Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 18:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cbd4ba3278a187d28cd170b81c5b2894b0ff5c84e3755a95e3c5e6d73ab36940N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
cbd4ba3278a187d28cd170b81c5b2894b0ff5c84e3755a95e3c5e6d73ab36940N.exe
-
Size
454KB
-
MD5
2022ed2f3b947d31b8b6aa9be828f860
-
SHA1
3a72f89047d93e4d3714323ea020aba4ee21af94
-
SHA256
cbd4ba3278a187d28cd170b81c5b2894b0ff5c84e3755a95e3c5e6d73ab36940
-
SHA512
bb2db9a8378bb49bf08f25bdfd6506deaaabdd2e305c18bc63d766d11b5dcd17bfa3ede82674851cfe20e98328f1f1cc3c7c4fdbfdeafeda01fcae25f0f9cb49
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3272-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4216-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/728-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/428-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-692-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-756-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-1078-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-1482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-1740-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4888 5pjvj.exe 4664 bhbnbh.exe 4216 thhbbt.exe 1712 dvdpj.exe 4872 vpjvj.exe 3656 lrlxfxl.exe 3588 bbbttn.exe 4768 9dvjv.exe 1948 lxrllfl.exe 1984 3ttbnh.exe 4880 jjdpd.exe 1716 ffxlxxl.exe 3596 htbnhb.exe 3708 jjjdp.exe 4224 lffrxrr.exe 2348 bhbnbt.exe 4892 dppvj.exe 4792 rxxrrlf.exe 1220 vjvjv.exe 1528 nhnhbt.exe 4876 9vjvp.exe 4708 9rfrfxl.exe 3636 lfllxfr.exe 5056 1jjpd.exe 1480 xlfrfxr.exe 2400 9thtnn.exe 4956 vpdvd.exe 2352 lxxlxrf.exe 3728 bnhnhn.exe 2088 tbbtht.exe 2984 vjdpj.exe 3872 lffxxxx.exe 872 jdjdv.exe 4392 fxrfrlx.exe 400 7hbnbn.exe 428 pdjdp.exe 2684 xlrlxrx.exe 2480 bnnnnt.exe 3472 tbtnht.exe 4500 dpddp.exe 3044 rlllflr.exe 3204 ntnhtt.exe 1116 tnthbb.exe 4548 vpjdj.exe 524 vpvjj.exe 3664 frlxlfl.exe 2276 tntbnh.exe 4360 thhnbb.exe 1988 pjdpd.exe 1124 vjjvj.exe 3888 hbnbnh.exe 3672 tbtnbt.exe 4736 pjdvj.exe 3180 pjvvj.exe 4844 fxllxrf.exe 2760 ttttht.exe 4568 bttnbt.exe 3656 pvpdp.exe 2076 dpjjv.exe 964 rxlxrxl.exe 4000 thbnbt.exe 4520 1nnbhb.exe 4784 jjdpj.exe 1760 9rrfrlx.exe -
resource yara_rule behavioral2/memory/3272-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4216-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1712-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3300-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/728-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/428-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-756-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxflxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xfxrlf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3272 wrote to memory of 4888 3272 cbd4ba3278a187d28cd170b81c5b2894b0ff5c84e3755a95e3c5e6d73ab36940N.exe 83 PID 3272 wrote to memory of 4888 3272 cbd4ba3278a187d28cd170b81c5b2894b0ff5c84e3755a95e3c5e6d73ab36940N.exe 83 PID 3272 wrote to memory of 4888 3272 cbd4ba3278a187d28cd170b81c5b2894b0ff5c84e3755a95e3c5e6d73ab36940N.exe 83 PID 4888 wrote to memory of 4664 4888 5pjvj.exe 84 PID 4888 wrote to memory of 4664 4888 5pjvj.exe 84 PID 4888 wrote to memory of 4664 4888 5pjvj.exe 84 PID 4664 wrote to memory of 4216 4664 bhbnbh.exe 85 PID 4664 wrote to memory of 4216 4664 bhbnbh.exe 85 PID 4664 wrote to memory of 4216 4664 bhbnbh.exe 85 PID 4216 wrote to memory of 1712 4216 thhbbt.exe 86 PID 4216 wrote to memory of 1712 4216 thhbbt.exe 86 PID 4216 wrote to memory of 1712 4216 thhbbt.exe 86 PID 1712 wrote to memory of 4872 1712 dvdpj.exe 87 PID 1712 wrote to memory of 4872 1712 dvdpj.exe 87 PID 1712 wrote to memory of 4872 1712 dvdpj.exe 87 PID 4872 wrote to memory of 3656 4872 vpjvj.exe 88 PID 4872 wrote to memory of 3656 4872 vpjvj.exe 88 PID 4872 wrote to memory of 3656 4872 vpjvj.exe 88 PID 3656 wrote to memory of 3588 3656 lrlxfxl.exe 89 PID 3656 wrote to memory of 3588 3656 lrlxfxl.exe 89 PID 3656 wrote to memory of 3588 3656 lrlxfxl.exe 89 PID 3588 wrote to memory of 4768 3588 bbbttn.exe 90 PID 3588 wrote to memory of 4768 3588 bbbttn.exe 90 PID 3588 wrote to memory of 4768 3588 bbbttn.exe 90 PID 4768 wrote to memory of 1948 4768 9dvjv.exe 91 PID 4768 wrote to memory of 1948 4768 9dvjv.exe 91 PID 4768 wrote to memory of 1948 4768 9dvjv.exe 91 PID 1948 wrote to memory of 1984 1948 lxrllfl.exe 92 PID 1948 wrote to memory of 1984 1948 lxrllfl.exe 92 PID 1948 wrote to memory of 1984 1948 lxrllfl.exe 92 PID 1984 wrote to memory of 4880 1984 3ttbnh.exe 93 PID 1984 wrote to memory of 4880 1984 3ttbnh.exe 93 PID 1984 wrote to memory of 4880 1984 3ttbnh.exe 93 PID 4880 wrote to memory of 1716 4880 jjdpd.exe 147 PID 4880 wrote to memory of 1716 4880 jjdpd.exe 147 PID 4880 wrote to memory of 1716 4880 jjdpd.exe 147 PID 1716 wrote to memory of 3596 1716 ffxlxxl.exe 95 PID 1716 wrote to memory of 3596 1716 ffxlxxl.exe 95 PID 1716 wrote to memory of 3596 1716 ffxlxxl.exe 95 PID 3596 wrote to memory of 3708 3596 htbnhb.exe 96 PID 3596 wrote to memory of 3708 3596 htbnhb.exe 96 PID 3596 wrote to memory of 3708 3596 htbnhb.exe 96 PID 3708 wrote to memory of 4224 3708 jjjdp.exe 97 PID 3708 wrote to memory of 4224 3708 jjjdp.exe 97 PID 3708 wrote to memory of 4224 3708 jjjdp.exe 97 PID 4224 wrote to memory of 2348 4224 lffrxrr.exe 98 PID 4224 wrote to memory of 2348 4224 lffrxrr.exe 98 PID 4224 wrote to memory of 2348 4224 lffrxrr.exe 98 PID 2348 wrote to memory of 4892 2348 bhbnbt.exe 99 PID 2348 wrote to memory of 4892 2348 bhbnbt.exe 99 PID 2348 wrote to memory of 4892 2348 bhbnbt.exe 99 PID 4892 wrote to memory of 4792 4892 dppvj.exe 100 PID 4892 wrote to memory of 4792 4892 dppvj.exe 100 PID 4892 wrote to memory of 4792 4892 dppvj.exe 100 PID 4792 wrote to memory of 1220 4792 rxxrrlf.exe 101 PID 4792 wrote to memory of 1220 4792 rxxrrlf.exe 101 PID 4792 wrote to memory of 1220 4792 rxxrrlf.exe 101 PID 1220 wrote to memory of 1528 1220 vjvjv.exe 102 PID 1220 wrote to memory of 1528 1220 vjvjv.exe 102 PID 1220 wrote to memory of 1528 1220 vjvjv.exe 102 PID 1528 wrote to memory of 4876 1528 nhnhbt.exe 103 PID 1528 wrote to memory of 4876 1528 nhnhbt.exe 103 PID 1528 wrote to memory of 4876 1528 nhnhbt.exe 103 PID 4876 wrote to memory of 4708 4876 9vjvp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbd4ba3278a187d28cd170b81c5b2894b0ff5c84e3755a95e3c5e6d73ab36940N.exe"C:\Users\Admin\AppData\Local\Temp\cbd4ba3278a187d28cd170b81c5b2894b0ff5c84e3755a95e3c5e6d73ab36940N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\5pjvj.exec:\5pjvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\bhbnbh.exec:\bhbnbh.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\thhbbt.exec:\thhbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\dvdpj.exec:\dvdpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\vpjvj.exec:\vpjvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\lrlxfxl.exec:\lrlxfxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\bbbttn.exec:\bbbttn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\9dvjv.exec:\9dvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\lxrllfl.exec:\lxrllfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\3ttbnh.exec:\3ttbnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\jjdpd.exec:\jjdpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\ffxlxxl.exec:\ffxlxxl.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\htbnhb.exec:\htbnhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\jjjdp.exec:\jjjdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\lffrxrr.exec:\lffrxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\bhbnbt.exec:\bhbnbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\dppvj.exec:\dppvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\rxxrrlf.exec:\rxxrrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\vjvjv.exec:\vjvjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\nhnhbt.exec:\nhnhbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\9vjvp.exec:\9vjvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\9rfrfxl.exec:\9rfrfxl.exe23⤵
- Executes dropped EXE
PID:4708 -
\??\c:\lfllxfr.exec:\lfllxfr.exe24⤵
- Executes dropped EXE
PID:3636 -
\??\c:\1jjpd.exec:\1jjpd.exe25⤵
- Executes dropped EXE
PID:5056 -
\??\c:\xlfrfxr.exec:\xlfrfxr.exe26⤵
- Executes dropped EXE
PID:1480 -
\??\c:\9thtnn.exec:\9thtnn.exe27⤵
- Executes dropped EXE
PID:2400 -
\??\c:\vpdvd.exec:\vpdvd.exe28⤵
- Executes dropped EXE
PID:4956 -
\??\c:\lxxlxrf.exec:\lxxlxrf.exe29⤵
- Executes dropped EXE
PID:2352 -
\??\c:\bnhnhn.exec:\bnhnhn.exe30⤵
- Executes dropped EXE
PID:3728 -
\??\c:\tbbtht.exec:\tbbtht.exe31⤵
- Executes dropped EXE
PID:2088 -
\??\c:\vjdpj.exec:\vjdpj.exe32⤵
- Executes dropped EXE
PID:2984 -
\??\c:\lffxxxx.exec:\lffxxxx.exe33⤵
- Executes dropped EXE
PID:3872 -
\??\c:\jdjdv.exec:\jdjdv.exe34⤵
- Executes dropped EXE
PID:872 -
\??\c:\fxrfrlx.exec:\fxrfrlx.exe35⤵
- Executes dropped EXE
PID:4392 -
\??\c:\7hbnbn.exec:\7hbnbn.exe36⤵
- Executes dropped EXE
PID:400 -
\??\c:\pdjdp.exec:\pdjdp.exe37⤵
- Executes dropped EXE
PID:428 -
\??\c:\xlrlxrx.exec:\xlrlxrx.exe38⤵
- Executes dropped EXE
PID:2684 -
\??\c:\bnnnnt.exec:\bnnnnt.exe39⤵
- Executes dropped EXE
PID:2480 -
\??\c:\tbtnht.exec:\tbtnht.exe40⤵
- Executes dropped EXE
PID:3472 -
\??\c:\dpddp.exec:\dpddp.exe41⤵
- Executes dropped EXE
PID:4500 -
\??\c:\rlllflr.exec:\rlllflr.exe42⤵
- Executes dropped EXE
PID:3044 -
\??\c:\ntnhtt.exec:\ntnhtt.exe43⤵
- Executes dropped EXE
PID:3204 -
\??\c:\tnthbb.exec:\tnthbb.exe44⤵
- Executes dropped EXE
PID:1116 -
\??\c:\vpjdj.exec:\vpjdj.exe45⤵
- Executes dropped EXE
PID:4548 -
\??\c:\vpvjj.exec:\vpvjj.exe46⤵
- Executes dropped EXE
PID:524 -
\??\c:\frlxlfl.exec:\frlxlfl.exe47⤵
- Executes dropped EXE
PID:3664 -
\??\c:\tntbnh.exec:\tntbnh.exe48⤵
- Executes dropped EXE
PID:2276 -
\??\c:\thhnbb.exec:\thhnbb.exe49⤵
- Executes dropped EXE
PID:4360 -
\??\c:\pjdpd.exec:\pjdpd.exe50⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vjjvj.exec:\vjjvj.exe51⤵
- Executes dropped EXE
PID:1124 -
\??\c:\hbnbnh.exec:\hbnbnh.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3888 -
\??\c:\tbtnbt.exec:\tbtnbt.exe53⤵
- Executes dropped EXE
PID:3672 -
\??\c:\pjdvj.exec:\pjdvj.exe54⤵
- Executes dropped EXE
PID:4736 -
\??\c:\pjvvj.exec:\pjvvj.exe55⤵
- Executes dropped EXE
PID:3180 -
\??\c:\fxllxrf.exec:\fxllxrf.exe56⤵
- Executes dropped EXE
PID:4844 -
\??\c:\ttttht.exec:\ttttht.exe57⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bttnbt.exec:\bttnbt.exe58⤵
- Executes dropped EXE
PID:4568 -
\??\c:\pvpdp.exec:\pvpdp.exe59⤵
- Executes dropped EXE
PID:3656 -
\??\c:\dpjjv.exec:\dpjjv.exe60⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rxlxrxl.exec:\rxlxrxl.exe61⤵
- Executes dropped EXE
PID:964 -
\??\c:\thbnbt.exec:\thbnbt.exe62⤵
- Executes dropped EXE
PID:4000 -
\??\c:\1nnbhb.exec:\1nnbhb.exe63⤵
- Executes dropped EXE
PID:4520 -
\??\c:\jjdpj.exec:\jjdpj.exe64⤵
- Executes dropped EXE
PID:4784 -
\??\c:\9rrfrlx.exec:\9rrfrlx.exe65⤵
- Executes dropped EXE
PID:1760 -
\??\c:\flfrfrl.exec:\flfrfrl.exe66⤵PID:1716
-
\??\c:\httthb.exec:\httthb.exe67⤵PID:4276
-
\??\c:\pdjdv.exec:\pdjdv.exe68⤵PID:1572
-
\??\c:\frfrfxr.exec:\frfrfxr.exe69⤵PID:4936
-
\??\c:\hthbbt.exec:\hthbbt.exe70⤵PID:4432
-
\??\c:\3vpdv.exec:\3vpdv.exe71⤵PID:3508
-
\??\c:\lfxlfxr.exec:\lfxlfxr.exe72⤵PID:1044
-
\??\c:\jvjdd.exec:\jvjdd.exe73⤵PID:4884
-
\??\c:\1flxlfr.exec:\1flxlfr.exe74⤵PID:4676
-
\??\c:\fxffxrl.exec:\fxffxrl.exe75⤵PID:1864
-
\??\c:\nbnbbt.exec:\nbnbbt.exe76⤵PID:5072
-
\??\c:\nttnhb.exec:\nttnhb.exe77⤵PID:3300
-
\??\c:\lfffxrl.exec:\lfffxrl.exe78⤵PID:2332
-
\??\c:\3tnthb.exec:\3tnthb.exe79⤵PID:2596
-
\??\c:\htnbnh.exec:\htnbnh.exe80⤵PID:1768
-
\??\c:\pddpj.exec:\pddpj.exe81⤵PID:2100
-
\??\c:\xlrffrf.exec:\xlrffrf.exe82⤵PID:2696
-
\??\c:\btbthh.exec:\btbthh.exe83⤵PID:4924
-
\??\c:\jvjvj.exec:\jvjvj.exe84⤵PID:1232
-
\??\c:\lfrfrfr.exec:\lfrfrfr.exe85⤵PID:4956
-
\??\c:\rflxrrf.exec:\rflxrrf.exe86⤵PID:2612
-
\??\c:\pvpdp.exec:\pvpdp.exe87⤵PID:5068
-
\??\c:\dvddv.exec:\dvddv.exe88⤵PID:3732
-
\??\c:\ttnhbt.exec:\ttnhbt.exe89⤵PID:4660
-
\??\c:\5lxrffx.exec:\5lxrffx.exe90⤵PID:2516
-
\??\c:\ntbnbt.exec:\ntbnbt.exe91⤵PID:796
-
\??\c:\dvpjv.exec:\dvpjv.exe92⤵PID:2184
-
\??\c:\jddpj.exec:\jddpj.exe93⤵PID:4344
-
\??\c:\fxfrxrf.exec:\fxfrxrf.exe94⤵PID:4392
-
\??\c:\thhnbb.exec:\thhnbb.exe95⤵PID:4112
-
\??\c:\tthhbh.exec:\tthhbh.exe96⤵PID:5104
-
\??\c:\dvddd.exec:\dvddd.exe97⤵PID:4680
-
\??\c:\xfllfff.exec:\xfllfff.exe98⤵PID:4672
-
\??\c:\nbtnnh.exec:\nbtnnh.exe99⤵PID:4428
-
\??\c:\dvvpv.exec:\dvvpv.exe100⤵PID:3472
-
\??\c:\xrxfxrf.exec:\xrxfxrf.exe101⤵PID:3716
-
\??\c:\bttnbt.exec:\bttnbt.exe102⤵PID:3804
-
\??\c:\tntbtn.exec:\tntbtn.exe103⤵PID:3204
-
\??\c:\ppjdv.exec:\ppjdv.exe104⤵PID:2736
-
\??\c:\xlrllxr.exec:\xlrllxr.exe105⤵PID:4752
-
\??\c:\thbtnn.exec:\thbtnn.exe106⤵PID:3592
-
\??\c:\hbbnhh.exec:\hbbnhh.exe107⤵PID:2036
-
\??\c:\jvjvp.exec:\jvjvp.exe108⤵PID:728
-
\??\c:\lxffxrl.exec:\lxffxrl.exe109⤵PID:2992
-
\??\c:\hththb.exec:\hththb.exe110⤵PID:2152
-
\??\c:\djpdj.exec:\djpdj.exe111⤵PID:4284
-
\??\c:\3llxfxl.exec:\3llxfxl.exe112⤵PID:1124
-
\??\c:\lffxllx.exec:\lffxllx.exe113⤵PID:4664
-
\??\c:\hbbbtt.exec:\hbbbtt.exe114⤵PID:4952
-
\??\c:\jvjdp.exec:\jvjdp.exe115⤵PID:4716
-
\??\c:\ffxrfxr.exec:\ffxrfxr.exe116⤵PID:3652
-
\??\c:\xrxrxrx.exec:\xrxrxrx.exe117⤵PID:4836
-
\??\c:\nhtbhh.exec:\nhtbhh.exe118⤵PID:4872
-
\??\c:\ddjvd.exec:\ddjvd.exe119⤵PID:1608
-
\??\c:\frlflfr.exec:\frlflfr.exe120⤵PID:5112
-
\??\c:\bntnhh.exec:\bntnhh.exe121⤵PID:3372
-
\??\c:\htbthb.exec:\htbthb.exe122⤵PID:3736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-