Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 17:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7adcb518691ad6f5fe21c4c004ad1340e465fb83766a6843cb8bc80e3cbedb12N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
7adcb518691ad6f5fe21c4c004ad1340e465fb83766a6843cb8bc80e3cbedb12N.exe
-
Size
455KB
-
MD5
4595b4eff7f51d606a7abd85086395f0
-
SHA1
5534ae5aeed3a9eb6d6981194e4a03ae7b05ea55
-
SHA256
7adcb518691ad6f5fe21c4c004ad1340e465fb83766a6843cb8bc80e3cbedb12
-
SHA512
a27c1ee9c9bfc4cb9c988ff4bbf9fc5d4f41b9c11a34c834a6c33a75ddccb5933c1b5a918ae3c6ae29eb38883014c869eee5ff29269a92bb13ed71acd96d0602
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeA:q7Tc2NYHUrAwfMp3CDA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2364-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1028-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/792-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/828-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2836-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/804-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/652-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2712-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/364-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-691-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-978-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-1204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-1316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2244 ntbhhb.exe 4004 jjjdv.exe 1400 hhnnht.exe 224 flrfrlf.exe 4740 ddjvv.exe 4840 dpjvp.exe 3604 rfxlxlx.exe 3508 vddpj.exe 1028 nbttnb.exe 4536 7pjvj.exe 792 rflxffr.exe 5076 djpdp.exe 4856 hhtnhn.exe 1892 3vjpj.exe 2060 frfrlfr.exe 3092 ntbtnh.exe 3672 5vpdp.exe 1808 nbntnh.exe 4084 djjvd.exe 4080 vpdvj.exe 3884 xrrflfr.exe 3412 thhthb.exe 828 pvpjv.exe 1304 jdvjv.exe 3612 jvvjv.exe 2532 dvjjj.exe 2024 flfrlff.exe 3356 lxrlxfr.exe 1672 xrfxlfr.exe 3832 jvjvj.exe 2424 9vpjj.exe 2836 fffllfr.exe 4592 rfxlfrl.exe 1392 1jjdp.exe 3232 bbhhtt.exe 4180 3thbnh.exe 2828 9dvjv.exe 4880 rrrfrlf.exe 4172 thhbnh.exe 3696 3jvjv.exe 1492 lxffrrl.exe 1460 lrxxrrr.exe 2408 thhbhh.exe 2368 ppvpj.exe 220 rffxxfx.exe 3952 tntnhh.exe 1920 jvdvp.exe 804 jdjjd.exe 4696 rlrlrrx.exe 5064 btntth.exe 2016 nbbbbn.exe 4996 dvpdv.exe 2248 lfxrffx.exe 3740 tbnbth.exe 2472 nnbhtn.exe 4216 pjjjd.exe 3616 fffxrrl.exe 3528 1hhbth.exe 1652 pvvpj.exe 4484 llxfllr.exe 4708 rlrlffx.exe 3332 hbnhhh.exe 4384 pjjdp.exe 652 jddvj.exe -
resource yara_rule behavioral2/memory/2364-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1028-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/792-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/828-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/804-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/652-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2712-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/364-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/364-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-691-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxlxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llxlfr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2244 2364 7adcb518691ad6f5fe21c4c004ad1340e465fb83766a6843cb8bc80e3cbedb12N.exe 82 PID 2364 wrote to memory of 2244 2364 7adcb518691ad6f5fe21c4c004ad1340e465fb83766a6843cb8bc80e3cbedb12N.exe 82 PID 2364 wrote to memory of 2244 2364 7adcb518691ad6f5fe21c4c004ad1340e465fb83766a6843cb8bc80e3cbedb12N.exe 82 PID 2244 wrote to memory of 4004 2244 ntbhhb.exe 83 PID 2244 wrote to memory of 4004 2244 ntbhhb.exe 83 PID 2244 wrote to memory of 4004 2244 ntbhhb.exe 83 PID 4004 wrote to memory of 1400 4004 jjjdv.exe 84 PID 4004 wrote to memory of 1400 4004 jjjdv.exe 84 PID 4004 wrote to memory of 1400 4004 jjjdv.exe 84 PID 1400 wrote to memory of 224 1400 hhnnht.exe 85 PID 1400 wrote to memory of 224 1400 hhnnht.exe 85 PID 1400 wrote to memory of 224 1400 hhnnht.exe 85 PID 224 wrote to memory of 4740 224 flrfrlf.exe 86 PID 224 wrote to memory of 4740 224 flrfrlf.exe 86 PID 224 wrote to memory of 4740 224 flrfrlf.exe 86 PID 4740 wrote to memory of 4840 4740 ddjvv.exe 87 PID 4740 wrote to memory of 4840 4740 ddjvv.exe 87 PID 4740 wrote to memory of 4840 4740 ddjvv.exe 87 PID 4840 wrote to memory of 3604 4840 dpjvp.exe 88 PID 4840 wrote to memory of 3604 4840 dpjvp.exe 88 PID 4840 wrote to memory of 3604 4840 dpjvp.exe 88 PID 3604 wrote to memory of 3508 3604 rfxlxlx.exe 89 PID 3604 wrote to memory of 3508 3604 rfxlxlx.exe 89 PID 3604 wrote to memory of 3508 3604 rfxlxlx.exe 89 PID 3508 wrote to memory of 1028 3508 vddpj.exe 90 PID 3508 wrote to memory of 1028 3508 vddpj.exe 90 PID 3508 wrote to memory of 1028 3508 vddpj.exe 90 PID 1028 wrote to memory of 4536 1028 nbttnb.exe 91 PID 1028 wrote to memory of 4536 1028 nbttnb.exe 91 PID 1028 wrote to memory of 4536 1028 nbttnb.exe 91 PID 4536 wrote to memory of 792 4536 7pjvj.exe 92 PID 4536 wrote to memory of 792 4536 7pjvj.exe 92 PID 4536 wrote to memory of 792 4536 7pjvj.exe 92 PID 792 wrote to memory of 5076 792 rflxffr.exe 93 PID 792 wrote to memory of 5076 792 rflxffr.exe 93 PID 792 wrote to memory of 5076 792 rflxffr.exe 93 PID 5076 wrote to memory of 4856 5076 djpdp.exe 94 PID 5076 wrote to memory of 4856 5076 djpdp.exe 94 PID 5076 wrote to memory of 4856 5076 djpdp.exe 94 PID 4856 wrote to memory of 1892 4856 hhtnhn.exe 95 PID 4856 wrote to memory of 1892 4856 hhtnhn.exe 95 PID 4856 wrote to memory of 1892 4856 hhtnhn.exe 95 PID 1892 wrote to memory of 2060 1892 3vjpj.exe 96 PID 1892 wrote to memory of 2060 1892 3vjpj.exe 96 PID 1892 wrote to memory of 2060 1892 3vjpj.exe 96 PID 2060 wrote to memory of 3092 2060 frfrlfr.exe 97 PID 2060 wrote to memory of 3092 2060 frfrlfr.exe 97 PID 2060 wrote to memory of 3092 2060 frfrlfr.exe 97 PID 3092 wrote to memory of 3672 3092 ntbtnh.exe 98 PID 3092 wrote to memory of 3672 3092 ntbtnh.exe 98 PID 3092 wrote to memory of 3672 3092 ntbtnh.exe 98 PID 3672 wrote to memory of 1808 3672 5vpdp.exe 99 PID 3672 wrote to memory of 1808 3672 5vpdp.exe 99 PID 3672 wrote to memory of 1808 3672 5vpdp.exe 99 PID 1808 wrote to memory of 4084 1808 nbntnh.exe 100 PID 1808 wrote to memory of 4084 1808 nbntnh.exe 100 PID 1808 wrote to memory of 4084 1808 nbntnh.exe 100 PID 4084 wrote to memory of 4080 4084 djjvd.exe 101 PID 4084 wrote to memory of 4080 4084 djjvd.exe 101 PID 4084 wrote to memory of 4080 4084 djjvd.exe 101 PID 4080 wrote to memory of 3884 4080 vpdvj.exe 102 PID 4080 wrote to memory of 3884 4080 vpdvj.exe 102 PID 4080 wrote to memory of 3884 4080 vpdvj.exe 102 PID 3884 wrote to memory of 3412 3884 xrrflfr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\7adcb518691ad6f5fe21c4c004ad1340e465fb83766a6843cb8bc80e3cbedb12N.exe"C:\Users\Admin\AppData\Local\Temp\7adcb518691ad6f5fe21c4c004ad1340e465fb83766a6843cb8bc80e3cbedb12N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\ntbhhb.exec:\ntbhhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\jjjdv.exec:\jjjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\hhnnht.exec:\hhnnht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\flrfrlf.exec:\flrfrlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\ddjvv.exec:\ddjvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\dpjvp.exec:\dpjvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\rfxlxlx.exec:\rfxlxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\vddpj.exec:\vddpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\nbttnb.exec:\nbttnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\7pjvj.exec:\7pjvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\rflxffr.exec:\rflxffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\djpdp.exec:\djpdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\hhtnhn.exec:\hhtnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\3vjpj.exec:\3vjpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\frfrlfr.exec:\frfrlfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\ntbtnh.exec:\ntbtnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\5vpdp.exec:\5vpdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\nbntnh.exec:\nbntnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\djjvd.exec:\djjvd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\vpdvj.exec:\vpdvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\xrrflfr.exec:\xrrflfr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\thhthb.exec:\thhthb.exe23⤵
- Executes dropped EXE
PID:3412 -
\??\c:\pvpjv.exec:\pvpjv.exe24⤵
- Executes dropped EXE
PID:828 -
\??\c:\jdvjv.exec:\jdvjv.exe25⤵
- Executes dropped EXE
PID:1304 -
\??\c:\jvvjv.exec:\jvvjv.exe26⤵
- Executes dropped EXE
PID:3612 -
\??\c:\dvjjj.exec:\dvjjj.exe27⤵
- Executes dropped EXE
PID:2532 -
\??\c:\flfrlff.exec:\flfrlff.exe28⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lxrlxfr.exec:\lxrlxfr.exe29⤵
- Executes dropped EXE
PID:3356 -
\??\c:\xrfxlfr.exec:\xrfxlfr.exe30⤵
- Executes dropped EXE
PID:1672 -
\??\c:\jvjvj.exec:\jvjvj.exe31⤵
- Executes dropped EXE
PID:3832 -
\??\c:\9vpjj.exec:\9vpjj.exe32⤵
- Executes dropped EXE
PID:2424 -
\??\c:\fffllfr.exec:\fffllfr.exe33⤵
- Executes dropped EXE
PID:2836 -
\??\c:\rfxlfrl.exec:\rfxlfrl.exe34⤵
- Executes dropped EXE
PID:4592 -
\??\c:\1jjdp.exec:\1jjdp.exe35⤵
- Executes dropped EXE
PID:1392 -
\??\c:\bbhhtt.exec:\bbhhtt.exe36⤵
- Executes dropped EXE
PID:3232 -
\??\c:\3thbnh.exec:\3thbnh.exe37⤵
- Executes dropped EXE
PID:4180 -
\??\c:\9dvjv.exec:\9dvjv.exe38⤵
- Executes dropped EXE
PID:2828 -
\??\c:\rrrfrlf.exec:\rrrfrlf.exe39⤵
- Executes dropped EXE
PID:4880 -
\??\c:\thhbnh.exec:\thhbnh.exe40⤵
- Executes dropped EXE
PID:4172 -
\??\c:\3jvjv.exec:\3jvjv.exe41⤵
- Executes dropped EXE
PID:3696 -
\??\c:\lxffrrl.exec:\lxffrrl.exe42⤵
- Executes dropped EXE
PID:1492 -
\??\c:\lrxxrrr.exec:\lrxxrrr.exe43⤵
- Executes dropped EXE
PID:1460 -
\??\c:\thhbhh.exec:\thhbhh.exe44⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ppvpj.exec:\ppvpj.exe45⤵
- Executes dropped EXE
PID:2368 -
\??\c:\rffxxfx.exec:\rffxxfx.exe46⤵
- Executes dropped EXE
PID:220 -
\??\c:\tntnhh.exec:\tntnhh.exe47⤵
- Executes dropped EXE
PID:3952 -
\??\c:\jvdvp.exec:\jvdvp.exe48⤵
- Executes dropped EXE
PID:1920 -
\??\c:\jdjjd.exec:\jdjjd.exe49⤵
- Executes dropped EXE
PID:804 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe50⤵
- Executes dropped EXE
PID:4696 -
\??\c:\btntth.exec:\btntth.exe51⤵
- Executes dropped EXE
PID:5064 -
\??\c:\nbbbbn.exec:\nbbbbn.exe52⤵
- Executes dropped EXE
PID:2016 -
\??\c:\dvpdv.exec:\dvpdv.exe53⤵
- Executes dropped EXE
PID:4996 -
\??\c:\lfxrffx.exec:\lfxrffx.exe54⤵
- Executes dropped EXE
PID:2248 -
\??\c:\tbnbth.exec:\tbnbth.exe55⤵
- Executes dropped EXE
PID:3740 -
\??\c:\nnbhtn.exec:\nnbhtn.exe56⤵
- Executes dropped EXE
PID:2472 -
\??\c:\pjjjd.exec:\pjjjd.exe57⤵
- Executes dropped EXE
PID:4216 -
\??\c:\fffxrrl.exec:\fffxrrl.exe58⤵
- Executes dropped EXE
PID:3616 -
\??\c:\1hhbth.exec:\1hhbth.exe59⤵
- Executes dropped EXE
PID:3528 -
\??\c:\pvvpj.exec:\pvvpj.exe60⤵
- Executes dropped EXE
PID:1652 -
\??\c:\llxfllr.exec:\llxfllr.exe61⤵
- Executes dropped EXE
PID:4484 -
\??\c:\rlrlffx.exec:\rlrlffx.exe62⤵
- Executes dropped EXE
PID:4708 -
\??\c:\hbnhhh.exec:\hbnhhh.exe63⤵
- Executes dropped EXE
PID:3332 -
\??\c:\pjjdp.exec:\pjjdp.exe64⤵
- Executes dropped EXE
PID:4384 -
\??\c:\jddvj.exec:\jddvj.exe65⤵
- Executes dropped EXE
PID:652 -
\??\c:\lffxffx.exec:\lffxffx.exe66⤵PID:876
-
\??\c:\1hbthn.exec:\1hbthn.exe67⤵PID:2712
-
\??\c:\ddjpv.exec:\ddjpv.exe68⤵PID:3380
-
\??\c:\fxlfffx.exec:\fxlfffx.exe69⤵PID:3216
-
\??\c:\3tthhb.exec:\3tthhb.exe70⤵PID:364
-
\??\c:\bntnhh.exec:\bntnhh.exe71⤵PID:3024
-
\??\c:\1vdvp.exec:\1vdvp.exe72⤵PID:836
-
\??\c:\ffxfllf.exec:\ffxfllf.exe73⤵PID:2304
-
\??\c:\nbtbnt.exec:\nbtbnt.exe74⤵PID:2780
-
\??\c:\5hthbb.exec:\5hthbb.exe75⤵PID:3676
-
\??\c:\jdvpj.exec:\jdvpj.exe76⤵PID:3664
-
\??\c:\rffrxfx.exec:\rffrxfx.exe77⤵PID:2464
-
\??\c:\9hhbtt.exec:\9hhbtt.exe78⤵PID:3436
-
\??\c:\hhnttt.exec:\hhnttt.exe79⤵PID:4008
-
\??\c:\pvdvj.exec:\pvdvj.exe80⤵PID:2720
-
\??\c:\fllxfxr.exec:\fllxfxr.exe81⤵PID:2612
-
\??\c:\1nhbhb.exec:\1nhbhb.exe82⤵PID:4244
-
\??\c:\vppjj.exec:\vppjj.exe83⤵PID:2164
-
\??\c:\pjvpj.exec:\pjvpj.exe84⤵PID:1932
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe85⤵PID:4888
-
\??\c:\hhnntn.exec:\hhnntn.exe86⤵PID:4828
-
\??\c:\httnhh.exec:\httnhh.exe87⤵PID:2532
-
\??\c:\dpjjd.exec:\dpjjd.exe88⤵PID:4176
-
\??\c:\rffxrxx.exec:\rffxrxx.exe89⤵PID:4576
-
\??\c:\bnnhhn.exec:\bnnhhn.exe90⤵PID:2796
-
\??\c:\bnhbnb.exec:\bnhbnb.exe91⤵PID:5044
-
\??\c:\3vjvj.exec:\3vjvj.exe92⤵PID:2500
-
\??\c:\lffxlff.exec:\lffxlff.exe93⤵PID:4156
-
\??\c:\ttnhnh.exec:\ttnhnh.exe94⤵PID:3276
-
\??\c:\pvvpd.exec:\pvvpd.exe95⤵PID:4604
-
\??\c:\rrxrfrl.exec:\rrxrfrl.exe96⤵PID:4692
-
\??\c:\xflrllf.exec:\xflrllf.exe97⤵PID:3864
-
\??\c:\tntntt.exec:\tntntt.exe98⤵
- System Location Discovery: System Language Discovery
PID:2864 -
\??\c:\vvjjv.exec:\vvjjv.exe99⤵PID:4180
-
\??\c:\5xxrfll.exec:\5xxrfll.exe100⤵PID:2828
-
\??\c:\hbtbnh.exec:\hbtbnh.exe101⤵PID:4880
-
\??\c:\9dpjp.exec:\9dpjp.exe102⤵PID:1616
-
\??\c:\lfrlffl.exec:\lfrlffl.exe103⤵PID:3116
-
\??\c:\frxrffx.exec:\frxrffx.exe104⤵PID:1176
-
\??\c:\3nnbbt.exec:\3nnbbt.exe105⤵PID:4212
-
\??\c:\jdjpj.exec:\jdjpj.exe106⤵PID:4796
-
\??\c:\xrxrrll.exec:\xrxrrll.exe107⤵PID:3112
-
\??\c:\bnhbtn.exec:\bnhbtn.exe108⤵PID:1732
-
\??\c:\bhnbtn.exec:\bhnbtn.exe109⤵PID:928
-
\??\c:\jdjdd.exec:\jdjdd.exe110⤵PID:4380
-
\??\c:\fflfrrr.exec:\fflfrrr.exe111⤵PID:2056
-
\??\c:\ttnhht.exec:\ttnhht.exe112⤵PID:1088
-
\??\c:\dppdv.exec:\dppdv.exe113⤵PID:924
-
\??\c:\7xlxlfx.exec:\7xlxlfx.exe114⤵PID:2080
-
\??\c:\ffxffxl.exec:\ffxffxl.exe115⤵PID:2244
-
\??\c:\ntnbnh.exec:\ntnbnh.exe116⤵PID:4852
-
\??\c:\pjvjv.exec:\pjvjv.exe117⤵PID:3980
-
\??\c:\xffrfrf.exec:\xffrfrf.exe118⤵PID:3740
-
\??\c:\nhthhh.exec:\nhthhh.exe119⤵PID:2472
-
\??\c:\jdpjd.exec:\jdpjd.exe120⤵PID:4216
-
\??\c:\fxxlxfx.exec:\fxxlxfx.exe121⤵PID:4892
-
\??\c:\5nhnnn.exec:\5nhnnn.exe122⤵PID:3372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-