Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 23:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c86e31ee7c8895188798ee7bb8913b3d636b2d0b34af3f958324c8957b1b8ad9N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c86e31ee7c8895188798ee7bb8913b3d636b2d0b34af3f958324c8957b1b8ad9N.exe
-
Size
456KB
-
MD5
1a3f740b079dd2b1bd6043ded0520b70
-
SHA1
dd8ea0ca452e3067b6a0441e6bbfef493fa4b4e9
-
SHA256
c86e31ee7c8895188798ee7bb8913b3d636b2d0b34af3f958324c8957b1b8ad9
-
SHA512
7dee575f0ce4c62b32898fa6903f10a3f4587cbbb43bdf0a9b8227d0b995b1ef0d7de62d1f197cea23c05b187cdaae80277f1b63b68040bb44ca3a909378a446
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeN:q7Tc2NYHUrAwfMp3CDN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3672-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3644-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1740-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1012-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/440-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/856-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/848-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-719-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-747-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-776-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-934-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-1149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-1256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3172 nbhtbb.exe 3480 jvjpp.exe 4996 hbhbbb.exe 2936 7hbhtn.exe 1632 lrrflfr.exe 2324 ppdjv.exe 2052 tbthnh.exe 1716 xrlxrlx.exe 3936 bbbbbn.exe 2180 rllxlxl.exe 1116 bnnbth.exe 5064 jvpdp.exe 1360 rrlxlxf.exe 4644 ppvjd.exe 3292 1rrflfr.exe 3644 3pdpp.exe 4012 xxrfxlf.exe 1740 frlxlxr.exe 1580 jdddd.exe 1544 5lfrxlx.exe 2328 ttnhnh.exe 4292 bnbtht.exe 1204 1ddpd.exe 3432 3bhthn.exe 2600 vdpdj.exe 2368 9hhnbn.exe 1408 lfrrxxr.exe 3348 jvjvd.exe 3980 jjjvd.exe 4580 nbnbbt.exe 4964 vdvdp.exe 3608 bthhhn.exe 3844 jvpdj.exe 912 djpdj.exe 1012 lrrlfxx.exe 3968 bnttnh.exe 1736 pddvj.exe 3960 pvvjv.exe 432 9xlllrr.exe 4596 ntbntn.exe 4588 5hbhth.exe 3212 1pvpj.exe 1180 5xxlfxx.exe 3656 lxxrffr.exe 440 bnnntb.exe 3964 ppjvj.exe 4252 xxfrlfx.exe 4828 nbbnhn.exe 1416 btnbht.exe 5056 vvvdj.exe 4228 llrrlll.exe 3452 7hbtnn.exe 3776 vdppv.exe 1748 3xrflfr.exe 3540 rfxlxlx.exe 2996 7hbnnb.exe 4916 pvvjv.exe 2416 lrxlxrx.exe 3288 xxrfxlr.exe 5060 tnhtht.exe 856 nhhnbn.exe 3204 3vjvd.exe 1696 rrrfxlf.exe 4708 7tnbnh.exe -
resource yara_rule behavioral2/memory/3672-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3644-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1408-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/440-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/856-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/848-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-747-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3672 wrote to memory of 3172 3672 c86e31ee7c8895188798ee7bb8913b3d636b2d0b34af3f958324c8957b1b8ad9N.exe 83 PID 3672 wrote to memory of 3172 3672 c86e31ee7c8895188798ee7bb8913b3d636b2d0b34af3f958324c8957b1b8ad9N.exe 83 PID 3672 wrote to memory of 3172 3672 c86e31ee7c8895188798ee7bb8913b3d636b2d0b34af3f958324c8957b1b8ad9N.exe 83 PID 3172 wrote to memory of 3480 3172 nbhtbb.exe 84 PID 3172 wrote to memory of 3480 3172 nbhtbb.exe 84 PID 3172 wrote to memory of 3480 3172 nbhtbb.exe 84 PID 3480 wrote to memory of 4996 3480 jvjpp.exe 85 PID 3480 wrote to memory of 4996 3480 jvjpp.exe 85 PID 3480 wrote to memory of 4996 3480 jvjpp.exe 85 PID 4996 wrote to memory of 2936 4996 hbhbbb.exe 86 PID 4996 wrote to memory of 2936 4996 hbhbbb.exe 86 PID 4996 wrote to memory of 2936 4996 hbhbbb.exe 86 PID 2936 wrote to memory of 1632 2936 7hbhtn.exe 87 PID 2936 wrote to memory of 1632 2936 7hbhtn.exe 87 PID 2936 wrote to memory of 1632 2936 7hbhtn.exe 87 PID 1632 wrote to memory of 2324 1632 lrrflfr.exe 88 PID 1632 wrote to memory of 2324 1632 lrrflfr.exe 88 PID 1632 wrote to memory of 2324 1632 lrrflfr.exe 88 PID 2324 wrote to memory of 2052 2324 ppdjv.exe 89 PID 2324 wrote to memory of 2052 2324 ppdjv.exe 89 PID 2324 wrote to memory of 2052 2324 ppdjv.exe 89 PID 2052 wrote to memory of 1716 2052 tbthnh.exe 90 PID 2052 wrote to memory of 1716 2052 tbthnh.exe 90 PID 2052 wrote to memory of 1716 2052 tbthnh.exe 90 PID 1716 wrote to memory of 3936 1716 xrlxrlx.exe 91 PID 1716 wrote to memory of 3936 1716 xrlxrlx.exe 91 PID 1716 wrote to memory of 3936 1716 xrlxrlx.exe 91 PID 3936 wrote to memory of 2180 3936 bbbbbn.exe 92 PID 3936 wrote to memory of 2180 3936 bbbbbn.exe 92 PID 3936 wrote to memory of 2180 3936 bbbbbn.exe 92 PID 2180 wrote to memory of 1116 2180 rllxlxl.exe 93 PID 2180 wrote to memory of 1116 2180 rllxlxl.exe 93 PID 2180 wrote to memory of 1116 2180 rllxlxl.exe 93 PID 1116 wrote to memory of 5064 1116 bnnbth.exe 94 PID 1116 wrote to memory of 5064 1116 bnnbth.exe 94 PID 1116 wrote to memory of 5064 1116 bnnbth.exe 94 PID 5064 wrote to memory of 1360 5064 jvpdp.exe 95 PID 5064 wrote to memory of 1360 5064 jvpdp.exe 95 PID 5064 wrote to memory of 1360 5064 jvpdp.exe 95 PID 1360 wrote to memory of 4644 1360 rrlxlxf.exe 96 PID 1360 wrote to memory of 4644 1360 rrlxlxf.exe 96 PID 1360 wrote to memory of 4644 1360 rrlxlxf.exe 96 PID 4644 wrote to memory of 3292 4644 ppvjd.exe 97 PID 4644 wrote to memory of 3292 4644 ppvjd.exe 97 PID 4644 wrote to memory of 3292 4644 ppvjd.exe 97 PID 3292 wrote to memory of 3644 3292 1rrflfr.exe 98 PID 3292 wrote to memory of 3644 3292 1rrflfr.exe 98 PID 3292 wrote to memory of 3644 3292 1rrflfr.exe 98 PID 3644 wrote to memory of 4012 3644 3pdpp.exe 99 PID 3644 wrote to memory of 4012 3644 3pdpp.exe 99 PID 3644 wrote to memory of 4012 3644 3pdpp.exe 99 PID 4012 wrote to memory of 1740 4012 xxrfxlf.exe 100 PID 4012 wrote to memory of 1740 4012 xxrfxlf.exe 100 PID 4012 wrote to memory of 1740 4012 xxrfxlf.exe 100 PID 1740 wrote to memory of 1580 1740 frlxlxr.exe 101 PID 1740 wrote to memory of 1580 1740 frlxlxr.exe 101 PID 1740 wrote to memory of 1580 1740 frlxlxr.exe 101 PID 1580 wrote to memory of 1544 1580 jdddd.exe 102 PID 1580 wrote to memory of 1544 1580 jdddd.exe 102 PID 1580 wrote to memory of 1544 1580 jdddd.exe 102 PID 1544 wrote to memory of 2328 1544 5lfrxlx.exe 103 PID 1544 wrote to memory of 2328 1544 5lfrxlx.exe 103 PID 1544 wrote to memory of 2328 1544 5lfrxlx.exe 103 PID 2328 wrote to memory of 4292 2328 ttnhnh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\c86e31ee7c8895188798ee7bb8913b3d636b2d0b34af3f958324c8957b1b8ad9N.exe"C:\Users\Admin\AppData\Local\Temp\c86e31ee7c8895188798ee7bb8913b3d636b2d0b34af3f958324c8957b1b8ad9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\nbhtbb.exec:\nbhtbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\jvjpp.exec:\jvjpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\hbhbbb.exec:\hbhbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\7hbhtn.exec:\7hbhtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\lrrflfr.exec:\lrrflfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\ppdjv.exec:\ppdjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\tbthnh.exec:\tbthnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\xrlxrlx.exec:\xrlxrlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\bbbbbn.exec:\bbbbbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\rllxlxl.exec:\rllxlxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\bnnbth.exec:\bnnbth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\jvpdp.exec:\jvpdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\rrlxlxf.exec:\rrlxlxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\ppvjd.exec:\ppvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\1rrflfr.exec:\1rrflfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\3pdpp.exec:\3pdpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\xxrfxlf.exec:\xxrfxlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\frlxlxr.exec:\frlxlxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\jdddd.exec:\jdddd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\5lfrxlx.exec:\5lfrxlx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\ttnhnh.exec:\ttnhnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\bnbtht.exec:\bnbtht.exe23⤵
- Executes dropped EXE
PID:4292 -
\??\c:\1ddpd.exec:\1ddpd.exe24⤵
- Executes dropped EXE
PID:1204 -
\??\c:\3bhthn.exec:\3bhthn.exe25⤵
- Executes dropped EXE
PID:3432 -
\??\c:\vdpdj.exec:\vdpdj.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2600 -
\??\c:\9hhnbn.exec:\9hhnbn.exe27⤵
- Executes dropped EXE
PID:2368 -
\??\c:\lfrrxxr.exec:\lfrrxxr.exe28⤵
- Executes dropped EXE
PID:1408 -
\??\c:\jvjvd.exec:\jvjvd.exe29⤵
- Executes dropped EXE
PID:3348 -
\??\c:\jjjvd.exec:\jjjvd.exe30⤵
- Executes dropped EXE
PID:3980 -
\??\c:\nbnbbt.exec:\nbnbbt.exe31⤵
- Executes dropped EXE
PID:4580 -
\??\c:\vdvdp.exec:\vdvdp.exe32⤵
- Executes dropped EXE
PID:4964 -
\??\c:\bthhhn.exec:\bthhhn.exe33⤵
- Executes dropped EXE
PID:3608 -
\??\c:\jvpdj.exec:\jvpdj.exe34⤵
- Executes dropped EXE
PID:3844 -
\??\c:\djpdj.exec:\djpdj.exe35⤵
- Executes dropped EXE
PID:912 -
\??\c:\lrrlfxx.exec:\lrrlfxx.exe36⤵
- Executes dropped EXE
PID:1012 -
\??\c:\bnttnh.exec:\bnttnh.exe37⤵
- Executes dropped EXE
PID:3968 -
\??\c:\pddvj.exec:\pddvj.exe38⤵
- Executes dropped EXE
PID:1736 -
\??\c:\pvvjv.exec:\pvvjv.exe39⤵
- Executes dropped EXE
PID:3960 -
\??\c:\9xlllrr.exec:\9xlllrr.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:432 -
\??\c:\ntbntn.exec:\ntbntn.exe41⤵
- Executes dropped EXE
PID:4596 -
\??\c:\5hbhth.exec:\5hbhth.exe42⤵
- Executes dropped EXE
PID:4588 -
\??\c:\1pvpj.exec:\1pvpj.exe43⤵
- Executes dropped EXE
PID:3212 -
\??\c:\5xxlfxx.exec:\5xxlfxx.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1180 -
\??\c:\lxxrffr.exec:\lxxrffr.exe45⤵
- Executes dropped EXE
PID:3656 -
\??\c:\bnnntb.exec:\bnnntb.exe46⤵
- Executes dropped EXE
PID:440 -
\??\c:\ppjvj.exec:\ppjvj.exe47⤵
- Executes dropped EXE
PID:3964 -
\??\c:\xxfrlfx.exec:\xxfrlfx.exe48⤵
- Executes dropped EXE
PID:4252 -
\??\c:\nbbnhn.exec:\nbbnhn.exe49⤵
- Executes dropped EXE
PID:4828 -
\??\c:\btnbht.exec:\btnbht.exe50⤵
- Executes dropped EXE
PID:1416 -
\??\c:\vvvdj.exec:\vvvdj.exe51⤵
- Executes dropped EXE
PID:5056 -
\??\c:\llrrlll.exec:\llrrlll.exe52⤵
- Executes dropped EXE
PID:4228 -
\??\c:\7hbtnn.exec:\7hbtnn.exe53⤵
- Executes dropped EXE
PID:3452 -
\??\c:\vdppv.exec:\vdppv.exe54⤵
- Executes dropped EXE
PID:3776 -
\??\c:\3xrflfr.exec:\3xrflfr.exe55⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rfxlxlx.exec:\rfxlxlx.exe56⤵
- Executes dropped EXE
PID:3540 -
\??\c:\7hbnnb.exec:\7hbnnb.exe57⤵
- Executes dropped EXE
PID:2996 -
\??\c:\pvvjv.exec:\pvvjv.exe58⤵
- Executes dropped EXE
PID:4916 -
\??\c:\lrxlxrx.exec:\lrxlxrx.exe59⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xxrfxlr.exec:\xxrfxlr.exe60⤵
- Executes dropped EXE
PID:3288 -
\??\c:\tnhtht.exec:\tnhtht.exe61⤵
- Executes dropped EXE
PID:5060 -
\??\c:\nhhnbn.exec:\nhhnbn.exe62⤵
- Executes dropped EXE
PID:856 -
\??\c:\3vjvd.exec:\3vjvd.exe63⤵
- Executes dropped EXE
PID:3204 -
\??\c:\rrrfxlf.exec:\rrrfxlf.exe64⤵
- Executes dropped EXE
PID:1696 -
\??\c:\7tnbnh.exec:\7tnbnh.exe65⤵
- Executes dropped EXE
PID:4708 -
\??\c:\jvpdp.exec:\jvpdp.exe66⤵PID:4592
-
\??\c:\3pjvp.exec:\3pjvp.exe67⤵PID:4960
-
\??\c:\lxrfflr.exec:\lxrfflr.exe68⤵PID:60
-
\??\c:\ttntnn.exec:\ttntnn.exe69⤵PID:4768
-
\??\c:\jvjvj.exec:\jvjvj.exe70⤵PID:2296
-
\??\c:\3llxfrf.exec:\3llxfrf.exe71⤵PID:4148
-
\??\c:\9bthnh.exec:\9bthnh.exe72⤵PID:2548
-
\??\c:\tnnbhb.exec:\tnnbhb.exe73⤵PID:3196
-
\??\c:\jpjpv.exec:\jpjpv.exe74⤵PID:4740
-
\??\c:\7xllrfx.exec:\7xllrfx.exe75⤵PID:3944
-
\??\c:\lflxxll.exec:\lflxxll.exe76⤵PID:960
-
\??\c:\ntnbnh.exec:\ntnbnh.exe77⤵PID:3192
-
\??\c:\jvpdj.exec:\jvpdj.exe78⤵PID:2396
-
\??\c:\xrrflfr.exec:\xrrflfr.exe79⤵PID:4756
-
\??\c:\fllxrfr.exec:\fllxrfr.exe80⤵PID:3432
-
\??\c:\tbthnb.exec:\tbthnb.exe81⤵PID:3596
-
\??\c:\dddpd.exec:\dddpd.exe82⤵PID:4116
-
\??\c:\xfrfxfx.exec:\xfrfxfx.exe83⤵PID:2368
-
\??\c:\bbbnnh.exec:\bbbnnh.exe84⤵PID:848
-
\??\c:\vvdpj.exec:\vvdpj.exe85⤵PID:1336
-
\??\c:\pdpjp.exec:\pdpjp.exe86⤵PID:3396
-
\??\c:\frlxlxl.exec:\frlxlxl.exe87⤵PID:2480
-
\??\c:\bnhthb.exec:\bnhthb.exe88⤵PID:3924
-
\??\c:\jvdjd.exec:\jvdjd.exe89⤵PID:2412
-
\??\c:\5lfxllx.exec:\5lfxllx.exe90⤵PID:380
-
\??\c:\fxfxxlx.exec:\fxfxxlx.exe91⤵PID:5024
-
\??\c:\thbnnb.exec:\thbnnb.exe92⤵PID:4068
-
\??\c:\vjpdv.exec:\vjpdv.exe93⤵PID:5052
-
\??\c:\jjdjv.exec:\jjdjv.exe94⤵PID:4636
-
\??\c:\lxfrlxr.exec:\lxfrlxr.exe95⤵PID:2984
-
\??\c:\hnnhth.exec:\hnnhth.exe96⤵PID:4060
-
\??\c:\pjdvd.exec:\pjdvd.exe97⤵PID:3668
-
\??\c:\3rflxlf.exec:\3rflxlf.exe98⤵PID:220
-
\??\c:\frlxlfr.exec:\frlxlfr.exe99⤵PID:4088
-
\??\c:\bnbnhb.exec:\bnbnhb.exe100⤵PID:1100
-
\??\c:\vjjvj.exec:\vjjvj.exe101⤵PID:1216
-
\??\c:\1jpvp.exec:\1jpvp.exe102⤵PID:644
-
\??\c:\xlfrxrf.exec:\xlfrxrf.exe103⤵PID:2360
-
\??\c:\tnbbbh.exec:\tnbbbh.exe104⤵PID:1180
-
\??\c:\5bthth.exec:\5bthth.exe105⤵PID:4996
-
\??\c:\vjdpd.exec:\vjdpd.exe106⤵PID:4924
-
\??\c:\llfxrlf.exec:\llfxrlf.exe107⤵PID:3356
-
\??\c:\xllfrrf.exec:\xllfrrf.exe108⤵PID:212
-
\??\c:\hnbnnh.exec:\hnbnnh.exe109⤵PID:4104
-
\??\c:\7ddpd.exec:\7ddpd.exe110⤵PID:4828
-
\??\c:\lxrfrfx.exec:\lxrfrfx.exe111⤵PID:4688
-
\??\c:\lrrlxlx.exec:\lrrlxlx.exe112⤵PID:468
-
\??\c:\htnbnt.exec:\htnbnt.exe113⤵PID:3772
-
\??\c:\ddpdp.exec:\ddpdp.exe114⤵PID:3740
-
\??\c:\xlxrxll.exec:\xlxrxll.exe115⤵PID:1540
-
\??\c:\5flfrxr.exec:\5flfrxr.exe116⤵PID:3124
-
\??\c:\bntbnh.exec:\bntbnh.exe117⤵PID:528
-
\??\c:\dpvvp.exec:\dpvvp.exe118⤵PID:4700
-
\??\c:\fllxfxl.exec:\fllxfxl.exe119⤵PID:3664
-
\??\c:\7bbtnn.exec:\7bbtnn.exe120⤵PID:3284
-
\??\c:\5vjvd.exec:\5vjvd.exe121⤵PID:2720
-
\??\c:\llflfxx.exec:\llflfxx.exe122⤵PID:396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-