Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 17:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
46ee281d7fbe89a366ca00818d6a37a622b75f732973bb1496b7cfbe6db912e8.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
120 seconds
General
-
Target
46ee281d7fbe89a366ca00818d6a37a622b75f732973bb1496b7cfbe6db912e8.exe
-
Size
454KB
-
MD5
e20b07bb78a0c3a48d80d994695c1d4f
-
SHA1
0851e7d9a5206c32f45d01fae9ff4f5d0498aa8e
-
SHA256
46ee281d7fbe89a366ca00818d6a37a622b75f732973bb1496b7cfbe6db912e8
-
SHA512
8d0275e0a9b24424796ac7f36445f09714fa56e0786f35fb20a8c19414a80b66939cce365f3fb8b0ef8f534d0c6b384ba07daa1b6a17a3718f1a545720f3445f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeW:q7Tc2NYHUrAwfMp3CDW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1724-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1348-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/244-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/816-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1728-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-755-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-844-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-953-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-1168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-1344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-1459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-1818-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2548 bthbhh.exe 1348 5lrxrlf.exe 4172 9lfxrxr.exe 2644 nbhtnt.exe 4572 rrrlfrx.exe 3144 3nnhhh.exe 212 jvjdv.exe 1276 ddpjd.exe 3324 btbttt.exe 1776 vjvpj.exe 2064 bbtnhb.exe 4692 dddvv.exe 2392 lxfxrlr.exe 4952 jdjdv.exe 224 nbnthn.exe 244 thntbt.exe 4960 vjjdv.exe 412 ttnhtn.exe 32 lrxxrrr.exe 3580 9thbbb.exe 3872 7lrlxxr.exe 352 3bbhbb.exe 2192 rxlflll.exe 3816 jdvpd.exe 816 tttttt.exe 2880 pdjjd.exe 3304 htnnhn.exe 2316 pdpjd.exe 3568 bhthth.exe 4452 pdpjd.exe 3684 7bhntb.exe 4924 jddvp.exe 3212 5tbnht.exe 4824 9bbthn.exe 5020 jdvvp.exe 1304 fxrllrl.exe 208 9nnhbb.exe 4788 vvddj.exe 1204 xlrfxrl.exe 3136 tnbbtt.exe 1040 jddvp.exe 3376 rlfxlfl.exe 2084 tbhbtt.exe 756 5jjjd.exe 4020 pdjdv.exe 4680 lrrfrxx.exe 1848 9btnhb.exe 4484 pdpjp.exe 432 rffxrlf.exe 5044 9bhhbn.exe 5092 vpvvd.exe 64 pdjdv.exe 4716 1rxrxrl.exe 1952 bnnnnn.exe 1688 ttnbhb.exe 3680 vdpdv.exe 4376 xlxrllf.exe 4564 5tbtnh.exe 4600 vvvpp.exe 2800 djjdd.exe 3636 rxfxrlf.exe 3332 nhhbbb.exe 3284 jdjjj.exe 4760 xrlxlrf.exe -
resource yara_rule behavioral2/memory/1724-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1348-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/244-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/816-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1728-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2664-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-759-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-844-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/32-953-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-1119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-1168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-1344-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhbtt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1724 wrote to memory of 2548 1724 46ee281d7fbe89a366ca00818d6a37a622b75f732973bb1496b7cfbe6db912e8.exe 82 PID 1724 wrote to memory of 2548 1724 46ee281d7fbe89a366ca00818d6a37a622b75f732973bb1496b7cfbe6db912e8.exe 82 PID 1724 wrote to memory of 2548 1724 46ee281d7fbe89a366ca00818d6a37a622b75f732973bb1496b7cfbe6db912e8.exe 82 PID 2548 wrote to memory of 1348 2548 bthbhh.exe 83 PID 2548 wrote to memory of 1348 2548 bthbhh.exe 83 PID 2548 wrote to memory of 1348 2548 bthbhh.exe 83 PID 1348 wrote to memory of 4172 1348 5lrxrlf.exe 84 PID 1348 wrote to memory of 4172 1348 5lrxrlf.exe 84 PID 1348 wrote to memory of 4172 1348 5lrxrlf.exe 84 PID 4172 wrote to memory of 2644 4172 9lfxrxr.exe 85 PID 4172 wrote to memory of 2644 4172 9lfxrxr.exe 85 PID 4172 wrote to memory of 2644 4172 9lfxrxr.exe 85 PID 2644 wrote to memory of 4572 2644 nbhtnt.exe 86 PID 2644 wrote to memory of 4572 2644 nbhtnt.exe 86 PID 2644 wrote to memory of 4572 2644 nbhtnt.exe 86 PID 4572 wrote to memory of 3144 4572 rrrlfrx.exe 87 PID 4572 wrote to memory of 3144 4572 rrrlfrx.exe 87 PID 4572 wrote to memory of 3144 4572 rrrlfrx.exe 87 PID 3144 wrote to memory of 212 3144 3nnhhh.exe 88 PID 3144 wrote to memory of 212 3144 3nnhhh.exe 88 PID 3144 wrote to memory of 212 3144 3nnhhh.exe 88 PID 212 wrote to memory of 1276 212 jvjdv.exe 89 PID 212 wrote to memory of 1276 212 jvjdv.exe 89 PID 212 wrote to memory of 1276 212 jvjdv.exe 89 PID 1276 wrote to memory of 3324 1276 ddpjd.exe 90 PID 1276 wrote to memory of 3324 1276 ddpjd.exe 90 PID 1276 wrote to memory of 3324 1276 ddpjd.exe 90 PID 3324 wrote to memory of 1776 3324 btbttt.exe 91 PID 3324 wrote to memory of 1776 3324 btbttt.exe 91 PID 3324 wrote to memory of 1776 3324 btbttt.exe 91 PID 1776 wrote to memory of 2064 1776 vjvpj.exe 92 PID 1776 wrote to memory of 2064 1776 vjvpj.exe 92 PID 1776 wrote to memory of 2064 1776 vjvpj.exe 92 PID 2064 wrote to memory of 4692 2064 bbtnhb.exe 93 PID 2064 wrote to memory of 4692 2064 bbtnhb.exe 93 PID 2064 wrote to memory of 4692 2064 bbtnhb.exe 93 PID 4692 wrote to memory of 2392 4692 dddvv.exe 94 PID 4692 wrote to memory of 2392 4692 dddvv.exe 94 PID 4692 wrote to memory of 2392 4692 dddvv.exe 94 PID 2392 wrote to memory of 4952 2392 lxfxrlr.exe 95 PID 2392 wrote to memory of 4952 2392 lxfxrlr.exe 95 PID 2392 wrote to memory of 4952 2392 lxfxrlr.exe 95 PID 4952 wrote to memory of 224 4952 jdjdv.exe 96 PID 4952 wrote to memory of 224 4952 jdjdv.exe 96 PID 4952 wrote to memory of 224 4952 jdjdv.exe 96 PID 224 wrote to memory of 244 224 nbnthn.exe 97 PID 224 wrote to memory of 244 224 nbnthn.exe 97 PID 224 wrote to memory of 244 224 nbnthn.exe 97 PID 244 wrote to memory of 4960 244 thntbt.exe 98 PID 244 wrote to memory of 4960 244 thntbt.exe 98 PID 244 wrote to memory of 4960 244 thntbt.exe 98 PID 4960 wrote to memory of 412 4960 vjjdv.exe 99 PID 4960 wrote to memory of 412 4960 vjjdv.exe 99 PID 4960 wrote to memory of 412 4960 vjjdv.exe 99 PID 412 wrote to memory of 32 412 ttnhtn.exe 100 PID 412 wrote to memory of 32 412 ttnhtn.exe 100 PID 412 wrote to memory of 32 412 ttnhtn.exe 100 PID 32 wrote to memory of 3580 32 lrxxrrr.exe 101 PID 32 wrote to memory of 3580 32 lrxxrrr.exe 101 PID 32 wrote to memory of 3580 32 lrxxrrr.exe 101 PID 3580 wrote to memory of 3872 3580 9thbbb.exe 102 PID 3580 wrote to memory of 3872 3580 9thbbb.exe 102 PID 3580 wrote to memory of 3872 3580 9thbbb.exe 102 PID 3872 wrote to memory of 352 3872 7lrlxxr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\46ee281d7fbe89a366ca00818d6a37a622b75f732973bb1496b7cfbe6db912e8.exe"C:\Users\Admin\AppData\Local\Temp\46ee281d7fbe89a366ca00818d6a37a622b75f732973bb1496b7cfbe6db912e8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\bthbhh.exec:\bthbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\5lrxrlf.exec:\5lrxrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\9lfxrxr.exec:\9lfxrxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\nbhtnt.exec:\nbhtnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\rrrlfrx.exec:\rrrlfrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\3nnhhh.exec:\3nnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\jvjdv.exec:\jvjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\ddpjd.exec:\ddpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\btbttt.exec:\btbttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\vjvpj.exec:\vjvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\bbtnhb.exec:\bbtnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\dddvv.exec:\dddvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\lxfxrlr.exec:\lxfxrlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\jdjdv.exec:\jdjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\nbnthn.exec:\nbnthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\thntbt.exec:\thntbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
\??\c:\vjjdv.exec:\vjjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\ttnhtn.exec:\ttnhtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\lrxxrrr.exec:\lrxxrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\9thbbb.exec:\9thbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\7lrlxxr.exec:\7lrlxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\3bbhbb.exec:\3bbhbb.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:352 -
\??\c:\rxlflll.exec:\rxlflll.exe24⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jdvpd.exec:\jdvpd.exe25⤵
- Executes dropped EXE
PID:3816 -
\??\c:\tttttt.exec:\tttttt.exe26⤵
- Executes dropped EXE
PID:816 -
\??\c:\pdjjd.exec:\pdjjd.exe27⤵
- Executes dropped EXE
PID:2880 -
\??\c:\htnnhn.exec:\htnnhn.exe28⤵
- Executes dropped EXE
PID:3304 -
\??\c:\pdpjd.exec:\pdpjd.exe29⤵
- Executes dropped EXE
PID:2316 -
\??\c:\bhthth.exec:\bhthth.exe30⤵
- Executes dropped EXE
PID:3568 -
\??\c:\pdpjd.exec:\pdpjd.exe31⤵
- Executes dropped EXE
PID:4452 -
\??\c:\7bhntb.exec:\7bhntb.exe32⤵
- Executes dropped EXE
PID:3684 -
\??\c:\jddvp.exec:\jddvp.exe33⤵
- Executes dropped EXE
PID:4924 -
\??\c:\5tbnht.exec:\5tbnht.exe34⤵
- Executes dropped EXE
PID:3212 -
\??\c:\9bbthn.exec:\9bbthn.exe35⤵
- Executes dropped EXE
PID:4824 -
\??\c:\jdvvp.exec:\jdvvp.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5020 -
\??\c:\fxrllrl.exec:\fxrllrl.exe37⤵
- Executes dropped EXE
PID:1304 -
\??\c:\9nnhbb.exec:\9nnhbb.exe38⤵
- Executes dropped EXE
PID:208 -
\??\c:\vvddj.exec:\vvddj.exe39⤵
- Executes dropped EXE
PID:4788 -
\??\c:\xlrfxrl.exec:\xlrfxrl.exe40⤵
- Executes dropped EXE
PID:1204 -
\??\c:\tnbbtt.exec:\tnbbtt.exe41⤵
- Executes dropped EXE
PID:3136 -
\??\c:\jddvp.exec:\jddvp.exe42⤵
- Executes dropped EXE
PID:1040 -
\??\c:\rlfxlfl.exec:\rlfxlfl.exe43⤵
- Executes dropped EXE
PID:3376 -
\??\c:\tbhbtt.exec:\tbhbtt.exe44⤵
- Executes dropped EXE
PID:2084 -
\??\c:\5jjjd.exec:\5jjjd.exe45⤵
- Executes dropped EXE
PID:756 -
\??\c:\pdjdv.exec:\pdjdv.exe46⤵
- Executes dropped EXE
PID:4020 -
\??\c:\lrrfrxx.exec:\lrrfrxx.exe47⤵
- Executes dropped EXE
PID:4680 -
\??\c:\9btnhb.exec:\9btnhb.exe48⤵
- Executes dropped EXE
PID:1848 -
\??\c:\pdpjp.exec:\pdpjp.exe49⤵
- Executes dropped EXE
PID:4484 -
\??\c:\rffxrlf.exec:\rffxrlf.exe50⤵
- Executes dropped EXE
PID:432 -
\??\c:\9bhhbn.exec:\9bhhbn.exe51⤵
- Executes dropped EXE
PID:5044 -
\??\c:\vpvvd.exec:\vpvvd.exe52⤵
- Executes dropped EXE
PID:5092 -
\??\c:\pdjdv.exec:\pdjdv.exe53⤵
- Executes dropped EXE
PID:64 -
\??\c:\1rxrxrl.exec:\1rxrxrl.exe54⤵
- Executes dropped EXE
PID:4716 -
\??\c:\bnnnnn.exec:\bnnnnn.exe55⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ttnbhb.exec:\ttnbhb.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1688 -
\??\c:\vdpdv.exec:\vdpdv.exe57⤵
- Executes dropped EXE
PID:3680 -
\??\c:\xlxrllf.exec:\xlxrllf.exe58⤵
- Executes dropped EXE
PID:4376 -
\??\c:\5tbtnh.exec:\5tbtnh.exe59⤵
- Executes dropped EXE
PID:4564 -
\??\c:\vvvpp.exec:\vvvpp.exe60⤵
- Executes dropped EXE
PID:4600 -
\??\c:\djjdd.exec:\djjdd.exe61⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rxfxrlf.exec:\rxfxrlf.exe62⤵
- Executes dropped EXE
PID:3636 -
\??\c:\nhhbbb.exec:\nhhbbb.exe63⤵
- Executes dropped EXE
PID:3332 -
\??\c:\jdjjj.exec:\jdjjj.exe64⤵
- Executes dropped EXE
PID:3284 -
\??\c:\xrlxlrf.exec:\xrlxlrf.exe65⤵
- Executes dropped EXE
PID:4760 -
\??\c:\hnnhhb.exec:\hnnhhb.exe66⤵PID:2160
-
\??\c:\dvvjp.exec:\dvvjp.exe67⤵PID:476
-
\??\c:\jjvpj.exec:\jjvpj.exe68⤵PID:1524
-
\??\c:\lxfxrfx.exec:\lxfxrfx.exe69⤵PID:408
-
\??\c:\nthbhn.exec:\nthbhn.exe70⤵PID:4708
-
\??\c:\1bhbtt.exec:\1bhbtt.exe71⤵PID:2064
-
\??\c:\3pjdd.exec:\3pjdd.exe72⤵PID:4692
-
\??\c:\xlfxxxr.exec:\xlfxxxr.exe73⤵PID:2392
-
\??\c:\rflffll.exec:\rflffll.exe74⤵PID:3000
-
\??\c:\nttnnn.exec:\nttnnn.exe75⤵PID:5008
-
\??\c:\7dvvp.exec:\7dvvp.exe76⤵PID:224
-
\??\c:\frxfxfx.exec:\frxfxfx.exe77⤵PID:180
-
\??\c:\nbhbtn.exec:\nbhbtn.exe78⤵PID:3348
-
\??\c:\vppjj.exec:\vppjj.exe79⤵PID:112
-
\??\c:\xllfxrr.exec:\xllfxrr.exe80⤵PID:412
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe81⤵PID:4428
-
\??\c:\ntbtnn.exec:\ntbtnn.exe82⤵PID:1640
-
\??\c:\jvdjd.exec:\jvdjd.exe83⤵PID:3580
-
\??\c:\xrllfrl.exec:\xrllfrl.exe84⤵PID:548
-
\??\c:\9hhhbb.exec:\9hhhbb.exe85⤵PID:3360
-
\??\c:\pjjjd.exec:\pjjjd.exe86⤵PID:820
-
\??\c:\7pdvv.exec:\7pdvv.exe87⤵PID:2452
-
\??\c:\9rxrrrl.exec:\9rxrrrl.exe88⤵PID:4864
-
\??\c:\nttnnn.exec:\nttnnn.exe89⤵PID:1728
-
\??\c:\1ttnht.exec:\1ttnht.exe90⤵PID:2664
-
\??\c:\dvpjd.exec:\dvpjd.exe91⤵PID:2300
-
\??\c:\lfllfff.exec:\lfllfff.exe92⤵PID:888
-
\??\c:\bbtnbh.exec:\bbtnbh.exe93⤵PID:2316
-
\??\c:\1jvpj.exec:\1jvpj.exe94⤵PID:3708
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe95⤵PID:904
-
\??\c:\rrlrlxr.exec:\rrlrlxr.exe96⤵PID:1820
-
\??\c:\hbbttn.exec:\hbbttn.exe97⤵PID:2280
-
\??\c:\djjdv.exec:\djjdv.exe98⤵PID:1644
-
\??\c:\llrlfxr.exec:\llrlfxr.exe99⤵PID:2228
-
\??\c:\5tbttn.exec:\5tbttn.exe100⤵PID:1928
-
\??\c:\1pjvj.exec:\1pjvj.exe101⤵PID:684
-
\??\c:\3rfxrrr.exec:\3rfxrrr.exe102⤵PID:4444
-
\??\c:\tttbtt.exec:\tttbtt.exe103⤵PID:1860
-
\??\c:\7pvvd.exec:\7pvvd.exe104⤵PID:4592
-
\??\c:\vppjd.exec:\vppjd.exe105⤵PID:644
-
\??\c:\lffxxxf.exec:\lffxxxf.exe106⤵PID:3524
-
\??\c:\9tbnhh.exec:\9tbnhh.exe107⤵PID:4988
-
\??\c:\nnbnhb.exec:\nnbnhb.exe108⤵PID:1804
-
\??\c:\djvjv.exec:\djvjv.exe109⤵PID:1384
-
\??\c:\3xlfrrr.exec:\3xlfrrr.exe110⤵PID:2008
-
\??\c:\7hbthh.exec:\7hbthh.exe111⤵PID:756
-
\??\c:\ddvpp.exec:\ddvpp.exe112⤵PID:1520
-
\??\c:\jvvpj.exec:\jvvpj.exe113⤵PID:2980
-
\??\c:\xllfxrl.exec:\xllfxrl.exe114⤵PID:1848
-
\??\c:\ttbnnb.exec:\ttbnnb.exe115⤵PID:704
-
\??\c:\pjjdv.exec:\pjjdv.exe116⤵PID:432
-
\??\c:\1xxrlrl.exec:\1xxrlrl.exe117⤵PID:4008
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe118⤵PID:4056
-
\??\c:\ntnbtn.exec:\ntnbtn.exe119⤵PID:4296
-
\??\c:\vvvvp.exec:\vvvvp.exe120⤵PID:3592
-
\??\c:\frflfxx.exec:\frflfxx.exe121⤵PID:4172
-
\??\c:\ffxrxxx.exec:\ffxrxxx.exe122⤵PID:1688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-