\llfxxll.exec:\llfxxll.exe29⤵
- Executes dropped EXE
PID:4232 -
\??\c:\9tnhbh.exec:\9tnhbh.exe30⤵
- Executes dropped EXE
PID:2308 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe31⤵
- Executes dropped EXE
PID:512 -
\??\c:\1ntttt.exec:\1ntttt.exe32⤵
- Executes dropped EXE
PID:1584 -
\??\c:\vvpvp.exec:\vvpvp.exe33⤵
- Executes dropped EXE
PID:448 -
\??\c:\vpvpv.exec:\vpvpv.exe34⤵
- Executes dropped EXE
PID:4320 -
\??\c:\fxxrllf.exec:\fxxrllf.exe35⤵
- Executes dropped EXE
PID:4540 -
\??\c:\bnttnn.exec:\bnttnn.exe36⤵
- Executes dropped EXE
PID:1864 -
\??\c:\vppjd.exec:\vppjd.exe37⤵
- Executes dropped EXE
PID:5008 -
\??\c:\vppvp.exec:\vppvp.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1600 -
\??\c:\9fffxxf.exec:\9fffxxf.exe39⤵
- Executes dropped EXE
PID:4408 -
\??\c:\nhhhht.exec:\nhhhht.exe40⤵
- Executes dropped EXE
PID:652 -
\??\c:\jjpjp.exec:\jjpjp.exe41⤵
- Executes dropped EXE
PID:4720 -
\??\c:\rxrrxxx.exec:\rxrrxxx.exe42⤵
- Executes dropped EXE
PID:4496 -
\??\c:\ffrrxxx.exec:\ffrrxxx.exe43⤵
- Executes dropped EXE
PID:1164 -
\??\c:\hbtnhh.exec:\hbtnhh.exe44⤵
- Executes dropped EXE
PID:64 -
\??\c:\vpppj.exec:\vpppj.exe45⤵
- Executes dropped EXE
PID:1860 -
\??\c:\jddpp.exec:\jddpp.exe46⤵PID:4420
-
\??\c:\3rllrrl.exec:\3rllrrl.exe47⤵
- Executes dropped EXE
PID:4016 -
\??\c:\ttbttt.exec:\ttbttt.exe48⤵
- Executes dropped EXE
PID:4836 -
\??\c:\pppjd.exec:\pppjd.exe49⤵
- Executes dropped EXE
PID:1396 -
\??\c:\dpvvp.exec:\dpvvp.exe50⤵
- Executes dropped EXE
PID:3548 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe51⤵
- Executes dropped EXE
PID:4048 -
\??\c:\nhhbtn.exec:\nhhbtn.exe52⤵
- Executes dropped EXE
PID:1964 -
\??\c:\jjdvv.exec:\jjdvv.exe53⤵
- Executes dropped EXE
PID:4416 -
\??\c:\lfrlllr.exec:\lfrlllr.exe54⤵
- Executes dropped EXE
PID:3780 -
\??\c:\htbbtt.exec:\htbbtt.exe55⤵
- Executes dropped EXE
PID:1736 -
\??\c:\vpdjp.exec:\vpdjp.exe56⤵
- Executes dropped EXE
PID:5004 -
\??\c:\jddvj.exec:\jddvj.exe57⤵
- Executes dropped EXE
PID:5028 -
\??\c:\rlrrllf.exec:\rlrrllf.exe58⤵
- Executes dropped EXE
PID:1872 -
\??\c:\btbtnn.exec:\btbtnn.exe59⤵
- Executes dropped EXE
PID:3512 -
\??\c:\bhnhbh.exec:\bhnhbh.exe60⤵
- Executes dropped EXE
PID:3804 -
\??\c:\dvvvp.exec:\dvvvp.exe61⤵
- Executes dropped EXE
PID:1704 -
\??\c:\llxrffx.exec:\llxrffx.exe62⤵
- Executes dropped EXE
PID:3544 -
\??\c:\tntnhh.exec:\tntnhh.exe63⤵
- Executes dropped EXE
PID:2940 -
\??\c:\nntnnt.exec:\nntnnt.exe64⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vddvv.exec:\vddvv.exe65⤵
- Executes dropped EXE
PID:1000 -
\??\c:\frlfxrl.exec:\frlfxrl.exe66⤵
- Executes dropped EXE
PID:432 -
\??\c:\hbnbth.exec:\hbnbth.exe67⤵PID:388
-
\??\c:\9ppjd.exec:\9ppjd.exe68⤵PID:2224
-
\??\c:\3pvvv.exec:\3pvvv.exe69⤵PID:2104
-
\??\c:\9fflflf.exec:\9fflflf.exe70⤵PID:4744
-
\??\c:\rflfxfx.exec:\rflfxfx.exe71⤵PID:2996
-
\??\c:\bntnhh.exec:\bntnhh.exe72⤵PID:4872
-
\??\c:\pjvpp.exec:\pjvpp.exe73⤵PID:1156
-
\??\c:\rrfrffx.exec:\rrfrffx.exe74⤵PID:4944
-
\??\c:\9llfxrl.exec:\9llfxrl.exe75⤵PID:5052
-
\??\c:\nhttbh.exec:\nhttbh.exe76⤵PID:1400
-
\??\c:\pjpjd.exec:\pjpjd.exe77⤵PID:3772
-
\??\c:\fffrllf.exec:\fffrllf.exe78⤵PID:2464
-
\??\c:\lxfxrlf.exec:\lxfxrlf.exe79⤵PID:4804
-
\??\c:\thhbtn.exec:\thhbtn.exe80⤵PID:1348
-
\??\c:\vvjdd.exec:\vvjdd.exe81⤵PID:1328
-
\??\c:\9pvpp.exec:\9pvpp.exe82⤵PID:740
-
\??\c:\fxfflff.exec:\fxfflff.exe83⤵PID:3020
-
\??\c:\ntbhbn.exec:\ntbhbn.exe84⤵PID:2864
-
\??\c:\tbnbtn.exec:\tbnbtn.exe85⤵PID:5108
-
\??\c:\ppjjv.exec:\ppjjv.exe86⤵PID:2784
-
\??\c:\llffxxx.exec:\llffxxx.exe87⤵PID:372
-
\??\c:\nnnnhh.exec:\nnnnhh.exe88⤵PID:4572
-
\??\c:\7tbbhh.exec:\7tbbhh.exe89⤵PID:2736
-
\??\c:\dvvpj.exec:\dvvpj.exe90⤵PID:1988
-
\??\c:\9rxxxxf.exec:\9rxxxxf.exe91⤵PID:1976
-
\??\c:\ntbthb.exec:\ntbthb.exe92⤵PID:3960
-
\??\c:\7vpvj.exec:\7vpvj.exe93⤵PID:3264
-
\??\c:\5xrfrlf.exec:\5xrfrlf.exe94⤵PID:2216
-
\??\c:\fxfxrrf.exec:\fxfxrrf.exe95⤵PID:2592
-
\??\c:\bbhhhh.exec:\bbhhhh.exe96⤵PID:3456
-
\??\c:\7vpdp.exec:\7vpdp.exe97⤵PID:1600
-
\??\c:\rllfffx.exec:\rllfffx.exe98⤵PID:2124
-
\??\c:\frrffxx.exec:\frrffxx.exe99⤵PID:1200
-
\??\c:\nhbhnt.exec:\nhbhnt.exe100⤵PID:3812
-
\??\c:\jjpjp.exec:\jjpjp.exe101⤵
- System Location Discovery: System Language Discovery
PID:3208 -
\??\c:\frrlxlx.exec:\frrlxlx.exe102⤵PID:2868
-
\??\c:\5nnhnn.exec:\5nnhnn.exe103⤵PID:4376
-
\??\c:\dddvv.exec:\dddvv.exe104⤵PID:2752
-
\??\c:\lxrfxlf.exec:\lxrfxlf.exe105⤵PID:3584
-
\??\c:\fllffff.exec:\fllffff.exe106⤵PID:3492
-
\??\c:\9hnbbt.exec:\9hnbbt.exe107⤵PID:696
-
\??\c:\hbbtnt.exec:\hbbtnt.exe108⤵PID:2396
-
\??\c:\vpddd.exec:\vpddd.exe109⤵PID:1256
-
\??\c:\fxflrfl.exec:\fxflrfl.exe110⤵PID:4984
-
\??\c:\htbnbh.exec:\htbnbh.exe111⤵PID:4048
-
\??\c:\vvdpd.exec:\vvdpd.exe112⤵PID:1964
-
\??\c:\xxrlfff.exec:\xxrlfff.exe113⤵PID:1452
-
\??\c:\rxlrrll.exec:\rxlrrll.exe114⤵PID:4288
-
\??\c:\nnnnhh.exec:\nnnnhh.exe115⤵PID:3712
-
\??\c:\ppdjv.exec:\ppdjv.exe116⤵PID:2552
-
\??\c:\lrrfrlx.exec:\lrrfrlx.exe117⤵PID:5028
-
\??\c:\bbbbbb.exec:\bbbbbb.exe118⤵PID:3464
-
\??\c:\tnthbh.exec:\tnthbh.exe119⤵PID:3700
-
\??\c:\vddjd.exec:\vddjd.exe120⤵PID:3804
-
\??\c:\lxrfffx.exec:\lxrfffx.exe121⤵PID:1104
-
\??\c:\ntthbb.exec:\ntthbb.exe122⤵PID:3544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-