Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 22:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bef3cdcc0047b124a5e96f46a5eb49b59fc27b245f7934783c1f8e1b949daf45.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
bef3cdcc0047b124a5e96f46a5eb49b59fc27b245f7934783c1f8e1b949daf45.exe
-
Size
453KB
-
MD5
a2800be1770d8dbc5584b901ec0dd2f7
-
SHA1
ea126e012424d06898907c79179f2c11aade5e94
-
SHA256
bef3cdcc0047b124a5e96f46a5eb49b59fc27b245f7934783c1f8e1b949daf45
-
SHA512
32832daee3420bdfb150f460ce0a35de405f3c04636b71946f935e5af1c9063f67f9f0a06c03e80ddd35da1ad60eb3a20ea8807b8903f597065522e3b13b903d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeF:q7Tc2NYHUrAwfMp3CDF
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1360-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/756-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2512-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/672-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-568-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/884-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/836-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-780-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-1338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4992 nhthbb.exe 756 vvpjj.exe 4172 lrxrrll.exe 2512 tnhbhh.exe 2548 llxxxxx.exe 4864 vpvvp.exe 3776 rffxfff.exe 2124 btbbtt.exe 4728 djvpp.exe 1520 jjppd.exe 3736 lffllll.exe 4780 tbhhhb.exe 4968 7jjdd.exe 672 lfrlrrx.exe 2376 vppdd.exe 4984 nnbbtt.exe 2564 xrllrrx.exe 3396 1ddvp.exe 2032 bntbbb.exe 5056 pvvpj.exe 1056 dvjjd.exe 1172 lflrlxr.exe 3676 nnbtnb.exe 4676 vjddd.exe 2180 hthhbh.exe 5072 pvpvp.exe 4564 jdjdv.exe 4764 hbhbtn.exe 2284 bhnhnh.exe 3852 vjpjv.exe 2040 djvpj.exe 1200 rxfxrrl.exe 4000 hbnhnn.exe 2012 ntbtbh.exe 1852 vpjdd.exe 4212 fxflfrr.exe 4396 bnbbbb.exe 4600 jjvvp.exe 1464 3xffllf.exe 1684 tthhtt.exe 4332 pdpvp.exe 4916 lllrfrl.exe 3340 tthhnn.exe 4992 nbnhtt.exe 3056 jjjdv.exe 2508 llxxrff.exe 2740 flxxlll.exe 3464 tbhhbb.exe 3260 pdpjj.exe 4988 5fllfff.exe 4408 lxxxrfx.exe 3620 hhbthb.exe 2120 vjpjj.exe 2548 vvjdv.exe 4672 lrfrrrl.exe 948 bttbtn.exe 4712 ttttnn.exe 2592 vppjd.exe 1760 xflxrrl.exe 2320 tnbbbt.exe 4312 tttttt.exe 1564 pdjjv.exe 3436 rlrrrll.exe 1548 bhnnhn.exe -
resource yara_rule behavioral2/memory/1360-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/672-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2376-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1888-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/884-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-594-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lffrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthbt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1360 wrote to memory of 4992 1360 bef3cdcc0047b124a5e96f46a5eb49b59fc27b245f7934783c1f8e1b949daf45.exe 82 PID 1360 wrote to memory of 4992 1360 bef3cdcc0047b124a5e96f46a5eb49b59fc27b245f7934783c1f8e1b949daf45.exe 82 PID 1360 wrote to memory of 4992 1360 bef3cdcc0047b124a5e96f46a5eb49b59fc27b245f7934783c1f8e1b949daf45.exe 82 PID 4992 wrote to memory of 756 4992 nhthbb.exe 83 PID 4992 wrote to memory of 756 4992 nhthbb.exe 83 PID 4992 wrote to memory of 756 4992 nhthbb.exe 83 PID 756 wrote to memory of 4172 756 vvpjj.exe 84 PID 756 wrote to memory of 4172 756 vvpjj.exe 84 PID 756 wrote to memory of 4172 756 vvpjj.exe 84 PID 4172 wrote to memory of 2512 4172 lrxrrll.exe 85 PID 4172 wrote to memory of 2512 4172 lrxrrll.exe 85 PID 4172 wrote to memory of 2512 4172 lrxrrll.exe 85 PID 2512 wrote to memory of 2548 2512 tnhbhh.exe 86 PID 2512 wrote to memory of 2548 2512 tnhbhh.exe 86 PID 2512 wrote to memory of 2548 2512 tnhbhh.exe 86 PID 2548 wrote to memory of 4864 2548 llxxxxx.exe 87 PID 2548 wrote to memory of 4864 2548 llxxxxx.exe 87 PID 2548 wrote to memory of 4864 2548 llxxxxx.exe 87 PID 4864 wrote to memory of 3776 4864 vpvvp.exe 88 PID 4864 wrote to memory of 3776 4864 vpvvp.exe 88 PID 4864 wrote to memory of 3776 4864 vpvvp.exe 88 PID 3776 wrote to memory of 2124 3776 rffxfff.exe 89 PID 3776 wrote to memory of 2124 3776 rffxfff.exe 89 PID 3776 wrote to memory of 2124 3776 rffxfff.exe 89 PID 2124 wrote to memory of 4728 2124 btbbtt.exe 90 PID 2124 wrote to memory of 4728 2124 btbbtt.exe 90 PID 2124 wrote to memory of 4728 2124 btbbtt.exe 90 PID 4728 wrote to memory of 1520 4728 djvpp.exe 91 PID 4728 wrote to memory of 1520 4728 djvpp.exe 91 PID 4728 wrote to memory of 1520 4728 djvpp.exe 91 PID 1520 wrote to memory of 3736 1520 jjppd.exe 92 PID 1520 wrote to memory of 3736 1520 jjppd.exe 92 PID 1520 wrote to memory of 3736 1520 jjppd.exe 92 PID 3736 wrote to memory of 4780 3736 lffllll.exe 93 PID 3736 wrote to memory of 4780 3736 lffllll.exe 93 PID 3736 wrote to memory of 4780 3736 lffllll.exe 93 PID 4780 wrote to memory of 4968 4780 tbhhhb.exe 94 PID 4780 wrote to memory of 4968 4780 tbhhhb.exe 94 PID 4780 wrote to memory of 4968 4780 tbhhhb.exe 94 PID 4968 wrote to memory of 672 4968 7jjdd.exe 95 PID 4968 wrote to memory of 672 4968 7jjdd.exe 95 PID 4968 wrote to memory of 672 4968 7jjdd.exe 95 PID 672 wrote to memory of 2376 672 lfrlrrx.exe 96 PID 672 wrote to memory of 2376 672 lfrlrrx.exe 96 PID 672 wrote to memory of 2376 672 lfrlrrx.exe 96 PID 2376 wrote to memory of 4984 2376 vppdd.exe 97 PID 2376 wrote to memory of 4984 2376 vppdd.exe 97 PID 2376 wrote to memory of 4984 2376 vppdd.exe 97 PID 4984 wrote to memory of 2564 4984 nnbbtt.exe 98 PID 4984 wrote to memory of 2564 4984 nnbbtt.exe 98 PID 4984 wrote to memory of 2564 4984 nnbbtt.exe 98 PID 2564 wrote to memory of 3396 2564 xrllrrx.exe 99 PID 2564 wrote to memory of 3396 2564 xrllrrx.exe 99 PID 2564 wrote to memory of 3396 2564 xrllrrx.exe 99 PID 3396 wrote to memory of 2032 3396 1ddvp.exe 100 PID 3396 wrote to memory of 2032 3396 1ddvp.exe 100 PID 3396 wrote to memory of 2032 3396 1ddvp.exe 100 PID 2032 wrote to memory of 5056 2032 bntbbb.exe 101 PID 2032 wrote to memory of 5056 2032 bntbbb.exe 101 PID 2032 wrote to memory of 5056 2032 bntbbb.exe 101 PID 5056 wrote to memory of 1056 5056 pvvpj.exe 102 PID 5056 wrote to memory of 1056 5056 pvvpj.exe 102 PID 5056 wrote to memory of 1056 5056 pvvpj.exe 102 PID 1056 wrote to memory of 1172 1056 dvjjd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\bef3cdcc0047b124a5e96f46a5eb49b59fc27b245f7934783c1f8e1b949daf45.exe"C:\Users\Admin\AppData\Local\Temp\bef3cdcc0047b124a5e96f46a5eb49b59fc27b245f7934783c1f8e1b949daf45.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\nhthbb.exec:\nhthbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\vvpjj.exec:\vvpjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\lrxrrll.exec:\lrxrrll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\tnhbhh.exec:\tnhbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\llxxxxx.exec:\llxxxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\vpvvp.exec:\vpvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\rffxfff.exec:\rffxfff.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\btbbtt.exec:\btbbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\djvpp.exec:\djvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\jjppd.exec:\jjppd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\lffllll.exec:\lffllll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\tbhhhb.exec:\tbhhhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\7jjdd.exec:\7jjdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\vppdd.exec:\vppdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\nnbbtt.exec:\nnbbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\xrllrrx.exec:\xrllrrx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\1ddvp.exec:\1ddvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\bntbbb.exec:\bntbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\pvvpj.exec:\pvvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\dvjjd.exec:\dvjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\lflrlxr.exec:\lflrlxr.exe23⤵
- Executes dropped EXE
PID:1172 -
\??\c:\nnbtnb.exec:\nnbtnb.exe24⤵
- Executes dropped EXE
PID:3676 -
\??\c:\vjddd.exec:\vjddd.exe25⤵
- Executes dropped EXE
PID:4676 -
\??\c:\hthhbh.exec:\hthhbh.exe26⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pvpvp.exec:\pvpvp.exe27⤵
- Executes dropped EXE
PID:5072 -
\??\c:\jdjdv.exec:\jdjdv.exe28⤵
- Executes dropped EXE
PID:4564 -
\??\c:\hbhbtn.exec:\hbhbtn.exe29⤵
- Executes dropped EXE
PID:4764 -
\??\c:\bhnhnh.exec:\bhnhnh.exe30⤵
- Executes dropped EXE
PID:2284 -
\??\c:\vjpjv.exec:\vjpjv.exe31⤵
- Executes dropped EXE
PID:3852 -
\??\c:\djvpj.exec:\djvpj.exe32⤵
- Executes dropped EXE
PID:2040 -
\??\c:\rxfxrrl.exec:\rxfxrrl.exe33⤵
- Executes dropped EXE
PID:1200 -
\??\c:\hbnhnn.exec:\hbnhnn.exe34⤵
- Executes dropped EXE
PID:4000 -
\??\c:\ntbtbh.exec:\ntbtbh.exe35⤵
- Executes dropped EXE
PID:2012 -
\??\c:\vpjdd.exec:\vpjdd.exe36⤵
- Executes dropped EXE
PID:1852 -
\??\c:\fxflfrr.exec:\fxflfrr.exe37⤵
- Executes dropped EXE
PID:4212 -
\??\c:\bnbbbb.exec:\bnbbbb.exe38⤵
- Executes dropped EXE
PID:4396 -
\??\c:\jjvvp.exec:\jjvvp.exe39⤵
- Executes dropped EXE
PID:4600 -
\??\c:\3xffllf.exec:\3xffllf.exe40⤵
- Executes dropped EXE
PID:1464 -
\??\c:\tthhtt.exec:\tthhtt.exe41⤵
- Executes dropped EXE
PID:1684 -
\??\c:\pdpvp.exec:\pdpvp.exe42⤵
- Executes dropped EXE
PID:4332 -
\??\c:\lllrfrl.exec:\lllrfrl.exe43⤵
- Executes dropped EXE
PID:4916 -
\??\c:\tthhnn.exec:\tthhnn.exe44⤵
- Executes dropped EXE
PID:3340 -
\??\c:\nbnhtt.exec:\nbnhtt.exe45⤵
- Executes dropped EXE
PID:4992 -
\??\c:\jjjdv.exec:\jjjdv.exe46⤵
- Executes dropped EXE
PID:3056 -
\??\c:\llxxrff.exec:\llxxrff.exe47⤵
- Executes dropped EXE
PID:2508 -
\??\c:\flxxlll.exec:\flxxlll.exe48⤵
- Executes dropped EXE
PID:2740 -
\??\c:\tbhhbb.exec:\tbhhbb.exe49⤵
- Executes dropped EXE
PID:3464 -
\??\c:\pdpjj.exec:\pdpjj.exe50⤵
- Executes dropped EXE
PID:3260 -
\??\c:\5fllfff.exec:\5fllfff.exe51⤵
- Executes dropped EXE
PID:4988 -
\??\c:\lxxxrfx.exec:\lxxxrfx.exe52⤵
- Executes dropped EXE
PID:4408 -
\??\c:\hhbthb.exec:\hhbthb.exe53⤵
- Executes dropped EXE
PID:3620 -
\??\c:\vjpjj.exec:\vjpjj.exe54⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vvjdv.exec:\vvjdv.exe55⤵
- Executes dropped EXE
PID:2548 -
\??\c:\lrfrrrl.exec:\lrfrrrl.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4672 -
\??\c:\bttbtn.exec:\bttbtn.exe57⤵
- Executes dropped EXE
PID:948 -
\??\c:\ttttnn.exec:\ttttnn.exe58⤵
- Executes dropped EXE
PID:4712 -
\??\c:\vppjd.exec:\vppjd.exe59⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xflxrrl.exec:\xflxrrl.exe60⤵
- Executes dropped EXE
PID:1760 -
\??\c:\tnbbbt.exec:\tnbbbt.exe61⤵
- Executes dropped EXE
PID:2320 -
\??\c:\tttttt.exec:\tttttt.exe62⤵
- Executes dropped EXE
PID:4312 -
\??\c:\pdjjv.exec:\pdjjv.exe63⤵
- Executes dropped EXE
PID:1564 -
\??\c:\rlrrrll.exec:\rlrrrll.exe64⤵
- Executes dropped EXE
PID:3436 -
\??\c:\bhnnhn.exec:\bhnnhn.exe65⤵
- Executes dropped EXE
PID:1548 -
\??\c:\vvddv.exec:\vvddv.exe66⤵PID:3556
-
\??\c:\llffrrf.exec:\llffrrf.exe67⤵PID:3864
-
\??\c:\rrxfxxr.exec:\rrxfxxr.exe68⤵PID:4968
-
\??\c:\3tbthh.exec:\3tbthh.exe69⤵PID:4944
-
\??\c:\vvdjj.exec:\vvdjj.exe70⤵PID:1228
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe71⤵PID:4940
-
\??\c:\vpddd.exec:\vpddd.exe72⤵PID:2376
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe73⤵PID:4276
-
\??\c:\bbtbbt.exec:\bbtbbt.exe74⤵PID:4168
-
\??\c:\pvddv.exec:\pvddv.exe75⤵PID:4708
-
\??\c:\5pvpj.exec:\5pvpj.exe76⤵PID:3316
-
\??\c:\lflrxlr.exec:\lflrxlr.exe77⤵PID:1284
-
\??\c:\nhtttb.exec:\nhtttb.exe78⤵PID:4684
-
\??\c:\pdjdv.exec:\pdjdv.exe79⤵PID:2292
-
\??\c:\pddvp.exec:\pddvp.exe80⤵PID:3396
-
\??\c:\frffxrr.exec:\frffxrr.exe81⤵PID:3592
-
\??\c:\hntnhh.exec:\hntnhh.exe82⤵PID:3476
-
\??\c:\pppjd.exec:\pppjd.exe83⤵PID:4772
-
\??\c:\fflfxff.exec:\fflfxff.exe84⤵PID:4160
-
\??\c:\lflffxl.exec:\lflffxl.exe85⤵PID:924
-
\??\c:\ttthhn.exec:\ttthhn.exe86⤵PID:3604
-
\??\c:\3dddv.exec:\3dddv.exe87⤵PID:2236
-
\??\c:\9xxrrrr.exec:\9xxrrrr.exe88⤵
- System Location Discovery: System Language Discovery
PID:396 -
\??\c:\nbbtnn.exec:\nbbtnn.exe89⤵PID:628
-
\??\c:\tbntbt.exec:\tbntbt.exe90⤵PID:3500
-
\??\c:\ppppj.exec:\ppppj.exe91⤵PID:2328
-
\??\c:\fxxxlrl.exec:\fxxxlrl.exe92⤵PID:1688
-
\??\c:\btbhhh.exec:\btbhhh.exe93⤵PID:4252
-
\??\c:\pjvpp.exec:\pjvpp.exe94⤵PID:1648
-
\??\c:\9xfxrll.exec:\9xfxrll.exe95⤵PID:4124
-
\??\c:\bbhnnt.exec:\bbhnnt.exe96⤵PID:4208
-
\??\c:\dvjjd.exec:\dvjjd.exe97⤵PID:3964
-
\??\c:\pvjvd.exec:\pvjvd.exe98⤵PID:1892
-
\??\c:\nhttbb.exec:\nhttbb.exe99⤵PID:1128
-
\??\c:\vvjjv.exec:\vvjjv.exe100⤵PID:3216
-
\??\c:\xxlffff.exec:\xxlffff.exe101⤵PID:2220
-
\??\c:\rfrlffx.exec:\rfrlffx.exe102⤵PID:2444
-
\??\c:\tnbbtb.exec:\tnbbtb.exe103⤵PID:1576
-
\??\c:\dvdvv.exec:\dvdvv.exe104⤵PID:2116
-
\??\c:\fxlrxfx.exec:\fxlrxfx.exe105⤵PID:432
-
\??\c:\nhbtnh.exec:\nhbtnh.exe106⤵PID:4068
-
\??\c:\dpdvv.exec:\dpdvv.exe107⤵PID:1180
-
\??\c:\ffrrxfl.exec:\ffrrxfl.exe108⤵PID:4336
-
\??\c:\hhnhtt.exec:\hhnhtt.exe109⤵PID:1684
-
\??\c:\pdvjp.exec:\pdvjp.exe110⤵PID:4332
-
\??\c:\5pvvp.exec:\5pvvp.exe111⤵PID:3148
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe112⤵PID:2536
-
\??\c:\hbhnnt.exec:\hbhnnt.exe113⤵PID:1824
-
\??\c:\vdpjj.exec:\vdpjj.exe114⤵
- System Location Discovery: System Language Discovery
PID:4136 -
\??\c:\xrrlffx.exec:\xrrlffx.exe115⤵PID:1076
-
\??\c:\hnnhbt.exec:\hnnhbt.exe116⤵PID:4176
-
\??\c:\jdjpp.exec:\jdjpp.exe117⤵PID:2740
-
\??\c:\xrxrllf.exec:\xrxrllf.exe118⤵PID:3464
-
\??\c:\bbtbth.exec:\bbtbth.exe119⤵PID:1636
-
\??\c:\thnhnh.exec:\thnhnh.exe120⤵PID:3712
-
\??\c:\pppjj.exec:\pppjj.exe121⤵PID:2212
-
\??\c:\rfrxlll.exec:\rfrxlll.exe122⤵PID:3620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-